- openldap-technical - openldap.org

A LDAPS related issue
by ctosgh 25 Sep '10

25 Sep '10

Hi, folks I am using the APIs from openldap and recently run into a problem which upset me. Following is the framework of the function. ldaps_func() { LDAP* ld = NULL; char * uri ="ldaps://xxx.xxx.xxx:636"; ..... ldap_set_option(...); //using LDAP v3 ldap_set_option(...); // set LDAP_OPT_X_TLS_REQUIRE_CERT to deman ldap_set_option(...); // set LDAP_OPT_X_TLS_CACERTDIR to /tmp/ldapsCA/ ldap_initialize(&ld, uri); ..... ldap_simple_bind(.....); ldap_search_ext(...); ...... ldap_unbind(ld); ..... return 0; } Above function is called in a while loop to authenticate users to a LDAPS server when authentication request comes up. This function works fine. BUT after one successful authentication, if I delete CA certificates of server's certificate under /tmp/ldapsCA/, subsequent authentications will STILL succeed. If restart this daemon, no authentication will succeed, because CA certificates under /tmp/ldapsCA/ has been deleted. Why I delete CA certificates under /tmp/ldapsCA/? I just want to simulate "certificate change". Is the openssl library cache someting?? Any one has any ideas about this? I will really appreciate it. Thanks, Jacky

4 8

Some feedbacks on MMR tools.
by Thomas Chemineau 25 Sep '10

25 Sep '10

Hi, I post on openldap-technical list because OpenLDAP MMR Tools was released few days ago. This is the first one. So, I hope that could interest someone here. This project is not part of the OpenLDAP project. OpenLDAP MMR Tools is designed to help system administrator to deploy a multimaster cluster with OpenLDAP 2.4. For more information, you could visit this page: http://tools.ltb-project.org/news/15 There are still bugs, missing features, etc. But it could be interresting for people behind LTB Project to have some feedbacks. Best regards, Thomas. -- Thomas Chemineau

1 0

DB_Config issue
by Simon Gao 25 Sep '10

25 Sep '10

Hi, The change I made to DB_CONFIG does not take effect. Berkeley DB still uses default 256K for cache size. Here is set_cachesize line: set_cachesize 0 268435456 1 The DB version is 4.5.20 with patches. After changing DB_CONFIG, I rebuilt the database with: db_recover -h /var/lib/ldap The total cache size remains 256K, instead of 256M. What did I miss? Simon

1 0

N-way multimaster replication trouble
by NUNIN Roberto 24 Sep '10

24 Sep '10

Hello everybody I'm trying to start a two server multimaster installation. OpenLDAP is 2.4.23 built from sources, bdb 4.8.30 Configure options are: --enable-crypt --enable-overlays -enable-ppolicy --enable-memberof (maybe some are unuseful). OS is Centos 5.5, patched, virtual machines. LDAP server are addressed by client thru round-robin DNS registration. Behaviour: when a ldap user connected to a client try to change it's password thru the passwd command, on the LDAP server connected by the client thru the DNS name resolution, userPassword and shadowLastChange are updated, on the other LDAP server the field userPassword disappear (checked with slapcat). I suppose that this happen because on userPassword attribute there are ACL's (reported below) that permit only read action to syncuser. Infact, if I change the syncrepl instances and swap syncuser with admin (rootDN), the password change happens successfully and replica too. Now the question to the list: if I don't want to have rootDN used for replication, I must give the write permissions to syncuser to guarantee the replica, leaving the "bug" to have the a write account password written in clear text in config file ? There's a smarter method to reach the goal ? I apologize if solution is written on the documentation, but I've tried to find without success. Slapd config is still supplied thru slapd.conf. These are acl on bdb instance on userPassword and shadowLastChange attributes: access to attrs=userPassword by dn="cn=admin,dc=somedomain,dc=it" write by dn.base="cn=syncuser,ou=People,dc=somedomain,dc=it" read by anonymous auth by self write by * none access to attrs=shadowLastChange by dn="cn=admin,dc=somedomain,dc=it" write by dn.base="cn=syncuser,ou=People,dc=somedomain,dc=it" read by self write by * read syncrepl is configured as follow: syncrepl rid=000 provider=ldap://server1.somedomain.it:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=somedomain,dc=it" attrs="*,+" bindmethod=simple binddn="cn=syncuser,dc=somedomain,dc=it" credentials=syncuser_password syncrepl rid=001 provider=ldap://server2.somedomain.it:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=somedomain,dc=it" attrs="*,+" bindmethod=simple binddn="cn=syncuser,dc=somedomain,dc=it" credentials=syncuser_password MirrorMode TRUE Obviously servers are identified as serverID 001 and serverID 002 and both are started to listen only on their FQDN. Thanks to all for attention and support. Roberto Nunin Comifar Service SpA Italy Questo messaggio e' indirizzato esclusivamente al destinatario indicato e potrebbe contenere informazioni confidenziali, riservate o proprietarie. Qualora la presente venisse ricevuta per errore, si prega di segnalarlo immediatamente al mittente, cancellando l'originale e ogni sua copia e distruggendo eventuali copie cartacee. Ogni altro uso e' strettamente proibito e potrebbe essere fonte di violazione di legge. This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately, deleting the original and all copies and destroying any hard copies. Any other use is strictly prohibited and may be unlawful.

1 0

Question about slapcat tool
by Ivan Mladenović 24 Sep '10

24 Sep '10

Hi, I have Open LDAP version 2.3 installed on CentOS 5. Open LDAP is installed by using root account. I’m trying to make backup of LDAP data by using slapcat tool. If this tool is running by the root user backup is successfully created. But, if this tool is running by some other user following error is displayed: bdb_db_open: alock package is unstable backend_startup_one: bi_db_open failed! (-1) slap_startup failed I try to allow reading for all files that are in /var/lib/ldap folde, but it did not help. Can I run this tool if I’m logged in by using some other user and how I can do this? Thanks in advance. Best Regards, Ivan

2 1

syncrepl only working in one direction
by Alister Forbes 24 Sep '10

24 Sep '10

All, I have two identical servers (RHEL based VMs, server1 and server3) running 2.4.23 openldap. built with these options: --with-tls --prefix=/etc/operator/openldap --enable-syncprov --enable-syslog --enable-crypt - I have the strangest problem, and am desperate for any insight you might provide If I make a change on server3, then everything is fine, and the change is replicated to server1 If I make a change on server1 then server1 changes, but no changes are seen on server 3. looking at the logs, on server1, Using tcpdump to sniff the connection, when a change is made on server1, it doesn't even attempt to contact server3. As far as I can tell the configs are identical, and I have no clue whats causing this. Any hint at all would be gratefully accepted. Configs from both machines attached. server1 and server3(output of ldapsearch on cn=config) Also attached, logs (olcLogLevel is Sync) of the results when I change a value (olcLogLevel) on the two servers (change-on-server1 and change-on-server3) Thanks in advance for any help you can give. Alister -- Alister Forbes TACSUNS _.|._.|._ Cisco Systems Please avoid sending me Word or PowerPoint attachments. See - http://www.gnu.org/philosophy/no-word-attachments.html

2 6

help, how to maintain the ACL dynamic by C api???
by wu johnson 24 Sep '10

24 Sep '10

If the ACLs are large , how can?

1 1

OpenLDAP session authentication
by Erik Lotspeich 24 Sep '10

24 Sep '10

Hi, I have looked around for the answer to this question and the solution wasn't obvious to me... I have an OpenLDAP installation that I use as an addressbook. I do not use OpenLDAP for authentication on my network. I am using it on an internal network with anonymous read-only access. I would like to require user-level authentication and I would like to authenticate access to the LDAP database using system users in /etc/passwd. Is this possible? For authorization, I would like a few users to have read/write access and others to be read-only. I would like to disallow anonymous access to the database. I have SSL/TLS set up now and that works; I would like to be able to turn off all non-SSL access to the database once the authentication/authorization is set up. Regards, Erik

2 1

Cache size and performance questions.
by Antonio Galindo Castro 23 Sep '10

23 Sep '10

Hi @ll, I have an OpenLDAP 2.4.21 on a Ubuntu Server 10.04. The server is used for auth, when I have more than 20 user logged the server reponds very slow and has hight load. I have my config in this way: for 60000 registers in my db olcDbCheckpoint: 1024 5 olcDbCacheSize: 180000 olcDbConfig: {0}set_cachesize 0 94371840 0 olcDbConfig: {1}set_lk_max_objects 4500 olcDbConfig: {2}set_lk_max_locks 4500 olcDbConfig: {3}set_lk_max_lockers 4500 olcDbIDLcacheSize: 540000 The server is part of a multi master squema (MMR). Where I can found a good documentation for tunning my server in this scenario? Regards. -- Luis Antonio Galindo Castro aka FunkyM0nk3y Fingerprint: 237E EFE1 6055 BCEB ACD0 7A49 30FC A883 0044 A85E

2 2

Invalid credentials (49)
by Claudio Martella 23 Sep '10

23 Sep '10

Hello, I have a windows 2008 server, serving users auth with AD. I have another windows 2003 server, serving other users. I'm trying to access them through openldap and an PHP application. I can easly access my 2003 server with this command: ldapsearch -x -D "cn=cm,cn=TIS,dc=TIS,dc=local" -W -H ldap://192.168.10.206 but when i try to access the 2008 server with the same command i get: ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 525, v1772 in this case my user is "cm" and he is in the "TIS" folder and i can login from a windows client with user TIS\cm successfully. I've tried also with -Z and -ZZ, in that case i get a service unavailable error. Do you have any idea why this would happen? Claudio -- Claudio Martella Digital Technologies Unit Research & Development - Analyst TIS innovation park Via Siemens 19 | Siemensstr. 19 39100 Bolzano | 39100 Bozen Tel. +39 0471 068 123 Fax +39 0471 068 129 claudio.martella(a)tis.bz.it http://www.tis.bz.it

2 1

openldap back-sock
by stefano vital 23 Sep '10

23 Sep '10

Hi, I have a question about a special LDAP setup , I try to use sock backend for bind user that after succesfull bind have to search on another backend, Here my slapd.conf on openldap 2.4.11 access to * by users read ##################BACKEND SOCK################################################# database sock suffix "dc=reg-bus-users-local,dc=it" #catturo le richieste riscritte da rwm bloccando richieste di lettura e scrittura dirette socketpath /tmp/ldapauthorization.sock ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=tfk,dc=tfkdatastore" rootdn "cn=Root,dc=tfk,dc=tfkdatastore" rootpw xxxxx I also made a fake bind in server listening on socket ldapauthorization.sock if ($request eq "BIND\n") { my %req = (); print "RESULT\n"; print "code: 0\n"; print "matched: cn=fratbrother,dc=reg-bus-users-local,dc=it\n"; } my ldapsearch is : ldapsearch -H ldap://localhost:389/ -D "cn=fratbrother,dc=reg-bus-users-local,dc=it" -w xxxx -x -b "dc=tfk,dc=tfkdatastore" "(objectClass=*)" "*" result : ldap_bind: Insufficient access (50) my goal if work , is to make bind = (bind + search attribute) in other ldap server check the validity of attribute and then response bind succesfull, so redirected bind with check on remote attribute , is possible to do that ? is the right usage of backend sock ? Ps : also noted that ldap does not connect to socket but make response directly "insufficient access". Ps : sorry for the bad english Thanks in Advance Stefano Vitali

1 0

problem with replication
by Craig White 23 Sep '10

23 Sep '10

never did replication and certain to be something that I did but this is the type of error I am getting... Sep 15 10:58:44 srv1 slapd[2766]: slap_client_connect: URI=ldap://srv2.ayr1.local DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) Sep 15 10:58:44 srv1 slapd[2766]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) Obviously because I didn't tell it NOT to use SASL bind for replication. Is there some simple adjustment to use something other than SASL for credentials when replicating? Craig

2 8

Setting up a chain overlay
by Bram Cymet 23 Sep '10

23 Sep '10

Hi, I am trying to setup a chain overlay to allow writes to a read-only slave to be chained up to the master. The closest ldif file I could figure out to update the cn=config directory was: dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDBURI:ldap://10.1.0.3/ olcDbIDAssertBind: bindmethod=simple binddn="cn=admin,dc=roessner-net,dc=de" credentials=********** mode=self This works until I have to restart the slave ldap server because this is an invalid config. Can anyone let me know an ldif file to set up the chain to the master? Or at least point me to the right direction. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

4 7

Re: Problem of getpeereid.c:38: error: storage size of ‘peercred’ isn’t known
by Gavin Henry 22 Sep '10

22 Sep '10

Simply add CPPFLAGS=-D_GNU_SOURCE Don't email people directly :-) ----- Original Message ----- Hey , when i configure LDAP i got this error "getpeereid.c:38: error: storage size of ‘peercred’ isn’t known " also i saw your answer Presumably a dup of ITS#5464. > Workaround: Compile with CPPFLAGS=-D_GNU_SOURCE. what is the Presumably ? can you pls give me the full command that should i follow ??? Thx !! -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Replicating from a mirrormode pair to a read-only server
by Andrew Findlay 22 Sep '10

22 Sep '10

I am updating an OpenLDAP installation at present, and one of the improvements is to introduce a pair of master servers running in mirror mode. There will be several read-only servers as well, and I would like those to replicate from whichever master is currently available. I did the obvious thing, and put two syncrepl clauses in the read-only server's config - one for each master server. Starting with an empty database, the read-only server chews CPU badly and generates thousands of log messages like this: Sep 2 14:57:34 nis0 slapd[9257]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: conn=-1 op=0: attribute "entryCSN" index delete failure Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: conn=-1 op=0: attribute "entryCSN" index delete failure .... Sep 2 14:56:10 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:10 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: conn=-1 op=0: attribute "localAttribute" index add failure Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) It is very likely that each syncrepl connection will be retrieving the same entries at about the same time, so there is clearly potential for collisions. Question: is this topology sensible? If it is expected to work I will gather some debug data for an ITS. If not, I will have to drop back to plan B... OpenLDAP 2.4.22 with BerkeleyDB.4.8 running on SLES 10.3 i586 Thanks Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

3 8

slapo-rwm : concatenate rule
by Anthony Milan 22 Sep '10

22 Sep '10

Hi, I would like to create a rewrite rule with slapo-rwm using back-relay to concatenate two different attributes in an other one? Something like this with an approximate syntax: map attribute cn concat(givenName sn) or with Perl syntax: map attribute cn "$givenName $sn" Is it possible to do this with rewriteRules directives? Thanks for help, -- Anthony Milan

2 1

Recommended BerkeleyDB version?
by Marco Pizzoli 21 Sep '10

21 Sep '10

Hi all, I would like to know if is there a "recommended" version of BerkeleyDB to be used with OpenLDAP. Days ago, on this mailing list, I read comments about 4.8.30. On the Oracle site I see there are also: - 5.0.21 - 5.0.26 - 5.1.19 Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

3 3

Filter on higher rdn and read lower rdn attributes
by S.A. 21 Sep '10

21 Sep '10

Hello, I have a question regarding the construction of search filter (assuming that what I think is possible in LDAP). For a tree shown like below: o dc=com | o dc=xyz / | | \ ou=machines o . . . . . o ou=people / | \ uid=abby o . . o ou=xie <- OC1 / ou=options o <- OC2 / ou=theme1 o <- OC3 OC1 != OC2 != OC3 (objectclasses with different set of attributes) Assume that at uid=<name> rdn, the objectclass (OC1) has an attribute called accessFlag. Based on this accessFlag attribute value, is it possible to construct a search filter that will give us the attributes of the objectclass (OC3) with rdn ou=<theme name>? That is, I want to get the theme values of all users whose accessFlag is set to some value. Thank you!

2 3

Undefined attribute type (17)
by Michael Ostrowski 21 Sep '10

21 Sep '10

Hi, I am getting the following error when trying to modify an entry via the ldapmodify command Any help would be appreciated, Thanks, Mike c:\open-ldap\OpenLDAP>ldapmodify -f useradd1.ldif -v -D "cn=Manager,dc=loda,dc=l ocal" -w secret ldap_initialize( <DEFAULT> ) replace change-type: modify replace add: uid replace uid: larry modifying entry "cn=Larry Anderson, dc=loda, dc=local" modify complete ldap_modify: Undefined attribute type (17) additional info: change-type: attribute type undefined The LDIF file looks like dn: cn=Larry Anderson, dc=loda, dc=local change-type:modify add:uid uid:larry The current entry in the database dn: cn=Larry Anderson,dc=loda,dc=local cn: Larry Anderson objectClass: person sn:: QW5kZXJzb24gICAgICAgICAg structuralObjectClass: person entryUUID: 91801ba1-103b-4277-85fc-56dfa2ae0bd7 creatorsName: cn=Manager,dc=loda,dc=local modifiersName: cn=Manager,dc=loda,dc=local createTimestamp: 20100915201014Z modifyTimestamp: 20100915201014Z entryCSN: 20100915201014Z#000001#00#000000 <http://www.arraynetworks.net/entry.asp?PageID=395>

2 2

Re: Recommended BerkeleyDB version?
by Marco Pizzoli 21 Sep '10

21 Sep '10

Hi Quanah, thanks for the answer. If I would like to stay up-to-date with this information, where can I find it? I saw this url http://www.openldap.org/doc/admin24/appendix-recommended-versions.html but it still lists BDB versions 4.4 through 4.7. Thanks again Marco On Mon, Sep 20, 2010 at 5:35 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, September 20, 2010 9:35 AM +0200 Marco Pizzoli < > marco.pizzoli(a)gmail.com> wrote: > > Hi all, >> I would like to know if is there a "recommended" version of BerkeleyDB to >> be used with OpenLDAP. >> >> Days ago, on this mailing list, I read comments about 4.8.30. >> >> On the Oracle site I see there are also: >> - 5.0.21 >> - 5.0.26 >> - 5.1.19 >> > > 5.0.x has not yet been heavily tested with OpenLDAP. Recommended versions > remain 4.6.x through 4.8.x, as long as you have all patches applied for 4.6 > & 4.7. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

Policies!
by Alejandro Rodriguez Luna 21 Sep '10

21 Sep '10

Hi all!! is there a way that I can assign local policies and group policies to windows and linux machine through OpenLDAP, as I do with AD? ---------------------------------- Alejandro Rodriguez Luna Web: http://www.alexluna.org E-mail: el_alexluna(a)yahoo.com.mx MSN: el_alexluna(a)yahoo.com.mx GTalk: alexluna(a)gmail.com Movil: 044-311-112-86-41 ----------------------------------

2 1

How to slapadd cn=config
by Torsten Schlabach (Tascel eG) 21 Sep '10

21 Sep '10

Dear list! If I have an LDIF backup of a cn=config database, taken with slapcat, how would I use it to bootstrap a new server, for example, in a desaster recovery setting? I tried it and slapadd required a configuration, but cn=config *is* the configuration and I am trying to restore it. So this is a bit of a chicken and egg problem, isn't it? Is there an "official" way of doing that? Regards, Torsten

5 6

Re: How to slapadd cn=config
by Torsten Schlabach (Tascel eG) 21 Sep '10

21 Sep '10

Hi Ondrej! You're right, it's a classic RTFM: >From the slapadd man page: -n dbnum Add entries to the dbnum-th database listed in the configuration file. The -n cannot be used in conjunction with the -b option. To populate the config database slapd-config(5), use -n 0 as it is always the first database. It must physically exist on the filesystem prior to this, however. I tried -b 'cn=config' instead of -n 0, which is semantically the same, but not technially. Problem solved, I think. Regards, Torsten On Tue, 21 Sep 2010 14:45:33 +0200, Ondrej Kuznik <ondrej.kuznik(a)acision.com> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 09/21/2010 02:23 PM, Torsten Schlabach (Tascel eG) wrote: >> Hi Robert! >> >>> Slapd, etc. needs an /etc/openldap/slapd.conf file >> >> Well, either an /etc/openldap/slapd.conf file *or* a cn=config database, >> I >> guess. >> >> Ok, maybe a possible trick is to have a minimal slapd.conf file which >> just >> declares a cn=config database to be able to load it that way. >> >> In that case, a cut & paste example somewhere would come in handy. >> >> But I understand that in OpenLDAP 2.5 they think about doing away with >> slapd.conf entirely. This would then break your approach again. >> >> Maybe Howard will explain a bit better what he meand by "slapadd the same >> way you slapcat". > > I asked a similar question on the #openldap irc channel some time ago, > the advice was to use: > slapadd -n0 -l slapdconfig.ldif -F /path/to/new/slapd.d > > (the directory /path/to/new/slapd.d must already exist and should be > an empty directory) > > That way you need no prior configuration in the form of slapd.conf. > > Ondra > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iEYEARECAAYFAkyYqO0ACgkQ9GWxeeH+cXv1QACdHgrI5G/W760M2QCJ1PKiHbNM > lIIAn0wiPptdEEcCftO5gBDPk01dQcMi > =h2Z3 > -----END PGP SIGNATURE----- > > This e-mail and any attachment is for authorised use by the intended > recipient(s) only. It may contain proprietary material, confidential > information and/or be subject to legal privilege. It should not be copied, > disclosed to, retained or used by, any other party. If you are not an > intended recipient then please promptly delete this e-mail and any > attachment and all copies and inform the sender. Thank you.

1 0

Automate Create Home Directory
by Alejandro Rodriguez Luna 21 Sep '10

21 Sep '10

Hi, i'm testing a new openldap server, and i have everything set, i can add users, groups, and log on in differents machines with the same user. Everything works fine. but i have a problem, i have to create the home directory for each new user on each new machine that I log on. is there a way that this process can be automatic?. Ideas?

4 3

Forcing UID attribute
by Marco Pizzoli 20 Sep '10

20 Sep '10

Hi list, I need to populate an entry in OL having DN uid=pippo,ou=people,dc=mycorp. I need to force this entry to have a uid attribute *different* from uid appearing in the name. Example: I need "uid: pluto". ldapadd-ing the entry I have the entry with 2 uid attributes populated: - uid: pippo - uid: pluto Is there a way to NOT have "uid: pippo" populated even if the entry is called in that way? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 2

Configuring AD using OpenLDAP
by Vinay Kalkoti 20 Sep '10

20 Sep '10

Hi, Is it possible to use OpenLDAP client to authenticate against Active Directory without using Samba or SUF ? Thanks, Vinay

4 4

No connection! Some Ideas
by Márcio Luciano Donada 17 Sep '10

17 Sep '10

That night, I had a problem with stopping the LDAP, the only thing I have in the log is this: connection_read(42): no connection! my version OpenLDAP is: @(#) $OpenLDAP: slapd 2.4.11 (Jul 24 2010 08:14:20) $#012#011@murphy:/build/buildd-openldap_2.4.11-1+lenny2-i386-H5BDjb/open ldap-2.4.11/debian/build/servers/slapd Debian Lenny 5. after the restart ldap I have the following message: connection_input: conn=32 deferring operation: pending operations I honestly do not know what happens, I have this problem and sometimes for my system for some reason not yet know what it is, and debugging of slapd.conf is 256 and as I passed the e-mail that is the only information I have. Can anyone help me? Thanks -- Márcio Luciano Donada <mdonada -at- auroraalimentos -dot- com -dot- br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 3

Loglevel for authentication problem
by Darouichi, Aziz 17 Sep '10

17 Sep '10

Hi, We are working with a vendor of a hosted application, and we are using openldap-2.2.13-12.el4 for authentication. We are not able to login to the hosted application. This is what the vendor is getting for error message: message] [09-14-2010T10:27:30] Attempting to bind to xx.xxx.xxx.xxxx:389 [message] [09-14-2010T10:27:30] Binding as 'uid=pperson,ou=People,dc=college,dc=edu' [message] [09-14-2010T10:27:31] Bind successful [system ] [09-14-2010T10:27:31] Checking R25 WS user [message] [09-14-2010T10:27:31] Executing query (&(objectClass=user)(sAMAccountName=test)) [message] [09-14-2010T10:27:31] Building field mappings for query (&(objectClass=user)(sAMAccountName=test)) [message] [09-14-2010T10:27:31] Search path: OU=Group,DC=college,DC=edu [error ] [09-14-2010T10:27:32] Search error: [10061] Connection refused [message] [09-14-2010T10:27:32] Search path: OU=People,DC=college,DC=edu [error ] [09-14-2010T10:27:33] Search error: [10061] Connection refused [message] [09-14-2010T10:27:33] Search path: OU=Users,DC=college,DC=edu [error ] [09-14-2010T10:27:34] Search error: [10061] Connection refused [error ] [09-14-2010T10:27:34] Query (&(objectClass=user)(sAMAccountName=test)) returned no results We have log level 64 enabled, if we increase log level it slows the machine. This what We are getting in the log: Sep 16 09:31:01 ldap1 last message repeated 8 times Sep 16 09:32:06 ldap1 last message repeated 2 times Sep 16 09:33:07 ldap1 slapd[3288]: <= bdb_equality_candidates: (uniqueMember) index_param failed (18) Sep 16 09:34:26 ldap1 last message repeated 4 times Sep 16 09:35:36 ldap1 last message repeated 4 times Sep 16 09:36:39 ldap1 last message repeated 4 times Sep 16 09:37:14 ldap1 last message repeated 4 times Sep 16 09:37:23 ldap1 slapd[3288]: connection_read(26): no connection! Sep 16 09:37:26 ldap1 slapd[3288]: <= bdb_equality_candidates: (uniqueMember) index_param failed (18) Sep 16 09:38:15 ldap1 last message repeated 2 times Sep 16 09:39:16 ldap1 last message repeated 5 times Sep 16 09:40:28 ldap1 last message repeated 3 times Sep 16 09:40:56 ldap1 last message repeated 5 times Sep 16 09:41:10 ldap1 slapd[3288]: connection_read(34): no connection! Sep 16 09:41:17 ldap1 slapd[3288]: <= bdb_equality_candidates: (uniqueMember) index_param failed (18) I have a test server I can use to troubleshoot this problem if I know what log level should I use? Thanks, Aziz

2 2

Stitching two LDAP databases together using chaining?
by Michael Smith 17 Sep '10

17 Sep '10

Hi, Let's say I have a database with base DN dc=parent. On a particular server, dc=parent is a read-only syncrepl slave. On the same server, I have a separate read-write database, dc=child,dc=parent. Is there a way to make it so searches of dc=parent also search the database in dc=child,dc=parent? I'm thinking a referral plus the chain overlay might do the trick, but I can't create a referral object with name "dc=child,dc=parent" within the dc=parent database because the server knows dc=child,dc=parent already exists (as the other database). I get "Already exists (68)" from the server. I figure I'm missing something simple, or doing something stupid. Thanks, Mike

2 2

accesslog anomaly in drop/re-import (was Searched Attr=1.1)
by Marco Pizzoli 17 Sep '10

17 Sep '10

I re-post this help request using a more appropriate subject . Thanks in advance Marco ---------- Forwarded message ---------- From: Marco Pizzoli <marco.pizzoli(a)gmail.com> Date: Thu, Sep 16, 2010 at 1:07 PM Subject: Re: Searched Attr=1.1 To: Dieter Kluenter <dieter(a)dkluenter.de> Cc: openldap-technical(a)openldap.org Hi Dieter, thanks for your answer. I came to this evidence in investigating an anomaly that I'm having with my accesslog database. Symptom I was having was continuous high cpu spot. I suspected it was due to my accesslog database. - I made a slapcat of my entire log database. - I erased my log database - I tried a slapadd of my log database I had this problem: /usr/sbin/slapadd -b "cn=log,dc=mycorp.it" -l /srv/bck/dump_db_log.ldif.20100916 . 0.00% eta 08h35m elapsed spd 90.2 k/s str2entry: invalid value for attributeType reqControls #0 (syntax 1.3.6.1.4.1.4203.666.11.5.3.1) slapadd2.4: could not parse entry (line=4907) - 0.01% eta 05h58m elapsed spd 205.7 k/s Closing DB... I went to that line and found this entry: dn: reqStart=20100913065628.000008Z,cn=log,dc=mycorp.it objectClass: auditSearch structuralObjectClass: auditSearch reqStart: 20100913065628.000008Z reqEnd: 20100913065628.000009Z reqType: search reqSession: 1129 reqAuthzID: cn=syncrepl-ldap04,ou=utenze_tecniche_openldap,ou=Gestori,dc= mycorp.it reqControls: {0}{1.3.6.1.4.1.4203.1.9.1.1 controlValue "30440K0103043M7269643N 3030332M7369643N3030342M63736O3N32303130303931333036353130362O3932343735355K2 330303030303023303033233030303030300001PP"} reqControls: {1}{2.16.840.1.113730.3.4.2 criticality TRUE} reqDN: dc=mycorp.it reqResult: 0 reqScope: base reqDerefAliases: never reqAttrsOnly: TRUE reqFilter: (objectclass=*) reqAttr: 1.1 reqEntries: 0 reqTimeLimit: -1 reqSizeLimit: 1 entryUUID: 2beb0bd0-ba32-4a00-93da-748ef2177cc7 creatorsName: cn=Manager,cn=log,dc=mycorp.it createTimestamp: 20100913065628Z entryCSN: 20100913065628.167225Z#000000#003#000000 modifiersName: cn=Manager,cn=log,dc=mycorp.it modifyTimestamp: 20100913065628Z Can someone tell me why this entry result not accepted to my openldap system? I'm using OL 2.4.23 with password policy overlay defined. The entry I posted is related to an access made by a specific syncrepl-user. Replica configured in mirror-mode. Other OL systems are 2.4.22. Deleting this entry and re-slapadding I had another similar problem. /usr/sbin/slapadd2.4 -b "cn=log,dc=mycorp.it" -l /tmp/dump_db_log.ldif.20100916_Corrected " 4.69% eta 01h07m elapsed 03m19s spd 542.3 k/s str2entry: invalid value for attributeType reqRespControls #0 (syntax 1.3.6.1.4.1.4203.666.11.5.3.1) slapadd2.4: could not parse entry (line=3099715) * 4.70% eta 01h07m elapsed 03m20s spd 979.8 k/s Closing DB... The entry affected is this one: dn: reqStart=20100913093021.000000Z,cn=log,dc=mycorp.it objectClass: auditBind structuralObjectClass: auditBind reqStart: 20100913093021.000000Z reqEnd: 20100913093021.000001Z reqType: bind reqSession: 2746 reqAuthzID: reqControls: {0}{1.3.6.1.4.1.42.2.27.8.5.1} reqRespControls: {0}{1.3.6.1.4.1.42.2.27.8.5.1 controlValue "3000"} reqDN: uid=pe1597,ou=People,dc=mycorp.it reqResult: 0 reqVersion: 3 reqMethod: SIMPLE entryUUID: 192cbddf-4b5c-431d-a92e-c2f84fa4b7be creatorsName: cn=Manager,cn=log,dc=mycorp.it createTimestamp: 20100913093021Z entryCSN: 20100913093021.411398Z#000000#003#000000 modifiersName: cn=Manager,cn=log,dc=mycorp.it modifyTimestamp: 20100913093021Z Any help is appreciated. Thanks Marco On Thu, Sep 16, 2010 at 12:27 PM, Dieter Kluenter <dieter(a)dkluenter.de>wrote: > Marco Pizzoli <marco.pizzoli(a)gmail.com> writes: > > > Hi list, > > I found some entries in my OL logs about searches for attribute "1.1". > I've > > seen that the requester is the user used for the replication (syncrepl). > > > > Can anyone explain to me what this kind of attribute is this? > > > > conn=0 op=3 SRCH attr=1.1 > > oid 1.1 is just 'no attributes' > > -Dieter > > -- > Dieter Klünter | Systemberatung > sip: 7770535(a)sipgate.de > http://www.dpunkt.de/buecher/2104.html > GPG Key ID:8EF7B6C6 > -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

Re: How to bootstrap in mirror mode with cn=config
by Torsten Schlabach (Tascel eG) 17 Sep '10

17 Sep '10

Hi Brett! I see your point, and actually, this is what we are doing anyway. But I could ask my question in a different way as well: How would I turn a single server in to a mirror mode pair? > restoring > a server2 backup avoids problems with serverId etc. You know, I am asking because I want to understand those problems. Regards, Torsten P.S.: The list doesn't have the reply-tp header properly set. Make sure manually to reply tot he list. On Thu, 16 Sep 2010 19:52:01 +1000, "Brett @Google" <brett.maxfield(a)gmail.com> wrote: > I'd suggest a less complex approach. > > Restore server2 from backup, but make sure you emit a backup ldif > somewhere on a backed up filesystem daily or whatever. > > After restoring your server 2 ldif, you will be configured, and will > recover data quicker if you have some relatively static data sets. > > Building a replica with syncrepl can be slower than slapcat, restoring > a server2 backup avoids problems with serverId etc., even with newer > openldap versions. > > > On 9/16/10, Torsten Schlabach (Tascel eG) <tschlabach(a)tascel.net> wrote: >> Dear list! >> >> I am currently chasing some replication problems and I am trying to get >> my >> mind around a couple of questions. >> >> Let's assume this: >> >> We have two LDAP servers, server 1 and server 2, which are supposed to be >> mirrors of each other. >> The both have their cn=config database and a database with actual data, >> let's assume it's the dc=example,dc=com database. >> I want to run not only dc=example,dc=com but also cn=config in mirror >> mode >> to make sure that I keep the config in sync and that any changes to the >> config (e.g. ACls) can be done on one of the servers and will replicate >> to >> the other one. >> >> Let's assume this was all working well. >> >> Not server 2 fails and needs a complete reinstall. So I sit there with a >> slapd binary and no configuration at all. >> >> My idea would be (please tell me if I am on the right path) : >> >> 1. I could give server 2 a minimal config which does not contain anything >> else but "replicate your cn=config from server1". Let's call this a >> bootstrap config. >> 2. Once server 2 starts with that bootstrap config, it will fetch >> cn=config from server1. >> 3. It will learn from the replicated config that it has to have an >> dc=example,dc=com database, create it and replicate its content from >> server1 as well. >> 4. I would be back in business. >> >> Unfortunately, when I tried, what happened was: >> >> The contextCSN of the bootstrap config on server 2 is newer / higher than >> the one on server 1 which has not been touched for a while. So server 2 >> did >> not fetch the config from server 1 but vice versa, which was not exactly >> the result I intended. Though it's very consequent and logical behaviour. >> >> My question: >> >> Am I on the complete wrtong track? >> >> Would I have to do the slapcat -> slapadd thing between server 1 and >> server 2 first (with server 2 offline) and start server 2 only after >> that? >> >> When I do the slapcat / slapadd thing from server 1 to server 2, do I >> have >> to remove any contextCSN / entryCSN entries (as some postings such as >> http://www.mail-archive.com/openldap-technical@openldap.org/msg00109.html) >> suggest or would that be just wrong? >> >> Regards, >> Torsten >> >>

2 1

Attribute modification via alias
by Echedey Lorenzo 16 Sep '10

16 Sep '10

Hi, I wonder if it is possible to modify an attribute parsing to the request a dn which has an alias to the real entry where the attribute is placed. Thanks for your help -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

1 0

invalid syntax on pwdPolicy object add
by Julien Vehent 16 Sep '10

16 Sep '10

Hello all, I'm trying to add a default password policy to my directory. I have set the following parameters in slapd.conf: ---- include /etc/ldap/schema/ppolicy.schema [...] moduleload ppolicy [...] backend hdb database hdb suffix "dc=example,dc=net" [...] # Password policy overlay ppolicy ppolicy_default "cn=defaultpwpolicy,ou=policies,dc=example,dc=net" ---- I have created the OU 'policies' just fine, but when I try to add a pwdPolicy object, i get the following error: ---- # ldapadd -x -D cn=admin,dc=example,dc=net -W << EOF dn: cn=defaultpwpolicy,ou=policies,dc=example,dc=net objectClass: pwdPolicy objectClass: top pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdInHistory: 2 pwdMaxFailure: 10 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMinLength: 6 EOF Enter LDAP Password: adding new entry "cn=defaultpwpolicy,ou=policies,dc=example,dc=net" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax ---- The Schema is properly loaded, the ppolicy.so module is in the path (ie, /usr/lib/ldap on debian). So, I'm out of ideas. Anything I've missed here ? Thanks for your help, Julien

5 9

Re: Authenticate to ldap using Kerberos
by Dan White 16 Sep '10

16 Sep '10

On 09/09/10 10:21 +0800, Wouter van Marle wrote: >> That requires pass-through authentication. > >I see. >Well with the above instructions nothing seems to have changed. >I have restarted saslauthd and slapd after making the changes, and when >now accessing the ldap addressbook using Evolution, I still have to use >the ldap stored password, not the krb password. > >Wouter. To be a little more explicit, to enable pass-through authentication, you will need to replace the password (userPassword attribute) with: userPassword: {SASL}username@realm for instance: dn: uid=jsmith,dc=example,dc=com ... userPassword: {SASL}jsmith In this case, the user will have no valid password defined in LDAP (or at least not in the userPassword attribute). When attempting to perform a non-sasl bind, slapd will use saslauthd to authenticate, by taking the username (from the userPassword field), and the password that was submitted. -- Dan White

8 33

How to bootstrap in mirror mode with cn=config
by Torsten Schlabach (Tascel eG) 16 Sep '10

16 Sep '10

Dear list! I am currently chasing some replication problems and I am trying to get my mind around a couple of questions. Let's assume this: We have two LDAP servers, server 1 and server 2, which are supposed to be mirrors of each other. The both have their cn=config database and a database with actual data, let's assume it's the dc=example,dc=com database. I want to run not only dc=example,dc=com but also cn=config in mirror mode to make sure that I keep the config in sync and that any changes to the config (e.g. ACls) can be done on one of the servers and will replicate to the other one. Let's assume this was all working well. Not server 2 fails and needs a complete reinstall. So I sit there with a slapd binary and no configuration at all. My idea would be (please tell me if I am on the right path) : 1. I could give server 2 a minimal config which does not contain anything else but "replicate your cn=config from server1". Let's call this a bootstrap config. 2. Once server 2 starts with that bootstrap config, it will fetch cn=config from server1. 3. It will learn from the replicated config that it has to have an dc=example,dc=com database, create it and replicate its content from server1 as well. 4. I would be back in business. Unfortunately, when I tried, what happened was: The contextCSN of the bootstrap config on server 2 is newer / higher than the one on server 1 which has not been touched for a while. So server 2 did not fetch the config from server 1 but vice versa, which was not exactly the result I intended. Though it's very consequent and logical behaviour. My question: Am I on the complete wrtong track? Would I have to do the slapcat -> slapadd thing between server 1 and server 2 first (with server 2 offline) and start server 2 only after that? When I do the slapcat / slapadd thing from server 1 to server 2, do I have to remove any contextCSN / entryCSN entries (as some postings such as http://www.mail-archive.com/openldap-technical@openldap.org/msg00109.html) suggest or would that be just wrong? Regards, Torsten

1 0

Can't get TLS working.
by c0re 16 Sep '10

16 Sep '10

Hello everyone! Wrote to openldap-software, but got "Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 5.1.1 <openldap-software(a)openldap.org>... User unknown (state 14)." So I'm here. I'm trying to make openldap+TLS on freebsd 7.3. I configured openldap, nss_ldap, ldap.conf, nsswitch.conf, can ldapsearch it, can make "id user" and etc. So when I do "id test" I get uid=5555(test) gid=5555 groups=5555 All ok. And now I want to add TLS to it. So I add to slapd.conf TLSCertificateFile /usr/local/etc/openldap/ssl/ldap.server.ru.crt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/ldap.server.ru.key.pem TLSCACertificateFile /usr/local/etc/openldap/ssl/rootcrt.pem In nss_ldap and ldap.conf I add folowing: ssl start_tls tls_cacertfile /usr/local/etc/openldap/ssl-client/rootcrt.pem I start slapd with debugging: /usr/local/libexec/slapd -u ldap -d 1 and making "id test" I get "id: test: no such user" And slapd debug: slap_listener_activate(7): >>> slap_listener(ldap:///) connection_get(11): got connid=1000 connection_read(11): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 29 contents: op tag 0x77, time 1284477158 ber_get_next conn=1000 op=0 do_extended ber_scanf fmt ({m) ber: send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush2: 14 bytes to sd 11 connection_get(11): got connid=1000 connection_read(11): checking for input on id=1000 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(11): got connid=1000 connection_read(11): checking for input on id=1000 TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data connection_read(11): unable to get TLS client DN, error=49 id=1000 connection_get(11): got connid=1000 connection_read(11): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 5 contents: op tag 0x42, time 1284477158 ber_get_next TLS trace: SSL3 alert read:warning:close notify ber_get_next on fd 11 failed errno=0 (Undefined error: 0) conn=1000 op=1 do_unbind connection_close: conn=1000 sd=11 TLS trace: SSL3 alert write:warning:close notify That's all. What's wrong? Where should I look at? What other information should I post here? I do not like this string: "ber_get_next on fd 11 failed errno=0 (Undefined error: 0)" But I do not know what that mean.

4 16

Re: Troubleshoot ACLs
by Torsten Schlabach (Tascel eG) 15 Sep '10

15 Sep '10

Hi again! In the concrete case you explain, maybe the group thing doesn't work as expected. Here is our (anonymized) entry for that: {3}to dn.regex="o=([^,]+),o=planet" by self write by group.expand="cn=admins2,o=$1,o=planet" write by dn.base="cn=admin,o=planet" write by dn.base="uid=someoneelse,ou=user,o=anyorg,o=planet" write by * search What that does is: In each o=something,o=planet subtree we have a group called cn=admins2,o=something,o=planet. Each member of that group has write access to o=something,o=planet. The lines by dn.base="cn=admin,o=planet" write by dn.base="uid=someoneelse,ou=user,o=anyorg,o=planet" write are needed to make sure that our two superusers cn=admin,o=planet and uid=someoneelse,ou=user,o=anyorg,o=planet also keep having access. One nasty thing about how ACLs work is: As soon as the "to" portion machtes, no further entries are scanned. So if we would say {4}to * by dn.base="cn=admin,o=planet" write by dn.base="uid=someoneelse,ou=user,o=anyorg,o=planet" write later, the entry {3} would still result in cn=admin and uid=someoneelse not having *any* access to o=...,o=planet if they would not be explicitely mentioned in entry {3}. This is what many people stumble on. Regards, Torsten On Wed, 15 Sep 2010 14:58:43 +0200, Marcel van Dorp <marcel(a)van-dorp.nl> wrote: > Torsten Schlabach (Tascel eG) wrote: >> Hi Marcel! >> >> Your setup is exactly what we also do. >> >> My question: >> >> What works and what doesn't? > > It is quite a lot now, and I did not document properly what did and did > not work; sorry! I am working with a copy of a real configuration > (thanks to virtualization!), so basically I can start from scratch with > the ACLs. > >> >> How do you test it? Manually? >> > > With PHPldapadmin (PLA). I have a linux workplace, with 2 screens > (X-windows). On each screen I have a browser open. In the left browser I > log on as cn=admin,cn=config, and there I do the tweaking. On the right > browser I login as a user. This way the session cookies remain separate, > and do not conflict with each other (which happens if you use 2 tabs > within the same browser). I did some (obvious) abbreviation in my > original post. As a normal user I use something like: > > cn=testuser,ou=cust1,ou=customers,ou=people,dc=example,dc=com > > In this example I would like to have read rights to anything from: > > ou=cust1,ou=customers,ou=people,dc=example,dc=com > > this DN included, and all children (my own entry is there as well). > > If I am also a member of the group > > cn=cust1,ou=groups,dc=example,dc=com > > then I would like to have write rights as well in beformentioned parts > of the directory. > > I tried a zillion combinations, but all I get, is access to my own entry > (in many cases, I can login, but cannot read the directory, not even my > own entry). > > > When I log in in PLA, I get the two toplevel DNs: > cn=config > dc=example,dc=com > > Which I cannot expand. Just above this my own DN is displayed, and when > I click on the left-most field, I get my entry, and I then can expand > the tree (number of children between parenthesis): > > dc=example,dc=com (1) > ou=people (1) > ou=customers (1) > ou=cust1 (1) > cn=testuser > > When I open the parent (ou=cust1), I do not see any content (there is an > objectclass definition, the ou attribute (obviously) and an extra > 'description' attribute (for testing only). In my own entry > (cn=testuser), I can see all attributes. > > The debug output says a few things about matching and masking, but it is > not very clear which ACL-line is processed, and if this is about the > 'to' or the 'by' part. > > Hope this clearifies things a bit. Any suggestions? > > Marcel > >> Regards, >> Torsten >> >> On Wed, 15 Sep 2010 09:36:38 +0200, Marcel van Dorp <marcel(a)van-dorp.nl> >> wrote: >>> Hi, >>> >>> I try to implement certain ACLs, but apparently something goes wrong. I >>> read a lot about ACLs, and I do not understand what I do wrong. Maybe >>> someone on this list can help. >>> >>> I use the Debian (lenny) version of openLDAP (version 2.4.11-1), with >>> phpldapadmin as frontend. I use cn=config >>> >>> I try to achieve the following: >>> >>> *) No anonymous access >>> *) Users can change their own attributes/children >>> *) LDAP managers are listed in a groupOfNames >>> *) Customers should have READ access to their parent entry, and all >>> children of their parent (siblings) >>> *) Specific users below a customer should have WRITE access to their >>> parent, and all siblings (users are member of a specific groupOfNames) >>> >>> I have the following ACLs in olcAccess (sanitized, on multiple lines for >>> readability, with group/groupOfNames/member abbt. to g/gON/m below): >>> >>> {0}to attrs=userPassword,shadowLastChange >>> by dn.base="cn=admin,ou=roles,dc=exm,dc=com" write >>> by g/gON/m.exact="cn=ldapadm,ou=groups,dc=exm,dc=com" write >>> by g/gON/m.exact="cn=repl,ou=roles,dc=exm,dc=com" read >>> by anonymous auth >>> by self write >>> by * none >>> >>> {1}to dn.base="" by * read >>> >>> {2}to dn.regex="ou=([^,]+),ou=cust,ou=people,dc=exm,dc=com" >>> by dn.exact,expand="cn=[^,]+,ou=$1,ou=cust,ou=people,dc=exm,dc=com" >> read >>> by g/gON/m.exact,expand="cn=$1,ou=cust,ou=people,dc=exm,dc=com" write >>> by * none >>> >>> {3}to attrs=mail,entry >>> by dn.exact="cn=admin,ou=roles,dc=exm,dc=com" write >>> by g/gON/m.exact="cn=ldapadm,ou=groups,dc=exm,dc=com" write >>> by self write >>> by * read >>> >>> {4}to * >>> by dn.exact="cn=admin,ou=roles,dc=exm,dc=com" write >>> by g/gON/m.exact="cn=ldapadm,ou=groups,dc=exm,dc=com" write >>> by anonymous search >>> by self write >>> by * none >>> >>> >>> Explanation: >>> >>> {0} superuser, admins and self can change passwords. Replicators can >>> read, anonymous can authenticate, and others have no access. >>> >>> {1} Is added to get some result, gives read access to the top level of >>> the directory. It shows 'cn=config', and 'dc=exm,dc=com' >>> >>> {2} Is the ACL which I expected to work. >>> The 'to' clause matches any customer in that branch >>> The first 'by' matches any member in a group with the same name >>> The second 'by' matches any entry below this customer >>> The last 'by' denies other access >>> >>> {3} Is there, because the email address is used for login (matching dn >>> is looked up, and then used to bind. See documentation of phpldapadmin). >>> >>> {4} Is there, so I can actually do something (My dn is in the mentioned >>> group) >>> >>> I played with a different order and the like, but I do not get what I >>> want. When I enable logging (olcLogLevel = ACL), I get some info, but it >>> is hard to determine where it goes wrong. >>> >>> Regarding {2}: >>> *) I also prepended the 'to' with '.+,' to match everything below, but >>> to no avail. >>> *) I also tried the 'by' clauses with 'dn=regex' instead of 'dn.exact' >>> >>> Questions: >>> >>> 1) What is it I do wrong? >>> 2) How can I troubleshoot these issues (ACL validator available?) >>> >>> >>> If more info is needed, please let me know. >>> >>> Marcel

2 1

Changing serverID considered harmful
by Andrew Findlay 15 Sep '10

15 Sep '10

This one caused some head-scratching recently so just in case anyone else comes across it... I was updating the OpenLDAP installation for a customer, and part of the work involved converting from a single server to a mirrormode pair with some read-only slaves. The sequence of events was: 1) Dump old server to LDIF 2) Update software from 2.3.x to 2.4.23 3) Clear out and reload database from LDIF 4) Many entries added, deleted, modified 5) Second server introduced, mirrormode configured This involved adding 'serverID 1' to the original server config and restarting it. 6) Read-only slave configured, pre-loaded from the same LDIF 7) Slave started The new servers updated using refreshAndPersist mode: they got all the adds and changes but did not process any of the deletes. The problem was introduced at stage 5: by changing from serverID 000 to serverID 001 I had broken an assumption in the code. I am still not clear on exactly what went wrong, as I would expect the server to simply regard all its current entries to have come from some other master server. The effect was reproducable though: no deletes were processed by the consuming server. The correct thing would be to set the serverID before loading the initial data, but if that gets missed it seems to be OK to take a new LDIF dump after changing the ID, and to use that to pre-load replica servers. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 2

Re: Troubleshoot ACLs
by Torsten Schlabach (Tascel eG) 15 Sep '10

15 Sep '10

On Wed, 15 Sep 2010 14:58:43 +0200, Marcel van Dorp <marcel(a)van-dorp.nl> wrote: > When I log in in PLA, I get the two toplevel DNs: > cn=config > dc=example,dc=com > > Which I cannot expand. Might you make your life harder than necessary by using PLA? Could you properly expand dc=example,dc=com when you had the default ACL, i.e. before you did any changes? > Hope this clearifies things a bit. Any suggestions? Take a look at http://linux.die.net/man/8/slapacl It may be a bit of a learning curve initially, but this will enable you to write yourself some scripts which will iterate over a set of entries and check you permissions. So you can easily make changes and see if they do what you think you want to do. Regards, Torsten P.S.: Double-check to reply to the list. ;-)

1 0

syncrepl: contextCSN less than entryCSN
by Ioan Indreias 15 Sep '10

15 Sep '10

Hello, We are running openldap 2.4.21 configured as a consumer, using a refreshAndPersist replication: syncrepl rid=202 provider=ldaps://ldap.hashed.net type=refreshAndPersist interval=00:00:05:00 retry="10 3 60 +" searchbase="ou=emailservice,o=hashed" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=ldap-hashed-service,o=hashed" credentials=xx-xx-xx tls_reqcert=never In order to check if the replication works OK we compare (periodically) the provider's contextCSN versus the consumer's contextCSN Most of the time both are in sync but from time to time we see that these parameters are different (provider contextCSN > consumer contextCSN) and we thought that the consumer was not "in sync" with the provider. Continuing our investigations we found that in the consumer there are objects with entryCSN greater than the consumer contextCSN. Is this a normal situation or a bug? Bellow you could find an extract from the ldapsearch we ran on the consumer side. Best regards, Ioan Indreias ### Provider SID: 001 Local SID: 015 test199.entryCSN (20100910085049.959625) less than 001.contextCSN (20100910085055.650259) less than johndoe.entryCSN (20100910092955.693053) --- CONSUMER --- # extended LDIF # # LDAPv3 # base <o=hashed> with scope subtree # filter: (objectclass=*) # requesting: + # # hashed dn: o=hashed structuralObjectClass: organization entryUUID: 541ccdcb-8d82-4160-9fc7-1892765cbdac creatorsName: cn=superuser,o=hashed createTimestamp: 20100714124242Z entryCSN: 20100714124242.721169Z#000000#015#000000 modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100714124242Z contextCSN: 20100909124709.457916Z#000000#015#000000 contextCSN: 20100910085055.650259Z#000000#001#000000 entryDN: o=hashed subschemaSubentry: cn=Subschema auditContext: cn=auditlog # emailservice, hashed dn: ou=emailservice,o=hashed structuralObjectClass: organizationalUnit entryUUID: b8950978-248b-4b77-bcf9-6455f9c273c0 creatorsName: cn=superuser,o=hashed createTimestamp: 20100714124242Z modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100714124242Z entryCSN: 20100730103008.669976Z#000000#001#000000 entryDN: ou=emailservice,o=hashed subschemaSubentry: cn=Subschema hasSubordinates: TRUE # org, emailservice, hashed dn: dc=org,ou=emailservice,o=hashed structuralObjectClass: domain entryUUID: 32e805e8-669c-471e-b9d3-1d22938bdce3 creatorsName: cn=superuser,o=hashed createTimestamp: 20100714124242Z modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100714124242Z entryCSN: 20100730103013.472630Z#000000#001#000000 entryDN: dc=org,ou=emailservice,o=hashed subschemaSubentry: cn=Subschema hasSubordinates: TRUE # hashed, org, emailservice, hashed dn: dc=hashed,dc=org,ou=emailservice,o=hashed structuralObjectClass: domain entryUUID: 3bd366ba-5213-4bf2-8935-3ddbb26bf220 creatorsName: cn=superuser,o=hashed createTimestamp: 20100714124242Z modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100714124242Z entryCSN: 20100730103018.690150Z#000000#001#000000 entryDN: dc=hashed,dc=org,ou=emailservice,o=hashed subschemaSubentry: cn=Subschema hasSubordinates: TRUE # users, hashed, org, emailservice, hashed dn: ou=users,dc=hashed,dc=org,ou=emailservice,o=hashed structuralObjectClass: organizationalUnit entryUUID: 87390f34-5698-4653-a700-5045843813db creatorsName: cn=superuser,o=hashed createTimestamp: 20100714124242Z modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100714124242Z entryCSN: 20100802144805.677791Z#000000#001#000000 entryDN: ou=users,dc=hashed,dc=org,ou=emailservice,o=hashed subschemaSubentry: cn=Subschema hasSubordinates: TRUE ... # test199, users, hashed, org, emailservice, hashed dn: uid=test199,ou=users,dc=hashed,dc=org,ou=emailservice,o=hashed structuralObjectClass: inetOrgPerson entryCSN: 20100910085049.959625Z#000000#001#000000 entryUUID: 416a2a78-5104-102f-8592-6d824ed7581a creatorsName: cn=superuser,o=hashed createTimestamp: 20100910085049Z modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100910085049Z entryDN: uid=test199,ou=users,dc=hashed,dc=org,ou=emailservice,o=hashed subschemaSubentry: cn=Subschema hasSubordinates: FALSE # johndoe, users, hashed, org, emailservice, hashed dn: uid=johndoe,ou=users,dc=hashed,dc=org,ou=emailservice,o=hashed structuralObjectClass: inetOrgPerson entryCSN: 20100910092955.693053Z#000000#001#000000 entryUUID: b794ae8a-5109-102f-8593-6d824ed7581a creatorsName: cn=superuser,o=hashed createTimestamp: 20100910092955Z modifiersName: cn=superuser,o=hashed modifyTimestamp: 20100910092955Z entryDN: uid=johndoe,ou=users,dc=hashed,dc=org,ou=emailservice,o=hashed subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 2 result: 0 Success # numResponses: 197 # numEntries: 196 ###

3 5

Troubleshoot ACLs
by Marcel van Dorp 15 Sep '10

15 Sep '10

Hi, I try to implement certain ACLs, but apparently something goes wrong. I read a lot about ACLs, and I do not understand what I do wrong. Maybe someone on this list can help. I use the Debian (lenny) version of openLDAP (version 2.4.11-1), with phpldapadmin as frontend. I use cn=config I try to achieve the following: *) No anonymous access *) Users can change their own attributes/children *) LDAP managers are listed in a groupOfNames *) Customers should have READ access to their parent entry, and all children of their parent (siblings) *) Specific users below a customer should have WRITE access to their parent, and all siblings (users are member of a specific groupOfNames) I have the following ACLs in olcAccess (sanitized, on multiple lines for readability, with group/groupOfNames/member abbt. to g/gON/m below): {0}to attrs=userPassword,shadowLastChange by dn.base="cn=admin,ou=roles,dc=exm,dc=com" write by g/gON/m.exact="cn=ldapadm,ou=groups,dc=exm,dc=com" write by g/gON/m.exact="cn=repl,ou=roles,dc=exm,dc=com" read by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to dn.regex="ou=([^,]+),ou=cust,ou=people,dc=exm,dc=com" by dn.exact,expand="cn=[^,]+,ou=$1,ou=cust,ou=people,dc=exm,dc=com" read by g/gON/m.exact,expand="cn=$1,ou=cust,ou=people,dc=exm,dc=com" write by * none {3}to attrs=mail,entry by dn.exact="cn=admin,ou=roles,dc=exm,dc=com" write by g/gON/m.exact="cn=ldapadm,ou=groups,dc=exm,dc=com" write by self write by * read {4}to * by dn.exact="cn=admin,ou=roles,dc=exm,dc=com" write by g/gON/m.exact="cn=ldapadm,ou=groups,dc=exm,dc=com" write by anonymous search by self write by * none Explanation: {0} superuser, admins and self can change passwords. Replicators can read, anonymous can authenticate, and others have no access. {1} Is added to get some result, gives read access to the top level of the directory. It shows 'cn=config', and 'dc=exm,dc=com' {2} Is the ACL which I expected to work. The 'to' clause matches any customer in that branch The first 'by' matches any member in a group with the same name The second 'by' matches any entry below this customer The last 'by' denies other access {3} Is there, because the email address is used for login (matching dn is looked up, and then used to bind. See documentation of phpldapadmin). {4} Is there, so I can actually do something (My dn is in the mentioned group) I played with a different order and the like, but I do not get what I want. When I enable logging (olcLogLevel = ACL), I get some info, but it is hard to determine where it goes wrong. Regarding {2}: *) I also prepended the 'to' with '.+,' to match everything below, but to no avail. *) I also tried the 'by' clauses with 'dn=regex' instead of 'dn.exact' Questions: 1) What is it I do wrong? 2) How can I troubleshoot these issues (ACL validator available?) If more info is needed, please let me know. Marcel

1 0

ldapcompare on rootDSE attribute types
by Dieter Kluenter 14 Sep '10

14 Sep '10

Hello, what would be the correct DN for a compare on rootDSE? Although the examples of the manual page seem to be quite specific, none of the following seem to be correct: :~> ldapcompare -x -Z -H ldap://localhost:9004 "" supportedControl:1.3.6.1.4.1.42.2.27.8.5.1 Compare Result: Inappropriate matching (18) Additional info: inappropriate matching request UNDEFINED :~> ldapcompare -x -Z -H ldap://localhost:9004 dn: supportedControl:1.3.6.1.4.1.42.2.27.8.5.1 Compare Result: Invalid DN syntax (34) Additional info: invalid DN UNDEFINED -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

2 1

I can't login in my system using OpenLDAP
by Eric KOM 14 Sep '10

14 Sep '10

Hi Dear! Since 3 days I try to setting a LDAP Server with OpenLDAP on Debian Lenny. I'm using Mandriva Management Console (mmc) like web based admin. I already create some users with mmc, but I can't login? Please, everybody can help me or provide me a good tuto? -- Yours truly, Eric KOM 110 LAWN STREET ROSETTENVILLE 2190 JOHANNESBURG SOUTH AFRICA Phone: +27 (0) 788 791 334 Fax: +27 (0) 865 563 009 E-mail: erickom(a)namekom.co.za Websites: www.erickom.co.za | www.namekom.co.za/erickom | www.namekom.co.za

5 9

troubles with back-ldap based replication
by DT Piotr Wadas 14 Sep '10

14 Sep '10

Hello. I have some troubles setting syncrepl + back-ldap push based replication, as described on http://www.openldap.org/doc/admin24/replication.html#LDAP Sync Replication I'm using current stable openldap - the problem is, when I set up daemons (using the same slapcat output file) and modify e.g. "description" attribute on master side, back-ldap pushes out system attributes like entryCSN, creatorsName, etc, which causes modify operation to fail on final consumer side. conn=1000 op=33 MOD attr=creatorsName createTimestamp description entryCSN conn=1000 op=33 RESULT tag=103 err=19 text=creatorsName: no user modification allowed Is it some ACL-related matter, should I create some ACL, which denies to read of system attributes on master-side, to avoid replicating it with syncrepl to local back-ldap ? In such push-based scenario ( in opposite to classic provider-consumer syncrepl), final consumer does not know actually that it is a replica, it's just receiving modify operation, how do I prevent read-only system attributes from being pushed from back-ldap to final replica? Regards, DT

2 2

Re: invalid syntax on pwdPolicy object add
by Julien Vehent 14 Sep '10

14 Sep '10

On Tue, 14 Sep 2010 10:51:01 +0200, Emmanuel Lecharny <elecharny(a)gmail.com> wrote: > On 9/14/10 8:40 AM, mailing lists wrote: >> Hello, >> >> I think that the pwdAttribute needs an OID value (specified by the syntax) >> so you would must use the OID of the userPassword attribute which is >> 2.5.4.35 >> >> >> >> >> > I thought that would be a possibility for the failure Kiran and Julien are facing, (please guys, can you give it a try ?), but IMO, there is no reason why we would not be allowed to use 'userPassword' in this context. > > Using the OID instead of the alias name does not carry any extra information, as soon as the alias is valid accordingly to the schema (whatever it represents, be it an AT, OC, MR, or any of the other kind of schema objects). The syntax should just check that the alias is syntaxically correct. It's up to the ppolicy overlay to check that the value is a valid AT. > > Plus the error message is really misleading if this is the cause for the error. I tried with the OID... same thing. How can I check that the module is properly loaded and functional ? Julien

2 1

objectClass index from slapd.conf is not working
by tim stone 14 Sep '10

14 Sep '10

Hello, I've a strange behavior while using index objectClass for searching. In my slapd.conf I have defined the index in the database section: index objectClass eq Other indexes follows in the config. All of them working fine. If I search via ldapsearch like: ldapsearch -x -h localhost -w password -D"cn=admin,ou=root" -b"ou=root" "(objectclass=Guest)" I can find following Message in the syslog (loglevel -1): Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_equality_candidates (objectClass) Sep 1 14:02:52 LDAP01 slapd[17856]: => key_read Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_index_read: failed (-30989) Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_equality_candidates: id=0, first=0, last=0 Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=0 first=0 last=0 Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_filter_candidates Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_equality_candidates (objectClass) Sep 1 14:02:52 LDAP01 slapd[17856]: => key_read Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_index_read 355545 candidates Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_equality_candidates: id=-1, first=228, last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=-1 first=228 last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_list_candidates: id=-1 first=228 last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=-1 first=228 last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_list_candidates: id=-1 first=112277 last=355755 Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=-1 first=112277 last=355755 Sep 1 14:02:52 LDAP01 slapd[17856]: bdb_search_candidates: id=-1 first=112277 last=355755 Sep 1 14:02:52 LDAP01 slapd[17856]: => test_filter Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856]: <= test_filter 5 Sep 1 14:02:52 LDAP01 slapd[17856]: bdb_search: 112277 does not match filter Sep 1 14:02:52 LDAP01 slapd[17856]: entry_decode: "cn=Aaa,cn=Bbb,... Sep 1 14:02:52 LDAP01 slapd[17856]: <= entry_decode(cn=Aaa,cn=Bbb,... Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_dn2id("cn=aaa,cn=bbb,... Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_dn2id: got id=0x1b696 Sep 1 14:02:52 LDAP01 slapd[17856]: => test_filter Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856] ... all other entires following... As result, the entires are found, but not in the index and the search takes a very long time. After this, I have rebuild the complete database via slapcat/slapadd, rebuild the index via slapindex for objetClass, but nothing helped. In tried the test above on: * OpenSuSE 11.1 and openLDAP 2.4.21 and 2.4.23 (linked against libdb-4.5) * OpenSuSE 11.0 and openLDAP 2.4.9 (linked against libdb-4.5) * Debian Lenny and openLDAP 2.4.11 (linked against libdb-4.2) with different databases and a search against a objectClass. If I try another index (not objectClass) from the slapd.conf the index works, example: ldapsearch -x -h localhost -w password -D"cn=admin,ou=root" -b"ou=root" "(mypk=1234-234)" Sep 1 14:03:44 LDAP01 slapd[17856]: => bdb_equality_candidates (mypk) Sep 1 14:03:44 LDAP01 slapd[17856]: => key_read Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_index_read 1 candidates Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_equality_candidates: id=1, first=112838, last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=1 first=112838 last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_list_candidates: id=1 first=112838 last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=1 first=112838 last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_list_candidates: id=1 first=112838 last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: <= bdb_filter_candidates: id=1 first=112838 last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: bdb_search_candidates: id=1 first=112838 last=112838 Sep 1 14:03:44 LDAP01 slapd[17856]: => test_filter Sep 1 14:03:44 LDAP01 slapd[17856]: EQUALITY Sep 1 14:03:44 LDAP01 slapd[17856]: <= test_filter 6 Sep 1 14:03:44 LDAP01 slapd[17856]: => send_search_entry: conn 1002 dn="cn=Fff,cn=Eee,... Sep 1 14:03:44 LDAP01 slapd[17856]: <= send_search_entry: conn 1002 exit. Sep 1 14:03:44 LDAP01 slapd[17856]: send_ldap_result: conn=1002 op=1 p=3 Sep 1 14:03:44 LDAP01 slapd[17856]: send_ldap_response: msgid=2 tag=101 err=0 Sep 1 14:03:44 LDAP01 slapd[17856]: connection_get(12): got connid=1002 Sep 1 14:03:44 LDAP01 slapd[17856]: connection_read(12): checking for input on id=1002 Sep 1 14:03:44 LDAP01 slapd[17856]: op tag 0x42, time 1283342624 Sep 1 14:03:44 LDAP01 slapd[17856]: conn=1002 op=2 do_unbind Sep 1 14:03:44 LDAP01 slapd[17856]: connection_close: conn=1002 sd=12 Why does only the objectClass index not work? The only difference I can see, is that all other indexes are based on "normal" attributes. I don't know, if it is necessary, but for objectClass I can't find a attribute definition in the schema. In the core.schema is the attribute definition for objectClass deactivated (aka #)... Here is the Config from the LDAP-Server: # Schema and objectClass definitions include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/my_ldap_attribute.schema include /etc/openldap/schema/my_ldap.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb sizelimit -1 timelimit 300 disallow bind_anon gentlehup on tool-threads 1 ####################################################################### # bdb database definitions ####################################################################### database bdb suffix "ou=root" rootdn "cn=root,ou=root" checkpoint 4096 15 rootpw password directory /var/lib/ldap dbnosync # Indices to maintain index objectClass,entryUUID,entryCSN eq index mypk,myusername pres,eq index myproperty,mylanguage eq index cn eq,sub Kindly regards Tim Stone

3 7

Re: invalid syntax on pwdPolicy object add
by mailing lists 14 Sep '10

14 Sep '10

Hello, I think that the pwdAttribute needs an OID value (specified by the syntax) so you would must use the OID of the userPassword attribute which is 2.5.4.35

3 2

Keep alive functionality when the remote closes the conenction due idle
by alin vasile 13 Sep '10

13 Sep '10

Hi guys, I have a question related to the open ldap client keep alive functionality. Our OS is SLES 11. In our client code we are reusing the ldap connections between requests uning a connection pool. For each conenction we are setting the keep-alive options (LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES and LDAP_OPT_X_KEEPALIVE_INTERVAL) and this works fine. My question is how the openl ldap library (libldap and libldap_r) handles the situation when the number of kee-alive probes for a connection is exceeded and the connection is closed at the server side. Did you dealt with this situation? Thanks, Alin

4 5

syncrepl incomplete database problem
by Islam Amer 13 Sep '10

13 Sep '10

Hello everyone, I have a problem with a simple master/slave syncrepl replication setup. Everytime I restart the slave it goes back to an empty state and then syncs about only 200 entries from thousands in the master. >From then on it gets the update events from the master fine. I have tried some of the things suggested in this mailing list but none have worked so far. For example I tried initializing the slave with a full slapcat of the master after deleting all files from /var/lib/ldap/ , but when I start the slave it deletes ALL entries and starts over. The master is debian etch with 2.3.30-5+etch2 ( critical, not easy to update ) The slave is 2.3.43 RHEL The slave config is : syncrepl rid=100 provider=ldaps://xxxxxxxxxxxxxx:636 type=refreshOnly tls_cert=/var/lib/ldap/ssl/clientcert.pem tls_key=/var/lib/ldap/ssl/clientkey.pem tls_cacert=/var/lib/ldap/ssl/cacert.pem interval=00:00:01:00 retry="5 60" searchbase="dc=xxxx" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=xxxxx,dc=xxxx" credentials=xxxxxx slapd is started with options "-c rid=100,csn=0" ( the real values are obscured for security, sorry ) I switched to refreshOnly because the connection passes through a strict firewall, and I read that the persistent connection of refreshAndPersist has problems with that. Any help is appreciated. Thanks.

1 0

Re: invalid syntax on pwdPolicy object add
by Julien Vehent 13 Sep '10

13 Sep '10

On Mon, 13 Sep 2010 19:29:12 +0530, Kiran Ayyagari <kayyagari(a)apache.org> wrote: > On Mon, Sep 13, 2010 at 5:07 PM, Julien Vehent <julien(a)linuxwall.info> wrote: >> >> >> >> # slapd -V >> @(#) $OpenLDAP: slapd 2.4.23 (Aug 26 2010 18:33:04) $ >> root@monster:/tmp/buildd/openldap-2.4.23/debian/build/servers/slapd >> >> >> It's not a space/tab problem, and I've tried to put the request in an ldif file and insert it, with the same result. >> It's definitely a constraint that's not satisfied... but which one ?? > > think it is reproducible cause I have got the same error when I > followed the above steps > 'error code 21 - pwdAttribute: value #0 invalid per syntax' > > I have built OpenLDAP version 2.4.23 on Ubuntu 9.04 with berkeley db > version 4.7.25 > > Kiran Ayyagari > Alright, so it's either my steps that are wrong, or a problem with slapd. I'll be humble and suppose that my configuration is wrong first. Any hint on what I could have missed ? described here: http://wiki.linuxwall.info/doku.php/en:ressources:dossiers:openldap:openlda… Julien

2 1

Logging practices of OpenLDAP
by Mark John Rank 13 Sep '10

13 Sep '10

List: UW-Milwaukee is in the process of reviewing IAM infrastructure and looking to harmonize logging, audit and data retention configuration for many of our IAM related services. Our OpenLDAP service is in scope for this review. To help frame the review, I am looking for guidance or best practices for configuring logging for OpenLDAP, especially for the HigherEd community. Of particular interest is the decision process around balancing log level, performance overhead and data retention. A search of the archives didn't result in much so I though I would just ask the question of the list. If individuals are interested in sharing, they can reply to the list or they can contact me directly at the address below. Regards, Mark ------------------------------------------ Mark Rank, Middleware Architect University Information Technology Services UW-Milwaukee Email: rankm(a)uwm.edu Phn: 414-229-3706 ------------------------------------------

1 0

Confused about password authentication formats
by 1.41421＠gmail.com 12 Sep '10

12 Sep '10

I have an OpenLDAP 2.4.23 server up and running in a Linux box L against which I can carry out password authentication on behalf of users logging into an embedded system E. To accomplish this, in LI have an LDIF file with entries along the following lines: dn: uid=xxx,ou=yyy,dc=zzz,dc=com uid: xxx cn: xxx objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: ThisIsthePassword shadowLastChange: 14014 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 1003 gidNumber: 1003 homeDirectory: /home/xxx gecos: ,,, I would like to change this so that, when sending password information from my LDAP client in E to the LDAP server in L, the password itself is never sent in the clear. So I thought to change the value of the userPassword attribute to read {SHA}3DRF4FXpG8r+Ki8i8azuZh7KwO8= instead, where the string above was obtained by means of slappasswd -v -s ThisIsthePassword -h "{SHA}" in L. After restarting the LDAP server in L, when user xxx logs into E with password "ThisIsthePassword" I can verify in the traces of the LDAP server (I am running it as slapd -d 255) that the client in E is sending the "3DRF4FXpG8r+Ki8i8azuZh7KwO8=" string, exactly as specified in the value of the userPassword attribute. However, the authentication is failing. What is it exactly that the LDAP client in L is supposed to be sending to the LDAP server in this case? I noticed that if the client sends the actual "ThisIsthePassword" string instead the authentication also fails. I am obviously missing something here but, what is it?

2 2

Re: objectClass index from slapd.conf is not working
by tim stone 10 Sep '10

10 Sep '10

> The very first time you start slapd, I always expect searches to be slow, as > it has to load up the dncache, entrycache, and idlcache. If you are only > seeing this slowness the first time the search executes after slapd is > started, then this is normal behavior. No, as I said, it takes always a long(er) time. It seems to me, that the index for objectClass returns too much entires?! If I search for an other indexed attribute in the same container (exist in this container also only one time), then the index returned the matched entity in only 0,05 sec (used command time for measuring). See my first posting. Only for the index objectClass I see this strange behavior. The index should return only one Candidate, if there is only one entry that match in this searchBase? kindly regards, Tim

1 0

Re: objectClass index from slapd.conf is not working
by tim stone 10 Sep '10

10 Sep '10

>> >> I tried to increase the cachesize and idlcachesize to 100000 and >> restarted the slapd, but it did not help. > > If you are using back-hdb, and using a subtree as the base (which it looked > like you were doing), the first time through the search will be very slow > while the cache is filled. That's a long-standing issue with back-hdb. > Subsequent searches are substantially faster. > Thanks, but I use bdb as backend (see config). Due more investigation today I find out, that if I use cachsize and idlcachsize about 500000 the second response (after first search) is quite faster, because now the entries are cached. But by configuring an index for objectClass it should avoid for searching all the entries? This Configuration is not applicable at the moment, because my Linux is 32bit (PAE) and the cachesize for the bdb-index is 1GByte. Slapd is using about 2Gby of RAM at the moment. But if I could increase the RAM, the problem of the index still exist. In one of my DN (Container) are 88000 entires. I placed my search there (searchBase) Only the Container itself has the searched objectClass, but all entires in this container will be examined too. Should the index for objectClass not only give back this _one_ (and not 355545) Candidate, or do I misunderstood this? ================================================== Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_equality_candidates (objectClass) Sep 1 14:02:52 LDAP01 slapd[17856]: => key_read Sep 1 14:02:52 LDAP01 slapd[17856]: <= bdb_index_read 355545 candidates ================================================== Thanks Tim

2 1

GSSAPI Bind across trusted realms
by Indexer 10 Sep '10

10 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I have REALM.A and REALM.B in my KDC setup. There is a two way trust between REALM.A and REALM.B. I have a client computer on REALM.A, and can correctly kinit to get tickets from both realms via this trust pathway. I also have an OpenLDAP server on the server with REALM.B, and it is identified by ldap/ldap.realm.b(a)REALM.B When i obtain a ticket on REALM.A via this , and try to execute a SASL bind to the ldap server, i get an error of SASL/GSSAPI authentication started ldap_err2string ldap_sasl_interactive_bind_s: Local error (-2) It says that Minor code may provide more information (Server ldap/ldap.realm.b(a)REALM.B not found in Kerberos database). A user from REALM.B can access the LDAP server correctly with GSSAPI klist shows that i am getting a TGT for both REALM.A and REALM.B on my user(a)REALM.A. Is this an issue with kerberos being unable to find the ticket across the realm trust for ldap to be verified? What steps can i follow to help fix this issue? Are there principal flags that i am forgetting to add to my LDAP principal for this to work? Your help is appreciated. William Brown pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) iQIcBAEBAgAGBQJMiF0cAAoJEHF16AnLoz6J6mIP/0Jnfw8vG13LyOlv2gm3zwrF psHWASKmzaPngS0c7nbNSDDWi6jZJXogP9kF8uI/JQibUlYJb9TtfiG1K7l6yMol /jD8l3TGVy/VBrG6Yk0sqiQeHn52IaPTXv/xk0a8o6rk/wAUFzEnXH3+K/oRg+4A +Z5WHWHsdz73QBkMRVE+IY+IHwUB+GoglyocZmnQBjigU+2+So2hhlxp8XqmZPSZ jke2yk375LXHgv8/cppIIx3YV5VtvMe/O/lQoptBl39D8Y7CFwJsuQqGtyTRQVJh PpnMDARhqR+UKqJeZRksQLUeFZhQYzLWpTStm/8NhYAVBhTF32NPwgkcv5LohUdH yK3TCjvPodXCs27kGFX2s20tpFjLfpnx+gzyCTRQbbygPR4/Nn+11kmqDlrC05fW GpUOA8aknL7J6tN5twlO/wHtIaIvTPP4MmDD9DlS6OtNbBtaumDrS6ehWQ0j4FlA IfK+eHwIRgvjxCGa7N9S7jv5ZqxkAyeVArWWJczcCL6qKij7Zgh0w8nvzMTJq1Jj TwYK9O8RHL0d66NSFs2sTaEUZECnYA29oh6XppmvaOUdI5JOzQ4keG6xhTieRPBx Tdkq/1B51nl6EfJTu4fLOKfRz2UnOY2Uvms+2qdH0cZZIhOu98I3BsSdKhUgPtAB kZoLSAwYj33BL/KU/8Yj =RZcN -----END PGP SIGNATURE-----

2 1

Re: Authenticate to ldap using Kerberos
by Bill MacAllister 09 Sep '10

09 Sep '10

--On Thursday, September 09, 2010 08:02:54 AM -0700 Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, September 09, 2010 5:13 PM +0800 Wouter van Marle <wouter(a)squirrel-systems.com> wrote: > >> Kerberos is the authentication system, it's specialised in that. At >> least that's what I learned about it. I have set it up in order to have >> a single sign-on, a single password for all services running on my >> network, makes it much easier for me to administer. >> >> LDAP is a specialised database system storing typically personal >> information, I also use it for aliases database, userID, groupID, and >> other system info. This part works great as well. >> >> Now all I want is for openldap to use kerberos as its authentication >> broker. Nothing more, nothing less. LDAP is now authenticating its users >> by itself which seems to be the default behaviour, and that's what I >> want to get rid of. As you say yourself LDAP is not an authentication >> broker, but why can it not easily be configured to use an external >> authentication broker, such as pam, which is designed to be just that? > > You are directing your unhappiness at the wrong place, as Howard > already noted. As someone who set up a large OpenLDAP directory > service that only allows SASL/GSSAPI connections, the issue is not > OpenLDAP. The problem is client software that, even though SASL has > been a standard for many, many years, still fail to properly support > it. This includes things like Evolution and Postfix. I used to > maintain a patch for Postfix specifically that allowed it to do > SASL/GSSAPI binds. > > In sum, SASL is the RFC supported mechanism to use for doing these > types of binds to LDAP. It has been the RFC supported method for a > very, very long time. Unfortunately, people who write LDAP client > software often skip implementing SASL support. This is not the > fault of the OpenLDAP or any other directory project. If you have > client software that doesn't support SASL that implements LDAP v3 > support, then you need to contact the authors of that software or > fix it yourself. > > --Quanah Following up on Quanah's assertion that this is a client problem, you might want to help some clients pick the correct SASL mechanism when connecting to your LDAP server by restricting the mechanism list that is presented to the clients. In the default installation OpenLDAP's slapd will present all of the mechanisms that it knows about which probably includes mechanisms that you don't support. In the case of allowing only Kerberos authenticated binds you will want to restrict the mechanism list to GSSAPI. I went back to look at where setting the mechanism list was documented and what I found was a set of internal email exchanges describing the problem. Re-reading email stream it looks like the mechanism list on Debian systems will be read from either /usr/lib/sasl2/slapd.conf or /etc/ldap/sasl2/slapd.conf. We are using a /etc/ldap/sasl2/slapd.conf that consists of: mech_list: GSSAPI Bill -- Bill MacAllister Infrastructure Delivery Group, Stanford University

1 0

slapcat generate extra "space" characters in LDIF output
by Frank Bonnet 09 Sep '10

09 Sep '10

Hello I'm in trouble with slapcat when generating a LDIF file it puts some extra "space" characters into some dn longer than 80 characters. is there a way to change the output format of slapcat command to generate lines longer than 80 characters in the LDIF file ? I need this because I need to duplicate our directory server to another TLD and I need to substitute dc=fr by dc=biz but sometime I get this ------------------------------------------------dc=fr sometime I get this ------------------------------------------------dc= fr sometime I get this ------------------------------------------------dc =fr sometime I get this ------------------------------------------------dc= fr Thank you

6 7

Re: slapcat generate extra "space" characters in LDIF output
by masarati＠aero.polimi.it 09 Sep '10

09 Sep '10

> I'd note that while the current maximum width of lines is enforced to 76 > chars, they happen to be 78 char long (because of an extra LDIF_KLUDGE set > to 1 and, I guess, of the leading blank). > > In any case, in the spirit of being liberal when needed, I have nothing > against allowing OpenLDAP tools to visualize LDIF with arbitrary width, as > soon as the default behavior remains the original one, in order to avoid > breaking existing software. See <http://www.openldap.org/its?findid=6645>. p.

1 0

cn=config and ACL formatting
by Victor Mataré 09 Sep '10

09 Sep '10

Hi everyone, I just switched our servers from slapd.conf to cn=config in slapd.d, and I'm a bit annoyed with my ACLs now. The problem is that olcAccess attributes tend to be somewhat lengthy and I'd really appreciate some newlines in them, but slapd seems to eat those. Is there any way to tell the server to preserve the newlines in attribute values, or maybe use some other character that causes a line break? Of course I might edit the files in /etc/slapd.d, but then the whole cn=config thingy becomes pointless, doesn't it? greetings, Victor

5 5

rwm rewrite
by Mark Coetser 09 Sep '10

09 Sep '10

Hi I have googled and read over slapo-rwm man page, some great examples there BUT I cant seem too grasp the rewrite rule. Basically I have merged a couple of individual openldap directories under a meta database which works fine. Some of the individual directories have clashing posix uidnumber attributes ie uid=joe,dc=subdomain1,dc=test uidnumber: 1023 uid=soap,dc=subdomain2,dc=test uidnumber: 1023 uid=user2,dc=sudomain2,dc=test uidnumber: 1024 what I am trying too do is create a rwm overlay that would rewrite the uidnumber attribute for subdomain2 so add a 10 in front of each uidnumber for each user in the subdomain database. ie uid=soap,dc=subdomain2,dc=test uidnumber: 101023 uid=user2,dc=sudomain2,dc=test uidnumber: 101024 -- Thank you, Mark Adrian Coetser mark(a)tux-edo.co.za http://www.tux-edo.co.za http://www.tux-voip.co.za cel: +27 76 527 8789 fax: +27 86 677 4117

2 2

Authenticate to ldap using Kerberos
by Wouter van Marle 09 Sep '10

09 Sep '10

Hi group, I have been fighting the whole day already for something that I think is quite simple but I just can't get it to work: have slapd authenticate users against kerberos. Following many tutorials, trying many things, I give up on that and ask for your help. System: Debian Lenny. Situation: - workstation logins over the network authenticate against kerberos - credentials from LDAP - postfix has its alias database etc in LDAP, as are the groups and userIDs and everything - helps keeping uids the same on the workstations. Essential for NFS. - anything using pam will be authenticated against kerberos, including imap, postfix, etc. Except LDAP. Then slapd authenticates by itself against the password stored there. And that's not what I want. There should be no passwords in LDAP any more, everything against kerberos. Then at least when a user changes their kerberos password, the same password is used everywhere. I just can't get this to work for some reason. I have followed many tutorials, so many that I forgot what I did, and it still doesn't work. Slapd should use pam to authenticate, or directly talk to the kerberos server, whatever. saslauthd has the gssapi module installed. I have created an ldap/acorn.squirrel@SQUIRREL key, and added this keytab in /etc/defaults/slapd. acorn.squirrel is the fqdn of the server, SQUIRREL is its kerberos realm. My clients all run Ubuntu 10.04 LTS (a nice desktop but shitty to get kerberos/ldap authentication work on amongst other griefs). Current situation after all the hacking: $ ldapwhoami -x -D 'uid=wouter,ou=people,dc=squirrel' -W -h acorn.squirrel Enter LDAP Password: ldap_bind: Invalid credentials (49) when entering my Kerberos password; it accepts my credentials when I enter the LDAP stored password (a different password). Then I just did: ======================= wouter@acorn:~$ ldapsearch -LLL -s base -b '' '(objectClass=*)' + SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) wouter@acorn:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000_5lYS4w Default principal: wouter@SQUIRREL Valid starting Expires Service principal 09/08/10 22:42:07 09/09/10 08:42:07 krbtgt/SQUIRREL@SQUIRREL renew until 09/09/10 22:42:07 09/08/10 22:46:39 09/09/10 08:42:07 ldap/acorn.squirrel@SQUIRREL renew until 09/09/10 22:42:07 Kerberos 4 ticket cache: /tmp/tkt1000 klist: You have no tickets cached ======================= OK it seems ldap gets it's ticket. Issued the moment I ran the above command. Still I get the bind error. But for some reason I do not have a ticket myself, interesting. Running kinit doesn't solve this strangely enough, on the workstations it does give me a ticket. And running kinit kills the ldap ticket. Appears strange to me. Any ideas? I probably miss something very simple... it shouldn't be that hard to have slapd get its credentials from kerberos! Thanks! Wouter.

3 5

back-sql disconnects
by Frederik Bosch 08 Sep '10

08 Sep '10

While I have my slapd-server completely up and running, I do have one obstacle. The sql connection disconnects after some time of idling (MySQL server has gone away). Probably because the maximum seconds of idling has been reached. This means I have to restart slapd to fix the connection. I could open a cronjob to do that, but that's more a last-resort-solution. Is there a config option for reconnection or is there another possible solution? I could imagine that slapd would try to reconnect in case it loses sql connection because this could happen for all sort of reaons. Server information: I am on Debian Squeeze using openldap 2.4.17, recompiled with back-sql and openssl. The sql server is MySQL 5/InnoDB. I do not have full control over the sql server. So I cannot add a user without idling limit.

2 5

Re: slapd-meta idassert with SASL EXTERNAL not working correctly
by masarati＠aero.polimi.it 08 Sep '10

08 Sep '10

>> Hi, >> >> I'm trying to set up OpenLDAP as a Proxy for multiple LDAP servers >> using slapd-meta. >> The remote servers require SASL EXTERNAL authentication, so I have to >> configure TLS client auth. >> >> The relevant part of my slapd.conf looks like this: >> ------------------------------------------------- >> database meta >> suffix "dc=example" >> >> uri "ldaps://server2:636/cn=server2,dc=example" >> idassert-authzFrom "dn:*" >> idassert-bind bindmethod=sasl >> saslmech=EXTERNAL >> tls_cert=mycert.crt >> tls_key=mycert.key >> tls_cacert=trusted-ca.pem >> mode=none Add tls start here to request TLS to be established on connections (see slapd-meta(5) for details). I think this should be implicitly enabled by idassert-bind when it requires TLS (or at least its need should be documented). p.

1 0

slapd-meta idassert with SASL EXTERNAL not working correctly
by Manuel Gaupp 08 Sep '10

08 Sep '10

Hi, I'm trying to set up OpenLDAP as a Proxy for multiple LDAP servers using slapd-meta. The remote servers require SASL EXTERNAL authentication, so I have to configure TLS client auth. The relevant part of my slapd.conf looks like this: ------------------------------------------------- database meta suffix "dc=example" uri "ldaps://server2:636/cn=server2,dc=example" idassert-authzFrom "dn:*" idassert-bind bindmethod=sasl saslmech=EXTERNAL tls_cert=mycert.crt tls_key=mycert.key tls_cacert=trusted-ca.pem mode=none ------------------------------------------------- Starting slapd with this config results in anonymous authentication against "server2", even though I configured the idassert-bind to use SASL EXTERNAL with the given keys/certs. The strange thing is: When I'm starting slapd with the environment variables LDAPTLS_CERT,LDAPTLS_KEY,LDAPTLS_CACERT (same values as the options in idassert-bind), everything works (the meta backend authenticates with the given keys/certs). Why do I have to set those environment variables to get the meta backend working? And respectively, why do the tls_* options in idassert-bind have no effect (in that case)? Thanks in advance, Manuel

3 3

cannot bind to ldap other user as root
by Sandor Szalina 08 Sep '10

08 Sep '10

Hi! I have installed the openldap 2.2.13 with rpm on Red Hat Enterprise Linux ES release 4 (Nahant Update 8) I have set the TLS setting too. With the user root I can start the ldapsearch and I receive the result successfully, the ldap client can connect to the ldap server. However if I login with another user I receive the following message: ldap_bind: Can't contact LDAP server (-1) What can be the problem? Thanks for the help in advance, Sandor

3 3

ldap filter order
by DT Piotr Wadas 08 Sep '10

08 Sep '10

Hello, I have 10 000 objects with attributeA=john and 100 of these objects has also attributeB=mary both attributes are indexed. Does it make any difference between (&(attributeA=john)(attributeB=mary)) vs. (&(attributeB=mary)(attributeA=john)) I bet it is better to exclude john-matched objects from the set of 100 mary-matched objects, than exclude 100 mary-matched objects from the set of 10 000 john-matched objects, is that right? In other words - does it make sens to order complicated filters to match possible low-volume results from the left, and high-volume sets on the right? This, of course, apply to AND filters only. Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd version: 8.3.7 (api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

2 1

CRL refresh
by Gianluigi Nigro 08 Sep '10

08 Sep '10

Hi, Using version 2.4.23 with TLS. In slapd.conf the TLSCACertificatePath directive specifies the directory containing the certificate for the CA and the CRL. The content of this directory is hashed with c_rehash utilities. Everything works fine, but when a client certificate is revoked (ad a new CRL is created) i must restart the server to make it upgraded with the new CRL. Is there a way to do this, without having to reboot (a hot refresh of the CRL)? Thanks. gnigro -------------------------------------------------------------------- Il contenuto di questo messaggio di posta elettronica e ogni eventuale documento a quest'ultimo allegato puo contenere informazioni la cui riservatezza e' tutelata ed e' rivolto unicamente agli effettivi destinatari i quali prendono atto del carattere non strettamente personale dei messaggi di risposta, che potranno essere noti all'organizzazione aziendale. Sono vietati la riproduzione e l'uso di questo messaggio in mancanza di autorizzazione del destinatario. Se avete ricevuto questo messaggio per errore, vogliate cortesemente chiamarci immediatamente per telefono o fax e distruggere quanto ricevuto (compresi i file allegati) senza farne copia. Qualsivoglia utilizzo non autorizzato del contenuto di questo messaggio costituisce violazione dell'obbligo di non prendere cognizione della corrispondenza tra altri soggetti.

3 2

Sunone 5.2 to openldap migration
by Arya, Manish Kumar 07 Sep '10

07 Sep '10

Hi, I have a sunone 5.2 with custom schema and acis. can you please point me to some migration guide for schema,aci, data migration from sunone to openldap ? -- Manish www.mka.in +91-(0)-9871184321 xmpp manish(a)linuxlabs.biz Public Key http://www.mka.in/keys/public.asc

2 1

search with (uidNumber>=1900) got "text: inappropriate matching request"
by Zhang Weiwu 07 Sep '10

07 Sep '10

Hello. I am not quiet sure why a search with (uidNumber>=1900) got "text: inappropriate matching request". I've checked that uidNumber is mentioned and commented in nis.schema on my openldap-2.4.10 on Debian. Thus it should be a built-in attribute. It is of integerMatch Can you give some hint how to search for all users with uid greater than 1900? Thanks! Test case: $ ldapsearch -xD uid=supertuxadmin,ou=contacts,ou=china,dc=ahk,dc=de -b ou=contacts,ou=china,dc=ahk,dc=de '(uidNumber>=1900)' o uidNumber # extended LDIF # # LDAPv3 # base <ou=contacts,ou=china,dc=ahk,dc=de> with scope subtree # filter: (uidNumber>=1900) # requesting: o uidNumber # # search result search: 2 result: 0 Success text: inappropriate matching request # numResponses: 1

2 1

Back-ldap configuration and id-assertion.
by Mustafa A. Hashmi 07 Sep '10

07 Sep '10

Hi all, I am wondering if I am going about my setup the right way and am hoping someone can give me a bit of input. Using openldap-2.4.23 on Debian Linux, I have nssov configured to retrieve host, user and group information on my primary server, with back-ldap and nssov configured on a secondary machine doing the same. The back-ldap configuration is as follows: database ldap suffix dc=zivios,dc=net uri "ldap://dev03.zivios.net" acl-bind bindmethod=simple binddn="" credentials="" idassert-bind bindmethod=simple mode=self binddn="uid=zproxyauth,ou=zusers,ou=core control,ou=zivios,dc=zivios,dc=net" credentials="foo" idassert-authzFrom "dn.regex:.*" overlay nssov nssov-map group uniqueMember member nssov-ssd passwd ldap:///dc=zivios,dc=net??sub nssov-ssd group ldap:///dc=zivios,dc=net??sub nssov-ssd hosts ldap:///dc=zivios,dc=net??sub nssov-pam hostservice nssov-pam-session sshd nssov-pam-session login On the primary server, I have the authz policy set to "to", with an authzto rule as follows for the zproxyauth user: {0}ldap:///dc=zivios,dc=net??sub?(objectClass=posixAccount) I have setup appropriate ACLs that allow access to the authorizedService attribute for certain groups and, testing ssh & logins is working as required (on the primary server). However, when connections come in from the back-ldap server, the proxy auth works initially, with every "other" request failing. The back-ldap server log reports: send_ldap_result: err=123 matched="" text="anonymous proxied authorization not allowed" This is quite easily reproducible via simple getent passwd/group calls. Every second request fails with the aforementioned error. SSH access to the secondary server (with a successful regex, id-assertion and compare operation) works if I restart the back-ldap server, however, all subsequent requests fail. Below is the complete log of a failed request from the back-ldap server on a getent passwd command: dev02:/opt/zivios/openldap/etc/openldap# getent passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh sshd:x:101:65534::/var/run/sshd:/usr/sbin/nologin zopenldap:x:945:945::/home/zopenldap:/bin/false daemon: activity on 1 descriptor daemon: activity on: 10r daemon: read active on 10 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL connection_get(10) connection_get(10): got connid=0 nssov: connection from uid=0 gid=0 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL nssov_passwd_all() str2filter "(objectClass=posixAccount)" put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xf6e8f010 ptr=0xf6e8f010 end=0xf6e8f02d len=29 0000: a3 1b 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 0c 70 6f 73 69 78 41 63 63 6f 75 6e 74 .posixAccount end get_filter 0 =>ldap_back_getconn: conn 0x9398940 fetched refcnt=1. ldap_search_ext put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" ldap_build_search_req ATTRS: uid userPassword uidNumber gidNumber gecos cn homeDirectory loginShell objectClass ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x9397070 ptr=0x9397070 end=0x939716f len=255 0000: 30 81 fc 02 01 13 63 81 9c 04 10 64 63 3d 7a 69 0.....c....dc=zi 0010: 76 69 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 vios,dc=net..... 0020: 00 02 01 00 02 01 00 01 01 00 a3 1b 04 0b 6f 62 ..............ob 0030: 6a 65 63 74 43 6c 61 73 73 04 0c 70 6f 73 69 78 jectClass..posix 0040: 41 63 63 6f 75 6e 74 30 5c 04 03 75 69 64 04 0c Account0\..uid.. 0050: 75 73 65 72 50 61 73 73 77 6f 72 64 04 09 75 69 userPassword..ui 0060: 64 4e 75 6d 62 65 72 04 09 67 69 64 4e 75 6d 62 dNumber..gidNumb 0070: 65 72 04 05 67 65 63 6f 73 04 02 63 6e 04 0d 68 er..gecos..cn..h 0080: 6f 6d 65 44 69 72 65 63 74 6f 72 79 04 0a 6c 6f omeDirectory..lo 0090: 67 69 6e 53 68 65 6c 6c 04 0b 6f 62 6a 65 63 74 ginShell..object 00a0: 43 6c 61 73 73 a0 58 30 56 04 18 32 2e 31 36 2e Class.X0V..2.16. 00b0: 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 00c0: 2e 31 38 04 3a 64 6e 3a 67 69 64 4e 75 6d 62 65 .18.:dn:gidNumbe 00d0: 72 3d 30 2b 75 69 64 4e 75 6d 62 65 72 3d 30 2c r=0+uidNumber=0, 00e0: 63 6e 3d 70 65 65 72 63 72 65 64 2c 63 6e 3d 65 cn=peercred,cn=e 00f0: 78 74 65 72 6e 61 6c 2c 63 6e 3d 61 75 74 68 xternal,cn=auth ber_scanf fmt ({) ber: ber_dump: buf=0x9397070 ptr=0x9397076 end=0x939716f len=249 0000: 63 81 9c 04 10 64 63 3d 7a 69 76 69 6f 73 2c 64 c....dc=zivios,d 0010: 63 3d 6e 65 74 0a 01 02 0a 01 00 02 01 00 02 01 c=net........... 0020: 00 01 01 00 a3 1b 04 0b 6f 62 6a 65 63 74 43 6c ........objectCl 0030: 61 73 73 04 0c 70 6f 73 69 78 41 63 63 6f 75 6e ass..posixAccoun 0040: 74 30 5c 04 03 75 69 64 04 0c 75 73 65 72 50 61 t0\..uid..userPa 0050: 73 73 77 6f 72 64 04 09 75 69 64 4e 75 6d 62 65 ssword..uidNumbe 0060: 72 04 09 67 69 64 4e 75 6d 62 65 72 04 05 67 65 r..gidNumber..ge 0070: 63 6f 73 04 02 63 6e 04 0d 68 6f 6d 65 44 69 72 cos..cn..homeDir 0080: 65 63 74 6f 72 79 04 0a 6c 6f 67 69 6e 53 68 65 ectory..loginShe 0090: 6c 6c 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 a0 ll..objectClass. 00a0: 58 30 56 04 18 32 2e 31 36 2e 38 34 30 2e 31 2e X0V..2.16.840.1. 00b0: 31 31 33 37 33 30 2e 33 2e 34 2e 31 38 04 3a 64 113730.3.4.18.:d 00c0: 6e 3a 67 69 64 4e 75 6d 62 65 72 3d 30 2b 75 69 n:gidNumber=0+ui 00d0: 64 4e 75 6d 62 65 72 3d 30 2c 63 6e 3d 70 65 65 dNumber=0,cn=pee 00e0: 72 63 72 65 64 2c 63 6e 3d 65 78 74 65 72 6e 61 rcred,cn=externa 00f0: 6c 2c 63 6e 3d 61 75 74 68 l,cn=auth ber_flush2: 255 bytes to sd 13 0000: 30 81 fc 02 01 13 63 81 9c 04 10 64 63 3d 7a 69 0.....c....dc=zi 0010: 76 69 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 vios,dc=net..... 0020: 00 02 01 00 02 01 00 01 01 00 a3 1b 04 0b 6f 62 ..............ob 0030: 6a 65 63 74 43 6c 61 73 73 04 0c 70 6f 73 69 78 jectClass..posix 0040: 41 63 63 6f 75 6e 74 30 5c 04 03 75 69 64 04 0c Account0\..uid.. 0050: 75 73 65 72 50 61 73 73 77 6f 72 64 04 09 75 69 userPassword..ui 0060: 64 4e 75 6d 62 65 72 04 09 67 69 64 4e 75 6d 62 dNumber..gidNumb 0070: 65 72 04 05 67 65 63 6f 73 04 02 63 6e 04 0d 68 er..gecos..cn..h 0080: 6f 6d 65 44 69 72 65 63 74 6f 72 79 04 0a 6c 6f omeDirectory..lo 0090: 67 69 6e 53 68 65 6c 6c 04 0b 6f 62 6a 65 63 74 ginShell..object 00a0: 43 6c 61 73 73 a0 58 30 56 04 18 32 2e 31 36 2e Class.X0V..2.16. 00b0: 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 00c0: 2e 31 38 04 3a 64 6e 3a 67 69 64 4e 75 6d 62 65 .18.:dn:gidNumbe 00d0: 72 3d 30 2b 75 69 64 4e 75 6d 62 65 72 3d 30 2c r=0+uidNumber=0, 00e0: 63 6e 3d 70 65 65 72 63 72 65 64 2c 63 6e 3d 65 cn=peercred,cn=e 00f0: 78 74 65 72 6e 61 6c 2c 63 6e 3d 61 75 74 68 xternal,cn=auth ldap_write: want=255, written=255 0000: 30 81 fc 02 01 13 63 81 9c 04 10 64 63 3d 7a 69 0.....c....dc=zi 0010: 76 69 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 vios,dc=net..... 0020: 00 02 01 00 02 01 00 01 01 00 a3 1b 04 0b 6f 62 ..............ob 0030: 6a 65 63 74 43 6c 61 73 73 04 0c 70 6f 73 69 78 jectClass..posix 0040: 41 63 63 6f 75 6e 74 30 5c 04 03 75 69 64 04 0c Account0\..uid.. 0050: 75 73 65 72 50 61 73 73 77 6f 72 64 04 09 75 69 userPassword..ui 0060: 64 4e 75 6d 62 65 72 04 09 67 69 64 4e 75 6d 62 dNumber..gidNumb 0070: 65 72 04 05 67 65 63 6f 73 04 02 63 6e 04 0d 68 er..gecos..cn..h 0080: 6f 6d 65 44 69 72 65 63 74 6f 72 79 04 0a 6c 6f omeDirectory..lo 0090: 67 69 6e 53 68 65 6c 6c 04 0b 6f 62 6a 65 63 74 ginShell..object 00a0: 43 6c 61 73 73 a0 58 30 56 04 18 32 2e 31 36 2e Class.X0V..2.16. 00b0: 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 00c0: 2e 31 38 04 3a 64 6e 3a 67 69 64 4e 75 6d 62 65 .18.:dn:gidNumbe 00d0: 72 3d 30 2b 75 69 64 4e 75 6d 62 65 72 3d 30 2c r=0+uidNumber=0, 00e0: 63 6e 3d 70 65 65 72 63 72 65 64 2c 63 6e 3d 65 cn=peercred,cn=e 00f0: 78 74 65 72 6e 61 6c 2c 63 6e 3d 61 75 74 68 xternal,cn=auth ldap_result ld 0x9398980 msgid 19 wait4msg ld 0x9398980 msgid 19 (timeout 100000 usec) wait4msg continue ld 0x9398980 msgid 19 all 0 ** ld 0x9398980 Connections: * host: dev03.zivios.net port: 389 (default) refcnt: 2 status: Connected last used: Tue Aug 31 20:07:02 2010 ** ld 0x9398980 Outstanding Requests: * msgid 19, origid 19, status InProgress outstanding referrals 0, parent count 0 ld 0x9398980 request count 1 (abandoned 0) ** ld 0x9398980 Response Queue: Empty ld 0x9398980 response count 0 ldap_chkResponseList ld 0x9398980 msgid 19 all 0 ldap_chkResponseList returns ld 0x9398980 NULL ldap_int_select read1msg: ld 0x9398980 msgid 19 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 37 02 01 13 65 32 0a 07...e2. ldap_read: want=49, got=49 0000: 01 7b 04 00 04 2b 61 6e 6f 6e 79 6d 6f 75 73 20 .{...+anonymous 0010: 70 72 6f 78 69 65 64 20 61 75 74 68 6f 72 69 7a proxied authoriz 0020: 61 74 69 6f 6e 20 6e 6f 74 20 61 6c 6c 6f 77 65 ation not allowe 0030: 64 d ber_get_next: tag 0x30 len 55 contents: ber_dump: buf=0x93988f0 ptr=0x93988f0 end=0x9398927 len=55 0000: 02 01 13 65 32 0a 01 7b 04 00 04 2b 61 6e 6f 6e ...e2..{...+anon 0010: 79 6d 6f 75 73 20 70 72 6f 78 69 65 64 20 61 75 ymous proxied au 0020: 74 68 6f 72 69 7a 61 74 69 6f 6e 20 6e 6f 74 20 thorization not 0030: 61 6c 6c 6f 77 65 64 allowed read1msg: ld 0x9398980 msgid 19 message type search-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x93988f0 ptr=0x93988f3 end=0x9398927 len=52 0000: 65 32 0a 01 7b 04 00 04 2b 61 6e 6f 6e 79 6d 6f e2..{...+anonymo 0010: 75 73 20 70 72 6f 78 69 65 64 20 61 75 74 68 6f us proxied autho 0020: 72 69 7a 61 74 69 6f 6e 20 6e 6f 74 20 61 6c 6c rization not all 0030: 6f 77 65 64 owed ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 19 read1msg: ld 0x9398980 0 new referrals read1msg: mark request completed, ld 0x9398980 msgid 19 request done: ld 0x9398980 msgid 19 res_errno: 123, res_error: <anonymous proxied authorization not allowed>, res_matched: <> ldap_free_request (origid 19, msgid 19) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x93988f0 ptr=0x93988f3 end=0x9398927 len=52 0000: 65 32 0a 01 7b 04 00 04 2b 61 6e 6f 6e 79 6d 6f e2..{...+anonymo 0010: 75 73 20 70 72 6f 78 69 65 64 20 61 75 74 68 6f us proxied autho 0020: 72 69 7a 61 74 69 6f 6e 20 6e 6f 74 20 61 6c 6c rization not all 0030: 6f 77 65 64 owed ber_scanf fmt (}) ber: ber_dump: buf=0x93988f0 ptr=0x9398927 end=0x9398927 len=0 ldap_msgfree send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=123 matched="" text="anonymous proxied authorization not allowed" ---- The primary server log shows only one line: Aug 31 20:13:53 dev03 slapd[32705]: conn=1604 op=19 do_search: get_ctrls failed ---- I am not sure why an anonymous request is made by back-ldap -- probably my lack of understanding on how it should be configured. If anyone can point out where I am going wrong, it would be greatly appreciated. Mustafa.

2 8

Defining a password attributetype
by Rob Tanner 06 Sep '10

06 Sep '10

Hi, I need to define a secondary password attribute and I¹m not sure what to enter in the schema. Is the syntax oid exclusively for searching and therefore, can I omit it (I¹m not going to be searching on the password)? Or is the synoid also used for defining how the attribute is stored? So far, what I have is: attributetype ( 1.3.6.1.4.1.6459.10.2.213 NAME 'tempPassword' DESC 'Temporary password used for resets only' EQUALITY ?? SYNTAX ?? SINGLE-VALUE ) The attribute will be SHA encrypted digest encoded as Base64 (same as the standard userPassword attribute). Any guidance on the schema definition would be most appreciated. Thanks, Rob Rob Tanner UNIX Services Manager Linfield College, McMinnville Oregon

4 7

Invitation to connect on LinkedIn
by Vinay Jain 06 Sep '10

06 Sep '10

LinkedIn ------------Vinay Jain requested to add you as a connection on LinkedIn: ------------------------------------------ Edward, I'd like to add you to my professional network on LinkedIn. - Vinay Accept invitation from Vinay Jain http://www.linkedin.com/e/-48cabe-gdr321y2-1a/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Vinay Jain http://www.linkedin.com/e/-48cabe-gdr321y2-1a/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ Why might connecting with Vinay Jain be a good idea? People Vinay Jain knows can discover your profile: Connecting to Vinay Jain will attract the attention of LinkedIn users. See who's been viewing your profile: http://www.linkedin.com/e/-48cabe-gdr321y2-1a/wvp/inv18_wvmp/ ------ (c) 2010, LinkedIn Corporation

1 0

Can't start replication
by Alister Forbes 06 Sep '10

06 Sep '10

All, My situation is that I'm trying to get replication working between two instances of openldap 2.4.23, both running on RHEL5, both built with the same options, and db built under them with the same options, and both OS instances are the same (cloned VMs) I can see the two slapd's trying to communicate, but athough the passwords supplied in 'credentials' are definitely correct, I keep seeing the err=49 in the logs below I've been struggling with this for days now.. can anyone give me a hint what I've messed up? Also, I'm not sure if it's related, but I now can't change anything in the servers configs directly, I keep getting - ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I think this is the behaviour you would expect when the server was a syncrepl slave, but these are supposed to be multi-mastered. Any help, greatfully received Alister output of ldapsearch: # {0}config, config dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=ldap://10.211.55.8 binddn="cn=config" bindmet hod=simple credentials=cisco123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://10.211.55.11 binddn="cn=config" bindme thod=simple credentials=cisco123 searchbase="cn=config" type=refreshAndPersis t retry="5 5 300 5" timeout=1 Sep 3 14:08:59 rhel-lnx1 slapd[12715]: slap_client_connect: URI=ldap://10.211.55.11 DN="cn=config" ldap_sasl_bind_s failed (49) Sep 3 14:08:59 rhel-lnx1 slapd[12715]: do_syncrepl: rid=002 rc 49 retrying (1 retries left) Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 fd=9 ACCEPT from IP=10.211.55.11:33025 (IP=0.0.0.0:389) Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 op=0 BIND dn="cn=config" method=128 Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 op=0 RESULT tag=97 err=49 text= Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 op=1 UNBIND Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 fd=9 closed Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 fd=11 ACCEPT from IP=10.211.55.8:33001 (IP=0.0.0.0:389) Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 op=0 BIND dn="cn=config" method=128 Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 op=0 RESULT tag=97 err=49 text= Sep 3 14:09:04 rhel-lnx1 slapd[12715]: slap_client_connect: URI=ldap://10.211.55.8 DN="cn=config" ldap_sasl_bind_s failed (49) Sep 3 14:09:04 rhel-lnx1 slapd[12715]: do_syncrepl: rid=001 rc 49 retrying Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 op=1 UNBIND Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 fd=11 closed Sep 3 14:09:04 rhel-lnx1 slapd[12715]: slap_client_connect: URI=ldap://10.211.55.11 DN="cn=config" ldap_sasl_bind_s failed (49) Sep 3 14:09:04 rhel-lnx1 slapd[12715]: do_syncrepl: rid=002 rc 49 retrying Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 fd=9 ACCEPT from IP=10.211.55.11:33027 (IP=0.0.0.0:389) Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 op=0 BIND dn="cn=config" method=128 Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 op=0 RESULT tag=97 err=49 text= Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 op=1 UNBIND Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 fd=9 closed -- Alister Forbes TACSUNS _.|._.|._ Cisco Systems Please avoid sending me Word or PowerPoint attachments. See - http://www.gnu.org/philosophy/no-word-attachments.html

3 6

[Fwd: PAM not warning for password expiration]
by Dannie Obbink 06 Sep '10

06 Sep '10

-------- Forwarded Message -------- > From: Obbink, D. (Dannie) <dannie.obbink(a)vtspn.nl> > To: openldap-technical(a)openldap.org > Subject: PAM not warning for password expiration > Date: Thu, 22 Jul 2010 19:29:36 +0200 > > When users with an expired account try to log on to an application > making a bind using the user's own credentials, everything works as > expected; users cannot login, access gets denied. In the slapd > logging, the following message is displayed: > > Jul 21 14:06:25 slapd2.4[27182]: ppolicy_bind: Entry uid=<user> has an > expired password: 0 grace logins > > But when trying to log into PAM (ssh, su etc.), there is no warning > displayed the account is expired. The user is also allowed to login > normally. > > I've been Googling for a couple of days now, and can't really find the > culprit. > > I was especially interested in this thread: > http://www.openldap.org/lists/openldap-technical/201003/msg00197.html > > So, I've set pwdExpireWarning to 1 second less then pwdMaxAge. > > When I try to bind directly, such as with an ldapsearch, the logging > shows > > Jul 22 15:31:56 slapd2.4[27182]: ppolicy_bind: Setting warning for > password expiry for uid=<user> = 4318121 seconds > > So, that seems to be correct. > But, when logging in via PAM, the log does not display the "setting > warning". > > <SNIP> > Thanks you for any responses, > Dannie Obbink Hello list, Well, I finally found a workaround which "works for me"; use SSSD (found in the EPEL repos for Redhat / Centos / Fedora and standard for RHEL6). SSSD, unlike pam_ldap, IS nice enough to warn me for impending password expiry. I found multiple bugs about this (really helps if you know what to search) such as https://bugzilla.redhat.com/show_bug.cgi?id=190256 and http://bugs.centos.org/view.php?id=4468&nbn=5 I just wanted to share with you all that this definitely looks like a pam_ldap bug. Sincerely, Dannie Obbink -------------------------Disclaimer------------------------------- De informatie verzonden met dit e-mailbericht (en bijlagen) is uitsluitend bestemd voor de geadresseerde(n) en zij die van de geadresseerde(n) toestemming kregen dit bericht te lezen. Gebruik door anderen dan geadresseerde(n) is verboden. De informatie in dit e-mailbericht (en bijlagen) kan vertrouwelijk van aard zijn en kan binnen het bereik vallen van een geheimhoudingsplicht en een verschoningsrecht. -------------------------------------------------------------------

2 1

Password history configuration for ldap users.
by Meghanand Acharekar 06 Sep '10

06 Sep '10

Hello, I have configured openldap server on RHEL 5.4 I also want to enforce strong password policies for my ldap users. for which i configured pam module on each ldap client in following way. (/etc/pam.d/system-auth) #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_tally.so onerr=fail deny=5 unlock_time=300 auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 \ reject_username password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5 password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session optional pam_mkhomedir.so skel=/etc/skel umask=0066 I am having following problems with my configuration. 1. Although configured password history (pam_unix.so remember =5) is not working for ldap users, while other password policies (pam_cracklib,pam_tally) are working fine. 2. I also observed that I can't change/set any users password as root user (using passwd username). Following is my ldap client configuration file (ldap.conf). base dc=mycomp,dc=com bind_timelimit 120 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm pam_check_host_attr pam_password md5 ssl no timelimit 120 tls_cacertdir /etc/openldap/cacerts uri ldap://10.0.119.36 For further troubleshooting I observer my /var/log/secure file while changing ldap user's passwod. passwd: pam_unix(passwd:chauthtok): user "username" does not exist in /etc/passwd but #getent passwd show me the username. Thanks in advance. -- Regards, Meghanand N. Acharekar " A proud GNU\Linux User " Reg Linux User #397975 ------------------------------------------ I was born free! No Gates and Windows can restrict my Freedom !!!

2 2

solaris 10 as client to openldap
by Isaac Hailperin 03 Sep '10

03 Sep '10

Hi, I am trying to set up an solaris 10 ldap client to work with an openldap server. The server serves the following profile: dn: cn=solarisbox,ou=profile,dc=acme,dc=de bindTimeLimit: 10 credentialLevel: anonymous cn: solarisbox profileTTL: 43200 searchTimeLimit: 30 defaultSearchScope: sub followReferrals: TRUE authenticationMethod: simple defaultSearchBase: dc=acme,dc=de objectClass: top objectClass: DUAConfigProfile defaultServerList: 192.168.0.5 On the solaris box, I issue: ldapclient -v init -a profileName=solarisbox 192.168.0.5 Parsing profileName=solarisbox Arguments parsed: profileName: solarisbox defaultServerList: 192.168.0.5 Handling init option About to configure machine by downloading a profile findBaseDN: begins findBaseDN: ldap not running findBaseDN: calling __ns_ldap_default_config() found 1 namingcontexts findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=acme.de))" rootDN[0] dc=acme,dc=de found baseDN dc=acme,dc=de for domain acme.de Proxy DN: NULL Proxy password: NULL Credential level: 0 Authentication method: 1 No proxyDN/proxyPassword required Shadow Update is not enabled, no adminDN/adminPassword is required. About to modify this machines configuration by writing the files Stopping network services Stopping sendmail [...] restart: milestone/name-services:default... success Error resetting system. Recovering old system settings. Stopping network services Stopping sendmail stop: sleep 100000 microseconds [...] top: network/ldap/client:default... restoring from maintenance state stop: network/ldap/client:default... failed: required constraint not met Stopping ldap failed with (1) Error (1) while stopping services during reset recover: stat(/var/ldap/restore/defaultdomain)=0 [...] I am not very familiar with solaris, so I just drop a few other things that I found that seemed related: cat /var/ldap/cachemgr.log [...] Thu Sep 2 17:02:19.4557 Error: Unable to read '/var/ldap/ldap_client_file': Configuration Error: No entry for 'NS_LDAP_BINDDN' found Thu Sep 2 17:02:19.4601 detachfromtty(): child failed (rc = 255). Thu Sep 2 17:32:56.9181 Starting ldap_cachemgr, logfile /var/ldap/cachemgr.log [...] I can confirm that /var/ldap/ldap_client_file does not exist. grep ldap /var/svc/log/* /var/svc/log/network-ldap-client:default.log:[ Sep 2 17:02:19 Executing start m ethod ("/lib/svc/method/ldap-client start") ] /var/svc/log/network-ldap-client:default.log:/usr/lib/ldap/ldap_cachemgr: failed . Please see syslog for details. /var/svc/log/svc.startd.log:Sep 2 17:32:57/458 ERROR: svc:/network/ldap/client: default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. /var/svc/log/svc.startd.log:Sep 2 17:32:57/458: network/ldap/client:default fai led: transitioned to maintenance (see 'svcs -xv' for details) cat /var/adm/messages [...] Sep 2 17:32:56 unknown ldap_cachemgr[1134]: [ID 293258 daemon.error] libsldap: Status: 0 Mesg: Configuration Error: No entry for 'NS_LDAP_BINDDN' found Sep 2 17:32:56 unknown ldap_cachemgr[1133]: [ID 703877 daemon.error] ldap_cachemgr: failed (rc = 255). Sep 2 17:32:57 unknown svc.startd[7]: [ID 652011 daemon.warning] svc:/network/ldap/client:default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. [...] I had a look at another solaris 10 machine (which I did not set up). The file /var/ldap/ldap_client_file exists, but has no entry 'NS_LDAP_BINDDN'. Also, I can't find some sort of bindDN option to ldapclient, nor can I find an attribute of that kind for the profile. Any hints on how to get this working? Isaac

1 1

OID für caseExactIA5SubstringsMatch?
by Keutel, Jochen 02 Sep '10

02 Sep '10

Hello, there are 6 matching rules for IA5 strings: - caseExactIA5Match - caseIgnoreIA5Match - caseExactIA5SubstringsMatch - caseIgnoreIA5SubstringsMatch - caseExactIA5OrderingMatch - caseIgnoreIA5OrderingMatch Only three of them are defined in RFC4517: - caseExactIA5Match (1.3.6.1.4.1.1466.109.114.1) - caseIgnoreIA5Match (1.3.6.1.4.1.1466.109.114.2) - caseIgnoreIA5SubstringsMatch (1.3.6.1.4.1.1466.109.114.3) What are the OIDs for the other three matching rules? - in OpenLDAP - is there a standard? Regards, Jochen Keutel.

4 5

Re: custom hostname for openldap/sasl is not working
by Zaar Hai 02 Sep '10

02 Sep '10

On Thu, Sep 2, 2010 at 1:22 AM, Bill MacAllister <whm(a)stanford.edu> wrote: > > Simon Wilkinson discussed the problem on the Heimdal list. > > The problem is that both the client and the server must have a > matching idea of the service principal to use in establishing the > GSSAPI connection. > > The client will use ldap/ldap.uvm.edu, as that's the only name it > knows the server by. However, the server will end up using > ldap/hostname() and therefore the two won't match, and you'll get > these errors. So what sasl-host directive is good for? It does something in fact - if I enable it and set it to ldap.example.com, GSSAPI auth stop working with the same error. Also, I've tried to set server hostname to "ldap", and hostname --fqdn returned ldap.example.com, but this did not help either. -- Zaar

2 1

Re: Unix authentication in corporate AD
by Dan White 02 Sep '10

02 Sep '10

On 1/09/10 5:12 -0500, Dan White wrote: >On 01/09/10 12:05 -0400, Edsall, William (WJ) wrote: >>Hello, Just a few questions regarding authenticating OpenLDAP (centos >>5.4) to windows active directory. >> >>I'm able to bind, I've confirmed this by changing the bind password, and >>then the bind attempt fails. However I'm unable to authenticate. > >Could you clarify a few items? > >Are you binding directly to an OpenLDAP server or an Active Directory >Server? > >Which password are you changing, the user's password in Active Directory? > >>My attempt is always as follows: su: user blabla does not exist > >With regards to OpenLDAP, a successful bind is a success authentication. > >With something like su, your trouble may be related to a 3rd party PAM or >NSS module. How does su authenticate in your environment? On 02/09/10 10:25 -0400, Edsall, William (WJ) wrote: >Hello, > I am binding to an Active Directory server. > >When I say I change the password for testing, I'm changing the bind >password in the ldap.conf file. > >I believe PAM is using the ldap module: >passwd: files ldap >shadow: files ldap >group: files ldap > >The reason I used the binddn and bind password is because I know our >active directory setup does not allow anonymous binding. So as I understand it, you are not using the OpenLDAP server, but the OpenLDAP libraries in conjunction with a PAM ldap module. Do you know which PAM module you are using? The PADL one? If so, you may want to pose this problem on the pamldap(a)padl.com mailing list, or you could post a sanitized copy of your ldap configuration here to see if someone might recognize a problem. A general trouble shooting tip would be to find out what query your PAM ldap module is submitting to the Active Directory server, and attempting to reproduce it with an ldapwhoami command, and playing with the base/scope/filter settings until you get the expected response. -- Dan White

1 0

Unix authentication in corporate AD
by Edsall, William (WJ) 02 Sep '10

02 Sep '10

Hello, Just a few questions regarding authenticating OpenLDAP (centos 5.4) to windows active directory. I'm able to bind, I've confirmed this by changing the bind password, and then the bind attempt fails. However I'm unable to authenticate. My attempt is always as follows: su: user blabla does not exist No errors end up in the messages log. My question is .. could this be because the active directory I'm trying to authenticate against doesn't have any windows services for unix installed? Should that even matter if I can bind? _______________________________________ William J. Edsall

3 2

About Installation
by Murat Can Tuna 02 Sep '10

02 Sep '10

Hi, On every ubuntu introduction there is written "The installation process will prompt you for the LDAP directory admin password and confirmation." But I don't get such a prompt. What am I missing? I logged in over ssh, could it be the reason? Is there any way to give my password manually? Also dpkg-reconfigure slapd doesn't bring something, it asks just 3 questions about ldapv2 protocol and so. But on my own computer at home there isn't such a problem, I installed and configured everything without any problem. this is the version: DISTRIB_ID=Ubuntu DISTRIB_RELEASE=9.10 DISTRIB_CODENAME=karmic DISTRIB_DESCRIPTION="Ubuntu 9.10" Thanks in Advance Murat Can Tuna

1 1

custom hostname for openldap/sasl is not working
by Zaar Hai 02 Sep '10

02 Sep '10

Good day, dear list! I'm trying to setup SASL GSSAPI authentication for openldap that listens on hostname different from the machine hostname it runs on. openldap runs on server inka.example.com. ldap/inka/example.com principal is added to ldap's keytab file. This command works just fine: ldapsearch -Y GSSAPI -H 'ldap://inka.example.com' Now: * I've added second IP to the inka.example.com * Added A record for ldap.example.com to point to that IP and setup corresponding PTR record. * Created ldap/ldap.example.com principal and added it ldap's keytab. * Even set openldap to listen only on ldap.example.com IP. But the command ldapsearch -Y GSSAPI -H 'ldap://ldap.example.com' fails with the following error in ldap log: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Wrong principal in request) I see that client successfully obtains ticket for ldap/ldap.example.com(a)EXAMPLE.COM I've tried to set sasl-host to ldap.example.com and sasl-realm to EXAMPLE.COM in slapd.conf - did not help. I've even tried to do "hostname ldap" on inka.example.com and restart slapd - same error. >From what I understand, the slapd daemon will try, before connecting the KDC server, to read the keytab file and get the key of the principal ldap/<sasl-host>#<sasl-realm>, so it looks like I'm doing the right thing, but it does not work. System: Debian testing. slapd-2.4.17-2.1 sasl-2.1.23.dfsg1-5 MIT kerberos 1.8.3+dfsg~beta1-1 Thank you in advance for help, -- Zaar -- Zaar

2 1

TLS fails
by Frederik Bosch 01 Sep '10

01 Sep '10

After getting my ACL right (thanks Dieter!), I have problems installing an official certificate. I bought a certificate at RapidSSL. Starting slapd gives me the following error. TLS init def ctx failed: -69 This error is thrown in openldap 2.4.17. Since I am on debian, slapd is compiled against GnuTLS. When I was using 2.4.11 I had another error: TLS init def ctx failed: -207 When I had a self-signed certificate I had no trouble. What could be wrong?

4 7

RE: Getting Solaris to use Openldap
by Stuart Cherrington 01 Sep '10

01 Sep '10

> Date: Fri, 27 Aug 2010 21:33:42 +1200 > From: ian(a)ianshome.com > To: stuart_cherrington(a)hotmail.co.uk > Subject: Re: Getting Solaris to use Openldap > > On 08/27/10 08:48 PM, Stuart Cherrington wrote: > > Hi, > > > > I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients > > to use the master by use of the /etc/ldap.conf file. I'm now trying to > > get a SOlaris 10 client to use the master by initialising with the > > default profileName. If I run: > > > > ldapclient -v init -a proxypassword=xxxxx -a > > proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a > > domainname=ldn.sw.com 10.2.250.15 > > > I also add a -a profileName=default Shouldn't need to add this as ldapclient takes 'default' as the default profilename if not specified. I did try it with this anyway but got same error. > > > So the 2 errors are the *NOTFOUND nisDomainObject *which is there when > > I check on the master: > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b > > dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > > > # ldn.sw.com > > dn: dc=ldn,dc=sw,dc=com > > dc: ldn > > o: ldn > > associatedDomain: ldn.sw.com > > nisDomain: ldn.sw.com > > objectClass: dcObject > > objectClass: organization > > objectClass: domainRelatedObject > > *objectClass: nisDomainObject* > > objectClass: top > > > That looks OK. > > > > The other error is 'Failed to find defaultSearchBase for domain > > ldn.sw.com' > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b > > cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > Do you have a cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com entry? Yeh [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx -b cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # proxyagent, profile, ldn.sw.com dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com cn: proxyagent sn: proxyagent objectClass: top objectClass: person userPassword:: e0NSWVBUfXYuTWpqUDJEb3lpMXc= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 > > > # default, profile, ldn.sw.com > > dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com > > *defaultSearchBase: dc=ldn,dc=sw,dc=com* > > authenticationMethod: simple > > followReferrals: TRUE > > profileTTL: 43200 > > searchTimeLimit: 30 > > objectClass: DUAConfigProfile > > defaultServerList: 10.2.250.15 > > credentialLevel: proxy > > cn: default > > defaultSearchScope: one > > You should add > > serviceSearchDescriptor: passwd:<people base> > serviceSearchDescriptor: group:<group base> I initially had these (and one for shadow) but they didn't make any difference the error, but I expect I'll need them when its in operation. > > -- > Ian. >

3 7

Re: TLS fails
by Marc Patermann 01 Sep '10

01 Sep '10

Frederik, no TOFU, please. :) Frederik Bosch schrieb am 01.09.2010 10:23 Uhr: > Compiling 2.4.17 with OpenSSL was more succesful than on 2.4.11. I think > that's a Debian issue. Anyway, I have my server up and running! Thanks a > lot Dieter for answering all my questions. > > But I have a minor question left. Each time I restart slapd I have to > enter the PEM pass phrase. Is there a way to remember or not prompt for > the passphrase? You have to remove the passphrase from the PEM file. i.e.: http://www.openssl.org/docs/apps/rsa.html EXAMPLES To remove the pass phrase on an RSA private key: openssl rsa -in key.pem -out keyout.pem Marc

1 0

Re: OpenLDAP to replace Oracle Internet Directory
by Matheus Morais 30 Aug '10

30 Aug '10

Hi Gavin, Sorry for the late reply, I need to organize my mail box, I just not seen this email! On Mon, Jul 26, 2010 at 2:24 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > > I want thank every one responsible to keep OpenLDAP project with that > high > > level of quality and I am really proud about that kind of quality has > been > > produced by a free software project (free as in freedom). > > Excellent news! How is it going now? Did you use our docs to help you? > We're doing really well at this time. Right now we're waiting for the dev team to correct one of our LDAP API which was using substring search for distinguishedName attributes and that works on Oracle Internet Directory but as RFC 2256 say, section 5.50 more precisely, the 'client must not assume that LDAP servers are capable of performing attribute subtyping'. They are testing and after put on production we will be ready to change the last systems which still using Oralce Internet Directory. I most used the Administrator's Guide for version 2.4 and all the manuals available. I think the documentation is very complete in general but could be improved in some points, like the session of Monitor backend for example. I also would be happy if we had a portuguese version of Admin's Guide. Since I'm not a developer I could help on the documention at my spare time. I would be glad if I could help in some aspect. > Do you have any suggestions for improvements to the docs? > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > Thanks, Matheus Morais!

2 1

I can't see my /etc/ldap/slapd.conf file after reinstall
by Eric KOM 28 Aug '10

28 Aug '10

Hi Dear Team! Please, I got problem with my OpenLDAP server on Debian Testing. I try to purge slapd package with aptitude purge slapd and remove all files and directories with rm on /etc/ldap/. after reinstall slapd, I can't see the main configuration file /etc/ldap/slapd.conf? but the server is running. Thank you in advance. -- Yours truly, Eric KOM 110 LAWN STREET ROSETTENVILLE 2190 JOHANNESBURG SOUTH AFRICA Phone: +27 (0) 788 791 334 Fax: +27 (0) 865 563 009 E-mail: erickom(a)namekom.co.za Websites: www.erickom.co.za | www.namekom.co.za/erickom | www.namekom.co.za

5 11

to much archive logs
by isso2＠gmx.de 28 Aug '10

28 Aug '10

Hello team, our openldap-server (OS: Redhat 5) was succesfully installed and it works. But sometimes it gets out of control, that means: every 3 minutes it generates an archive-log. Shutdown and start is not successfully. We have do to a db_recover. Any idea ? Thanks a lot. -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 3

syncrepl help
by Adam Cassar 28 Aug '10

28 Aug '10

Hi All, I would appreciate some insight with a syncrepl issue that I have. The scenario is as follows: (1) LDAP master running debian slapd v2.3.30 replicating using syncrepl to (2) LDAP master running debian slapd v2.4.11 The initial data for this node was seeded using slapcat/slapadd due to the db size. This is replicating via syncrepl to (3) LDAP slave running debian slapd v2.4.11 On (3) the slave I am receiving the error: do_syncrep2: cookie=rid=001,csn=20100825064231Z#000000#00#000000 do_syncrep2: rid=001 CSN too old, ignoring 20100825064231Z#000000#00#000000 for all replication events that are being received. What I am trying to achieve is to deprecate server (1) with as little downtime as possible, server (2) becomes the new master and (3) the new slave Replication between 1 & 2 works correctly but not between 2 & 3. The time is correct on the servers. Server (3) database is seeded using syncrepl. Configurations for 1, 2 & 3 are attached.

2 2

Supported formats of server/client certificate
by Ondrej Moriš 27 Aug '10

27 Aug '10

Hi, I am wondering what formats of server/client x.509 certificates are supported by OpenLDAP? I see that PEM is supported, but what about other formats like binary DER, PKCS#7, PKCS#12? I've tried to find answer in documentation, but it said that CA cert should be given in PEM and nothing about server/client certs. Any help greatly appreciated! -- Ondrej Moriš

2 1

Re: replicate two branches?
by Marc Patermann 27 Aug '10

27 Aug '10

Isaac, Isaac Hailperin schrieb am 27.08.2010 12:49 Uhr: > On 08/27/2010 11:12 AM, Marc Patermann wrote: >> Isaac Hailperin schrieb am 25.08.2010 17:44 Uhr: >> >>> I was wondering whether there is a way to replicate more then one >>> branch. I tried to replicate two branches using two syncrepl sections in >>> slapd.conf with different rid, but that got me an error >>> "syncrepl: database already shadowed" >>> So I suppose its at least not that easy. >> You are speaking about the provider, right? > No, the error occured on the slave side, after I put two syncrepl > directives in slapd.conf. > >> If you have o=foo with branch a ou=a,o=foo and branch b in ou=b,o=foo, >> what do you want to achieve then? Replicate branch a to server a and >> branch b to server b, or what? > I have dc=foo with ou=bar,dc=foo ou=rab,dc=foo and ou=oof,dc=foo. > I want to replicate ou=bar and ou=rab to another server, but not ou=oof. Where syncrpl is a database option, you could define a database for each branch in the consumer and define the searchbase corresponding to each branch (if you cannot reduce the replication data to a branch by setting a filter, where "dn= ..." is not a valid filter). database bdb suffix "ou=bar,dc=foo" syncrepl rid=1 searchbase=ou=bar,dc=foo ... directory ... database bdb suffix "ou=rab,dc=foo" syncrepl rid=1 searchbase=ou=rab,dc=foo ... directory ... Marc

1 0

Re: replicate two branches?
by Marc Patermann 27 Aug '10

27 Aug '10

Isaac, Isaac Hailperin schrieb am 25.08.2010 17:44 Uhr: > I was wondering whether there is a way to replicate more then one > branch. I tried to replicate two branches using two syncrepl sections in > slapd.conf with different rid, but that got me an error > "syncrepl: database already shadowed" > So I suppose its at least not that easy. You are speaking about the provider, right? If you have o=foo with branch a ou=a,o=foo and branch b in ou=b,o=foo, what do you want to achieve then? Replicate branch a to server a and branch b to server b, or what? You may have to describe your problem a bit more in detail. Marc

2 1

Getting Solaris to use Openldap
by Stuart Cherrington 27 Aug '10

27 Aug '10

Hi, I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients to use the master by use of the /etc/ldap.conf file. I'm now trying to get a SOlaris 10 client to use the master by initialising with the default profileName. If I run: ldapclient -v init -a proxypassword=xxxxx -a proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a domainname=ldn.sw.com 10.2.250.15 This errors with Parsing proxypassword=5wap5proxy Parsing proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Parsing domainname=ldn.sw.com Arguments parsed: domainName: ldn.sw.com proxyDN: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com proxyPassword: xxxxx defaultServerList: 10.2.250.15 Handling init option About to configure machine by downloading a profile No profile specified. Using "default" findBaseDN: begins findBaseDN: ldap not running findBaseDN: calling __ns_ldap_default_config() found 1 namingcontexts findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=ldn.sw.com))" rootDN[0] dc=ldn,dc=sw,dc=com NOTFOUND:Could not find the nisDomainObject for DN dc=ldn,dc=sw,dc=com found_cxt = -1 findBaseDN: Err exit Failed to find defaultSearchBase for domain ldn.sw.com So the 2 errors are the NOTFOUND nisDomainObject which is there when I check on the master: [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # ldn.sw.com dn: dc=ldn,dc=sw,dc=com dc: ldn o: ldn associatedDomain: ldn.sw.com nisDomain: ldn.sw.com objectClass: dcObject objectClass: organization objectClass: domainRelatedObject objectClass: nisDomainObject objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The other error is 'Failed to find defaultSearchBase for domain ldn.sw.com' [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # default, profile, ldn.sw.com dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com defaultSearchBase: dc=ldn,dc=sw,dc=com authenticationMethod: simple followReferrals: TRUE profileTTL: 43200 searchTimeLimit: 30 objectClass: DUAConfigProfile defaultServerList: 10.2.250.15 credentialLevel: proxy cn: default defaultSearchScope: one # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Obviously I've missed something, anyhelp would be appreciated. Thanks, Stuart.

1 0

tnsnames in openldap
by Stuart Cherrington 27 Aug '10

27 Aug '10

Hi, I was wondering if anyone here has had a good/bad experience of getting Openldap to provision tnsnames lookup for Oracle Databases? We're thinking of removing our current OID implementation which is very old and as I'm already running OpenLDAP 2.4 is makes sense to just roll it from there. I found a VERY useful article at http://oracle-cookies.blogspot.com/2007/01/get-tnsnamesora-from-openldap.ht… which I think will help enormously. Thanks, STuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/195013117/direct/01/

3 2

Re: OpenLDAP as a proxy for Active Directory (missing attributes)
by Marius Flage 27 Aug '10

27 Aug '10

On 08/26/2010 11:10 PM, Mike Olivieri wrote: > However, when I try to search for that same user using ldapsearch, I get > no results. > ldapsearch -x \ > -a always \ > -h fqa-ldap \ > -p 9389 \ > -D "CN=mike0,OU=Service Accounts,dc=myco_ad,dc=mycompany,dc=com" \ > -w "password" \ > -b "DC=MYCO_AD,dc=mycompany,dc=com" \ > "(sAMAccountName=mikeo)" Try omitting the search filter '(sAMAccountName)', do you get any results then? If so, then you need to add the attribute declaration for sAMAccountName to your schema: attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) That's my only guess to this and I'll leave it to the experts if that's not the solution :) - Marius

1 0

access control, groups/organizationalRole
by Frederik Bosch 26 Aug '10

26 Aug '10

Hello, I am trying to setup an access control rule, but failed. All occupants of the objectClass organizationalRole which has a certain location may have read access. How do I setup this rule in slapd.conf? This is my line at the moment. This matches the dn of the occupant. But how do I match the location attribute of the organizationalRole? access to * by group/organizationalRole/roleOccupant="cn=Administrator,dc=example,dc=com" read Thanks in advance, Frederik

2 9

Problem with persistent search in OpenLDAP 2.4.23
by Tom Leach 26 Aug '10

26 Aug '10

I'm trying to write a perl script using PersistentSearch from Net::LDAP::Control::PersistentSearch against a freshly compiled OpenLDAP 2.4.23 server. I've configured/compiled the server with --enable-syncprov=yes and I have N-way multimaster setup and working. In the directory that I'm querying, I have syncrepl and mirrormode configured for the suffix dc=coas,dc=oregonstate,dc=edu. But, when I run the perl script using PersistentSearch I'm getting the following in my slapd log file when I search for something in the base ou=People,dc=coas,dc=oregonstate,dc=edu: slap_global_control: unrecognized control: 2.16.840.1.113730.3.4.3 I'm under the impression that PersistentSearch is enabled by the syncprov overlay so why would I be getting the unknown control message? Any help would be appreciated, I'm hitting dead ends everywhere I look. Tom Leach leach(a)coas.oregonstate.edu

4 11

Re: multi / standby master: incomplete replication after downtime (?) [SOLVED]
by Elmar Marschke 26 Aug '10

26 Aug '10

On 18.08.2010 17:16, Rein Tollevik wrote: > On 08/18/2010 04:28 PM, Elmar Marschke wrote: > >> Here's the logfile of MASTER: >> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ >> ===_BEGIN_CHANGES_WHILE_BOTH_UP_=== >> Aug 18 15:30:04 ldapmaster slapd[8017]: slap_queue_csn: queing >> 0x7f00f317b580 20100818133004.663851Z#000000#000#000000 > > Your ServerID setting is incorrect, and you are using the default > ServerID=0 on both systems. The ServerID is included in the csn value, > the second to last number (#000# here). Ensure that the ServerID URL is > the exact hostname of the systems it runs on, or that slapd is able to > select the correct sid based on its -h listener argument. > > Start slapd with -d config and verify that both logs lines with > differing SID= values. > > Rein > Hi all, thanks to your hints i think i got it working now :) Several details had to be changed. Perhaps someone has similar problems, so in the following i give a detailed description what had to be done in my case. Everything was executed on two freshly out-of-the-box installed openSuSE 11.3 x86_64 with SuSE-shipped openldap 2.4.21. First; according the inaccurate time on my testmachines: i deleted the openSuSE ntp.conf and additionally now i use other ntp servers as timesync source. Complete ntp.conf on ldapmaster and ldapslave now is: ----------------------------------------------------- server ptbtime1.ptb.de prefer server ptbtime2.ptb.de tinker panic 0 driftfile /var/lib/ntp/drift/ntp.drift This results in less different offset values: --------------------------------------------- ldapmaster:/etc/openldap # ntpq -p; ssh ldapslave ntpq -p remote refid offset ======================================== *ptbtime1.ptb.de .PTB. -1.218 +ptbtime2.ptb.de .PTB. -1.305 remote refid offset ========================================== *ptbtime1.ptb.de .PTB. -0.381 +ptbtime2.ptb.de .PTB. 0.203 ldapmaster:/etc/openldap # Second problem: the missing or wrong serverID in the csn values. To make clear what obviously helped i will describe how i create(d) my slapd.d/ online configuration. (My original slapd.conf was taken from the "openldap 2.4" book by Oliver Liebel & John Martin Ungar -- thanks Oliver :)! ------------------------------------------------------------ ldapmaster:/etc/openldap # slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/ hdb_db_open: database "dc=local,dc=site": db_open(/var/lib/ldap//id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=hdb, suffix="dc=local,dc=site"): bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) ------------------------------------------------------------ The following rcldap start every time resulted in: -------------------------------------------------- ldapmaster:/etc/openldap # rcldap start Starting ldap-serverstartproc: exit status of parent of /usr/lib/openldap/slapd: 1 failed ------------------------------------- and in /var/log/messages was written: -------------------------------------- Aug 26 15:47:22 ldapmaster slapd[7805]: @(#) $OpenLDAP: slapd 2.4.21 (Jul 5 2010 13:35:22) $#012#011abuild@build16:/usr/src/packages/BUILD/openldap-2.4.21/servers/slapd Aug 26 15:47:22 ldapmaster slapd[7805]: olcSyncrepl: value #0: <olcSyncrepl> invalid URL Aug 26 15:47:22 ldapmaster slapd[7805]: config error processing olcDatabase={0}config,cn=config: <olcSyncrepl> invalid URL Aug 26 15:47:22 ldapmaster slapd[7805]: slapd stopped. Aug 26 15:47:22 ldapmaster slapd[7805]: connections_destroy: nothing to destroy. I greped for "olcSyncrepl" in slapd.d: --------------------------------------- ldapmaster:/etc/openldap # grep -r olcSyncrepl slapd.d/ slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatc slapd.d/cn=config/cn=schema.ldif: olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN slapd.d/cn=config/olcDatabase={0}config.ldif:olcSyncrepl: rid=003 provider=ldap://ldapmaster.local.site uri="" bindmethod=s slapd.d/cn=config/olcDatabase={0}config.ldif:olcSyncrepl: rid=004 provider=ldap://ldapslave.local.site uri="" bindmethod=si slapd.d/cn=config/olcDatabase={1}hdb.ldif:olcSyncrepl: rid=001 provider=ldap://ldapmaster.local.site uri="" bindmethod=s slapd.d/cn=config/olcDatabase={1}hdb.ldif:olcSyncrepl: rid=002 provider=ldap://ldapslave.local.site uri="" bindmethod=si ldapmaster:/etc/openldap # Some internet research told me, that the empty uri="" should be the problem, and that it would help to remove it. BEFORE i always removed it; and right; starting of openldap worked then. BUT apparently this also leads to the missing serverID in my csn values (respectively that they all had default "000"). NOW i changed those config.ldif and hdb.ldif files from slapd.d (in which grep found the string "olcSyncrepl"), to give uri an appropriate value. Open each file, search for "uri". It's found two times in every file. Before each occurence there's a variable "provider", which is set to something. For example in slapd.d/cn=config/olcDatabase={0}config.ldif : provider=ldap://ldapmaster.local.site uri="" and provider=ldap://ldapslave.local.site uri="" The value of provider ALSO has to be put into uri, that afterwards it looks like: provider=ldap://ldapmaster.local.site uri="ldap://ldapmaster.local.site" and provider=ldap://ldapslave.local.site uri="ldap://ldapslave.local.site" I did it on every machine (no file copy from one to another). After that; "rcldap start" (also) works without problems. But that still was not enough... Third thing to do: additionally on each machine make slapd start with "-h" parameter correctly set; like Rein and Jonathan wrote. According to the SuSE-way of configuration (like it or not, but in this case i don't have a choice ;)) this can be done in /etc/sysconfig/openldap: set OPENLDAP_SLAPD_PARAMS correctly on every machine; e.g. on master: OPENLDAP_SLAPD_PARAMS="-h ldap://ldapmaster.local.site" And, by the way, to make sure that ONLY online configuration style (slapd.d) is used; one can set OPENLDAP_CONFIG_BACKEND from "" to: OPENLDAP_CONFIG_BACKEND="ldap" This all together seems to solve the problem. Now LDAP-Objects can be altered, removed and added on one of both machines while the other one is down; and all changes are replicated as soon as the "downed" machine comes back up again. (At least in my tests until now ;))! Thanks for your time, and best regards.. elmar

1 0

OpenLDAP and Load Balance F5 issue
by Matheus Morais 26 Aug '10

26 Aug '10

Hi there, We were having some performance troubles using OpenLDAP and F5 load balance solution from BigIP at a high concurrent enviroment. We faced the problem for one month after I discovered that those problems didn't happen when applications was pointed directly to OpenLDAP server instead of load balance VIP. After a tcpdump analysis of the packages we realize that are too many ACK comming from each request. Last week we solved the problem unsetting Nagle's algorithm on the load balance virtual server which was causing this issue. So, if you look yourself on a similiar situation, please check the Nagle's algorithm on the F5 configuration! Thanks, Matheus Morais

3 4

Re: Samba, Openldap and ppolicy
by smainklh＠free.fr 26 Aug '10

26 Aug '10

Hi Dieter, I did a "slaptest -f $configfile -F $path" command, here are the results : /etc/ldap/slapd.d/cn=config/cn\=module\{0\}.ldif ---- ... olcModuleLoad: {0}back_bdb olcModuleLoad: {1}ppolicy.la olcModuleLoad: {2}smbk5pwd.la ... /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}bdb/olcOverlay\=\{2\}smbk5pwd.ldif --- dn: olcOverlay={2}smbk5pwd objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig olcOverlay: {2}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdMustChange: 0 olcSmbK5PwdCanChange: 0 structuralObjectClass: olcSmbK5PwdConfig entryUUID: 4fffa030-4543-102f-8b00-5f29b421ba43 creatorsName: cn=config createTimestamp: 20100826095158Z entryCSN: 20100826095158.762397Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100826095158Z I still have the following errors : smbk5pwd: unable to find "krb5KDCEntry" objectClass. Aug 26 11:52:03 deathnote2 slapd[13165]: config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config: <olcSmbK5PwdEnable> handler exited with 1 Aug 26 11:52:03 deathnote2 slapd[13165]: slapd stopped. I thought that if i specify "olcSmbK5PwdEnable" parameter, it doesn't look for the krb5KDCEntry attribute... Thanks for your help, Smaine ----- Mail Original ----- De: "Dieter Kluenter" <dieter(a)dkluenter.de> À: openldap-technical(a)openldap.org Envoyé: Jeudi 26 Août 2010 11h12:47 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: Samba, Openldap and ppolicy smainklh(a)free.fr writes: > Now another error :( > > @(#) $OpenLDAP: slapd 2.4.23 (Aug 24 2010 14:56:29) $ root@myserver:/root/openldap-2.4.23/debian/build/servers/slapd > slapd[11666]: UNKNOWN attributeDescription "OLCSMBK5PWDENABLE" inserted. > slapd[11666]: config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config,olcDatabase={1}bdb,cn=config: The module smbk5pwd has not been loaded > > Old fashion configuration file : > --- > include /etc/ldap/schema/samba.schema > ... > > moduleload smbk5pwd.la > ... > overlay smbk5pwd > smbk5pwd-enable samba > > > > Overlay configuration : > --- > dn: olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcSmbK5PwdConfig > olcOverlay: {2}smbk5pwd > olcSmbK5PwdEnable: samba You didn't provide a cn={x}module,cn=config entry, so most likely you have not added an entry to load the module. -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 5

LDAP backend: schema synchronization?
by Mark J. Reed 26 Aug '10

26 Aug '10

OK, so I've got the ldap backend set up to talk to a couple different servers, and it's working, but I can only see attributes that exist in slapd's local schema. any way to import the schemas of the backends? automatically would be great, manually would be ok... -- Mark J. Reed <markjreed(a)gmail.com>

3 3

Re: Samba, Openldap and ppolicy
by smainklh＠free.fr 26 Aug '10

26 Aug '10

Now another error :( @(#) $OpenLDAP: slapd 2.4.23 (Aug 24 2010 14:56:29) $ root@myserver:/root/openldap-2.4.23/debian/build/servers/slapd slapd[11666]: UNKNOWN attributeDescription "OLCSMBK5PWDENABLE" inserted. slapd[11666]: config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config,olcDatabase={1}bdb,cn=config: Old fashion configuration file : --- include /etc/ldap/schema/samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd smbk5pwd-enable samba Overlay configuration : --- dn: olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig olcOverlay: {2}smbk5pwd olcSmbK5PwdEnable: samba ----- Mail Original ----- De: smainklh(a)free.fr À: smainklh(a)free.fr Cc: openldap-technical(a)openldap.org Envoyé: Jeudi 26 Août 2010 10h12:54 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: Samba, Openldap and ppolicy Ok, now i followed the documentation and configured my slapd server like that : include /etc/ldap/schema/samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd smbk5pwd-enable samba But i still have the following error : config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config: Regards, Smaine Selon smainklh(a)free.fr: > > Hi, > > I already have an openldap server configured with a password policy. > Now, i need to implement a samba server in order to authenticate my alfresco > users. > > I would like to know how to keep my password policy working with these two > authentication services. > I've heard of the smbk5pwd but i don't know how to configure it. > > I upgraded to slapd 2.4.23. > > my slapd configuration : > include samba.schema > ... > moduleload smbk5pwd.la > ... > overlay smbk5pwd > > But when i start the slapd service, it complains that some ObjectClass are > missing. > Maybe Samba needs to be upraded too ? ... > > I need your advices please. > > Regards, > Smaine

2 1

Re: Samba, Openldap and ppolicy
by smainklh＠free.fr 26 Aug '10

26 Aug '10

Ok, now i followed the documentation and configured my slapd server like that : include /etc/ldap/schema/samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd smbk5pwd-enable samba But i still have the following error : config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config: Regards, Smaine Selon smainklh(a)free.fr: > > Hi, > > I already have an openldap server configured with a password policy. > Now, i need to implement a samba server in order to authenticate my alfresco > users. > > I would like to know how to keep my password policy working with these two > authentication services. > I've heard of the smbk5pwd but i don't know how to configure it. > > I upgraded to slapd 2.4.23. > > my slapd configuration : > include samba.schema > ... > moduleload smbk5pwd.la > ... > overlay smbk5pwd > > But when i start the slapd service, it complains that some ObjectClass are > missing. > Maybe Samba needs to be upraded too ? ... > > I need your advices please. > > Regards, > Smaine

1 0

Samba, Openldap and ppolicy
by smainklh＠free.fr 25 Aug '10

25 Aug '10

Hi, I already have an openldap server configured with a password policy. Now, i need to implement a samba server in order to authenticate my alfresco users. I would like to know how to keep my password policy working with these two authentication services. I've heard of the smbk5pwd but i don't know how to configure it. I upgraded to slapd 2.4.23. my slapd configuration : include samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd But when i start the slapd service, it complains that some ObjectClass are missing. Maybe Samba needs to be upraded too ? ... I need your advices please. Regards, Smaine

3 2

filter to find attributes with multiple values
by Tim Gustafson 25 Aug '10

25 Aug '10

Hi, Is there any way to search for records that have multiple attributes? For example, I'd like to know how many users have multiple userPassword values. Is there some filter syntax that can find that out for me? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 2

stats2 and stats level logging
by Derek Yarnell 25 Aug '10

25 Aug '10

Hi, So a while back we had to go away form stats (256) level debugging because it was spiking our Spunk traffic so much and go to stat2 (512). Even now 1 days worth of LDAP logs on one replica is 1.5G. Now the problem is that stat2 never gives a way to map the connection to a host. Is there anyway to do this? We seem to have one host that might be misbehaving in the amounts of ldap queries it is making but I can't exactly pin point it. Thanks, derek Derek Yarnell UNIX Systems Administrator University of Maryland Institute for Advanced Computer Studies

2 1

replicate two branches?
by Isaac Hailperin 25 Aug '10

25 Aug '10

Hi, I was wondering whether there is a way to replicate more then one branch. I tried to replicate two branches using two syncrepl sections in slapd.conf with different rid, but that got me an error "syncrepl: database already shadowed" So I suppose its at least not that easy. The alternative would be to move all the branches into the same subtree and just replicate that subtree. Which raises the question: Is there a simpler way to move branches other then dumping to ldif, do an intelligent search and replace for all the dns, and then add the ldif again? Isaac

1 0

overlay: How to not apply attribute modification to background ?
by Lucas Brasilino 25 Aug '10

25 Aug '10

Hi I'm writing an overlay which it's principal function is being called on 'modify' operation. This function basically see if a given attribute is being modified. If so, it pass it's value to an external daemon through an unix domain socket to store this value in an external database. Of course, when the 'modify' callback ends with SLAP_CB_CONTINUE, the operation continues and the new value is committed to background. This is my problem, I don't want to really modify the attribute value at background.... So, Is there a way to 'abort' modify operation in my overlay without stopping to pass control to other overlays? I saw there's others return values from callbacks, as SLAP_CB_BYPASS and SLAP_CB_FREEME but I'm not sure about it... I guess SLAP_CB_BYPASS do the trick, but I'm not sure. Thanks a lot in advance Lucas Brasilino

2 3

openldap-2.4.23 Segfault with Error number: 0xffffffffffffffff ()
by Yusuf Rajah 24 Aug '10

24 Aug '10

Hi All I am using openldap-2.4.23 which I compiled from source with back-ndb support. I am able to browse the directory and add some data. When I try to add the posixAccount to any entry, even a new one, I get an Error number: 0xffffffffffffffff () . I am using PhpLDAPadmin to manage the data. When I have a look at /var/log/syslog the last three lines are : Aug 24 15:45:24 sms slapd[1406]: conn=1001 op=5 MOD dn="uid=test,ou=UIDs,ou=School Management System" Aug 24 15:45:24 sms slapd[1406]: conn=1001 op=5 MOD attr=cn gidnumber homedirectory objectclass uidnumber Aug 24 15:45:24 sms kernel: [ 3368.265357] slapd[1437]: segfault at 28 ip 00000000004aa995 sp 00007f5b9b78ac10 error 4 in slapd[400000+169000] I am not sure how to tackle this, your pearls of wisdom will be tremendously appreciated. Thank you kindly. Yusuf Rajah

4 6

Unknown objectClass in search filter alters the filter?
by Marius Flage 24 Aug '10

24 Aug '10

Hi! How does OpenLDAP behave when it encounters a search filter with an unknown objectClass? From what I've been able to gather, it translates the search filter into (?objectClass=value), thus yielding the rest of the search invalid. What can I do about this? Either just pass the search as it is, or remove it altogether? The reason I'm asking about this is that I'm setting up OpenLDAP as a proxy for Active Directory. After months of researching I've discovered that the problem lays exactly here - OpenLDAP alters the search filter for object classes it knows nothing about. Example: (| (& (objectClass=group) (member=cn=username,ou=test,dc=example,dc=com) ) (& (objectClass=groupOfNames) (member=cn=username,ou=test,dc=example,dc=com) ) (& (objectClass=groupOfUniqueNames) (uniqueMember=cn=username,ou=test,dc=example,dc=com) ) (& (objectClass=accessGroup) (member=cn=username,ou=test,dc=example,dc=com) ) (& (objectClass=univentionGroup) (uniqueMember=cn=username,ou=test,dc=example,dc=com) ) ) Yields no entries. I've looked at the syslog (loglevel = 256) and I see that the last two clauses have been "translated" into "?objectClass=accessGroup" and "?objectClass=univentionGroup". But if I then remove the last two clauses, like so... (| (& (objectClass=group) (member=cn=username,ou=test,dc=example,dc=com) ) (& (objectClass=groupOfNames) (member=cn=username,ou=test,dc=example,dc=com) ) (& (objectClass=groupOfUniqueNames) (uniqueMember=cn=username,ou=test,dc=example,dc=com) ) ) ... then I get the entries I want back. Problem here is that I'm unable to alter the search filter, since this is generated by a 3rd-party app that I can't change, so I need to fix my OpenLDAP to let this stuff pass through. Any idea? - Marius

3 5

Translating back_ldap config to cn=config format
by Mark J. Reed 24 Aug '10

24 Aug '10

To your mailing list welcome. I here am new... I'm trying to configure an LDAP backend, but the man page is still slapd.conf-style, and the mappings to cn=config I've tried aren't working. For instance, to supply the backend LDAP URL, the man page lists: uri <ldapurl> so I tried this: olcURI: ldap://foo.bar/ and got Aug 24 13:30:36 bottom slapd[2265]: UNKNOWN attributeDescription "OLCURI" inserted. Maybe I'm just missing the objectClass that defines those attributes, but I don't know what that would be. I just have olcDatabaseConfig; I tried olcLdapConfig, but that wasn't recognized as a legal class name. Where can I find the config schema? Any help, pointers to someplace this is actually documented, etc. appreciated. Thanks! -- Mark J. Reed <markjreed(a)gmail.com>

1 1

Re: Openldap2.4.16 performance issue
by William E Jojo 24 Aug '10

24 Aug '10

----- Original Message ----- > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Sent: Saturday, August 21, 2010 3:07:04 AM > Subject: Re: Openldap2.4.16 performance issue > "Singh, Devender (GE Capital, consultant)" <Devender.Singh2(a)ge.com> > writes: > > > Hi Dieter, > > > > Please find the below details: > > > > 1. hardware related > > > > - type of storage - Simply SATA had disk attached. > > > > - raid level, if any- No RAID > > > > - file system of disk(s)- ext3 on LVm > > > > - type of network, 100MB, 1G, 10G > > > > > > > > 2. is this host running on a virtual machine or on bare metal. > > > > - if virtual machine, -Yes, OS installed on VM > > > > -- what type ---Don’t know > > There is nothing suspicious, except for the virtual machine. Your > really should carefully check layout and configuration of this VM, do > not use virtual disks. > Hi Dieter, Could you kindly explain what this means? I've been all over the inter-webs and I'm not finding anything concrete about OpenLDAP and VM's or Databases and VM's in general. The closest I came was about some database latency studies and some VMware propaganda. We are about to launch a master and two replicas (utilizing delta-syncrepl) running in Ubuntu 10.04 on a VMware VSphere ESXi 4.0 cluster with four IBM x3650-M2's (2 Quad Nahalem and 64GB memory each) with virtual disks carved from NFS mounts to all of the VSphere servers in the cluster to facilitate HA and FT - by the VMware book. (BTW, I took one of Howard's old posts to heart and we are following the Ubuntu playbook and we have purchased Canonical 24x7 support/maintenance. :-) ) We have had no problems with this environment in development and get better results than on bare metal with or without RAID. I know that it is recommended that the logs live on another "disk" from the database and RAID is frowned upon, but I have difficulty with a few points: 1) Separate, unprotected disks seems illogical. The last log and the BDB files are necessary to start BDB in slapd, correct? So, if you lose either disk, you're in trouble. Backups are ok, but daily seems too long a time. Seeing as we process new user accounts every 15 minutes, this would not be ideal for us. 2) RAID-1 I can understand having an issue on writes. But what about LUNs in FC from a NetApp 3140? Virtual disks on NFS in VMware? Both of these are in the best practices of both VMware and NetApp documentation. 3) 13-disk 7200RPM SATA RAID-DP (NetApp) is far faster than a single disk, dual diak or RAID-1, so why wouldn't you use SAN/NAS storage? I seriously want to understand the VM concern as it pertains to OpenLDAP. I think more and more people are doing this very thing and will benefit from this discussion. Our database is 86K+ DN's averaging about 40 attributes each. We've tuned the HDB cache to 768MB in a shared memory segment and the pertinent master slapd.conf file shows: shm_key 100 cachesize 200000 idlcachesize 600000 dncachesize 400000 checkpoint 1024 15 . . . # main database . . . index objectClass eq index cn eq,sub index sn eq,sub index gn eq,sub index mail eq,sub index uid eq,sub index displayname sub,eq index memberUid eq,sub index uidNumber eq index gidNumber eq index sambaSID eq index sambaSIDlist eq index sambaDomainName eq index sambaPrimaryGroupSID eq index sambaGroupType eq index entryCSN eq index entryUUID eq index default sub,eq Replicas have identical indexes and shared memory usage. Basically, just running database population tests with full checking turned on, I get the following results: Ubuntu 10.04.1 on all with OpenLDAP 2.4.21/BDB 4.7.25 (all generate 200-10MB log files): IBM x3550 2-quad 5450 16GB, RAID-1 15K 73GB 3.0Gb/s SAS, 86K DN's - 30 minutes IBM x3550 2-quad 5450 16GB, Single 15K 73GB 3.0Gb/s SAS, 86K DN's - 28 minutes IBM x3550 2-quad 5450 16GB, 2-single 15K 73GB (db and logs on separate disks) 3.0Gb/s SAS, 86K DN's - 28 minutes VMware guest 2-vCPU, 3GB memory, 100GB virtual disk on VMware NFS mount of 13-1TB 7200RPM SATA disks in NetApp 3140 - 4 minutes. We can replicate to another VM in 9 minutes and two VMs simultaneously to the same 13-disk aggregate in 13 minutes. Aside from VM clock skew problems, I don't see the benefit of Bare Metal and I'm feeling pretty dumb at the moment. Any insight from you, Quanah and/or Howard is humbly accepted and appreciated - I am here to learn. :-) Thank you, Bill > -Dieter > > -- Dieter Klünter | Systemberatung > sip: 7770535(a)sipgate.de > http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

4 5

Setting up anonymous access for certain objects and attributes ...
by Christopher Koeber 23 Aug '10

23 Aug '10

Hello, I am trying to set up anonymous binding where systems can only see certain objects and subtrees. In addition, I want to have limits on the attributes that can be seen on those objects. Below is my config file but so far only the manager CN can bind. What else do I need to do? Thanks. slapd.conf: ------------------------------------------------------------------------- # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sendmail.schema include /etc/openldap/schema/postfix.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap/openldap # moduleload back_sock.so # moduleload back_shell.so # moduleload back_relay.so # moduleload back_perl.so # moduleload back_passwd.so # moduleload back_null.so # moduleload back_monitor.so # moduleload back_meta.so # moduleload back_ldap.so # moduleload back_dnssrv.so moduleload back_hdb.so # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read # ################################################### # # --- # # Directory Service Access Policy # ################################################### # # Allow folks to read basic attributes from everyone access to dn.subtree="dc=domain,dc=com" attr=displayName,givenName,employeeNumber,mail by anonymous read # ################################################### # # End Security Setup. # ################################################### # access to * by self write by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "dc=domain,dc=com" # <kbyte> <min> checkpoint 32 30 rootdn "cn=Manager,dc=domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw --- # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/openldap-data # Indices to maintain index objectClass eq ------------------------------------------------------------------------- Regards, Christopher Koeber

1 0

Syncrepl REFRESH_PRESENT leads to glue nodes on branch nodes in the tree on the consumer
by Robert Hanson 23 Aug '10

23 Aug '10

Hi. Using 2.4.23, and bdb 4.2.52. I have two nodes, A and B. When I start up the nodes (in either order), B performs a REFRESH_PRESENT phase. In this phase, it executes syncrepl_del_nonpresent(). This identifies a number of nodes that it thinks need to be deleted, and deletes them. Since many of the nodes are non-leaf nodes, instead of deleting them it replaces them with glue nodes. My question is: should I post this as a bug for tracking purposes? What information exactly should I post as a followup to this email so that someone can help me with this issue? I can provide slapcat output for both nodes, and slapd.conf files for both nodes. Where should I post these?

1 0

Re: replication from child to Parent domain
by owen nirvana 23 Aug '10

23 Aug '10

parent is customer """ suffix "dc=SCNCA,dc=ROOTCA" rootdn "cn=admin,dc=SCNCA,dc=ROOTCA" rootpw secret checkpoint 512 30 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ServerID 000 syncrepl rid=001 provider=ldap://${SON_LDAP_ADDRESS}:${SON_LDAP_PORT} type=refreshOnly # five minutes, you should do syncrepl once a day in practice interval=00:01:00:00 searchbase="${SON_BASE}" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="${SON_ADMIN}" credentials=${SON_PASSWD} retry="5 5 300 +" mirrormode on """ son is provider """ suffix "dc=sonCA,dc=SCNCA,dc=ROOTCA" rootdn "cn=admin,dc=sonCA,dc=SCNCA,dc=ROOTCA" rootpw secret checkpoint 512 30 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ServerID 001 """ and son's log is """ <<< dnPrettyNormal: <dc=sonca,dc=scnca,dc=rootca>, <dc=sonca,dc=scnca,dc=rootca> SRCH "dc=sonca,dc=scnca,dc=rootca" 2 0 0 0 0 ber_scanf fmt (m) ber: ber_dump: buf=010E1060 ptr=010E109C end=010E1136 len=154 0000: 87 0b 6f 62 6a 65 63 74 43 6c 61 73 73 30 06 04 ..objectClass0.. 0010: 01 2a 04 01 2b a0 81 82 30 62 04 18 31 2e 33 2e .*..+...0b..1.3. 0020: 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 6.1.4.1.4203.1.9 0030: 2e 31 2e 31 04 46 30 44 0a 01 01 04 3c 72 69 64 .1.1.F0D....<rid 0040: 3d 30 30 31 2c 73 69 64 3d 30 30 30 2c 63 73 6e =001,sid=000,csn 0050: 3d 32 30 31 30 30 38 31 33 30 37 34 38 34 36 2e =20100813074846. 0060: 34 35 37 32 37 39 5a 23 30 30 30 30 30 30 23 30 457279Z#000000#0 0070: 30 30 23 30 30 30 30 30 30 01 01 ff 30 1c 04 17 00#000000...0... 0080: 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 33 37 33 2.16.840.1.11373 0090: 30 2e 33 2e 34 2e 32 01 01 ff 0.3.4.2... filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=010E1060 ptr=010E10A9 end=010E1136 len=141 0000: 00 06 04 01 2a 04 01 2b a0 81 82 30 62 04 18 31 ....*..+...0b..1 0010: 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e .3.6.1.4.1.4203. 0020: 31 2e 39 2e 31 2e 31 04 46 30 44 0a 01 01 04 3c 1.9.1.1.F0D....< 0030: 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 30 2c rid=001,sid=000, 0040: 63 73 6e 3d 32 30 31 30 30 38 31 33 30 37 34 38 csn=201008130748 0050: 34 36 2e 34 35 37 32 37 39 5a 23 30 30 30 30 30 46.457279Z#00000 0060: 30 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 30 0#000#000000...0 0070: 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 ...2.16.840.1.11 0080: 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 3730.3.4.2... => get_ctrls ber_scanf fmt ({m) ber: ber_dump: buf=010E1060 ptr=010E10B4 end=010E1136 len=130 0000: 30 62 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0b..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 31 04 46 30 44 4203.1.9.1.1.F0D 0020: 0a 01 01 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 ....<rid=001,sid 0030: 3d 30 30 30 2c 63 73 6e 3d 32 30 31 30 30 38 31 =000,csn=2010081 0040: 33 30 37 34 38 34 36 2e 34 35 37 32 37 39 5a 23 3074846.457279Z# 0050: 30 30 30 30 30 30 23 30 30 30 23 30 30 30 30 30 000000#000#00000 0060: 30 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 34 30 0...0...2.16.840 0070: 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 32 01 .1.113730.3.4.2. 0080: 01 ff .. ber_scanf fmt (m) ber: ber_dump: buf=010E1060 ptr=010E10D0 end=010E1136 len=102 0000: 00 46 30 44 0a 01 01 04 3c 72 69 64 3d 30 30 31 .F0D....<rid=001 0010: 2c 73 69 64 3d 30 30 30 2c 63 73 6e 3d 32 30 31 ,sid=000,csn=201 0020: 30 30 38 31 33 30 37 34 38 34 36 2e 34 35 37 32 00813074846.4572 0030: 37 39 5a 23 30 30 30 30 30 30 23 30 30 30 23 30 79Z#000000#000#0 0040: 30 30 30 30 30 01 01 ff 30 1c 04 17 32 2e 31 36 00000...0...2.16 0050: 2e 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e .840.1.113730.3. 0060: 34 2e 32 01 01 ff 4.2... => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) ber_scanf fmt ({i) ber: ber_dump: buf=010E10D2 ptr=010E10D2 end=010E1118 len=70 0000: 30 44 0a 01 01 04 3c 72 69 64 3d 30 30 31 2c 73 0D....<rid=001,s 0010: 69 64 3d 30 30 30 2c 63 73 6e 3d 32 30 31 30 30 id=000,csn=20100 0020: 38 31 33 30 37 34 38 34 36 2e 34 35 37 32 37 39 813074846.457279 0030: 5a 23 30 30 30 30 30 30 23 30 30 30 23 30 30 30 Z#000000#000#000 0040: 30 30 30 01 01 ff 000... ber_scanf fmt (m) ber: ber_dump: buf=010E10D2 ptr=010E10D7 end=010E1118 len=65 0000: 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 .<rid=001,sid=00 0010: 30 2c 63 73 6e 3d 32 30 31 30 30 38 31 33 30 37 0,csn=2010081307 0020: 34 38 34 36 2e 34 35 37 32 37 39 5a 23 30 30 30 4846.457279Z#000 0030: 30 30 30 23 30 30 30 23 30 30 30 30 30 30 01 01 000#000#000000.. 0040: ff . ber_scanf fmt (b) ber: ber_dump: buf=010E10D2 ptr=010E1115 end=010E1118 len=3 0000: 00 01 ff ... ber_scanf fmt (}) ber: ber_dump: buf=010E10D2 ptr=010E1118 end=010E1118 len=0 ber_scanf fmt ({m) ber: ber_dump: buf=010E1060 ptr=010E1118 end=010E1136 len=30 0000: 00 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 ....2.16.840.1.1 0010: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... ber_scanf fmt (b) ber: ber_dump: buf=010E1060 ptr=010E1133 end=010E1136 len=3 0000: 00 01 ff ... => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) <= get_ctrls: n=2 rc=0 err="" attrs: * + send_ldap_result: conn=1001 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 2984 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ daemon: activity on 5 descriptors daemon: activity on: 4r daemon: read activity on 4 daemon: WSselect: listen=2 active_threads=0 tvp=zero connection_get(4) daemon: WSselect: listen=3 active_threads=0 tvp=zero connection_get(4): got connid=1001 connection_read(4): checking for input on id=1001 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=013E5460 ptr=013E5460 end=013E5465 len=5 0000: 02 01 03 42 00 ...B. op tag 0x42, time 1282112561 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 4 failed errno=0 (unknown WSA error) connection_read(4): input error=-2 id=1001, closing. connection_closing: readying conn=1001 sd=4 for close daemon: activity on 1 descriptor connection_close: deferring conn=1001 sd=4 daemon: waked daemon: WSselect: listen=2 active_threads=0 tvp=zero conn=1001 op=2 do_unbind daemon: WSselect: listen=3 active_threads=0 tvp=zero connection_resched: attempting closing conn=1001 sd=4 connection_close: conn=1001 sd=4 daemon: removing 4 """ gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com> On Mon, Aug 16, 2010 at 10:54 PM, Marc Patermann < hans.moser(a)ofd-z.niedersachsen.de> wrote: > Off list: > > owen nirvana schrieb am 16.08.2010 16:08 Uhr: > > However, the method of different search for different node is not > effective. > > > > In my configuration of parent CA, > > ''" > > syncrepl rid=001 > > ... > > searchbase = "dc=sonCA,dc=parentCA,dc=rootCA" > > ... > > """ > Did you try my first glue with multiple databases? > > > I believe the reason is the two nodes have not the same DIT. > What did you mean by that? > your tree from dc=sonCA,dc=parenCA,dc=rootCA will be replicated beyond > dc=parenCA,dc=rootCA if you configure it in the right way. > > > Maybe syncrepl could not support it. > You better try one of the approaches und post the consumer and provider > config and replication logs to the list (and maybe some data) > > Marc >

2 1

Openldap2.4.16 performance issue
by Singh, Devender (GE Capital, consultant) 21 Aug '10

21 Aug '10

Hi All, I need help for openldap slapd 200% cpu utilization issue. I have configured three openldap servers(2 Masters and 1 Slave). I have configure PEN load balancer for failover setup on 2 master openldap servers.It means application server first of all hit the loadbalancer port and than PEN LB will forwad that request to Master 1 or 2 openldap server. Hardware configuration on all boxes: OS: RHEL5(x86_64) RAM: 2GB Number of CPU: 2(Intel(R) Xeon(R)2.00GHz) Number of BDB databases: 2 Databse1: Number of users : 830000 Number of dns: 830000 Database2: Number of users: 2000 Number of dns: 800000 My Application1 using Databse1 and Application2 using Databse2. Application2 just authenticating the users and store last 10 password history only, It means Application1 is not using openldap too much. In Application2(90% dependent on openldap) every user have 1000+ sub leafs entries. when I want to do major changes(number of leafs write) into this, it.s got hanged and got socket closed error in application logs and CPU utilization goes 200% and RAM 52%. My DB_CONFIG file is below: # $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/12/18 11:53:27 ghenry Exp $ # Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. # # See the Oracle Berkeley DB documentation # <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/d b_config.html <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/d b_config.html> > # for detail description of DB_CONFIG syntax and semantics. # # Hints can also be found in the OpenLDAP Software FAQ # <http://www.openldap.org/faq/index.cgi?file=2 <http://www.openldap.org/faq/index.cgi?file=2> > # in particular: # <http://www.openldap.org/faq/index.cgi?file=1075 <http://www.openldap.org/faq/index.cgi?file=1075> > # Note: most DB_CONFIG settings will take effect only upon rebuilding # the DB environment. # one 0.25 GB cache set_cachesize 0 268435456 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs # Note: special DB_CONFIG flags are no longer needed for "quick" # slapadd(8) or slapindex(8) access (see their -q option). Please help me here that what I need to do for better performance. Thanks in advance. My contact number is +919650477441 Thanks & Regards, Devender Singh Senior Unix Administrator, (SOA Support Team) ________________________________________________________________________ ________________________________________________ SDG Software India Pvt. Ltd A-10, Sector 2, Noida 201301, U.P, India M: +91-9910024231 O: +91.120.401.4000 F: +91.120.401.4020 website : www.sdgc.com <http://www.sdgc.com/> ________________________________________________________________________ ________________________________________________ Please Note: The e-mail content is intended for the sole use of the intended recipient/s and may contain material that is CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or copying or distribution or forwarding of any or all of the contents in this message is STRICTLY PROHIBITED. If you have erroneously received this message, please delete it immediately and notify the sender. Before opening any attachments please check them for viruses and defects.

11 32

Re: How to check LDAP replication status?
by Gavin Henry 20 Aug '10

20 Aug '10

On 22/07/10 13:55, Paul Harvey wrote: > On 07/22/2010 02:34 PM, Priyesh Potdar wrote: >> Hi, >> >> Check out this link: >> http://docs.hp.com/en/5991-7504/ar01s08.html >> >> Refer to the section: >> Monitoring the Replication Status >> >> Hope this helps... >> >> On Thu, 2010-07-22 at 07:17 -0500, Proskurin Kirill wrote: >> >>> On 22/07/10 15:40, Priyesh Potdar wrote: >>> >>>> Hi, >>>> >>>> Two things you can do: >>>> 1) Check the replog file, if the data is getting pushed to slave from >>>> there or not. >>>> >>> As I understand it is deprecated and only used with Slurpd? >>> >>> I fogot to say - I use LDAP 2.4.11+ with Syncrepl. >>> >>> >>>> 2) Issue an ldapsearch command on the slave servers to check a newly >>>> updated data. >>>> >>> I don`t know what data is changing _now_ so what to search? >>> >>> >> > Precisely what i was after, thanks. > > Is there any way to manually create a hidden entry, in a similar style > to the contextCSN, or would this require the an overlay to be written? That's what the contextCSN is for. Just ldapsearch for it and if they match, they are up to date: http://blog.suretecsystems.com/archives/146-OpenLDAP-Quick-Tips-Checking-th… I really need to start those "Quick Tips" up again! If anyone wants to contribute some? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

3 2

Syncrepl: Reliable method to ask a server for its own URL
by Torsten Schlabach (Tascel eG) 20 Aug '10

20 Aug '10

Hi all! I do have a multi-master replication setup. So I do have an olcServerID attribute with multiple values, for example: dn: cn=config olcServerID: 1 ldap://ldapserver1.some.tld/ olcServerID: 2 ldap://ldapserver2.some.tld/ olcServerID: 3 ldap://ldapserver3.some.tld/ I understand that the meaning of this is: Each server will pick the attribute value which matches its own URL to determine the actual ServerID to be used in contextCSN generation, right? So if the server listening to ldap://ldapserver2.some.tld/ will come up, it will pick the attribute value "2 ldap://ldapserver2.some.tld/" and thus decide that its serverID is 2 in this case. I also understand that this mechanism has been created to allow the cn=config database to be replicated across all servers which are part of the cluster. Now obviously, if I made a mistake here, for example I make a typo: dn: cn=config olcServerID: 1 ldap://ldapserver1.some.tld/ olcServerID: 2 ldap://ldapsrever2.some.tld/ olcServerID: 3 ldap://ldapserver3.some.tld/ the server ldap://ldapserver2.some.tld/ will not find its entry and thus its serverID will default to 0, right? And I guess this will lead to results of the sychronization which are not what I expect. Of course I can carefully watch the config to guess what the effective ServerID *should* be. But would there be any way to actually query the server for what it thinks its ID is? I tried ldapsearch -x -D 'cn=admin,cn=config' -w XXXX -b '' -s base olcServerID but this also just gives me: # config dn: cn=config olcServerID: 1 ldap://192.168.5.11:389/ olcServerID: 2 ldap://192.168.5.12:389/ olcServerID: 3 ldap://192.168.9.2:389/ in my case. I guess I may have to query -b "", right? Any hints are welcome. I hope I was able to make my question clear. Regards, Torsten

2 1

pass-through authentication
by Brent Bice 20 Aug '10

20 Aug '10

I tried to send this yesterday but didn't see it come back from the list (and didn't see any replies). So I'll try once more. Apologies if anyone gets this twice. I've been trying to get Pass-Through authentication to work using a userPassword attribute of the form {SASL}username@realm. Is there a way to tell slapd what pathspec to use to talk to saslauthd? (I'm guessing maybe it's using one path but saslauthd is using a different one for the socket file) I've got saslauthd running ok and can authenticate using testsaslauthd so I'm fairly sure saslauthd is configured right and working. And I've got openldap compiled with --enable-spasswd option so it ought to support the SASL pass-through option, right? I ran saslauthd with debugging on so I can see every auth request and whether it succeeds or fails and I can see it when testsaslauth connects and succeeds. But when I try to bind to slapd using the DN whose userPassword is {SASL}bbice@ldap the authentication to slapd fails and saslauthd doesn't show any authentication attempt at all. It's as if it's not even trying (or can't find) saslauthd. I ran slapd with the -d 255 option and saved the output to a file. Here's all the lines containing the string sasl: >>> dnPretty: <cn=SASL> => ldap_bv2dn(cn=SASL,0) <= ldap_bv2dn(cn=SASL)=0 <= ldap_dn2bv(cn=SASL)=0 <<< dnPretty: <cn=SASL> >>> dnNormalize: <cn=SASL> <<< dnNormalize: <cn=sasl> ldap_sasl_bind_s ldap_sasl_bind SASL Canonicalize [conn=1000]: authcid="bbice@ldap" SASL Canonicalize [conn=1000]: authcid="bbice@ldap" SASL Canonicalize [conn=1001]: authcid="bbice@ldap" SASL Canonicalize [conn=1001]: authcid="bbice@ldap" So if I'm reading that right, slapd does see that it's supposed to hand off the authentication to saslauthd and it has picked out the username and realm. But it doesn't seem to be connecting to or using saslauthd. Any ideas? What am I missing here? Brent Bice bbice(a)sgi.com

2 1

OpenLDAP as a proxy for Active Directory (missing attributes)
by Marius Flage 20 Aug '10

20 Aug '10

I've been banging my head against the wall with this project for the last months and still haven't found a decent solution for my problem. I'm trying to set up OpenLDAP to act as a proxy for Active Directory. OpenLDAP should be the internet-facing interface for all external queries for the AD catalog. I've gotten the connection set up and I'm able to retrieve and search for most important values. However, when I try to get out the group membership of the different objects, I've encountered some problems. When doing a search directly towards Active Directory I can see the memberOf attributes for the objects [1], but when I perform the very same search through the proxy, those attributes have been ignored/stripped away from the result [2]. I've tried including schemas for Active Directory found on the internet (like http://www.grotan.com/ldap/microsoft.schema), but if I try to include this in OpenLDAP I get lots and lots of errors and I have to start commenting out different attributes and objecttypes to get OpenLDAP to start. Example of errors are stuff like: /etc/ldap/schema/microsoft2.schema: line 30 objectclass: AttributeType not found: "remoteSource" And then I comment out the objectclass and retry. And this basically goes on and on forever. I've also tried just including the attribute I'm looking for, namely memberOf, like so: attributetype ( 1.2.840.113556.1.2.102 NAME 'memberOf' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' NO-USER-MODIFICATION ) And then I get the following error when I try to start slapd: /etc/ldap/schema/activedirectory.schema: line 60 attributetype: AttributeType inappropriate USAGE: "memberOf" /etc/ldap/slapd.conf: line 15: <include> handler exited with 1! So my question is basically; how can I get the memberOf attribute included in my searches through OpenLDAP? Do I need to include the schema or am I approaching this from the wrong angle? What needs to be done to set up OpenLDAP as a complete transparent proxy towards Active Directory - basically having it behave as it was the AD itself answering whenever you query the proxy? I'd be very grateful for whatever question or feedback I can get, since this has been bothering me for a very long time now. I've also included my slapd.conf file [3] and the schema [4] I've tried including. - Marius [1] http://pastebin.com/E6GVViGE [2] http://pastebin.com/W28KPSky [3] http://pastebin.com/T5Wd4JEB [4] http://pastebin.com/8AGtnj2Q

2 1

Dynamic posixGroup, dynlist overlay
by Wiktor Warmus 19 Aug '10

19 Aug '10

Hi, I'm trying to use dynlist overlay as dynamic group container. system config: OS: debian lenny slapd: 2.4.11-1 slapd.conf [...] moduleload dynlist overlay dynlist dynlist-attrset groupOfNames labeledURI member When I do a search like: ldapsearch -x cn=ssh_admin I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: cn=ssh_admin # requesting: ALL # # ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000 user1 is added manually, since at least one member attribute is required by groupOfNames (posixGroup is an auxiliary type) And such a request: ldapsearch -x "(member=uid=user1,ou=People,dc=domain,dc=com)" results in: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user1,ou=People,dc=domain,dc=com) # requesting: ALL # # ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000 BUT with this one, which is a search done by a linux system when, e.g. doing id user2: ldapsearch -x "(member=uid=user2,ou=People,dc=domain,dc=com)" I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user2,ou=People,dc=domain,dc=com) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 My question is: how to make use of dynlist to get it working with a linux system, to automate group assignments. Or is there another way to do it? The goal is to have a dynamic posixGroups generated upon some specified filters, as shown in the example, to manage the authorization to a service (for instance sshd). Thanks for any suggestions and help. -- Wiktor Warmus

1 0

Notification of userPassword change in OpenLDAP?
by Tom Leach 19 Aug '10

19 Aug '10

I'm trying to work on a password sync scheme between OpenLDAP and some systems that use flat Unix passwd/shadow files. I have been able to update the LDAP server when someone changes their password on the standalone Unix systems, but I'm having problems trying to get any kind of notification from the LDAP server if someone from a system using the LDAP directory changes their password. So far, I'm looking at searching the LDAP directory every few minutes for any entries that have had their modifyTimestamp attribute change since the last time the search ran, then checking to see if the userPassword attribute in the LDAP directory is different then the shadow file on the Unix system. This seems like a real stupid scheme, especially when passwords are changed infrequently. I just don't want a long delay between syncing the directory and flat files in case someone changes their password on an LDAP client, then tries to log into the flat file system. Ideally, there could be some option in OpenLDAP that could call an external program when some attribute(s) have changed. That program could then perform the necessary searches and update the flat files if appropriate. So far, I've found nothing indicating that this is possible so I figured I'd ask and see if anyone else has tried this and what they found. Thanks! Tom Leach leach(a)coas.oregonstate.edu

3 2

Unable to start
by VANTASSLE, GEORDON M (ATTSI) 19 Aug '10

19 Aug '10

I finally got everything compiled, and the make test worked like a charm. However, when I try to manually start LDAP via the rc.openldap script, I get: $ ./test.rc.openldap start Starting test.rc.openldap service(s) --------------------------------- Tue-Aug-17-14.23.51-2010 --------------------------------- STATUS: LDAP start attempt logged to /opt/app/ivr/openldap/openldap-2.4.11/var/logs/SystemOut.log STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence ERROR: Unable to successfully start ldap within time limit --------------------------------- Tue-Aug-17-14.24.54-2010 --------------------------------- Is there some way that I can see what is going on with this? I don't know anything about LDAP, but my client requires it for one of their apps, so I would appreciate the help. Thanks, Geordon

3 2

(no subject)
by VANTASSLE, GEORDON M (ATTSI) 19 Aug '10

19 Aug '10

I'm at a loss as to what to do next. I'm running on RHEL 5 and installing as a non-root user. I get the following message when trying to start a fresh install of openLdap: $ ./slapd ./slapd: error while loading shared libraries: libltdl.so.3: cannot open shared object file: No such file or directory $ locate libltdl.so.3 /usr/local/lib/libltdl.so.3 /usr/local/lib/libltdl.so.3.1.4 /usr/share/libtool/libltdl/.libs/libltdl.so.3 /usr/share/libtool/libltdl/.libs/libltdl.so.3.1.4 This is what I used to configure the install: CPPFLAGS="-DOPENLDAP_FD_SETSIZE=8192 -I /opt/app/ivr/openldap/tools /include -I/usr/local/opt/gnu/include -I/usr/include -I/usr/local/lib" \ CFLAGS="-g" \ LDFLAGS="-g -L${TOOLS_HOME}/lib -R /opt/app/ivr/openldap/tools /lib -L/usr/local/opt/gnu/lib -R/usr/local/opt/gnu/lib -I/usr/lib -R/usr/lib" \ LD_RUN_PATH /opt/app/ivr/openldap/tools /lib \ ./configure \ --without-subdir \ --with-tls \ --with-cyrus-sasl \ --enable-spasswd \ --enable-shared \ --enable-dynamic \ --enable-slapd \ --enable-modules \ --enable-rewrite \ --enable-rlookups \ --enable-wrappers \ --enable-backends=mod \ --disable-shell \ --disable-sql \ --enable-overlays=mod \ --disable-slurpd \ --enable-multimaster \ --enable-syslog \ --prefix= /opt/app/ivr/openldap/ openldap-2.4.11 Any suggestions on where I should go from here would be greatly appreciated. Thanks, Geordon

3 3

pwdMustChange and pwdExpireWarning
by Wei Gao 18 Aug '10

18 Aug '10

I have pwdMustChange set to true in my default ppolicy. I tried to change a user's password EITHER as Manager on LDAP server OR via the following command on my LDAP server ldappasswd -x -D "cn=Manager,dc=example,dc=company" -W -S "uid=user1,ou=People,dc=example,dc=company" Since I have pwdMustChange set to true, the user should be required to change his password when he tries to log in next time. But the system doesn't prompt the user to change his password. And when I ran slapcat -a '(uid=user1)', I saw most Operational Attributes except pwdReset. All my settings seem to be correct. I couldn't figure out what is wrong here. One other question I have is: In my default ppolicy, I have pwdExpireWarning set to 1209600 (14 days). My current password is going to expire in 12 days, how come I don't see a warning message when I ssh to my system? Thank you for your help. Regards Wei

3 5

Re: multi / standby master: incomplete replication after downtime (?)
by Elmar Marschke 18 Aug '10

18 Aug '10

Am 18.08.2010 17:16, schrieb Rein Tollevik: > On 08/18/2010 04:28 PM, Elmar Marschke wrote: > >> Here's the logfile of MASTER: >> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ >> ===_BEGIN_CHANGES_WHILE_BOTH_UP_=== >> Aug 18 15:30:04 ldapmaster slapd[8017]: slap_queue_csn: queing >> 0x7f00f317b580 20100818133004.663851Z#000000#000#000000 > > Your ServerID setting is incorrect, and you are using the default > ServerID=0 on both systems. The ServerID is included in the csn value, > the second to last number (#000# here). Ensure that the ServerID URL is > the exact hostname of the systems it runs on, or that slapd is able to > select the correct sid based on its -h listener argument. > > Start slapd with -d config and verify that both logs lines with > differing SID= values. > > Rein > hey folks, thanks a lot; hope is coming back ;) Unfortunately i'll be out of office from now on until 25th august, because of relocation. My testservers in the office are already switched off, and i'm at home already. So i can't check anything right now.. But /etc/hosts should be correct on both systems; i've written the names in there. I'd be glad to come back to you next wednesday ..:) best regards elmar

1 0

multi / standby master: incomplete replication after downtime (?)
by Elmar Marschke 18 Aug '10

18 Aug '10

Hi all, i set up a multi master scenario using 2.4.21 on two servers. Online config (slapd.d) and ldap content is replicated fine, as long as both servers are up (means: i can change objects using ANY of the servers; and changes are transferred immediately to the other one. (Later in production, there will just one server be used actively, the other one shall be used by the clients just in case of failure)). Then i shut down one of the servers, and do changes on the remaining one. I expect the switched-off server to get ALL the latest changes from the online-server as soon as it's up again. But this seems to happen only partially; for example: - deletion of a user object works ( = shows up on the former switched-off server immediately after coming up again) - adding of a user does not - changing just subordinate attributes of user objects, like telephone number, does not show up. It just gets replicated to the former switched-off machine, when something else of that object is changed while both servers are alive. So finally i end up with different content on every machine... Did i miss something about how that works ?? Or is my config wrong for that; example: syncrepl rid=001 provider="ldap://ldapmaster.local.site" type=refreshAndPersist retry="5 +" searchbase="dc=local,dc=site" bindmethod=simple binddn="cn=replicator,dc=local,dc=site" credentials="<secret>" Thanks for help... PS: my setup / slapd.conf is according to the book "openLDAP 2.4" by Oliver Liebel & John Martin Ungar. -- elmar

4 7

ldap_add: Invalid syntax (21)
by Cole 18 Aug '10

18 Aug '10

Hello. I'm trying to set up a computer cluster for a school project, and I am following a guide at debianclusters.org <http://www.debianclusters.org>. I'm trying to set up LDAP and I've followed the tutorial, but I keep getting this error. I saw this error in the FAQ, but I'm not sure how to fix it. Any ideas on what I am doing wrong? Here is a link to the tutorial: http://debianclusters.org/index.php/LDAP_Server ------------------------------------------------ root@durnik:/usr/share/migrationtools# ./migrate_all_online.sh Enter the X.500 naming context you wish to import into: [dc=muncc,dc=loc] Enter the hostname of your LDAP server [ldap]: durnik Enter the manager DN: [cn=admin,dc=muncc,dc=loc]: Enter the credentials to bind with: Do you wish to generate a DUAConfigProfile [yes|no]? no Importing into dc=muncc,dc=loc... Creating naming context entries... Migrating aliases... Migrating groups... Migrating hosts... Migrating networks... Migrating users... Migrating protocols... Migrating rpcs... Migrating services... Migrating netgroups... Migrating netgroups (by user)... Migrating netgroups (by host)... Importing into LDAP... adding new entry "ou=Hosts,dc=muncc,dc=loc" adding new entry "ou=Rpc,dc=muncc,dc=loc" adding new entry "ou=Services,dc=muncc,dc=loc" adding new entry "nisMapName=netgroup.byuser,dc=muncc,dc=loc" adding new entry "ou=Mounts,dc=muncc,dc=loc" adding new entry "ou=Networks,dc=muncc,dc=loc" adding new entry "ou=People,dc=muncc,dc=loc" adding new entry "ou=Group,dc=muncc,dc=loc" adding new entry "ou=Netgroup,dc=muncc,dc=loc" adding new entry "ou=Protocols,dc=muncc,dc=loc" adding new entry "ou=Aliases,dc=muncc,dc=loc" adding new entry "nisMapName=netgroup.byhost,dc=muncc,dc=loc" adding new entry "cn=mailer-daemon,ou=Aliases,dc=muncc,dc=loc" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax /usr/bin/ldapadd: returned non-zero exit status: saving failed LDIF to /tmp/nis.ldif.ImwnfdMVQr ----------------------------------------

2 1

Infrastructure for authentication using referrals
by Luiz M Oliveira 18 Aug '10

18 Aug '10

Hello everyone I'm having trouble configuring a distributed environment directories. I have the following scenario: A company with three departments (departments A, B and C) separated geographically. In each department a server is configured to store user input for authentication. The suffix of the directory of the three departments are configured as dc = company, dc = com Below the root directory of the three branches are configured. Using the example of the department A: Department_A dc =, dc = company, dc = com: has the user input in that department. departamento_B dc =, dc = company, dc = com: stores a referral to server B department departamento_C dc =, dc = company, dc = com: stores a referral to server B from the Department All departments follow this structure, but each department is set up a referral for other outlying departments. If a user of the department is located on the department network and B want to authenticate to that site, to query the server B, you receive a referral for their department of origin. Can I implement this authentication scenario, with all servers using the same suffix and below referrasl implemented for the branches of foreign departments? Thanks to all

2 1

Maximum ldap search filter string length ?
by Arjan Filius 18 Aug '10

18 Aug '10

Hello openldap-technical ML. Is there a clear answer to the question about the maximum ldap search filter length ? Dit hava a look at the ldapsearch code (2.4.19) and all seems dynamicaly allocated, and therefore no hard/fixed limit. ldap_search_ext/ldap_search (manpage) doesn't talk about limits too. filter is about: RFC 4515 as extended by RFC 4526, but doesn't mention maximum size as far i read. That leaves me to the conclusion that the filter size is dependent on archite4cture (32/64 bits), available memory systemwide, and available memory within a proces. Can someone confirm or deny this is correct, and perhaps is there a (rough) guide/best practice about max filter string length's ? Thanks in Advance, -- Arjan Filius mailto:iafilius@xs4all.nl

1 0

Re: replication from child to Parent domain
by Marc Patermann 16 Aug '10

16 Aug '10

Owen, owen nirvana schrieb am 13.08.2010 20:02 Uhr: > I means how to config replication in a multi-level LDAP nodes. like the > following > > the parent node is has a domain "dc=parentCA, dc=rootCA", and under this > domain, many users were saved with dn like "cn=john, > ou=sales,dc=parentCA, dc=rootCA" > it has some sons nodes,like "dc=son1CA,dc=parentCA, dc=rootCA" and like > its parent,users were saved with dn like "cn=john, > ou=sales,dc=son1CA,dc=parentCA, dc=rootCA" > > Now, I hope parent node could saved data from sons node, so I try to > config replication between the two nodes to make parent node could pull > data from son node. However, it seems like the current replication > solution was designed between the same nodes with the same domain, I > don't know how to implement replcation between the different level nodes So your consumer has a superset of data from (various) providers!? I think, it should be fine to define a database for each provider/subset of data on the consumer and define different syncrepl statements for each database (it may work in one database with different "searchbase"s und "rid"s). Marc

2 1

Re: replication from child to Parent domain
by owen nirvana 13 Aug '10

13 Aug '10

I means how to config replication in a multi-level LDAP nodes. like the following the parent node is has a domain "dc=parentCA, dc=rootCA", and under this domain, many users were saved with dn like "cn=john, ou=sales,dc=parentCA, dc=rootCA" it has some sons nodes,like "dc=son1CA,dc=parentCA, dc=rootCA" and like its parent,users were saved with dn like "cn=john, ou=sales,dc=son1CA,dc=parentCA, dc=rootCA" Now, I hope parent node could saved data from sons node, so I try to config replication between the two nodes to make parent node could pull data from son node. However, it seems like the current replication solution was designed between the same nodes with the same domain, I don't know how to implement replcation between the different level nodes thanks for help gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com> On Fri, Aug 13, 2010 at 8:18 PM, Torsten Schlabach (Tascel eG) < tschlabach(a)tascel.net> wrote: > Hi Owen! > > I am not sure I understand properly what you are trying to do. > > Do you want to replicate different parts within the same tree? This > wouldn't make too much sense to me. > > Or do you mean you want to replicate the content of what you call the > parent domain(dc=parentCA) on one server to the child domain on a different > server? > > Regards, > Torsten > > On Fri, 13 Aug 2010 17:11:10 +0800, owen nirvana <freeespeech(a)gmail.com> > wrote: > > How to config slapd.conf to replicate between the parent > > domain(dc=parentCA) > > and the child(dc=sonCA,dc=parentCA) domain. > > > > > > gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com> < > gtalk%3Afreeespeech(a)gmail.com <gtalk%253Afreeespeech(a)gmail.com>> >

1 0

Authentication information cannot be recovered
by Matt Burkhardt 13 Aug '10

13 Aug '10

I have a headless server running Ubuntu 10.04 with LDAP set to expire every 30 days. This is the first time that my password expired after the upgrade from 8.10 LTS, and now it won't let me get to the command prompt. I login, then I get the following messages: WARNING: Your password has expired. You must change your password now and login again! Enter login(LDAP) password: LDAP Password incorrect: try again Enter login(LDAP) password: passwd: Authentication information cannot be recovered passwd: password unchanged and it logs me off. What should I be looking for? Thanks, Matt Burkhardt Impari Systems, Inc. mlb(a)imparisystems.com http://www.imparisystems.com http://www.linkedin.com/in/mlburkhardt http://www.twitter.com/matthewboh 502 Fairview Avenue Frederick, MD 21701 work (301) 682-7901 cell (301) 802-3235

1 0

replication from child to Parent domain
by owen nirvana 13 Aug '10

13 Aug '10

How to config slapd.conf to replicate between the parent domain(dc=parentCA) and the child(dc=sonCA,dc=parentCA) domain. gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

delta-sync replication slave quitting problem - not a single retry
by Alexander Ivanov 13 Aug '10

13 Aug '10

Hello guys, I have a problem with delta-syn replication (all set up according to 'official' guide - http://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl I have master instance with logs 'shipped' to a client - it all works fine as long as connection is good. Getting ready to move into production I'm trying to emulate connectivity problems and here where I got problems. Specifically - even though I have mirror instance set up as: syncrepl rid=101 provider=ldap://192.168.22.62:389 type=refreshAndPersist bindmethod=simple binddn="cn=replicator,xxxxx" credentials="xxxxxx" searchbase="xxxxxxx" filter="(objectClass=*)" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" scope=sub attrs="*,+" schemachecking=off * retry="1 +"* syncdata=accesslog once I have server disconnected (I sumply restart slapd on master), the client not even tries to re-connect, the log below shows modificatin operation at 18:34:18 that went fine and 11 seconds later I restart master's ldap service (which became immediately available again): Jul 28 18:34:18 newton slapd[20353]: => entry_encode(0x00000032): mail=xxxxxxxxxxxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: bdb_modify: updated id=00000032 dn="yyyyyyyyyyyyyyyyyyyyyyyy" Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: conn=-1 op=0 p=0 Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: err=0 matched="" text="" Jul 28 18:34:18 newton slapd[20353]: syncrepl_entry: rid 101 be_modify (0) Jul 28 18:34:18 newton slapd[20353]: bdb_modify: xxxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: bdb_dn2entry("oxxxxxxxxxxxxxxx") Jul 28 18:34:18 newton slapd[20353]: bdb_modify_internal: 0x00000001: o=xxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: <= acl_access_allowed: granted to database root Jul 28 18:34:18 newton slapd[20353]: bdb_modify_internal: replace contextCSN Jul 28 18:34:18 newton slapd[20353]: => entry_encode(0x00000001): o=xxxxxxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: bdb_modify: updated id=00000001 dn="xxxxxxxxxxxxxxxx" Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: conn=-1 op=0 p=0 Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: err=0 matched="" text="" Jul 28 18:34:18 newton slapd[20353]: daemon: activity on 1 descriptor Jul 28 18:34:18 newton slapd[20353]: daemon: activity on: Jul 28 18:34:18 newton slapd[20353]: Jul 28 18:34:18 newton slapd[20353]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 28 18:34:29 newton slapd[20353]: daemon: activity on 1 descriptor Jul 28 18:34:29 newton slapd[20353]: daemon: activity on: Jul 28 18:34:29 newton slapd[20353]: 14r Jul 28 18:34:29 newton slapd[20353]: Jul 28 18:34:29 newton slapd[20353]: daemon: read active on 14 Jul 28 18:34:29 newton slapd[20353]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 28 18:34:29 newton slapd[20353]: connection_get(14) Jul 28 18:34:29 newton slapd[20353]: connection_get(14): got connid=0 Jul 28 18:34:29 newton slapd[20353]: =>do_syncrepl rid 101 Jul 28 18:34:29 newton slapd[20353]: =>do_syncrep2 rid 101 Jul 28 18:34:29 newton slapd[20353]: do_syncrep2: rid 101 Can't contact LDAP server Jul 28 18:34:29 newton slapd[20353]: connection_get(14) Jul 28 18:34:29 newton slapd[20353]: connection_get(14): got connid=0 Jul 28 18:34:29 newton slapd[20353]: daemon: removing 14 Jul 28 18:34:29 newton slapd[20353]: daemon: activity on 1 descriptor Jul 28 18:34:29 newton slapd[20353]: daemon: activity on: Jul 28 18:34:29 newton slapd[20353]: Jul 28 18:34:29 newton slapd[20353]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 28 18:34:29 newton slapd[20353]: do_syncrepl: rid 101 quitting I'm running openldap 2.3.43-12.el5_5.1 from standard CentOS 5.4 installation. Do I get something wrong and slave not supposed to re-connect after master service restart or is this some kind of a problem that was fixed in later versions? Thank you, Alex

4 7

Evidence of client information in openldap accesslog
by Marco Pizzoli 13 Aug '10

13 Aug '10

Hi list, I'm implementing slapo-accesslog in my openldap deployment. I have about 100 unix/linux systems that use a central openldap deployment to make authentication and grant access to users. With accesslog I'm able to see when a particular user has logged in, but is there a way to obtain, on the LDAP server side, information about which system has been accessed? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

4 5

monitorCounter meaning
by Matheus Morais 11 Aug '10

11 Aug '10

Hi there, I was playing around with cn=Monitor and I became curious with the following search: ldapsearch -x -LLL -h host.example.com -s base -b cn=entries,cn=statistics,cn=monitor '(objectclass=*)' '*' '+' dn: cn=Entries,cn=Statistics,cn=Monitor objectClass: monitorCounterObject structuralObjectClass: monitorCounterObject cn: Entries creatorsName: modifiersName: createTimestamp: 20100804183416Z modifyTimestamp: 20100804183416Z monitorCounter: 45607686 entryDN: cn=Entries,cn=Statistics,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE What precisely meaning the attribute monitorCounter? Is it represent the number of entries which has been used as search base or something like that? Thanks! Matheus Morais

2 1

openldap-2.4.23 compile configure: error: could not locate ndbclient library
by Yusuf Rajah 11 Aug '10

11 Aug '10

Hi All I have been trying to solve this for 4 days now without any luck. I have searched and tried fixes and nothing works, I am hoping some fresh minds and eyes can help me out with this. I want to run OpenLDAP using MySQL Cluster Server with the ndb backend database. I have installed mysql-cluster-gpl-7.1.5 from source, it is working and I have migrated some data into it to test. I am trying to compile openldap-2.4.23 with support for back-NDB. I run: ./configure --enable-ndb --disable-hdb --disable-bdb --prefix=/usr/local/openldap and eventually get: checking for ndb_init in -lndbclient... no configure: error: could not locate ndbclient library I am doing this on an Ubuntu 10.04 Linux system 2.6.32-24-server SMP x86_64 GNU/Linux. Your help would be tremendously appreciated. Regards Yusuf Rajah

2 4

how to implement replication from son CA to superior CA
by owen nirvana 11 Aug '10

11 Aug '10

syncrepl could copy data between master and slave. However, it happened the two same LDAP server. So I need replicate data to superior CA, like the following: superior CA : dc= ACA,dc=RootCA (ip is 192.168.0.137) son CA: dc=BCA,dc=ACA,dc=RootCA (ip is 192.168.0.138) In superior CA , slapd.conf is including: syncrepl rid=000 provider=ldap://192.168.0.138:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=BCA,dc=ACA,dc=RootCA" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=BCA,dc=ACA,dc=RootCA" credentials=secret retry="5 5 300 +" mirrormode on It doesn't work. Thanks for help! gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

1 0

comp match module has unusable X509 cert code
by Lehnert, Hartmut 10 Aug '10

10 Aug '10

Hi all! I have performed some tests with the comp match module (yes it runs if you work around ITS 6556 ;-)). The result is that the comp match module only works with very simple X509 certs that use old algorithms! For example if you use X509 certificates with long serial numbers the snacc generated asn.1 parser (contained in file certificate.c) fails decoding the serial number. Another drawback: The attributes in Name components subject and issuer (cn, c, o, ou) have to be PrintableStrings; if for example there is an UTF8String present in the issuer the asn.1 parser fails decoding the issuer. All modern algorithms (sha256WithRSA, sha512WithRSA) are not recognized by the parser; if your X509 certificate is signed with sha256WithRSA the asn.1 parser fails decoding the AlgorithmIdentifier. In modern times these drawbacks aren't acceptable. Another appropriate asn.1 module for the X509 certificate structure has to be compiled with the openldap esnacc compiler. I would have done this but the openldap esnacc fails parsing its own modules!!! See something like this: openldap@ocsp-openldap24:~/Certificate> ~/openldap-snacc-2.3.6/compiler/esnacc -E BER_COMP -E GSER -t -d -f -I /home/openldap/openldap-snacc-2.3.6/asn1specs -I . Certificate.asn1 /home/openldap/openldap-snacc-2.3.6/asn1specs/asn1module.asn1(91) : parse error at symbol ""OID"" Parsing errors---cannot proceed The code in the asn.1 module: 88 ModuleId ::= SEQUENCE 89 { 90 name MyString, 91 oid OBJECT IDENTIFIER OPTIONAL --snacc cTypeName:"OID" isPtr:"TRUE" 92 } 93 Does anybody know how the esnacc error can be avoided? Regards, Hartmut

5 33

Multiple Admin
by Tears ! 09 Aug '10

09 Aug '10

Dear Users! I have ldap server running. Here is my ldap structure *dc=umar,dc=com (base) * 1) *dc=imran.com,dc=umar,dc=com *ou=users,dc=imran.com,dc=umar,dc=com ou=groups,dc=imran.com,dc=umar,dc=com 2) *dc=irfan.com,dc=umar,dc=com *ou=users,dc=irfan.com,dc=umar,dc=com ou=groups,dc=irfan.com,dc=umar,dc=com Ldap main user is (admin) which is master account. Now i want create another 2 admin users like (admin-irfan and admin-imran). *admin-imran* is the owner of *dc=imran.com* and *admin-irfan* is the owner of *dc=irfan.com*. Both admin can create,delete,update account in their respective domains. Would you please help me how i can do this. Regards, -- Umar Draz

1 0

ldap on Ubuntu 10.0.4
by Raymond Norton 09 Aug '10

09 Aug '10

Ubuntu 10.0.4 uses ldap 2.4.21, which does not use slapd.conf. I am having difficulty finding good documentation to configure openladap without slapd.conf. Is there a simple doc available on this? Raymond

11 13

repost: what makes client use mech=SIMPLE?
by Klavs Klavsen 09 Aug '10

09 Aug '10

Hi, I asked this before, but appearently no one took notice - or no one knows :( I have many ubuntu 8.04 clients which all work fine with my ldap server. I am now trying to connect a 10.04 client to the server - but login fails - and the only difference in output (in the debug file on the server) is the mech=SIMPLE line in the client that works. The one that works: Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" mech=SIMPLE ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 RESULT tag=97 err=0 text= The one that fails: Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 RESULT tag=97 err=49 text= Any idea what makes the client try binding with mech=SIMPLE? or perhaps a hint as to why the first "method=128" doesn't work? I hope you have ideas :) As to what I could find in the documentation method=128 (which they both use first) means SIMPLE-auth - so it "should" be the same they are doing.. obviously not - and "annoyingly" it's run over ldaps - so it's a bit harder to sniff :( Thank you in advance -- Regards, Klavs Klavsen, GSEC - kl(a)vsen.dk - http://www.vsen.dk "Those who do not understand Unix are condemned to reinvent it, poorly." --Henry Spencer

1 0

Re: Unclear attribute: entry
by Jonathan CLARKE 06 Aug '10

06 Aug '10

On 05/08/2010 10:59, Klaus Ethgen wrote: > Hi, > > Dieter Kluenter<dieter(a)dkluenter.de> schrieb: >>> So my question is what is the rights that are needed for which entry >>> attribute (in tree) to allow read, write, search or other access to >>> other attributes? >> entry and children are so called pseudo attributes. They are mainly >> used to allow access to children of an entry. As example you have an >> entry ouers,dcample,dcm and want to allow access to children >> of this entry but no read or write access to the entry itself, a rule >> set could be >> >> access to dn.onelevelers,dcample,dcm >> by users write >> by anonymous auth >> access to dn.baseers,dcample,dcm attrstry,children >> by users write >> by anonymous auth > > Thanks for your answer. But it do not makes that clear for me. I did > found some examples with entry and children but the description about > ist not clear for me. > > The children attribute might be somewhat clear. But the real mysteric is > the entry attribute and as the logic seems to be somewhat identical also > the real meaning of children. > > For example: > [1] access to attrs=sn > by * read > > [2] access to attrs=entry,sn > by * read > > [1] will not allow to read the attribute sn. Only with [2] that will > work. However, _I_ would expect that all attributes of that particular > entry would be readable with [2] but only the sn attribute with [1]. And > exactly there is my problem with the understanding. Indeed. Reading any object requires access to the entry pseudo attribute. All the requirements regarding these two pseudo attributes are documented in the man page, slapd.access(5), under "OPERATION REQUIREMENTS". For example, for searching and reading attributes: > The search operation, requires search (=s) privileges on the entry pseudo-attribute of the searchBase > (NOTE: this was introduced with OpenLDAP 2.4). Then, for each entry, it requires search (=s) privileges on > the attributes that are defined in the filter. The resulting entries are finally tested for read (=r) > privileges on the pseudo-attribute entry (for read access to the entry itself) and for read (=r) access on > each value of each attribute that is requested. Jonathan -- ========================================== Jonathan CLARKE ------------------------------------------ Normation 44 rue Cauchy, 94110 Arcueil, France ------------------------------------------ Telephone: +33 (0)1 83 62 26 96 ------------------------------------------ Web: http://www.normation.com/ ==========================================

1 0

Re: Unclear attribute: entry
by Dieter Kluenter 06 Aug '10

06 Aug '10

Klaus Ethgen <klaus+usenet(a)ethgen.de> writes: > Hi, > > Dieter Kluenter <dieter(a)dkluenter.de> schrieb: >>> So my question is what is the rights that are needed for which entry >>> attribute (in tree) to allow read, write, search or other access to >>> other attributes? >> entry and children are so called pseudo attributes. They are mainly >> used to allow access to children of an entry. As example you have an >> entry ouers,dcample,dcm and want to allow access to children >> of this entry but no read or write access to the entry itself, a rule >> set could be >> >> access to dn.onelevelers,dcample,dcm >> by users write >> by anonymous auth >> access to dn.baseers,dcample,dcm attrstry,children >> by users write >> by anonymous auth > > Thanks for your answer. But it do not makes that clear for me. I did > found some examples with entry and children but the description about > ist not clear for me. > > The children attribute might be somewhat clear. But the real mysteric is > the entry attribute and as the logic seems to be somewhat identical also > the real meaning of children. > > For example: > [1] access to attrs=sn > by * read > > [2] access to attrs=entry,sn > by * read > > [1] will not allow to read the attribute sn. Only with [2] that will > work. However, _I_ would expect that all attributes of that particular > entry would be readable with [2] but only the sn attribute with [1]. And > exactly there is my problem with the understanding. Well, if [1] doesn't allow read access then there are other rules which prevent this. The only function of the pseudo attributes entry and children is to allow the access parser to check whether the referenced object and subentries exist. Just to give an example, the last acl rule of my slapd.conf is access to dn.base="o=avci,c=de" attrs=entry,children by group.exact="cn=Administratoren,o=avci,c=de" write by users read by anonymous auth A search with base o=avci,c=de and scope subtree results in the following acl parsing: => access_allowed: search access to "o=avci,c=de" "entry" requested -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

1 0

Capturing events in OpenLDAP
by Suneet Shah 06 Aug '10

06 Aug '10

Hello, Is there a way to capture events such as creating a new user, changing a users, changing the password, etc in openLDAP in real time? If so, how? Any guidance to docs or examples would be greatly appreciated. If its not possible to capture these as an event, is there an alternative? Thanks in advance

2 1

Client Configuration on Windows
by Wallus, Harald Dr. 06 Aug '10

06 Aug '10

Hi all, I just ty to figure out client certificates for the access to ldap. My problem I can't configure e.g. ldapsearch on windows properly. If I understood it right, I must define and store some directives within a ldap.conf (see an example at the bottom), But what I must do that e.g. ldapsearch will read the configuration? Harald URI ldaps://myldap.mydomain.de BASE OU=myOrg,O=mydomain,C=DE BINDDN CN=me,OU=USERS,OU=myorg,O=mydomain,C=DE TLS_CACERT C:/OpenSSL-Win32/bin/demoCA/cacert.pem TLS_CERT C:/app/H23232/product/11.2.0/client_2/BIN/owm/wallets/H23232/clientcert.pem TLS_KEY C:/app/ H23232/product/11.2.0/client_2/BIN/owm/wallets/H23232/privateKeyOhnePass.pem TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLS_REQCERT never #TLS_REQCERT allow #TLS_REQCERT try TLS_REQCERT demand

2 2

can't get slapd to do pass-through authentication
by Brent Bice 06 Aug '10

06 Aug '10

I've been trying to get Pass-Through authentication to work using a userPassword attribute of the form {SASL}username@realm. At this point I'm guessing but is there a way to tell slapd what pathspec to use to talk to saslauthd? (I'm guessing maybe it's using one path but saslauthd is using a different one for the socket file) I've got saslauthd running ok and can authenticate using testsaslauthd so I'm fairly sure I'm ok there. And I've got openldap compiled with --enable-spasswd option so it ought to support the SASL pass-through option, right? I ran saslauthd with debugging on so I can see every auth request and whether it succeeds or fails and I can see it when testsaslauth connects and succeeds. But when I try to bind to slapd using the DN whose userPassword is {SASL}bbice@ldap the authentication to slapd fails and saslauthd doesn't show any authentication attempt at all. It's as if it's not even trying (or can't find) saslauthd. I ran slapd with the -d 255 option and saved the output to a file. Here's all the lines containing the string sasl: >>> dnPretty: <cn=SASL> => ldap_bv2dn(cn=SASL,0) <= ldap_bv2dn(cn=SASL)=0 <= ldap_dn2bv(cn=SASL)=0 <<< dnPretty: <cn=SASL> >>> dnNormalize: <cn=SASL> <<< dnNormalize: <cn=sasl> ldap_sasl_bind_s ldap_sasl_bind SASL Canonicalize [conn=1000]: authcid="bbice@ldap" SASL Canonicalize [conn=1000]: authcid="bbice@ldap" SASL Canonicalize [conn=1001]: authcid="bbice@ldap" SASL Canonicalize [conn=1001]: authcid="bbice@ldap" So if I'm reading that right, slapd does see that it's supposed to hand off the authentication to saslauthd and it has picked out the username and realm. But it doesn't seem to be connecting to or using saslauthd. Any ideas? What am I missing here? Brent Bice bbice(a)sgi.com

4 8

Change User Password (passwd vs. ldappasswd)
by weigao88＠gmail.com 06 Aug '10

06 Aug '10

Hi, I have set up and configured openldap 2.3 servers (master-slave) that comes with CentOS 5.4. I use openldap to centralize Linux/Unix user account management. Everything works as expected. However, I am confused about changing user password. Without LDAP, we use file-based authentication (/etc/passwd and /etc/shadow), so users can change their password via "passwd" command. Now I have migrated all my users to LDAP with default password policy, users can still use passwd command to change the password, but LDAP password policy is not enforced, for example, my ldap password policy has a minimum password length requirement of 12, and I am able to change user password to something less than 12 characters. However, if users use "ldappasswd -x -vv -S -W -D uid=user1,ou=People,dc=IT,dc=Company" to change their password, the LDAP password policy will be enforced, ie they will not allow to change to a password less than 12 characters. Are the users supposed to use passwd OR ldappasswd command to change their password? It's very inconvenient for users to use ldappassword command to change password as you can see they have to do much more typing, and some novice users are not even aware of ldappasswd command. I am confused here. Any help would be greatly appreciated. Thanks Wei

3 3

Back-ldap and Nssov
by Mustafa A. Hashmi 05 Aug '10

05 Aug '10

Hi all, I am using Openldap 2.4.23 (on Ubuntu Hardy 8.04) to test nssov. Everything is working perfectly on the primary server, with user, group and host information being pulled from Openldap via nssov. Testing of authorized service / pam integration via slapd acls is also working correctly. On another Ubuntu Hardy system I setup back-ldap and nssov, and though it works perfectly (including logins/acls, etc), there appears to be some issue when running: getent group I simply get one group returned (there are 4 on the primary server), with the following recorded in the (back-ldap server) logs (debug set to -1): -- back-ldap log on `getent group` -- root@dev01:/opt/zivios/openldap/etc/openldap# getent group root:x:0: daemon:x:1: bin:x:2: sys:x:3: adm:x:4: tty:x:5: disk:x:6: lp:x:7: mail:x:8: news:x:9: uucp:x:10: man:x:12: proxy:x:13: kmem:x:15: dialout:x:20: fax:x:21: voice:x:22: cdrom:x:24: floppy:x:25: tape:x:26: sudo:x:27:zwebuser audio:x:29: dip:x:30: www-data:x:33: backup:x:34: operator:x:37: list:x:38: irc:x:39: src:x:40: gnats:x:41: shadow:x:42: utmp:x:43: video:x:44: sasl:x:45: plugdev:x:46: staff:x:50: games:x:60: users:x:100: nogroup:x:65534: libuuid:x:101: dhcp:x:102: syslog:x:103: klog:x:104: scanner:x:105: nvram:x:106: ssh:x:107: ntp:x:109: ssl-cert:x:110:zwebuser,zopenldap zwebgroup:x:950: zopenldap:x:945: mysql:x:108: daemon: activity on 1 descriptor daemon: activity on: 10r daemon: read active on 10 connection_get(10) connection_get(10): got connid=0 nssov: connection from uid=0 gid=0 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL nssov_group_all() str2filter "(objectClass=posixGroup)" put_filter: "(objectClass=posixGroup)" put_filter: simple put_simple_filter: "objectClass=posixGroup" begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb6db8010 ptr=0xb6db8010 end=0xb6db802b len=27 0000: a3 19 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 0a 70 6f 73 69 78 47 72 6f 75 70 .posixGroup end get_filter 0 =>ldap_back_getconn: conn 0x8d3b058 fetched refcnt=1. ldap_search_ext put_filter: "(objectClass=posixGroup)" put_filter: simple put_simple_filter: "objectClass=posixGroup" ldap_build_search_req ATTRS: cn userPassword gidNumber memberUid member ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x8d484a8 ptr=0x8d484a8 end=0x8d4851d len=117 0000: 30 73 02 01 04 63 6e 04 10 64 63 3d 7a 69 76 69 0s...cn..dc=zivi 0010: 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 00 02 os,dc=net....... 0020: 01 00 02 01 00 01 01 00 a3 19 04 0b 6f 62 6a 65 ............obje 0030: 63 74 43 6c 61 73 73 04 0a 70 6f 73 69 78 47 72 ctClass..posixGr 0040: 6f 75 70 30 30 04 02 63 6e 04 0c 75 73 65 72 50 oup00..cn..userP 0050: 61 73 73 77 6f 72 64 04 09 67 69 64 4e 75 6d 62 assword..gidNumb 0060: 65 72 04 09 6d 65 6d 62 65 72 55 69 64 04 06 6d er..memberUid..m 0070: 65 6d 62 65 72 ember ber_scanf fmt ({) ber: ber_dump: buf=0x8d484a8 ptr=0x8d484ad end=0x8d4851d len=112 0000: 63 6e 04 10 64 63 3d 7a 69 76 69 6f 73 2c 64 63 cn..dc=zivios,dc 0010: 3d 6e 65 74 0a 01 02 0a 01 00 02 01 00 02 01 00 =net............ 0020: 01 01 00 a3 19 04 0b 6f 62 6a 65 63 74 43 6c 61 .......objectCla 0030: 73 73 04 0a 70 6f 73 69 78 47 72 6f 75 70 30 30 ss..posixGroup00 0040: 04 02 63 6e 04 0c 75 73 65 72 50 61 73 73 77 6f ..cn..userPasswo 0050: 72 64 04 09 67 69 64 4e 75 6d 62 65 72 04 09 6d rd..gidNumber..m 0060: 65 6d 62 65 72 55 69 64 04 06 6d 65 6d 62 65 72 emberUid..member ber_flush2: 117 bytes to sd 12 0000: 30 73 02 01 04 63 6e 04 10 64 63 3d 7a 69 76 69 0s...cn..dc=zivi 0010: 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 00 02 os,dc=net....... 0020: 01 00 02 01 00 01 01 00 a3 19 04 0b 6f 62 6a 65 ............obje 0030: 63 74 43 6c 61 73 73 04 0a 70 6f 73 69 78 47 72 ctClass..posixGr 0040: 6f 75 70 30 30 04 02 63 6e 04 0c 75 73 65 72 50 oup00..cn..userP 0050: 61 73 73 77 6f 72 64 04 09 67 69 64 4e 75 6d 62 assword..gidNumb 0060: 65 72 04 09 6d 65 6d 62 65 72 55 69 64 04 06 6d er..memberUid..m 0070: 65 6d 62 65 72 ember ldap_write: want=117, written=117 0000: 30 73 02 01 04 63 6e 04 10 64 63 3d 7a 69 76 69 0s...cn..dc=zivi 0010: 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 00 02 os,dc=net....... 0020: 01 00 02 01 00 01 01 00 a3 19 04 0b 6f 62 6a 65 ............obje 0030: 63 74 43 6c 61 73 73 04 0a 70 6f 73 69 78 47 72 ctClass..posixGr 0040: 6f 75 70 30 30 04 02 63 6e 04 0c 75 73 65 72 50 oup00..cn..userP 0050: 61 73 73 77 6f 72 64 04 09 67 69 64 4e 75 6d 62 assword..gidNumb 0060: 65 72 04 09 6d 65 6d 62 65 72 55 69 64 04 06 6d er..memberUid..m 0070: 65 6d 62 65 72 ember ldap_result ld 0x8d48288 msgid 4 wait4msg ld 0x8d48288 msgid 4 (timeout 100000 usec) wait4msg continue ld 0x8d48288 msgid 4 all 0 ** ld 0x8d48288 Connections: * host: dev02.zivios.net port: 389 (default) refcnt: 2 status: Connected last used: Wed Aug 4 17:21:55 2010 ** ld 0x8d48288 Outstanding Requests: * msgid 4, origid 4, status InProgress outstanding referrals 0, parent count 0 ld 0x8d48288 request count 1 (abandoned 0) ** ld 0x8d48288 Response Queue: Empty ld 0x8d48288 response count 0 ldap_chkResponseList ld 0x8d48288 msgid 4 all 0 ldap_chkResponseList returns ld 0x8d48288 NULL ldap_int_select read1msg: ld 0x8d48288 msgid 4 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 82 01 26 02 01 04 64 0..&...d ldap_read: want=290, got=290 0000: 82 01 1f 04 26 63 6e 3d 65 63 6c 73 74 61 66 66 ....&cn=eclstaff 0010: 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 63 3d 7a 69 ,ou=groups,dc=zi 0020: 76 69 6f 73 2c 64 63 3d 6e 65 74 30 81 f4 30 13 vios,dc=net0..0. 0030: 04 09 67 69 64 4e 75 6d 62 65 72 31 06 04 04 33 ..gidNumber1...3 0040: 30 30 30 30 10 04 02 63 6e 31 0a 04 08 65 63 6c 0000...cn1...ecl 0050: 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 65 72 staff0....member 0060: 31 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d 69 1...%uid=mhashmi 0070: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 0080: 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d ios,dc=net.#uid= 0090: 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 fkhan,ou=users,d 00a0: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 00b0: 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 3d %uid=jabbasi,ou= 00c0: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 00d0: 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 61 dc=net.%uid=zsha 00e0: 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d ikh,ou=users,dc= 00f0: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 zivios,dc=net.#u 0100: 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 id=akhan,ou=user 0110: 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e s,dc=zivios,dc=n 0120: 65 74 et ber_get_next: tag 0x30 len 294 contents: ber_dump: buf=0x8d496d0 ptr=0x8d496d0 end=0x8d497f6 len=294 0000: 02 01 04 64 82 01 1f 04 26 63 6e 3d 65 63 6c 73 ...d....&cn=ecls 0010: 74 61 66 66 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 taff,ou=groups,d 0020: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 30 c=zivios,dc=net0 0030: 81 f4 30 13 04 09 67 69 64 4e 75 6d 62 65 72 31 ..0...gidNumber1 0040: 06 04 04 33 30 30 30 30 10 04 02 63 6e 31 0a 04 ...30000...cn1.. 0050: 08 65 63 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 .eclstaff0....me 0060: 6d 62 65 72 31 81 bf 04 25 75 69 64 3d 6d 68 61 mber1...%uid=mha 0070: 73 68 6d 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 shmi,ou=users,dc 0080: 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 =zivios,dc=net.# 0090: 75 69 64 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 uid=fkhan,ou=use 00a0: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 00b0: 6e 65 74 04 25 75 69 64 3d 6a 61 62 62 61 73 69 net.%uid=jabbasi 00c0: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 00d0: 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d ios,dc=net.%uid= 00e0: 7a 73 68 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 zshaikh,ou=users 00f0: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0100: 74 04 23 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d t.#uid=akhan,ou= 0110: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 0120: 64 63 3d 6e 65 74 dc=net read1msg: ld 0x8d48288 msgid 4 message type search-entry ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d496d3 end=0x8d497f6 len=291 0000: 64 82 01 1f 04 26 63 6e 3d 65 63 6c 73 74 61 66 d....&cn=eclstaf 0010: 66 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 63 3d 7a f,ou=groups,dc=z 0020: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 30 81 f4 30 ivios,dc=net0..0 0030: 13 04 09 67 69 64 4e 75 6d 62 65 72 31 06 04 04 ...gidNumber1... 0040: 33 30 30 30 30 10 04 02 63 6e 31 0a 04 08 65 63 30000...cn1...ec 0050: 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 65 lstaff0....membe 0060: 72 31 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d r1...%uid=mhashm 0070: 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 i,ou=users,dc=zi 0080: 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 vios,dc=net.#uid 0090: 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c =fkhan,ou=users, 00a0: 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 dc=zivios,dc=net 00b0: 04 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 .%uid=jabbasi,ou 00c0: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 00d0: 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 ,dc=net.%uid=zsh 00e0: 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 aikh,ou=users,dc 00f0: 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 =zivios,dc=net.# 0100: 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 uid=akhan,ou=use 0110: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 0120: 6e 65 74 net >>> dnPrettyNormal: <cn=eclstaff,ou=groups,dc=zivios,dc=net> => ldap_bv2dn(cn=eclstaff,ou=groups,dc=zivios,dc=net,0) <= ldap_bv2dn(cn=eclstaff,ou=groups,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=eclstaff,ou=groups,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=eclstaff,ou=groups,dc=zivios,dc=net)=0 <<< dnPrettyNormal: <cn=eclstaff,ou=groups,dc=zivios,dc=net>, <cn=eclstaff,ou=groups,dc=zivios,dc=net> ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49702 end=0x8d497f6 len=244 0000: 30 13 04 09 67 69 64 4e 75 6d 62 65 72 31 06 04 0...gidNumber1.. 0010: 04 33 30 30 30 30 10 04 02 63 6e 31 0a 04 08 65 .30000...cn1...e 0020: 63 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 clstaff0....memb 0030: 65 72 31 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 er1...%uid=mhash 0040: 6d 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a mi,ou=users,dc=z 0050: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 ivios,dc=net.#ui 0060: 64 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 d=fkhan,ou=users 0070: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0080: 74 04 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f t.%uid=jabbasi,o 0090: 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f u=users,dc=zivio 00a0: 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 s,dc=net.%uid=zs 00b0: 68 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 haikh,ou=users,d 00c0: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 00d0: 23 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 #uid=akhan,ou=us 00e0: 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 ers,dc=zivios,dc 00f0: 3d 6e 65 74 =net ber_scanf fmt ([W]) ber: ber_dump: buf=0x8d496d0 ptr=0x8d4970f end=0x8d497f6 len=231 0000: 00 06 04 04 33 30 30 30 30 10 04 02 63 6e 31 0a ....30000...cn1. 0010: 04 08 65 63 6c 73 74 61 66 66 30 81 ca 04 06 6d ..eclstaff0....m 0020: 65 6d 62 65 72 31 81 bf 04 25 75 69 64 3d 6d 68 ember1...%uid=mh 0030: 61 73 68 6d 69 2c 6f 75 3d 75 73 65 72 73 2c 64 ashmi,ou=users,d 0040: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 0050: 23 75 69 64 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 #uid=fkhan,ou=us 0060: 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 ers,dc=zivios,dc 0070: 3d 6e 65 74 04 25 75 69 64 3d 6a 61 62 62 61 73 =net.%uid=jabbas 0080: 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 i,ou=users,dc=zi 0090: 76 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 vios,dc=net.%uid 00a0: 3d 7a 73 68 61 69 6b 68 2c 6f 75 3d 75 73 65 72 =zshaikh,ou=user 00b0: 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e s,dc=zivios,dc=n 00c0: 65 74 04 23 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 et.#uid=akhan,ou 00d0: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 00e0: 2c 64 63 3d 6e 65 74 ,dc=net ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49717 end=0x8d497f6 len=223 0000: 30 10 04 02 63 6e 31 0a 04 08 65 63 6c 73 74 61 0...cn1...eclsta 0010: 66 66 30 81 ca 04 06 6d 65 6d 62 65 72 31 81 bf ff0....member1.. 0020: 04 25 75 69 64 3d 6d 68 61 73 68 6d 69 2c 6f 75 .%uid=mhashmi,ou 0030: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 0040: 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d 66 6b 68 ,dc=net.#uid=fkh 0050: 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a an,ou=users,dc=z 0060: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 ivios,dc=net.%ui 0070: 64 3d 6a 61 62 62 61 73 69 2c 6f 75 3d 75 73 65 d=jabbasi,ou=use 0080: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 0090: 6e 65 74 04 25 75 69 64 3d 7a 73 68 61 69 6b 68 net.%uid=zshaikh 00a0: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 00b0: 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d ios,dc=net.#uid= 00c0: 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 akhan,ou=users,d 00d0: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 c=zivios,dc=net ber_scanf fmt ([W]) ber: ber_dump: buf=0x8d496d0 ptr=0x8d4971d end=0x8d497f6 len=217 0000: 00 0a 04 08 65 63 6c 73 74 61 66 66 30 81 ca 04 ....eclstaff0... 0010: 06 6d 65 6d 62 65 72 31 81 bf 04 25 75 69 64 3d .member1...%uid= 0020: 6d 68 61 73 68 6d 69 2c 6f 75 3d 75 73 65 72 73 mhashmi,ou=users 0030: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0040: 74 04 23 75 69 64 3d 66 6b 68 61 6e 2c 6f 75 3d t.#uid=fkhan,ou= 0050: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 0060: 64 63 3d 6e 65 74 04 25 75 69 64 3d 6a 61 62 62 dc=net.%uid=jabb 0070: 61 73 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d asi,ou=users,dc= 0080: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 zivios,dc=net.%u 0090: 69 64 3d 7a 73 68 61 69 6b 68 2c 6f 75 3d 75 73 id=zshaikh,ou=us 00a0: 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 ers,dc=zivios,dc 00b0: 3d 6e 65 74 04 23 75 69 64 3d 61 6b 68 61 6e 2c =net.#uid=akhan, 00c0: 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 ou=users,dc=zivi 00d0: 6f 73 2c 64 63 3d 6e 65 74 os,dc=net ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49729 end=0x8d497f6 len=205 0000: 30 81 ca 04 06 6d 65 6d 62 65 72 31 81 bf 04 25 0....member1...% 0010: 75 69 64 3d 6d 68 61 73 68 6d 69 2c 6f 75 3d 75 uid=mhashmi,ou=u 0020: 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 sers,dc=zivios,d 0030: 63 3d 6e 65 74 04 23 75 69 64 3d 66 6b 68 61 6e c=net.#uid=fkhan 0040: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 0050: 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d ios,dc=net.%uid= 0060: 6a 61 62 62 61 73 69 2c 6f 75 3d 75 73 65 72 73 jabbasi,ou=users 0070: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0080: 74 04 25 75 69 64 3d 7a 73 68 61 69 6b 68 2c 6f t.%uid=zshaikh,o 0090: 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f u=users,dc=zivio 00a0: 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d 61 6b s,dc=net.#uid=ak 00b0: 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d han,ou=users,dc= 00c0: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 zivios,dc=net ber_scanf fmt ([W]) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49734 end=0x8d497f6 len=194 0000: 00 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d 69 ....%uid=mhashmi 0010: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 0020: 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d ios,dc=net.#uid= 0030: 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 fkhan,ou=users,d 0040: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 0050: 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 3d %uid=jabbasi,ou= 0060: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 0070: 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 61 dc=net.%uid=zsha 0080: 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d ikh,ou=users,dc= 0090: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 zivios,dc=net.#u 00a0: 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 id=akhan,ou=user 00b0: 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e s,dc=zivios,dc=n 00c0: 65 74 et >>> dnPretty: <uid=mhashmi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=mhashmi,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=fkhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=fkhan,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=fkhan,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=jabbasi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=jabbasi,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=zshaikh,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=zshaikh,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=akhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=akhan,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=akhan,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=mhashmi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=mhashmi,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=fkhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=fkhan,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=fkhan,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=jabbasi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=jabbasi,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=zshaikh,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=zshaikh,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=akhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=akhan,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=akhan,ou=users,dc=zivios,dc=net> ber_scanf fmt ({xx) ber: ber_dump: buf=0x8d496d0 ptr=0x8d496d3 end=0x8d497f6 len=291 0000: 64 82 01 1f 04 26 63 6e 3d 65 63 6c 73 74 61 66 d....&cn=eclstaf 0010: 66 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 63 3d 7a f,ou=groups,dc=z 0020: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 00 81 f4 30 ivios,dc=net...0 0030: 13 04 09 67 69 64 4e 75 6d 62 65 72 00 06 04 04 ...gidNumber.... 0040: 33 30 30 30 30 10 04 02 63 6e 00 0a 04 08 65 63 30000...cn....ec 0050: 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 65 lstaff0....membe 0060: 72 00 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d r....%uid=mhashm 0070: 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 i,ou=users,dc=zi 0080: 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 vios,dc=net.#uid 0090: 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c =fkhan,ou=users, 00a0: 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 dc=zivios,dc=net 00b0: 04 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 .%uid=jabbasi,ou 00c0: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 00d0: 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 ,dc=net.%uid=zsh 00e0: 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 aikh,ou=users,dc 00f0: 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 =zivios,dc=net.# 0100: 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 uid=akhan,ou=use 0110: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 0120: 6e 65 74 net ldap_msgfree ldap_abandon_ext 4 do_abandon origid 4, msgid 4 ldap_msgdelete ld=0x8d48288 msgid=4 ber_flush2: 8 bytes to sd 12 0000: 30 06 02 01 05 50 01 04 0....P.. ldap_write: want=8, written=8 0000: 30 06 02 01 05 50 01 04 0....P.. ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_free_request (origid 4, msgid 4) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=80 matched="" text="" -- The output is simply: eclstaff:*:3000:mhashmi,fkhan,jabbasi,zshaikh,akhan On the primary server however, I see all 4 group entries are sent during the request: conn=1000 op=5 ENTRY dn="cn=eclstaff,ou=groups,dc=zivios,dc=net" conn=1000 op=5 ENTRY dn="cn=sysadmin,ou=groups,dc=zivios,dc=net" conn=1000 op=5 ENTRY dn="cn=mailadmin,ou=groups,dc=zivios,dc=net" conn=1000 op=5 ENTRY dn="cn=finance,ou=groups,dc=zivios,dc=net" On the back-ldap server, probing a single group works, albeit, with the same err=80 being logged. getent passwd & hosts works perfectly. Please find below the relevant configuration sections of my primary slapd.conf, the back-ldap slapd.conf as well as sample user and group entries: === primary server slapd.conf === database hdb #overlay smbk5pwd overlay unique overlay nssov suffix "dc=zivios,dc=net" rootdn "cn=admin,dc=zivios,dc=net" rootpw foo # nssov config nssov-map group uniqueMember member nssov-ssd passwd ldap:///dc=zivios,dc=net??sub nssov-ssd group ldap:///dc=zivios,dc=net??sub nssov-ssd hosts ldap:///dc=zivios,dc=net??sub nssov-pam hostservice nssov-pam-session sshd nssov-pam-session login === Back-ldap slapd.conf === database ldap suffix dc=zivios,dc=net uri "ldap://dev02.zivios.net" acl-bind bindmethod=simple binddn="" credentials="" idassert-bind bindmethod=simple binddn="cn=admin,dc=zivios,dc=net" // just for testing... credentials="foo" mode=none flags=non-prescriptive overlay nssov nssov-map group uniqueMember member nssov-ssd passwd ldap:///dc=zivios,dc=net??sub nssov-ssd group ldap:///dc=zivios,dc=net??sub nssov-ssd hosts ldap:///dc=zivios,dc=net??sub nssov-pam hostservice nssov-pam-session sshd nssov-pam-session login lastmod off === 2 sample groups === dn: cn=eclstaff,ou=groups,dc=zivios,dc=net objectClass: groupOfNames objectClass: posixGroup gidNumber: 3000 description: Emergen Staff cn: eclstaff member: uid=mhashmi,ou=users,dc=zivios,dc=net member: uid=fkhan,ou=users,dc=zivios,dc=net member: uid=jabbasi,ou=users,dc=zivios,dc=net member: uid=zshaikh,ou=users,dc=zivios,dc=net member: uid=akhan,ou=users,dc=zivios,dc=net dn: cn=sysadmin,ou=groups,dc=zivios,dc=net objectClass: groupOfNames objectClass: posixGroup gidNumber: 3001 description: Administrator cn: sysadmin member: uid=mhashmi,ou=users,dc=zivios,dc=net member: uid=fkhan,ou=users,dc=zivios,dc=net === 2 sample users === dn: uid=mhashmi,ou=users,dc=zivios,dc=net cn: Mustafa Hashmi gidnumber: 3000 givenname: Mustafa homedirectory: /home/mhashmi objectclass: inetOrgPerson objectclass: posixAccount objectclass: shadowAccount ou: Users sn: Hashmi uid: mhashmi uidnumber: 5050 userpassword: foo dn: uid=fkhan,ou=users,dc=zivios,dc=net cn: Faraz Khan gidnumber: 3000 givenname: Faraz homedirectory: /home/fkhan objectclass: inetOrgPerson objectclass: posixAccount objectclass: shadowAccount ou: Users sn: Khan uid: fkhan uidnumber: 5051 userpassword: foo === Please note: running a ldapsearch on the back-ldap server for groups works correctly and all entries are returned. I am at a bit of loss here -- if anyone can tell me how to debug this further, it would be greatly appreciated. Many thanks, Mustafa.

2 2

Incorrect NetBios Hostname on LDAP packet
by Przemek Jagieła 05 Aug '10

05 Aug '10

Hello I install Samba 4.0.0 alpha 12 on Ubuntu 9.10 and configured as PDC. When I want join windows to domain I get error message: It’s unable to communicate with domain controller for domain firma.local. Query DNS resource record for the service location (SRV) used to locate a domain controller for domain firma.local was successful. The query was for the SRV record for _ldap._tcp.dc._msdcs.firma.local The query identified the following domain controllers: Przemek-laptop.firma.local The most common causes of this error are: - host (A) records that map the name of the domain controller to IP addresses are missing or contain incorrect addresses. - Domain controllers registered in DNS are not connected to the network or do not work. In smb.conf file netbios name is “PRZEMEK-LAPTOP”. In captured packet in line 6 on the CLDAP packet from server to client http://www.psalask.cba.pl/foto1.jpg I saw that NetBios Hostname is “\\PRZEMEK-LAPTOP” http://www.psalask.cba.pl/foto2.jpg . NetBios Hostname is taken by LDAP from smb.conf because when I change netbios name on this file, CLDAP packet is changing to. I include captured packet from attempt to connect to domain on Samba 4 www.psalask.cba.pl/packet_samba4.pcap <http://www.psalask.cba.pl/packet_samba4.pcap> To compare I include captured packets from connection to the same domain on Active Directory in Windows 2003 http://psalask.cba.pl/packets_AD_windows2003.pcap My question is: How can I remove “\\” from NetBios Hostname on CLDAP packet? Thanks -- Pozdrawiam Przemysław Jagieła

1 0

Proxycache overlay to back-ldap with cn=config
by Nicolas Brisac 05 Aug '10

05 Aug '10

Hi, I'm trying to set up a proxy-cache to a couple of OpenLDAP servers configured in mirror mode. The back-ldap part is working fine and I can query the underlying slapd instances through the proxy. However, I'm still struggling with the caching bit. I couldn't find any documentation or posts related to setting this up using the new cn=config way of configuring LDAP. So after some reading and a bit of guessing, I came up with the following config: # {1}ldap, config dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=sol1,dc=net olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by self write by users read by anonymous auth olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcRootPW: secret olcDbURI: "ldap://192.168.200.12 ldap://192.168.200.14" olcDbACLBind: bindmethod=simple binddn="uid=ldapadmin,dc=sol1,dc=net" credentials="secret" starttls=no # {0}pcache, {1}ldap, config dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: bdb 10000 3 1000 100 olcPcacheAttrset: 0 uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass olcPcacheAttrset: 1 sudoCommand sudoHost olcPcacheAttrset: 2 gidNumber olcPcacheTemplate: (&(objectClass=)(uid=)) 0 300 olcPcacheTemplate: (sudoUser=) 1 300 olcPcacheTemplate: (&(objectClass=)(memberUid=)) 2 300 # {2}bdb, config dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/cache olcSuffix: cn=proxy olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcDbCacheSize: 5000 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: mail eq olcDbIndex: surname eq olcDbIndex: givenname eq olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaDomainName eq olcDbIndex: sudoUser eq But running ldapsearch keeps returning: # search result search: 2 result: 52 Server is unavailable text: pcachePrivDB: cacheDB not available I didn't find any way to specify which database to use when declaring the overlay, apart from the 'bdb' part of olcPcache, but that seems to be interpreted as the database type, not its name (I've tried replacing it with cn=proxy, but that throws an error). Looking at the pcache overlay source (I'm running 2.4.21 from Ubuntu Lucid and also checked the latest 2.4.23 stable source), I can see this bit: { "pcache-", "private database args", 1, 0, STRLENOF("pcache-"), ARG_MAGIC|PC_PRIVATE_DB, pc_cf_gen, NULL, NULL, NULL }, That seems to be for the private DB options, but the other equivalent "pcacheXXXX" in this file have the corresponding attribute declaration for the schema instead of 'NULL, NULL, NULL'. Anyway, I'm obviously missing something :) If someone who's got this working or a developer could point me in the right direction, that would be greatly appreciated! Thanks, Nico

1 1

using ldap to control access to other services
by William Cai 04 Aug '10

04 Aug '10

Hi List, I have been using LDAP for some time. The LDAP server is mainly used to store user information. Today I heard that LDAP can be used to control access to other services. More specific, "The way it works is that your (or any other) app calls LDAP with like "I am user A, here is my ticket, so what I can do?" and then LDAP responds: "User A has a type X and can access B, C and D function, but can not access X, Y and Z function". So your app realizes that "Type X can access today and tomorrow, but not day after tomorrow" etc." I went through OpenLDAP document http://www.openldap.org/doc/admin24/access-control.html. But seems it focuses on how to control the access to LDAP server itself. Could anybody show me how to implement this? 1. Do I need to model the business environment in LDAP? e.g. create a node for each function point. 2. What is the programming model? Can I use Java interface to retrieve these permission information? 3. Is it OpenLDAP specific function or LDAP common function? Thanks, William

3 2

Webmin LDAP User Module Don't Wor
by Andrea Minardi 04 Aug '10

04 Aug '10

Webmin's LDAP Users and Groups module stopped working after upgrading from Webmin 1.400 to webmin 1.510 I have been using Webmin's LDAP Users and Groups module on my company's server to administer users. It was working fine on Webmin 1.400, but after upgrading I get the error: "Webmin has connected to the LDAP server, but failed to fetch the schema. Make sure that access has not been denied in the LDAP Server module." I work with OpenLDAP 2.3.27 on Red Hat 5. Thanks. Andrea Minardi

3 2

Re: Unclear attribute: entry
by Dieter Kluenter 04 Aug '10

04 Aug '10

Klaus Ethgen <klaus+usenet(a)ethgen.de> writes: > Hello, > > I have to admit that I do not know what exactly the entry attribute (and > partly the children attribute too) is for. I know that it is needed to > give access to any other attribute but that is not enough for me as I > want to _know_ what it is for. > > Unfortunately I did not find a more clear description of this attribute > than "scope limited to this entry" which is somewhat meaningless for me. > > So my question is what is the rights that are needed for which entry > attribute (in tree) to allow read, write, search or other access to > other attributes? > > Please excuse that I did crosspost this question to three groups as > there is no user group and g.n.o.general is very empty so it was not > clear if it is read at all. entry and children are so called pseudo attributes. They are mainly used to allow access to children of an entry. As example you have an entry ou=users,dc=example,dc=com and want to allow access to children of this entry but no read or write access to the entry itself, a rule set could be access to dn.onelevel=ou=users,dc=example,dc=com by users write by anonymous auth access to dn.base=ou=users,dc=example,dc=com attrs=entry,children by users write by anonymous auth -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

1 0

about LDIF operation by API
by owen nirvana 04 Aug '10

04 Aug '10

It seems nothing is provided for operating LDIF. How to implement ldif export and import with C/C++ in OpenLDAP. gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

Kerberos userpassword storage
by Indexer 04 Aug '10

04 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Im attempting to use Kerberos as a password storage backend in my ldap server. I have the server setup with its own principal of the form ldap/domainname@REALM , and this keytab is in the KRB5_KTNAME environment variable as slapd starts. I have put olcSaslRealm=REALM and olcSaslHost=kdc.domain into my cn=config. Then, i have uid=user, where the userPassword attribute is {KERBEROS}user@REALM When attempting to bind to this user, it seems to fail. When i reset the password to a standard SSHA hash, it authenticates correctly. I can authenticate with kerberos to the host that the ldap enabled client, but i just cannot use ldap with the kerberos password backend. Any help in solving what else i need to do in this would be greatly appreciated William Brown pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) iQIcBAEBAgAGBQJMWSI4AAoJEHF16AnLoz6JYt0P/0GzaH8jSYxiFLkjuh+XnXKI E1Io0H9a0U3Z2GWnkpGwfYmZpPSPHhCV7qs18y2AFHyekvxW9Io3sraKWbsHqLOh yygbVeZXvhdp29fpvvDfUoSXE6VN20pYtNdRUGQ+aMFCTwGjikBQoMZJjzjYZQOG cN3HF/TDHLVKQHKsmkVJr5qHKoWEjG2duD/vQ1vd1PS1Lv+QtQxjuSLFZFU5Fmwd L0ujNLExlyosR0CyvuIQ+wzZldPDy0yrCHlfD69GYNyfYp1l6+9o4bR9glFVdzIP C6JBciipPuq+PmHfi8YuWI0pO5XCS0n0S2K1Jtp5iMgCeInUiAMKw1oPnrygTXBi K8SaiO9jjleA6GFeql4Tzf9swIYVXxtOrUkTS+lRmEX4hl8ZkyRC+2lMDcKk5O5m 4OmW6B5k0NFQ+oEkGnmW+6UzfdhXuDC/I42XHGMfAMf3aW3f671JjTllxS/1aQJE A2v1VgjHAVLHx0qRj0aucJGQveGK8wmpA9odZIokxu4KJPn42THFa2ITvWAk/hux dpYuh4d8PFU8ikHVu4rmXsvPFfpVUrFl389+P9jAziS41dCpqC5doo3TP+W+pz93 7d0gkSCPGPnPp7f/tXAcnISwQMeKvzqi0XzJN3xmCRXVdfsJNk8yxFF+KZ1JoZKW r+qQcwwXTkogq/+tBeNq =0f+g -----END PGP SIGNATURE-----

3 2

what makes client use mech=SIMPLE?
by Klavs Klavsen 04 Aug '10

04 Aug '10

Hi, I have many ubuntu 8.04 clients which all work fine with my ldap server. I am now trying to connect a 10.04 client to the server - but login fails - and the only difference in output (in the debug file on the server) is the mech=SIMPLE line in the client that works. The one that works: Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" mech=SIMPLE ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 RESULT tag=97 err=0 text= The one that fails: Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 RESULT tag=97 err=49 text= Any idea what makes the client try binding with mech=SIMPLE? or perhaps a hint as to why the first "method=128" doesn't work? I hope you have ideas :) Thank you in advance -- Regards, Klavs Klavsen, GSEC - kl(a)vsen.dk - http://www.vsen.dk "Those who do not understand Unix are condemned to reinvent it, poorly." --Henry Spencer

1 0

trying to understand referrals
by Khaled Blah 04 Aug '10

04 Aug '10

Hello all, I'm writing an LDAP application using OpenLDAP. First of all, thanks to the many contributors to this project! It's highly appreciated! Now, I'm trying to understand how I can implement an application that knows how to deal with referrals. I've implemented a function which I assign via ldap_set_rebind_proc, however I am not entirely sure what to do within this function that I assign to ldap_set_rebind_proc. What I've done so far is to parse the url parameter using ldap_url_parse and then assign the data from the LDAPURLDesc structure to my own data structure. Then I call ldap_init and ldap_bind_s in order to bind to the referral. However, it seems I am doing something wrong. Can anyone here give me any hints as to what to within that function that is assigned to ldap_set_rebind_proc? Thanks in advance! Regards, Khaled

2 4

ldapadd Naming Violation error 64
by Raymond Norton 03 Aug '10

03 Aug '10

Ubuntu server 10.0.4, ldap 2.4.21 I am getting the following error when attempting to use the ldapadd command: sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif (error) adding new entry "cn=module{0},cn=config" ldap_add: Naming violation (64) db.ldif: # Load modules for database type dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb # Create directory database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=2190-db,dc=org olcRootDN: cn=admin,dc=isd2190-db,dc=org olcRootPW: 1234 olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=isd2190-db,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=isd2190-db,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq ################################################## ######### # DEFAULTS MODIFICATION ################################################## ######### # Some of the defaults need to be modified in order to allow # remote access to the LDAP config. Otherwise only root # will have administrative access. dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {CRYPT}7hzU8RaZxaGi2 dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess

3 4

Query: simple authenticated bind request
by Vinay Kalkoti 03 Aug '10

03 Aug '10

Hi, I am trying to setup OpenLDAP client with user/password authenticated bind to authenticate against an OpenLDAP server. This is how my /etc/ldap.conf look like host xx.xx.xx.xx base dc=my_comp,dc=com bind_policy soft pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,ldap nss_schema rfc2307bis nss_map_attribute uniqueMember member ldap_version 3 pam_filter objectClass=posixAccount tls_checkpeer no #ssl on ssl no binddn cn=Administrator,dc=my_comp,dc=com <============ I am giving the root DN bindpw Administrator scope sub If I give the root DN, it works, But, if I give a non-root DN in binddn, I get "invalid credentials (49)" error. Does OpenLDAP server always require root DN for binding ?. Is there a way to provide non-root DN for binddn ? Thanks, Vinay

1 0

How to properly initialize the LDAP client library
by Ian Anderson 03 Aug '10

03 Aug '10

I'm using both libldap and libsasl2 in my application on Mac OS X. libldap itself uses libsasl2 internally on that platform, and it changes some of the libsasl2 globals (namely the mutex functions) during its initialization. My app uses libldap only in response to user actions, so libldap initialization happens at a fairly random time. This means the libsasl2 globals end up changing on me after I've been using libsasl2 for awhile in my app's lifecycle, and I end up getting random crashes because the mutex functions are all different from when I initially created the sasl client connection. So, my solution to this was to initialize libldap myself on app launch so that it can set up the libsasl2 environment as it wants to. I looked at the manual page for ldap(3) and ldap_initialize(3), and they seemed to suggest that I should use ldap_get_option to initialize OpenLDAP. Which option should I ask for though? I tried LDAP_OPT_API_INFO, but that ends up doing a DNS query which can really balloon my launch time depending on my network configuration. Is there a better option I could do that basically does nothing but initialize a few innocuous OpenLDAP globals without doing a significant amount of work? Ian

1 0

ldap_start_tls: Connect error (-11)
by Russell Knighton 02 Aug '10

02 Aug '10

Hi Everyone, I'm trying to set-up an new openldap service utilising TLS. At the moment, it all appears to work fine with out TLS, but unfortunately it always fails with it. The service is running on neptune.mps.lan (with a CNAME for ldap), and my client desktop box is called blacktip. The server is Ubuntu 10.04 LTS server, and the desktop is also Ubuntu 10.04; both with latest updates. I have created a Self signed CA and, after setting up the server keys, I have installed this onto the client. I then added the following line to the client /etc/ldap.conf: TLS_CACERT /etc/ssl/certs/slapd-ca-cert.pem This is the command I am running to test the connection: root@blacktip:~# ldapsearch -d 16383 -x -h ldap.mps.lan -ZZ -b dc=mps,dc=lan ldap_create ldap_url_parse_ext(ldap://ldap.mps.lan) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldap.mps.lan:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.0.203:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f1965937630 ptr=0x7f1965937630 end=0x7f196593764f len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x7f1965937630 ptr=0x7f1965937635 end=0x7f196593764f len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush2: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x7f196592f3a0 msgid 1 wait4msg ld 0x7f196592f3a0 msgid 1 (infinite timeout) wait4msg continue ld 0x7f196592f3a0 msgid 1 all 1 ** ld 0x7f196592f3a0 Connections: * host: ldap.mps.lan port: 389 (default) refcnt: 2 status: Connected last used: Mon Aug 2 16:48:35 2010 ** ld 0x7f196592f3a0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f196592f3a0 request count 1 (abandoned 0) ** ld 0x7f196592f3a0 Response Queue: Empty ld 0x7f196592f3a0 response count 0 ldap_chkResponseList ld 0x7f196592f3a0 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f196592f3a0 NULL ldap_int_select read1msg: ld 0x7f196592f3a0 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 78 07 0a 0....x.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e50 end=0x7f1965938e5c len=12 0000: 02 01 01 78 07 0a 01 00 04 00 04 00 ...x........ read1msg: ld 0x7f196592f3a0 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ read1msg: ld 0x7f196592f3a0 0 new referrals read1msg: mark request completed, ld 0x7f196592f3a0 msgid 1 request done: ld 0x7f196592f3a0 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ber_scanf fmt (}) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e5c end=0x7f1965938e5c len=0 ldap_msgfree tls_write: want=93, written=93 0000: 16 03 02 00 58 01 00 00 54 03 02 4c 56 e8 d3 01 ....X...T..LV... 0010: 2e bb 5d b7 71 7e ec ab 4c e0 6a 32 63 85 76 88 ..].q~..L.j2c.v. 0020: b9 12 b3 fc e3 56 fe 2a db 9a 0d 00 00 24 00 33 .....V.*.....$.3 0030: 00 45 00 39 00 88 00 16 00 32 00 44 00 38 00 87 .E.9.....2.D.8.. 0040: 00 13 00 66 00 2f 00 41 00 35 00 84 00 0a 00 05 ...f./.A.5...... 0050: 00 04 01 00 00 07 00 09 00 03 02 00 01 ............. tls_read: want=5, got=0 TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string ldap_start_tls: Connect error (-11) additional info: A TLS packet with unexpected length was received. As you can see, the TLS connection fails to negotiate. I have extensively googled this error but have not yet found a cause nor a solution. OpenLDAP server version: root@neptune:~# slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Apr 26 2010 11:08:43) $ buildd@yellow:/build/buildd/openldap-2.4.21/debian/build/servers/slapd Gnutls Library Version: root@neptune:~# aptitude show libgnutls26 | grep ^Ver Version: 2.8.5-2 Many thanks in advance for any help/advice given. Kind Regards, Russell Knighton --

2 3

Replication and uniqueness overlay
by Ondrej Kuznik 02 Aug '10

02 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, is there a way to disable uniqueness checking for replicated content? Our problem is that we have a database with no uniqueness checking and when trying to replicate to an enforcing one, it rejects the first offending entry and makes both nodes trying to restart the replication again and again, eating both traffic and cpu capacity. Thanks, Ondra Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkxWsI8ACgkQ9GWxeeH+cXszhQCgpKo28Yas1/LEJ8vWqFl8SzB/ VzAAn1IwVwZQdY0bommYNa2LesqkZa7N =Ing2 -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

back-sql mysql innodb
by Frederik Bosch 31 Jul '10

31 Jul '10

Hi all, Two weeks ago I also wrote to this mailinglist, but now my problem is much more clear. I succesfully installed slapd and managed to start it with back-sql. However, I have one problem. Once slapd has retrieved childs from a certain entry, it is not able to refresh it. A slapd restart is needed for that. The problem is due to the MySQL engine used: InnoDB. I discovered that when I converted my database to MyISAM, which had no problems at all. Upgrading myodbc to version 5.1.6 (I as on 3.51 before) did not help. Converting to MyISAM is not an option and was just for testing. Restarting the server each 5 minutes looks like a ugly solution to me. What could be wrong? Thank you. Frederik Bosch

2 4

Hmm. No one seems to be able to answer my question about SSL connections
by Bryan Boone 30 Jul '10

30 Jul '10

So I will try once more. I have successfully setup an openldap server using TLS. I generated self sign certs using http://www.openldap.org/faq/data/cache/185.html I have succussfully setup a client computer on a different computer than the server. I copied the cacert.pem to my client computer I can successfully run ldapsearch with the -ZZ option on the client PC. Now I want to write a client program in C that I can put on any PC, that will automatically download cacert.pem from the openldap server, and prompt a user to accept or reject the cacert.pem. If they accept it, I want to store the cert in the /etc/ssl/certs directory. If they do not accept the cert, I want to stop the connection. How do I accomplish this? I don't see any openldap functions that help me do this.

3 2

understanding referrals
by Khaled Blah 29 Jul '10

29 Jul '10

Hello all, I'm writing an LDAP application using OpenLDAP. First of all, thanks to the many contributors to this project! It's highly appreciated! Now, I'm trying to understand how I can implement an application that knows how to deal with referrals. I've implemented a function which I assign via ldap_set_rebind_proc, however I am not entirely sure what to do within this function that I assign to ldap_set_rebind_proc. What I've done so far is to parse the url parameter using ldap_url_parse and then assign the data from the LDAPURLDesc structure to my own data structure. Then I call ldap_init and ldap_bind_s in order to bind to the referral. However, it seems I am doing something wrong. Can anyone here give me any hints as to what to within that function that is assigned to ldap_set_rebind_proc? Thanks in advance! Regards, Khaled

1 0

DIT entry layout - multiple mail fields, mutiple mailboxes.
by Lauro Costa G. Borges 28 Jul '10

28 Jul '10

Is it possible to have an user entry with multiple "mail" fields mapping to multiple mailboxes (or mailroutingaddress, or something similar)? What I want is to group together "mail" field and "mailroutingaddress"(or maildrop) below an user entry (by "user entry" I mean a DN with obj. classes like inetorgperson, eduperson, postfixuser, etc): - "userdn" -- attr foo -- attr bar -- obj class xyz -- obj class abc -- "some sort of container" --- mail field --- "mail destination" field -- "another container" --- mail field 2 --- "mail destination" field 2 Note that lines with 3 "-"'s are children of lines with 2 "-"'s. However, if there is another way to accomplish this without "child" entries or "containers", please tell me. Thanks ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Finiky old OpenLDAP Server: To be or not to be...
by Kendall Gifford 28 Jul '10

28 Jul '10

Sorry for the somewhat vague email title but it is actually somewhat descriptive of a problem I'm having. I also apologize if this is the incorrect list for this question (I first subscribed to openldap-software@... but upon subscription the "welcome" message said it had been shut down and to use this list instead). I'm pretty new to the whole OpenLDAP (and LDAP in general) thing. I'm running an old OpenLDAP server (2.2.29) in a production environment. I recently needed to add some extra schema definitions for my postfix email server (attached as postfix.schema). I edited my slapd.conf file and included my schema file, then restarted the server. All is good so far... Skipping ahead in my story, to test things out I created the following LDIF below: dn: mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM mailDomain: example.com objectClass: top objectClass: mailDomainEntry mailDomainVirtual: FALSE The "organization unit" named "Email" already existed. I then ran sladadd: $ sudo slapadd -v -l data.ldif added: "mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM" (0000023e) I then ran ldapsearch to dump everything at or under my "Email" ou: $ ldapsearch -x -b "ou=Email,dc=EXAMPLE,dc=COM" This dumped the Email organization unit entry and nothing else. So, on a whim I re-ran the above slapadd command to retry adding a sub-entry beneath my "Email" entry. This time I got the following error: slapadd: could not add entry dn="mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) So, apparently it DID get added as this says it "already exists". Hmm, so I'll try to delete it: $ sudo ldapdelete -vx -D "cn=root,dc=EXAMPLE,dc=COM" \ -W "mailDomain=example.com,dc=EXAMPLE,dc=COM" ldap_initialize( <DEFAULT> ) Enter LDAP Password: ******** deleting entry "mailDomain=example.com,dc=EXAMPLE,dc=COM" Delete Result: No such object (32) Matched DN: dc=EXAMPLE,dc=COM So, now it doesn't exist? "To be or not to be?" Hmm. Anyhow, I've tried many search queries and used tools like phpLDAPadmin and JXplorer and cannot find this entry I've created/added. The only command/tool that claims it exists is slapadd when I try to add the same entry again. I know my server version is very very old (2005-ish?) but does anyone have any ideas or recommendations (besides the obvious "save/export your data and upgrade your server" kind which isn't an immediate option). Thanks in advance. I'm hoping I'm just doing something obviously stupid. -- Kendall Gifford

2 1

rebinding and following referrals on bind
by Arthur de Jong 27 Jul '10

27 Jul '10

Hello list, Is there a way to follow a referral on bind? I'm trying to get the PAM module in nss-pam-ldapd to follow referrals while binding. Background is available here [1]. If ldapserver1 refers a subtree to another server (server2) searches for a user are correctly continued on server2 (using ldap_set_rebind_proc()) but when I try to call ldap_simple_bind_s() on the connection that just returned the user from server2 I get "Invalid credentials". Is there a way to find out which LDAP server returned a specific entry or is there some other way to solve this? Thanks for any pointes. [1] http://lists.arthurdejong.org/nss-pam-ldapd-users/2010/msg00097.html -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

2 2

How to let users change their passwords?
by Steven Truong 27 Jul '10

27 Jul '10

Dear, all. I have been searching low and high for a tool that can let users to change their passwords in 389 DS or OpenLDAP? I think there is a real need for such a tool and I hope that people already wrote such a tool... Please share your ways of how you allow your users to change their passwords or other setup/architecture that allow this function. Beside that, I also recommend Apache Studio as a great tool to work with LDAP servers..... Thank you in advance.

5 5

Re: Server Side sort and the cn attribute
by Ladislav Pašek 27 Jul '10

27 Jul '10

Hello, is there any another solution for this then patching the source like here: http://www.openldap.org/lists/openldap-technical/201001/msg00078.html Lada > On Fri, Dec 11, 2009 at 1:31 PM, Edward Capriolo <edlinuxguru(a)gmail.com> wrote: >> We use openldap as a back end for many things. One of the thing, it >> can be used for is an address book for outlook. Recently we upgrade to >> 2.4.16->2.4.20 from 2.(who knows how old). >> >> Outlook 2003 clients stopped working: >> >> http://support.microsoft.com/kb/555536 >> >> So I followed the instructions here to enable server side sorting: >> >> http://bacedifo.blogspot.com/2009/09/server-side-sort-with-openldap2418.html >> >> I was able to add the ordering to the sn attribute. >> >> attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) >> DESC 'RFC2256: last (family) name(s) for which the entity is known by' >> ORDERING caseIgnoreOrderingMatch >> SUP name ) >> >> Unfortunately outlook is looking at the cn attribute >> >> @400000004b21316a0e808064 sssvlv: no ordering rule specified and no >> default ordering rule for attribute cn >> @400000004b21316a0e808834 <= get_ctrls: n=1 rc=18 err="serverSort >> control: No ordering rule" >> >> That unfortunately is not defined in the core.schema >> # system schema >> #attributetype ( 2.5.4.3 NAME ( 'cn' 'commonName' ) >> # DESC 'RFC2256: common name(s) for which the entity is known by' >> # SUP name ) >> >> I am sure there is a good reason why cn does not have an ordering, but >> I am guessing it used to have this in the distant past since this >> previously worked. So how would I go about changing the system schema? >> Or does anyone have a better way to deal with this. >> >> (I know I could play with client registry (kb) article but I would >> like to handle this server side) >> >> Thank you for your insights. >> > > To follow up, does anyone know why CN does not have any ordering rule? > Is their a way to add an ordering rule?

2 1

slappasswd2.4 output issue
by Stuart Cherrington 27 Jul '10

27 Jul '10

Hi, I'm writing a script to help my fellow admins automatically creates user accounts in OpenLDAP 2.4. Can provide copy of script if you would like it. The issue I have is encrypting the plain text word into passwd format, I found the very helpful slappasswd2.4 which seems to work so I put it into my script: echo $NEWPASS > /tmp/newpass chmod 400 /tmp/newpass slappasswd2.4 -h {crypt} -T /tmp/newpass > /tmp/passenc chmod 400 /tmp/passenc EPASS=`cat /tmp/passenc` It creates an entry in the passenc file which looks like this: {crypt}mHUqpeNah1BOQ But when i use this as a variable to the 'userpassword:' attribute then try to compare passwds within phpLDAPadmin it fails. Any hints would be appreciated. Thanks, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/195013117/direct/01/ We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now

2 5

Ldapsearch Error while using Back-NDB
by Priyesh Potdar 27 Jul '10

27 Jul '10

Hi, An error comes while searching in ldap compiled with NDB support. To reproduce the issue: 1) Import the below sample.ldif file to the database by issuing the following command: /usr/local/sbin/slapadd -l sample.ldif sample.ldif: dn: dc=dimdim,dc=com dc: dimdim description: My wonderful company as much text as you want to place in this line up to 32K continuation data for the line above must have <CR> or <CR><LF> i.e. ENTER works on both Windows and *nix system - new line MUST begin with ONE SPACE objectClass: dcObject objectClass: organization o: Example, Inc. dn: ou=people, dc=dimdim,dc=com ou: people description: All people in organisation objectclass: organizationalunit dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectclass: inetOrgPerson cn: Robert Smith cn: Robert Pagal cn: Howard Chu sn: smith uid: rjsmith userpassword: rJsmitH carlicense: HISCAR 123 homephone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com description: swell guy ou: Human Resources 2) Start the ldap server and issue the command to search: ldapsearch -H ldap://192.168.3.47 -x -D "dc=dimdim,dc=com" -b "dc=dimdim,dc=com" -w dimdim "(uid=rjsmith)" 3) It will return multiple results and that is the issue we are facing. Output of the command: # extended LDIF # # LDAPv3 # base <dc=dimdim,dc=com> with scope subtree # filter: (uid=rjsmith) # requesting: ALL # # Robert Smith, people, dimdim.com dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectClass: inetOrgPerson userPassword:: ckpzbWl0SA== description: swell guy sn: smith cn: Robert Smith cn: Robert Pagal cn: Howard Chu ou: Human Resources carLicense: HISCAR 123 homePhone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com uid: rjsmith # Robert Smith, people, dimdim.com dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectClass: inetOrgPerson userPassword:: ckpzbWl0SA== description: swell guy sn: smith cn: Robert Smith cn: Robert Pagal cn: Howard Chu ou: Human Resources carLicense: HISCAR 123 homePhone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com uid: rjsmith # Robert Smith, people, dimdim.com dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectClass: inetOrgPerson userPassword:: ckpzbWl0SA== description: swell guy sn: smith cn: Robert Smith cn: Robert Pagal cn: Howard Chu ou: Human Resources carLicense: HISCAR 123 homePhone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com uid: rjsmith # search result search: 2 result: 0 Success # numResponses: 4 # numEntries: 3 Kindly provide a solution for the same. -- Best Regards, Priyesh Potdar Dimdim Inc.

3 3

Re: OpenLDAP with MySQL Cluster - No free node Error
by Gavin Henry 27 Jul '10

27 Jul '10

On 03/06/10 13:18, Priyesh Potdar wrote: > Hi All, > > I am new to use of ndb with openLDAP. I have established a MySQL Cluster > in my network and also compiled the openLDAP with --enable-ndb option. > Now when I start the openLDAP with command "slapd -d 5" (To see the > debug output), I get the following error: > > Configuration error: Error : Could not alloc node id at 192.168.7.40 > port 1186: No free node id found for mysqld(API). Did you resolve this? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

Re: OpenLDAP to replace Oracle Internet Directory
by Gavin Henry 27 Jul '10

27 Jul '10

> I want thank every one responsible to keep OpenLDAP project with that high > level of quality and I am really proud about that kind of quality has been > produced by a free software project (free as in freedom). Excellent news! How is it going now? Did you use our docs to help you? Do you have any suggestions for improvements to the docs? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: acls help
by Gavin Henry 27 Jul '10

27 Jul '10

> Please, where can I found which ACLs are Denying > cn=postmaster,vd=social.com.br,o=hosting,dc=example,dc=tld ? > I only see, access_allowed, slap_access_allowed, backend default add > access denied. > I cannot do much more with this information. > How can I debug ACLs hardest? (Only acls, I already tryed -1 without > success (looking for denying information)) > Sorry my low know how in this issue, but I realy need to finish this job. > Thanks. "man slapacl" will help -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

how to add a new database with slapd.d?
by Zhang Weiwu 27 Jul '10

27 Jul '10

With Ubuntu 10.04, slapd is shipped by default using slapd.d configuration instead of slapd.conf. Referring to the document [1] I believe adding a new database should be as simple as adding a new file in slapd.d/cn=config/ But it doesn't work for me. Behavior explained below: I created this new database definition by copying example [2]: # cat "/etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb" # BDB definition for example.com dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: "dc=test,dc=com" olcDbDirectory: /var/lib/ldap olcRootDN: "cn=Manager,dc=test,dc=com" olcRootPW: secret olcDbIndex: uid pres,eq olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=test,dc=com" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=test,dc=com" write by * read According to my experience of using slapd.conf in the last five years, if I restart slapd, I should see DB_CONFIG and a few other files created in DB directory. But this is not happening this time. root@orphalese:~# ls -dlh /var/lib/ldap drwxr-x--- 2 openldap openldap 4.0K Jun 12 10:36 /var/lib/ldap root@orphalese:~# ls -lh /var/lib/ldap total 0 Quesiton: 1) did I do anything wrong? 2) What would you future suggest me to check? List of what I have checked: 1. Adding entry to the newly created database also doesn't work: # slapadd -b dc=test,dc=com < /tmp/first.ldif slapadd: slap_init no backend for "dc=test,dc=com" 2. I checked syslog with LogLevel set to 255, end up with a lot of details in syslog but none mentioning keyword 'hdb'. 3. The above experiment is re-done with hdb replaced with bdb without luck neither. 4. Authentication also fails: $ ldapsearch -x -D cn=Manager,dc=test,dc=com -w secret ldap_bind: Invalid credentials (49) 5. I also checked to make sure slapd.conf doesn't exist. 6. I also checked there is only one slapd.d directory and slapd is using the same slapd.d that I am editing, by the fact I changed LogLevel in cn=config.ldif and it has vivid effect on syslog. [1] http://www.openldap.org/doc/admin24/slapdconf2.html [2] The 'example' is "/etc/ldap/slapd.d/cn=config/olcDatabase=bdb" shipped with Ubuntu: # cat "/etc/ldap/slapd.d/cn=config/olcDatabase=bdb" # BDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: "dc=example,dc=com" olcDbDirectory: /usr/local/var/openldap-data olcRootDN: "cn=Manager,dc=example,dc=com" olcRootPW: secret olcDbIndex: uid pres,eq olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=example,dc=com" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read

3 7

"objectClass: olcBdbConfig" causes "ldap_add: Invalid syntax" error
by Zhang Weiwu 27 Jul '10

27 Jul '10

Hello. This is again the problem of adding a new database with cn=config structure. Since I asked last question I now have much more knowledge to ask again with more understandable description of the problem, thus new post here. In short the problem is "objectClass: olcBdbConfig" causes "ldap_add: Invalid syntax" error. Step 1: fresh new Ubuntu 10.04 installation with slapd package. (Production server is Debian, but home PC is Ubuntu, try at home first, there hardly can be difference on server packages like slapd between Ubutnu and Debian) Step 2: Not being able to find default credential to access cn=config I added my own, adding these two lines to /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif olcRootDN: cn=Manager,cn=config olcRootPW: secret And test the new credential works. (how do I test? [1]) Step 3: Adding a new database definition from ldif file. Error: # ldapadd -x -D cn=Manager,cn=config -w secret < /tmp/ldif adding new entry "olcDatabase=bdb,cn=config" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax The file that caused the error is attached below, I could not see anything wrong in it and it is mostly copied from document[2] example. # BDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=Manager,dc=example,dc=com olcRootPW: secret olcDbIndex: uid pres,eq olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=example,dc=com" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read [1] To verify the credential I added to cn=config is usable I did this: # ldapsearch -x -D cn=Manager,cn=config -w secret -b cn=config | tail ,cn=auth manage by * break olcRootDN: cn=Manager,cn=config olcRootPW: secret # search result search: 2 result: 0 Success # numResponses: 6 # numEntries: 5 [2] ending page of this document: http://www.openldap.org/doc/admin24/slapdconf2.html

3 3

openLDAP and SSL client/server certs
by Bryan Boone 27 Jul '10

27 Jul '10

Hi everyone. I am trying to develop an ldap client that uses SSL. I read in the documentation on the openldap website this... You must also install a copy of the CA certificate on all of your client machines. Configuration is done in /usr/local/etc/openldap/ldap.conf: TLS_CACERT /usr/local/etc/openldap/cacert.pem Does this mean that the function ldap_start_tls_s()performs mutual SSL authentication??? If I want to achieve server side authentication, does that mean I will have to use the openSSL libraries to get the server cert prior to using the ldap_start_tls_s() function???

2 1

More about libldap locking
by masarati＠aero.polimi.it 26 Jul '10

26 Jul '10

I'm having trouble in determining what mutex is related to what data in libldap's structures. For example, as far as I understand, lconn_refcnt in LDAPConn is tested and even modified without expressly locking any mutex. Logically, it seems to me that ld_conn_mutex should be the one. Could anybody please confirm this or provide insight? Thanks, p.

2 1

ldap_new_connection() mutex issue
by masarati＠aero.polimi.it 26 Jul '10

26 Jul '10

ldap_new_connection(), if ( connect ) and lconn_server->lud_exts contain the tls ext, first unlocks and then re-locks ld_req_mutex and ld_res_mutex. As far as I understand, while the former is actually held by the caller(s) of ldap_new_connection(), the latter is not. If this analysis is correct, I'll post an ITS. p.

2 5

ldap_sasl_bind_s() with DIGEST-MD5
by Shankar Anand R 26 Jul '10

26 Jul '10

Hi, The problem explained below must be fairly straightforward or even look silly for folks on this mailing list. Sorry for the trouble but I hope one of you might be willing to help a newbie. I am implementing an simple application that finds out a user's attributes using OpenLDAP. This a snippet of my code. ... BerValue cred; cred.bv_len = 10; cred.bv_val = strdup("mypassword"); ldap_sasl_bind_s(ld, "myuser", LDAP_SASL_SIMPLE /*NULL*/, &cred, NULL, NULL, NULL); This succeeds and I am able to proceed with my ldap_search_st() call. But since I don't want to send "mypassword" as plain text over the wire I opted for "DIGEST-MD5" ... BerValue cred; cred.bv_len = 10; cred.bv_val = strdup("mypassword"); ldap_sasl_bind_s(ld, "myuser", "DIGEST-MD5", &cred, NULL, NULL, NULL); This fails with the error 49 ldap_sasl_bind_s: Invalid credentials (49) additional info: 80090326: LdapErr: DSID-0C0904D1, comment: AcceptSecurityContext error, data 57, v1772 Note: I am using Active Directory. And I believe that my cyrus-sasl installation is good. I searched a lot but couldn't find the proper documentation for this. Do I have to fill up cred.bv_val differently while using DIGEST-MD5? Is there an OpenLDAP API to do that? Can someone explain or point me to the right documentation? Thanks and Regards, Shankar

5 9

attribute "reqEnd" undefined
by Peter Clark 26 Jul '10

26 Jul '10

Hello, I upgraded (portmanager on FreeBSD) my openldap install on a delta-synch master and client machines on Friday. All of the client machines upgraded without a hitch and restarted correctly. The master failed with this error on the console: /usr/local/etc/openldap/slapd.conf: line 60: index attribute "reqEnd" undefined Line 60 is from the accesslog definitions: # Accesslog database definitions database bdb suffix cn=accesslog directory /var/db/openldap-data/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart I changed the loglevel to -1 and tried to start the process. Here is the log output: Jul 26 08:12:04 vanity slapd[55419]: @(#) $OpenLDAP: slapd 2.4.23 (Jul 23 2010 16:39:09) $ blah@vanity:/usr/ports/net/openl dap24-server/work/openldap-2.4.23/servers/slapd Jul 26 08:12:04 vanity slapd[55419]: line 21 (gentlehup on) Jul 26 08:12:04 vanity slapd[55419]: line 24 (pidfile /var/run/openldap/slapd.pid) Jul 26 08:12:04 vanity slapd[55419]: line 25 (argsfile /var/run/openldap/slapd.args) Jul 26 08:12:04 vanity slapd[55419]: line 28 (modulepath /usr/local/libexec/openldap) Jul 26 08:12:04 vanity slapd[55419]: line 29 (moduleload back_bdb) Jul 26 08:12:04 vanity slapd[55419]: loaded module back_bdb Jul 26 08:12:04 vanity slapd[55419]: bdb_back_initialize: initialize BDB backend Jul 26 08:12:04 vanity slapd[55419]: bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) Jul 26 08:12:04 vanity slapd[55419]: module back_bdb: null module registered Jul 26 08:12:04 vanity slapd[55419]: line 35 (sizelimit 262144) Jul 26 08:12:04 vanity slapd[55419]: line 36 (timelimit 300) Jul 26 08:12:04 vanity slapd[55419]: line 39 (TLSCACertificateFile /usr/local/openssl/myCA/ca-cert.pem) Jul 26 08:12:04 vanity slapd[55419]: line 40 (TLSCertificateFile /usr/local/openssl/myCA/vanity.mtmary.edu.cert) Jul 26 08:12:04 vanity slapd[55419]: line 41 (TLSCertificateKeyFile /usr/local/openssl/myCA/vanity.mtmary.edu.key) Jul 26 08:12:04 vanity slapd[55419]: line 42 (TLSRandFile /dev/random) Jul 26 08:12:04 vanity slapd[55419]: line 55 (database bdb) Jul 26 08:12:04 vanity slapd[55419]: bdb_db_init: Initializing BDB database Jul 26 08:12:04 vanity slapd[55419]: line 56 (suffix cn=accesslog) Jul 26 08:12:04 vanity slapd[55419]: >>> dnPrettyNormal: <cn=accesslog> Jul 26 08:12:04 vanity slapd[55419]: <<< dnPrettyNormal: <cn=accesslog>, <cn=accesslog> Jul 26 08:12:04 vanity slapd[55419]: line 57 (directory /var/db/openldap-data/accesslog) Jul 26 08:12:04 vanity slapd[55419]: line 58 (rootdn cn=accesslog) Jul 26 08:12:04 vanity slapd[55419]: >>> dnPrettyNormal: <cn=accesslog> Jul 26 08:12:04 vanity slapd[55419]: <<< dnPrettyNormal: <cn=accesslog>, <cn=accesslog> Jul 26 08:12:04 vanity slapd[55419]: line 59 (index default eq) Jul 26 08:12:04 vanity slapd[55419]: line 60 (index entryCSN,objectClass,reqEnd,reqResult,reqStart) Jul 26 08:12:04 vanity slapd[55419]: index entryCSN 0x0004 Jul 26 08:12:04 vanity slapd[55419]: index objectClass 0x0004 Jul 26 08:12:04 vanity slapd[55419]: slapd destroy: freeing system resources. Jul 26 08:12:04 vanity slapd[55419]: slapd stopped. Jul 26 08:12:04 vanity slapd[55419]: connections_destroy: nothing to destroy. Any help in figuring this out would be appreciated. Peter

2 2

PAM not warning for password expiration
by Obbink, D. (Dannie) 26 Jul '10

26 Jul '10

Hello list, First of all; sorry if this is on the wrong list, reaches the wrong people, has been asked 1000 times before, or is just a basic or stupid question. Yes, I have searched Google and the mailing list archives. We (succesfully) implemented ppolicy on our 2.4.22 OpenLDAP server. Password constraints are enforced correctly, but letting the accounts expiry correctly seems a bit tricky. When users with an expired account try to log on to an application making a bind using the user's own credentials, everything works as expected; users cannot login, access gets denied. In the slapd logging, the following message is displayed: Jul 21 14:06:25 slapd2.4[27182]: ppolicy_bind: Entry uid=<user> has an expired password: 0 grace logins But when trying to log into PAM (ssh, su etc.), there is no warning displayed the account is expired. The user is also allowed to login normally. I've been Googling for a couple of days now, and can't really find the culprit. I was especially interested in this thread: http://www.openldap.org/lists/openldap-technical/201003/msg00197.html So, I've set pwdExpireWarning to 1 second less then pwdMaxAge. When I try to bind directly, such as with an ldapsearch, the logging shows Jul 22 15:31:56 slapd2.4[27182]: ppolicy_bind: Setting warning for password expiry for uid=<user> = 4318121 seconds So, that seems to be correct. But, when logging in via PAM, the log does not display the "setting warning". ldap.conf on the clients read: binddn cn=<binddn> base <base> bindpw <secret> <mailto:P4ons@Ldap> uri ldaps://<master1> <ldaps://<master1>> ldaps:// <ldaps://isibsu0019.iscbeheer.local> <master2> ssl yes bind_timelimit 2 tls_checkpeer yes tls_ciphers TLSv1 tls_cacertdir /etc/ssl/openldap2.4 pam_password crypt pam_check_host_attr yes pam_lookup_policy yes I think this is caused by PAM using the bindDN and then *querying* the user. So the server does not set a password expiry warning. But as I understood, "pam_lookup_policy" should ensure PAM trying to query for an expiry date. How can I configure PAM to display the "Your password will expire in ... days"? /etc/pam.d/system-auth: auth required /lib/security/$ISA/pam_tally2.so onerr=succeed audit auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth sufficient /lib/security/$ISA/pam_krb5.so use_first_pass auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so broken_shadow account sufficient /lib/security/$ISA/pam_localuser.so account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account [default=bad success=ok user_unknown=ignore service_err=ignore] /lib/security/$ISA/pam_ldap.so account [default=bad success=ok user_unknown=ignore service_err=ignore] /lib/security/$ISA/pam_krb5.so account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 type= password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password sufficient /lib/security/$ISA/pam_ldap.so use_authtok password sufficient /lib/security/$ISA/pam_krb5.so use_authtok password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session optional /lib/security/$ISA/pam_krb5.so sshd_config shows "UsePAM yes" Again, sorry if this is not a question for this list. Thanks you for any responses, Dannie Obbink -------------------------Disclaimer------------------------------- De informatie verzonden met dit e-mailbericht (en bijlagen) is uitsluitend bestemd voor de geadresseerde(n) en zij die van de geadresseerde(n) toestemming kregen dit bericht te lezen. Gebruik door anderen dan geadresseerde(n) is verboden. De informatie in dit e-mailbericht (en bijlagen) kan vertrouwelijk van aard zijn en kan binnen het bereik vallen van een geheimhoudingsplicht en een verschoningsrecht. -------------------------------------------------------------------

1 0

OpenLDAP for lager number of entries
by Marcelo 25 Jul '10

25 Jul '10

Hi, My organization works with public software, and we are interested in use OpenLDAP to control close of 100,000,000 users. Is it a good idea? What kind of database can we use? Is there some research that points what is the limit for the volume of users? Thanks, Marcelo

2 1

Re: segmentation fault when attempting to delete olcOverlay={0}syncprov entry in cn=config (Runtime) Configuration
by jon brandt 23 Jul '10

23 Jul '10

Here is the # of the bug report on bugzilla. Bug 625219 Submitted "OpenLDAP server 2.4.21-47.1 crashes (segmentation fault) when deleting syncprov overlay entry in cn=config configuration" On Thu, Jul 22, 2010 at 2:06 AM, Ralf Haferkamp <rhafer(a)suse.de> wrote: > Am Mittwoch 21 Juli 2010, 20:02:43 schrieben Sie: > > Hi Ralf, > > Sorry for not replying to the entire list, but I have 2 reasons: > > > > 1) I am working on adding the bug report to bugzilla (got my account, > > ect.) ... wasn't sure what product to file the bug under. > openSUSE 11.3 should be fine in your case. (BTW, which product did you > install the 2.4.21 package on?) > > > 2) While searching around other "openLdap" bug reports I found this > > one: *Bug 384787 - OpenLDAP packages do not contain overlays ( > > https://bugzilla.novell.com/show_bug.cgi?id=384787 ) > > *Which is EXACTLY my other issue I am trying to figure out ;o) ... > > Before I submit a detailed report at OpenLDAP.org, maybe you can > > answer this question for me (I can then post in a new email thread as > > not to mess up the current "delete issue" thread). > > > > In 384787, you say that all the overlays are "compiled statically into > > the slapd daemon". How do I fill in the olcModulePath value? I have > > this, and it doesn't seem to be working: > > > > dn: cn=module{0} > > objectClass: olcModuleList > > cn: module{0} > > olcModulePath: ../../../servers/slapd/overlays > > olcModuleLoad: {0}syncprov.la > As the overlays are compiled statically into the slapd binary there is no > need to load any module. So you can just leave out the cn=module object. > > > I still get this error message on both my servers ("do_syncrep2: got > > search entry withour Sync State control"). How do I configure the > > syncprov.laproperly in cn=config ... It works just fine the old way > > using slapd.conf > > files ... > It's a bit hard to tell, what got wrong there. But it could be e.g. that > you try to replicate a database which doesn't have the syncprov overlay > configured. Take a look at your provider's configuration and check that > each database that you want to replicate has the syncprov overlay > configured. If that doesn't help. Open a new thread on openldap-technical > containing the complete configuration (excluding the Schema) for the > provider and the consumer. > > regards, > Ralf > > > On Wed, Jul 21, 2010 at 11:54 AM, Ralf Haferkamp <rhafer(a)suse.de> > wrote: > > > Am Mittwoch 21 Juli 2010, 18:26:58 schrieb jon brandt: > > > > Thanks for the reply Ralf! > > > > > > > > I got the RPMs for SUSE I believe (i.e. I didn't build the server > > > > myself), so I'm assuming the DSLAP_CONFIG_DELETE flag was used. > > > > > > Yes, probably. Might I ask you to open a bug report at > > > bugzilla.novell.com? So we can fix it and probably release an > > > updated RPM. > > > > > > > All > > > > the other deletes work fine (I'm adding then deleting other > > > > directives, for example olcMirrorMode or olcDbIndex and those > > > > delete just fine from cn=config). > > > > > > Yes. The problematic thing is deleting complete objects (e.g. > > > overlays, databases). Deleting single Attributes should work just > > > fine and doesn't require -DSLAP_CONFIG_DELETE. > > > > > > > I will try to upgrade to a newer version > > > > and see if that helps. > > > > > > It'll probably just deny to execute the operations (e.g. when > > > removing overlay entries from the frontend or config db). But I > > > consider that better than crashing the server :). > > > > > > regards, > > > > > > Ralf > > > > > > > > What is strange is that this fails on most of > > > > the servers I have setup, but there there is one server that has a > > > > bit more horsepower that doesn't have the issue, so this leads me > > > > to believe it is a timing related issue. > > > > > > > > On Wed, Jul 21, 2010 at 9:18 AM, Ralf Haferkamp <rhafer(a)suse.de> > wrote: > > > > > Am Dienstag 20 Juli 2010, 20:25:46 schrieb jon brandt: > > > > > > I looked but couldn't find a match to this issue, so was > > > > > > wondering if anyone else has seen something like it or can > > > > > > tell what might be wrong in my configuration. Thanks in > > > > > > advance! > > > > > > > > > > > > I'm using OpenLDAP version 2.4.21-47.1 (here is the relevant > > > > > > output from "rpm -qa | grep ldap" on my server): > > > > > > > > > > > > openldap2-client-2.4.21-51.1 > > > > > > openldap2-2.4.21-47.1 > > > > > > openldap2-back-meta-2.4.21-51.1 > > > > > > > > > > > > I'm trying to get Multi-master replication working between 2 > > > > > > servers. In my testing, I have discovered that when I try to > > > > > > reset the server (remove the configuration and start again) it > > > > > > crashes when trying to remove the > > > > > > olcOverlay={0}syncprov,olcDatabase={0}config,cn=config entry > > > > > > in the cn=config tree. I attached a screen shot of the > > > > > > output from tracing with slapd -d -1 when the fault happened > > > > > > in the attached file called * segFaultOutput.bmp.* > > > > > > > > > > > > If I restart the server, I can run the test again (which > > > > > > configures the olcOverlay={0}syncprov entry and then removes > > > > > > it) and it will work the first time, but if I run it a second > > > > > > time it will crash. > > > > > > > > > > Hm, did you build your server with -DSLAP_CONFIG_DELETE? If yes, > > > > > please note that delete support in cn=config is still > > > > > experimental. So please test again with cvs HEAD if it works > > > > > there. There have been some changes/fixes in that area > > > > > recently. > > > > > > > > > > If you didn't compile with -DSLAP_CONFIG_DELETE please make a > > > > > bugreport slapd should have rejected the delete operation in > > > > > that case. >

1 0

segmentation fault when attempting to delete olcOverlay={0}syncprov entry in cn=config (Runtime) Configuration
by jon brandt 23 Jul '10

23 Jul '10

I looked but couldn't find a match to this issue, so was wondering if anyone else has seen something like it or can tell what might be wrong in my configuration. Thanks in advance! I'm using OpenLDAP version 2.4.21-47.1 (here is the relevant output from "rpm -qa | grep ldap" on my server): openldap2-client-2.4.21-51.1 openldap2-2.4.21-47.1 openldap2-back-meta-2.4.21-51.1 I'm trying to get Multi-master replication working between 2 servers. In my testing, I have discovered that when I try to reset the server (remove the configuration and start again) it crashes when trying to remove the olcOverlay={0}syncprov,olcDatabase={0}config,cn=config entry in the cn=config tree. I attached a screen shot of the output from tracing with slapd -d -1 when the fault happened in the attached file called * segFaultOutput.bmp.* If I restart the server, I can run the test again (which configures the olcOverlay={0}syncprov entry and then removes it) and it will work the first time, but if I run it a second time it will crash. Here is the configuration from the ldif files in /etc/openldap/slapd.d *cn=config.ldif:* dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: 8d35d270-286b-102f-998d-8313efe688a2 creatorsName: cn=config createTimestamp: 20100720165657Z entryCSN: 20100720165733.055688Z#000000#00c#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100720165733Z contextCSN: 20100720165732.317584Z#000000#000#000000 contextCSN: 20100720165733.125549Z#000000#00c#000000 *cn=schema.ldif*: dn: cn=schema objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: 8d35e49a-286b-102f-998e-8313efe688a2 creatorsName: cn=config createTimestamp: 20100720165657Z entryCSN: 20100720165657.613177Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100720165657Z *olcDatabase={0}config.ldif*: dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcRootDN: cn=manager,cn=config olcRootPW:: Y29uZmln structuralObjectClass: olcDatabaseConfig entryUUID: 8d37bc20-286b-102f-9993-8313efe688a2 creatorsName: cn=config createTimestamp: 20100720165657Z entryCSN: 20100720165657.625245Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100720165657Z *olcDatabase={1}bdb.ldif:* dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=phoenix,dc=com olcRootDN: cn=manager,dc=phoenix,dc=com olcRootPW:: c2VjcmV0 structuralObjectClass: olcBdbConfig entryUUID: 8d37ea88-286b-102f-9995-8313efe688a2 creatorsName: cn=manager,cn=config createTimestamp: 20100720165657Z entryCSN: 20100720165733.125549Z#000000#00c#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100720165733Z *olcDatabase={-1}frontend.ldif:* dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 8d37c1a2-286b-102f-9994-8313efe688a2 creatorsName: cn=config createTimestamp: 20100720165657Z entryCSN: 20100720165657.625397Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100720165657Z the cn=schema directory has the following (I'm not going to paste the contents of these files): cn={0}core.ldif cn={1}cosine.ldif cn={2}inetorgperson.ldif cn={3}nis.ldif

3 5

back-sql caching
by Frederik Bosch 23 Jul '10

23 Jul '10

Hello, With BackSQL I am trying to make my SQL data available for LDAP purposes. Setup went OK, server starts and my data is available. I have one problem. Modifications in the SQL data do not seem to be executed until I restart slapd. As if the SQL data is cached. My setup uses openldap_2.4.11-1+lenny1 which I recompiled using debuild to enable backsql. My sqlserver is MySQL 5.0.5. So, starting slapd won't generate any errors or problems. When I delete or modify a row - with an other interface (directly accessing the SQL server) then LDAP - slapd does not seem to notify the changes. By enabling query logging for MySQL I found out that it actually executes a new SQL statement. So the problem seems to take place when the resultset is processed. Inserting a new row to ldap_entries gives exactly the same problem. It is not found until the slapd is restarted. When I started slapd with -d 16383 I found the line <==backsql_oc_get_candidates(): 0 which confirms my problem in this case. Annoyingly, restarting the server solves the problem (temporarily). The data modifications are found and the correct tree is available. In order to maintain correct data I could restart slapd each 5 minutes, but I think such a solution should be avoided in any case. Does anyone have a suggestion what could be wrong with my setup? Thanks in advance. Frederik Bosch

2 3

Error "got search entry without sync state control" on N-Way Multimaster cn=config Runtime Configuration
by jon brandt 23 Jul '10

23 Jul '10

I'm getting this error when trying to get N-Way Multimaster configuration working between two servers using cn=config (Runtime Configuration) method: "do_syncrep2: rid=002 got search entry without SyncState control" >From some searching around, I found out this normally means the provider side doesn't have the syncprov overlay configured correctly. I think I have the correct syncprov overlay configured in both my servers (I get the same error on both), but I must have something messed up. I did find this very helpful link in the SUSE bugzilla database (bug 384787): https://bugzilla.novell.com/show_bug.cgi?id=384787 This cleared up some confusion I had with regard to the olcModuleLoad: syncprov.la which the OpenLDAP documentation describes as needed in cn=config. Apparently that is out of date info according to Ralf H. who responded to the above report. He mentions that the overlays are compiled into slapd now, so this isn't needed. Thanks Ralf! Anyway, with or without the olcModuleLoad stuff, my configuration still doesn't work correctly. Here it is, and any help is very much appreciated! Note that I left out the schema ldif files below, they are the following standard ones: core, cosine, inetorgperson, nis. Server 1 (linux-h4bt): *cn=config.ldif* dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: b0a2110e-2926-102f-9fef-bbe8cc5f05fe creatorsName: cn=config createTimestamp: 20100721151632Z olcServerID: 3 entryCSN: 20100721160215.521297Z#000000#000#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160215Z contextCSN: 20100721160232.622424Z#000000#003#000000 *cn=module{0}.ldif* dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: ../../../servers/slapd/overlays olcModuleLoad: {0}syncprov.la structuralObjectClass: olcModuleList entryUUID: 1d89971e-292d-102f-9f46-af88272e60b3 creatorsName: cn=manager,cn=config createTimestamp: 20100721160232Z entryCSN: 20100721160232.622424Z#000000#003#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160232Z *olcDatabase={0}config.ldif* dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcRootDN: cn=manager,cn=config olcRootPW:: Y29uZmln structuralObjectClass: olcDatabaseConfig entryUUID: b0a2daa8-2926-102f-9ff5-bbe8cc5f05fe creatorsName: cn=config createTimestamp: 20100721151632Z entryCSN: 20100721151632.935961Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100721151632Z *olcDatabase={1}bdb.ldif* dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=phoenix,dc=com olcRootDN: cn=manager,dc=phoenix,dc=com olcRootPW:: c2VjcmV0 structuralObjectClass: olcBdbConfig entryUUID: b0a2ed7c-2926-102f-9ff7-bbe8cc5f05fe creatorsName: cn=manager,cn=config createTimestamp: 20100721151632Z olcAccess: {0}to attrs=userPassword by * auth by * +0 break olcAccess: {1}to * by dn.base="cn=manager,dc=phoenix,dc=com" read by * +0 br eak olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcSyncrepl: {0}rid=002 provider=ldap://unidome88xxx bindmethod=simple timeout =0 binddn="cn=manager,dc=phoenix,dc=com" credentials="secret" starttls=no fil ter="(objectclass=*)" searchbase="ou=users,dc=phoenix,dc=com" scope=sub attrs ="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" olcMirrorMode: TRUE entryCSN: 20100721160215.966913Z#000000#003#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160215Z *olcDatabase={-1}frontend.ldif* dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: b0a2dddc-2926-102f-9ff6-bbe8cc5f05fe creatorsName: cn=config createTimestamp: 20100721151632Z entryCSN: 20100721151632.936051Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100721151632Z *olcOverlay={0}syncprov.ldif* dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 structuralObjectClass: olcSyncProvConfig entryUUID: 135f0e4a-292d-102f-9f45-af88272e60b3 creatorsName: cn=manager,cn=config createTimestamp: 20100721160215Z entryCSN: 20100721160215.566453Z#000000#003#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160215Z Server 2 (unidome88xxx): *cn=config.ldif* dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: 24af41c0-292c-102f-9291-b374f89e9aa0 creatorsName: cn=config createTimestamp: 20100721155535Z olcServerID: 2 entryCSN: 20100721160201.051314Z#000000#000#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160201Z contextCSN: 20100721160215.084570Z#000000#002#000000 *cn=module{0}.ldif* dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: ../../../servers/slapd/overlays olcModuleLoad: {0}syncprov.la structuralObjectClass: olcModuleList entryUUID: 1315872a-292d-102f-8dcc-97104602b49d creatorsName: cn=manager,cn=config createTimestamp: 20100721160215Z entryCSN: 20100721160215.084570Z#000000#002#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160215Z *olcDatabase={0}config.ldif* dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcRootDN: cn=manager,cn=config olcRootPW:: Y29uZmln structuralObjectClass: olcDatabaseConfig entryUUID: 24b12f3a-292c-102f-9297-b374f89e9aa0 creatorsName: cn=config createTimestamp: 20100721155535Z entryCSN: 20100721155535.129218Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100721155535Z *olcDatabase={1}bdb.ldif* dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=phoenix,dc=com olcRootDN: cn=manager,dc=phoenix,dc=com olcRootPW:: c2VjcmV0 structuralObjectClass: olcBdbConfig entryUUID: 24b1553c-292c-102f-9299-b374f89e9aa0 creatorsName: cn=manager,cn=config createTimestamp: 20100721155535Z olcAccess: {0}to attrs=userPassword by * auth by * +0 break olcAccess: {1}to * by dn.base="cn=manager,dc=phoenix,dc=com" read by * +0 br eak olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcSyncrepl: {0}rid=002 provider=ldap://linux-h4bt bindmethod=simple timeout=0 binddn="cn=manager,dc=phoenix,dc=com" credentials="secret" starttls=no filte r="(objectclass=*)" searchbase="ou=users,dc=phoenix,dc=com" scope=sub attrs=" *,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" olcMirrorMode: TRUE entryCSN: 20100721160201.689045Z#000000#002#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160201Z *olcDatabase={-1}frontend.ldif* dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 24b134a8-292c-102f-9298-b374f89e9aa0 creatorsName: cn=config createTimestamp: 20100721155535Z entryCSN: 20100721155535.129372Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100721155535Z *olcOverlay={0}syncprov.ldif* dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 structuralObjectClass: olcSyncProvConfig entryUUID: 0adcc5dc-292d-102f-8dcb-97104602b49d creatorsName: cn=manager,cn=config createTimestamp: 20100721160201Z entryCSN: 20100721160201.290849Z#000000#002#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20100721160201Z * *

2 2

acls help
by Juliano Rodrigues 23 Jul '10

23 Jul '10

Hello, Im using Phamm, its an php-web front-end to manage ldap postfix virtual hosting mail env. at my Fedora 11 box (openldap 2.4.15-7). Its designed to manage multi roles access: Admin/Manager (full access) postmaster (manage accounts under own domain) account/user (manage own account only) Install instructions from Phamm autor, recommends to do an include at end of slapd.conf to phamm.acl file. But its not working here, only Admin or Manager (rootdn) can write changes. User postmaster cannot write and account users have read only access as well. Below I post phamm.acl, Please, Can anyone help me with this acls issue? Thanks! Juliano. --- phamm.acl --- access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=userPassword by dn="cn=admin,dc=example,dc=tld" write by self write by anonymous auth by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=amavisBypassVirusChecks,quota,smtpAuth,accountActive by dn="cn=admin,dc=example,dc=tld" write by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/editAccounts & [TRUE]" write by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" read by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=cn,sn,uid,forwardActive,vacationActive,vacationInfo,vacationStart,vacationEnd,vacationForward,amavisSpamTagLevel,amavisSpamTag2Level,amavisSpamKillLevel by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$1]" write access to dn.regex="^.*,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=editAccounts by dn="cn=admin,dc=example,dc=tld" write by self read by set.expand="user/editAccounts & [TRUE]" write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by * none access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=objectClass,entry by dn="cn=admin,dc=example,dc=tld" write by self write by anonymous read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/editAccounts & [TRUE]" write by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" read access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=amavisBypassSpamChecks,accountActive,delete by dn="cn=admin,dc=example,dc=tld" write by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=otherPath by dn="cn=admin,dc=example,dc=tld" write by anonymous read by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" read by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=createMaildir,vdHome,mailbox,otherTransport by dn="cn=admin,dc=example,dc=tld" write by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/vd & [$1]" read access to dn.regex="^(.+,)?vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=vd by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$2,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$2]" write access to dn.regex="^(.+,)?vd=([^,]+),o=hosting,dc=example,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/editAccounts & [FALSE]" read by dn.exact,expand="cn=postmaster,vd=$2,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$2]" write access to dn.regex=".+,o=hosting,dc=example,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by anonymous auth access to dn.regex=".+,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by anonymous auth access to dn.regex=".+,ou=admin,dc=example,dc=tld$" attrs=userPassword by dn="cn=admin,dc=example,dc=tld" write by self write by anonymous auth access to dn.regex=".+,ou=admin,dc=example,dc=tld$" attrs=vd by dn="cn=admin,dc=example,dc=tld" write by self read access to dn.regex="ou=admin,dc=example,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by self read --- end ---

2 5

Global shadowMax and shadowMin
by mj romero 23 Jul '10

23 Jul '10

Hello everyone, I have a doubt. Sorry if a silly question...Is it possible to define the attributes shadowMax and shadowMin globally? ie, is it possible that all entries in the LDAP inherit those attributes of a particular entry? Thank you very much. _________________________________________________________________ Prepárate para la multitud de novedades que Hotmail tiene para ti http://explore.live.com/windows-live-hotmail

1 0

OpenLDAP, MS AD and SASLauthd
by OSHIM 23 Jul '10

23 Jul '10

hi all, i configured two systems for OpenLDAP authentication with MS AD, I have used SASLauthd between them. one is on debian and another one is on centos. But I am getting a strange problem. If I change my user password on MS AD then OpenLDAP on debian can authenticate the old passwd and the new passwd, after 1 hr the old passwd does npt get valid. and on centos Openldap can recognize the new passwd of MS AD if I change the user passwd twice at a time then the old passwd does not get valid. Anyone have got this problem? Any solution? Please help. Thanks Oshim

2 1

Design question
by Isaac Hailperin 23 Jul '10

23 Jul '10

Hi, currently I am redesigning the ldap server for a site which has about 700 users, with approximatly 200 new user per year, and maybe a little less dropping out every year. The information about the lifetime of an account is kept in a different database(mysql). Thus, in order to check if an account is expired, I need to check with that database. While this might not be the happiest situation, it is partly due to historical rereasons, partly due to other restrictions beyond my reach. In any case, there is nothing I can do about it. Now I would like to have a way to make shure that usernames and numerical uids will never get reused. Also, I would like to keep trac of who had an account, sort of a history. Two ideas came to my mind: 1. Have an "expired" flag in the schema. Records with the expired flag would be blocked from login with an appropriate acl. 2. Have an archive subtree, where expired records get moved to. The beauty of the first idea seems to me that it is very simple. The downside is that there would be two places where the expired flag would live, the ldap server and the other database (see above). Also, over the years, the number of records in the people subtree would grow and grow (not shure if this is an disadvantage though). The beauty of the second idea is that the people subtree would be "clean", containing only active accounts. The downside seems to me that it looks a bit more involved. Now I was wondering how other people have solved this, or if anyone would favor on of the solution. thank you, Isaac

3 4

How to check LDAP replication status?
by Proskurin Kirill 22 Jul '10

22 Jul '10

Hello all. I have one master LDAP and many slaves. I want to check what replication to slaves are ok - how can I do it? -- Best regards, Proskurin Kirill

5 9

Able to delete olcDbIndex config attribute, but not add it.
by Ian Collins 22 Jul '10

22 Jul '10

Hello, While attempting to add an extra index to an existing config, I was able to (accidentally!) delete the attribute, but not add it back: dn: olcDatabase={1}hdb,cn=config changetype: modify delete: olcDbIndex modifying entry "olcDatabase={1}hdb,cn=config" dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: objectClass eq - ldapmodify: wrong attributeType at line 8, entry "olcDatabase={1}hdb,cn=config" Is this a bug, or have I done something stupid? -- Ian.

2 2

OpenLDAP authenticate the username/password with MS-AD?
by OSHIM 20 Jul '10

20 Jul '10

Hi, I need a help from you guys. Anyone know how to customize Squid, Dansguardian, Postfix, Samba to use OpenLDAP and let OpenLDAP authenticate the username/password with MS-AD? Thanks Oshim

3 26

So I finally upgraded from slurpd...
by Kolbjørn Barmen 20 Jul '10

20 Jul '10

Hello Let me start by introducing myself briefly: * I'm a sysadm at the Norwegian NREN (UNINETT) * As sysadm here, I end up doing a heck lot of things at once, and our LDAP servers are really just tiny (but important) pieces in our huge puzzle that is our network infrastructure. Point being, I dont have the capasity to "know it all", or RTFM (and comprehend) everything I'm involved with, things just tend to drop into my lap. * I'm not paricularly interested or fond of LDAP as such :) * I have also no particular interest in diving into LDAP and become some sort of LDAP-wizzard in the future I just felt mentioning the above before anyone throw me an RTFM ;) Anyways... I have at last upgraded a system from using slurpd (debian etch, slapd 2.3.30) to using replsync, at least that was the intention. Let me start with the scenario: * one master LDAP-server with a web frontend (old modified GOsa) * 30ish slave LDAP-servers spread around on various institutions * on the master LDAP-server, each institution has its own branch, like dc=foo,dc=no ; dc=bar,dc=no etc. * each slave is supposed to replacicate only its own branch, for exmple server.foo.no only has dc=foo,dc=no replicated from the master * for each dc=foo,dc=no there is an admin user, eg. cn=admin,dc=foo,dc=no that has all rights granted to the according subtree dc=foo,dc=no That in all its simplity i the scenario. With slurpd I had in masters slapd.conf entries like this: replica host="server.foo.no" suffix="dc=foo,dc=no" binddn="cn=admin,dc=foo,dc=no" credentials="f00bAr123" bindmethod="simple" tls="critical" and on the slaves, (running 2.4.23, they were upgraded some time ago): updatedn "cn=admin,dc=foo,dc=no" updateref ldap://masterserver.uninett.no/ This worked fine, apart from occations of out-of-sync every now and then. Now, with upgraded master - I have yet to get any replication working. Which sync method is most likely the best for my scenario? On master I have added: =================== ... moduleload syncprov.la moduleload back_ldap.la ... # and under database, it looks like this: database bdb suffix "dc=no" directory "/var/lib/ldap" rootdn "cn=root,dc=no" rootpw {SMD5}XXXXXXXXXXXXXXXXXXXXXXXXXXX= index objectClass eq index uid,gidNumber,uidNumber,memberUid pres,eq index mail,gosaMailAlternateAddress pres,eq,sub index gosaUser,gosaObject pres,eq,sub index zoneName,relativeDomaiNname pres,eq lastmod on sizelimit 4000 overlay syncprov syncprov-checkpoint 1000 60 syncprov-sessionlog 100 # and some access lists access to dn.regex="dc=([^,]+),dc=no$" attrs=userPassword,sambaLMPassword,sambaNTPassword,goImapPassword by dn.regex="^cn=admin,dc=$1,dc=no$" write by anonymous auth by self write by * none access to dn.base="" by * read access to dn.regex="dc=([^,]+),dc=no$" by dn.regex="^cn=admin,dc=$1,dc=no$" write by * read =================== And on slave: =================== ... ... database bdb suffix "dc=foo,dc=no" directory "/var/lib/ldap" rootdn "cn=admin,dc=foo,dc=no" rootpw {SMD5}XXXXXXXXXXXXXXXXXXXXXXXXXXX= index objectclass,entryCSN,entryUUID eq index uid,gidNumber,uidNumber,memberUid pres,eq index mail,gosaMailAlternateAddress pres,eq,sub lastmod on sizelimit 4000 # updatedn "cn=admin,dc=foo,dc=no" # updateref ldap://masterserver.uninett.no/ syncrepl rid=123 provider=ldaps://masterserver.uninett.no:636/ type=refreshOnly interval=00:00:00:10 retry="60 +" searchbase="dc=foo,dc=no" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=foo,dc=no" credentials="f00bAr123" access to attrs=userPassword,sambaLMPassword,sambaNTPassword,goImapPassword by anonymous auth by self write by * none access to dn.base="" by * read access to * by * read =================== I have (in good tradition) done a slapcat of the subtree dc=foo,dc=no on the master and copied over the ldif to the slave, and there used slapadd to create the entire database from scratch, so the content is identical. When I start slapd on the slave I get on the slave: =================== 18:37:50 server.foo.no slapd[7971]: @(#) $OpenLDAP: slapd 2.4.23 (Jul 5 2010 18:35:50) $ ^Iroot@localhost:/home/kolla/openldap/openldap-2.4.23/debian/build/servers/slapd 18:37:50 server.foo.no slapd[7972]: slapd starting 18:37:50 server.foo.no slapd[7972]: syncrepl_message_to_entry: rid=123 mods check (objectClass: value #0 provided more than once) 18:37:50 server.foo.no slapd[7972]: do_syncrepl: rid=123 rc 20 retrying 18:38:50 server.foo.no slapd[7972]: syncrepl_message_to_entry: rid=123 mods check (objectClass: value #0 provided more than once) 18:38:50 server.foo.no slapd[7972]: do_syncrepl: rid=123 rc 20 retrying =================== And on the master: =================== 18:37:50 ratatosk slapd[9162]: conn=1069 fd=16 ACCEPT from IP=NNN.NN.NN.NN:43227 (IP=0.0.0.0:636) 18:37:50 ratatosk slapd[9162]: conn=1069 fd=16 TLS established tls_ssf=256 ssf=256 18:37:50 ratatosk slapd[9162]: conn=1069 op=0 BIND dn="cn=admin,dc=foo,dc=no" method=128 18:37:50 ratatosk slapd[9162]: conn=1069 op=0 BIND dn="cn=admin,dc=foo,dc=no" mech=SIMPLE ssf=0 18:37:50 ratatosk slapd[9162]: conn=1069 op=0 RESULT tag=97 err=0 text= 18:37:50 ratatosk slapd[9162]: conn=1069 op=1 SRCH base="dc=foo,dc=no" scope=2 deref=0 filter="(objectClass=*)" 18:37:50 ratatosk slapd[9162]: conn=1069 op=1 SRCH attr=* + 18:37:50 ratatosk slapd[9162]: conn=1069 op=2 UNBIND 18:37:50 ratatosk slapd[9162]: conn=1069 fd=16 closed 18:38:50 ratatosk slapd[9162]: conn=1070 fd=16 ACCEPT from IP=NNN.NN.NN.NN:43239 (IP=0.0.0.0:636) 18:38:50 ratatosk slapd[9162]: conn=1070 fd=16 TLS established tls_ssf=256 ssf=256 18:38:50 ratatosk slapd[9162]: conn=1070 op=0 BIND dn="cn=admin,dc=foo,dc=no" method=128 18:38:50 ratatosk slapd[9162]: conn=1070 op=0 BIND dn="cn=admin,dc=foo,dc=no" mech=SIMPLE ssf=0 18:38:50 ratatosk slapd[9162]: conn=1070 op=0 RESULT tag=97 err=0 text= 18:38:50 ratatosk slapd[9162]: conn=1070 op=1 SRCH base="dc=foo,dc=no" scope=2 deref=0 filter="(objectClass=*)" 18:38:50 ratatosk slapd[9162]: conn=1070 op=1 SRCH attr=* + 18:38:50 ratatosk slapd[9162]: conn=1070 op=2 UNBIND 18:38:50 ratatosk slapd[9162]: conn=1070 fd=16 closed =================== and so it goes, but no sync is done whatsoever. What am I doing wrong here? And what could cause this message to appear on the slave: "syncrepl_message_to_entry: rid=123 mods check (objectClass: valu e #0 provided more than once)" Any help is very welcome, especially examplified configs that I can use as "template" for my scenario. Thanks a bunch! :) -- Kolbjørn Barmen UNINETT Driftsenter

3 7

Re: ***UNCHECKED*** Re: slapd goes down
by Quanah Gibson-Mount 20 Jul '10

20 Jul '10

--On Tuesday, July 20, 2010 1:27 PM +0300 Khalid Maslak <maslak(a)ihlas.net.tr> wrote: > Hello > > My ldap server crashed and it gave core.file > I attached it to this mail as zipped. I cannot do anything with your core file. It has to be loaded and examined on your system with your compiled version of slapd. I suggest you use gdb or your favorite debugger to load it with your slapd executable, and get a backtrace from it. <http://www.openldap.org/faq/index.cgi?_highlightWords=gdb&file=59> --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

need an overlay for rewriting attribute values
by Thomas Wunder 20 Jul '10

20 Jul '10

Hi, I need some kind of overlay which allows me to rewrite attribute values. I.e. if there's an object "cn=a,ou=src,dc=my,dc=com" which has attributes like memberUid="uid=usrA,ou=rest,ou=of,dc=the,dc=dn" and memberUid="uid=usrB,ou=rest,ou=of,dc=the,dc=dn" I want that overlay to suffixmassage (or whatever) it to an object like "cn=b,ou=dst,dc=my,dc=com" where for example memberUid="usrA" memberUid="usrB" but the rest (i.e. other Attributes like 'gidNumber', 'userPassword', 'description',...) of the object should be identical to the 'source'-object. The whole thing is needed because slapo-autogroup puts in full DNs as attribute values but my client programs (e.g. nss-ldapd) expect only a plain username to be there. In practical this means that I need to have that overlay to split the values of a particular type of attribute (like 'memberUid') and extract a particular part of it. It would be very nice if it was possible to use regular expressions with backreferences for matching/rewriting the values or if there was a chance to 'plug in' an external program which accomplishes that job. (As far as i know slapo-rwm is only capable of rewriting dn's and attribute names etc. but no values, isn't it? So i need something else...) Thanks in advance! Tom

4 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical