- openldap-technical - openldap.org

Question regarding meta proxy server
by lists＠zxt10d.de 18 Nov '22

18 Nov '22

Hello list, I set-up a meta proxy server (hopefully that term is correct), to combine information from an AD-server and an ldap-server. For some reasons (historical?) both are running and provide mostly different attributes. In principle it seems to work, as I get information from both defined systems - but I don't get all information as there're not the same attributes on AD and ldap. For example, the unique userID on AD is "cn" and "sAMAccountName", on ldap its "uid". So, when doing a: ldapsearch "(uid=USERID)" -H ldap://metaldapserver... I will get information from the defined ldap-server only, and when doing a ldapsearch "(cn=USERID)" -H ldap://metaldapserver... I will get information from the defined AD-server only. Is there still a way to combine both infomation? Debian Bullseye with Symas OpenLDAP Server, slapd 2.6.3 Cheers, Torsten

3 3

SSSD looking for password policy: "unrecognized control"
by jarett＠bioteam.net 02 Nov '22

02 Nov '22

Hi, I am attempting to have SSSD do logins to my OpenLDAP 2.6.3 installation, however, I get "permission denied" when trying to log in because SSSD is asking for a password policy, which the server does not appear to have by default. Notably, we don't really care what "policy" the server will claim to have, because password authentication is delegated via SASL to another server which ensures strong passwords. So I just need something that will "get past" whatever checks SSSD is doing. What LDIF config can I add to my configuration to allow SSSD to let users log in properly? The error from `journalctl -u slapd` is shown below: Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 fd=11 ACCEPT from IP=10.8.8.202:41516 (IP=0.0.0.0:389) Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion> Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=0 SEARCH RESULT tag=101 err=0 qtime=0.000020 etime=0.000271 nentries=1 text= Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=1 BIND dn="cn=admin,dc=clab,dc=lab" method=128 Nov 01 18:16:58 ldapserver00 slapd[105481]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=1 BIND dn="cn=admin,dc=clab,dc=lab" mech=SIMPLE bind_ssf=0 ssf=0 Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=1 RESULT tag=97 err=0 qtime=0.000028 etime=0.000136 text= Nov 01 18:16:58 ldapserver00 slapd[105481]: get_filter: conn 2239 unknown attribute type=sudoHost (17) Nov 01 18:16:58 ldapserver00 slapd[105481]: get_ssa: conn 2239 unknown attribute type=sudoHost (17) Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=2 SRCH base="ou=users,dc=clab,dc=lab" scope=2 deref=0 filter="(&(?objectClass=sudoRole)(|(&(!(?sudoHost=*))(cn=de> Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=2 SRCH attr=objectClass objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs sudoRunAsUser sudoRunAs> Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000016 etime=0.000326 nentries=0 text= TIA!

5 5

upgrading openldap 2.4 to 2.5
by CHIROSSEL, Olivier 02 Nov '22

02 Nov '22

Hi I have an architecture with 2 openldap masters in mirormode ( refreshAndPersist ). and few consumers ( refreshAndPersist ) The provisionning api and consumer request masters via vip ( sorry server configuration ), It's complex for me to upgrade all the openldap in the same operation. Can i upgrade only the 2 masters in 2.5, and the consumers in a second time ? The replication between master in 2.5 and consumers in 2.4 work's fine ? Thank's in advance for your replies. Regards Olivier

2 1

Two notes on slapppasswd (old version)
by Ulrich Windl 31 Oct '22

31 Oct '22

Hi! When using an old version (from 2.4.41) of slapasswd, I noticed two things: 1) Using "-h SSHA", slappasswd was asking for passwords first, then telling me: "Password generation failed for scheme SSHA: scheme not recognized" I think "SSHA" is unique enough to recognize; and if it's not, then complain before asking for passwords. 2) When I mistyped the option as "-h '{SSHA}>'", slappasswd did not complain and produce some output. I think if it's picky on the first case, it should also be for the second case (assuming the output "{SSHA}oTEDKWKn0fimGo6J8de0I5qRixGWJxhJ" was correct overall) Maybe check if these problems still exist in the current version. Regards, Ulrich Windl

2 1

LMDB, virtual machines, and copying mdb files
by selama＠gmail.com 28 Oct '22

28 Oct '22

I am working on developing a new document-oriented (XML+JSON) database, using LMDB as an engine, and I have two questions. 1. So far, it have been working really smoothly for me. But my one customer so far for the DB is really concerned about running LMDB in a virtual environment such as Docker, when performing reads and writes. Especially when mounting volumes. Their concern is because of the following caveat: "Do not use LMDB databases on remote filesystems, even between processes on the same host. This breaks flock() on some OSes, possibly memory map sync, and certainly sync between programs on different hosts" I think it shouldn't be an issue with Docker, but I want to be certain. 2. We have one server that updates the database, and another server with a read-only copy of the same database. Our plan was to simply copy the mdb files from the update machine to the read only machine, but we noticed that if we copy the file immediately after writing, the copy may end up being corrupted. My solution was to suspend all writing and wait few minutes before writing, to make sure everything back from memory, and I'm also using the "sync" command (not sure if it does anything here). It seem to be working, but I wonder if there is a more robust way of doing that? And also, is it safe to overwrite to the read-only server while it performs read transactions to the current file (or maybe rename it and copy to a new file with the same name)?

5 5

Read speeds, bottleneck, correct understanding?
by Sam Dave 27 Oct '22

27 Oct '22

Hi, If my program reads through an LMDB database apparently slow at first run, but suddenly runs much quicker at the second run (which does exactly the same thing), can't I already say with confidence that my choice of LMDB - in this case its builtin memory mapping functionality - is already paying off in terms of read speeds? I mean, that alone (exact same thing runs much faster the second time) already PROVES that the bottleneck was reading from disk as opposed to memory, right? I'm looking for excuses for patting myself on the back for investing in LMDB. Regards, Sam

2 3

cn=config TLS Configuration Problem
by Timothy Stonis 25 Oct '22

25 Oct '22

Hi, I am trying to setup an OpenLDAP 2.6.3 server and I’d like to only use olc configuration (no slapd.conf file). So far things are going okay, but I’m having a problem with TLS configuration. I am able to enable TLS using a self-signed certificate without any problem, however, if I try to disable TLS using the following LDIF: dn: cn=config changetype: modify delete: olcTLSCertificateFile - delete: olcTLSCertificateKeyFile - I get the following error: modifying entry "cn=config" ldap_modify: Server is unwilling to perform (53) I enabled debugging and cannot seem to see the error. I have also tried reordering the entries, doing one at a time, disabling ldaps:// binding, etc but nothing seems to work. If I just remove the certificate and/or key files, then the server does not start. Is enabling TLS a one way street? Or, should I just use slapd.conf? As a second question, I read in an article online that there is a way to store the TLS cert(s) and key in the LDAP database itself. However, I cannot find any info on that in the documentation. Can anyone shed some light on that? Thank you in advance! Tim

2 7

RE25 testing call (2.5.14)
by Quanah Gibson-Mount 24 Oct '22

24 Oct '22

This is the first testing call for OpenLDAP 2.5.14. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.14 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with controls (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-remoteauth memory leaks (ITS#9438) Build Environment Fixed build process to not use gmake specific features (ITS#9894) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Documentation Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Regards, Quanah

5 9

Attribute Cert. schema (RFC 5755)
by Pascal Jakobi 21 Oct '22

21 Oct '22

Hi there I am looking for an RFC 5755 (attribute certificates profile) schema file. I thought it was in pmi.schema, but it appears that no, unless I am missing sthing. Before creating one from the RFC, I would like to be sure it does not exist somewhere I couldn't find. Thanks in adv. P

3 4

SyncRepl fails object class 'organization' requires attribute 'o'
by Sander Smeenk 21 Oct '22

21 Oct '22

Hi, I'm trying to set up SyncRepl between two servers. When the SyncRepl client connects and tries to start it logs: | Entry (dc=example,dc=nl): object class 'organization' requires attribute 'o' | syncrepl_null_callback : error code 0x41 | syncrepl_entry: rid=000 be_add dc=example,dc=nl failed (65) There is only one such entry in the db and it has an 'o' attribute: | dn: dc=example,dc=nl | objectClass: top | objectClass: dcObject | objectClass: organization | dc: example | o: example.nl | structuralObjectClass: organization | [ .. create, modify, entry uuids etc ..] What could i be missing here? Regards, -Sander. -- | Inside every older person is a younger person wondering what happened. | 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2

2 2

replacement of memberof by dynlist.. questions..
by Frédéric Goudal 19 Oct '22

19 Oct '22

Hello, We have to install a product which use ldap and that seems to need memberof overlay. As I have read this overlay is deprecated is cause trouble with replication. So I have dug to found a replacement solution, and what I have found is to add something like that : In the olcDynamicList olcDlAttrSet: myPerson labeledURI myMemberOf And in each user <user> : labeledURI: ldap:///ou=groups,dc=example,dc=com??sub?(&(objectclass=posixgroup) (memberuid=<user>)) I find this way quite heavy to deal with, adding such attribute to every user (1), but we can do it. My other problem is that the myMemberOf may be really long to compute at each request (and for stupid historic reason some old programs do qyery on the full user set of atttributes). So I intend to add a proxycache. But I have a questiion concerning the templates : if I add the following template (myMemberOf=*) will it cache only the requests that are exactly (myMemberOf=XXX) or requests that contains the pattern like (&(Status=xxx)(myMemberOf=yyy)) ? Thanks. f.g. Note 1 : it would be nice that we could define thinks like in a single place : labeledURI: ldap:///ou=groups,dc=example,dc=com??sub?(&(objectclass=posixgroup) (memberuid=%uid%)) where %uid% would be the uid attribute value of the considered object. Or do I miss solething ? — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 3

Fwd: [OldapWS] -> Proposal of a REST Web Service for CRUD Operations
by Howard Chu 17 Oct '22

17 Oct '22

Forwarding for exposure - any interest? -------- Forwarded Message -------- Subject: [OldapWS] -> Proposal of a REST Web Service for CRUD Operations Date: Fri, 16 Sep 2022 13:21:10 +0200 From: Olivier CHATOR <olivier.chator15(a)gmail.com> To: openldap-devel(a)openldap.org Dear all, I am a "long time user" of OpenLDAP core parts. If the core is very stable, I often received some request from application developers, complaining about the lack of REST Web Service API to manipulate their Directory objects. Of course, as far as I could see, there is commercial solution available to do this, or even a project using Spring. But I could not see a simple proposal based on a simple Apache Server and "fully free" of rights. I also saw (https://www.openldap.org/devel/contributing.html) that "The OpenLDAP Project welcomes contributions of independently-developed stand-alone LDAP-related software packages suitable for distribution separately from existing packages (e.g., OpenLDAP Software, JLDAP, JDBC-LDAP)". Then, I would like to propose a full Open Source first realease of a CRUD REST Web Service to manipulate OpenLDAP's Directory Objects. I know that this first release is very limited in term of features, but I think it does the "core job", and may be a common base to be enriched to build a real OpenLDAP REST API ? Package available here: https://drive.google.com/drive/folders/1s4zlTleJ1JWhQWP2kLGHtTRofpWNevS7?us… Thanks for your time reading this proposal, do not hesitate to ask if you have any question. Kind regards, Olivier Chator

8 8

How to debug out of sync servers ?
by Frédéric Goudal 13 Oct '22

13 Oct '22

Hello, I have a kind of annoying problem with two openldap servers. It is a simple pair setup in delta-sync and multimaster althought modifications are actually always done on the same one. Version is 2.5.7 (well I know 2.6 is out but I can’t work as fast as openldap people). Several times a day the de-facto client is out of sync for several minutes. For example now I have a delta of about 50 minutes (usually it’s less), but the sync logs are very active here is some lines of the current operations Oct 12 16:03:24 ldap-renater3 slapd[1343]: do_syncrep2: rid=901 cookie=rid=901,sid=029,csn=20221012140303.663754Z#000000#029#000000 Oct 12 16:03:24 ldap-renater3 slapd[1343]: slap_queue_csn: queueing 0x7fa7278dd0e0 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:24 ldap-renater3 slapd[1343]: syncrepl_message_to_op: rid=901 tid 0x7fa826062700 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=elafont,ou=bordeaux-inp.fr,ou=mailboxes,dc=ipb,dc=fr on opc=0x7fa81002d008 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_add_slog: adding csn=20221012140303.663754Z#000000#029#000000 to sessionlog, uuid=d4eaa120-c1e0-103b-88a5-0dec75f30866 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_add_slog: expiring csn=20221007192836.067967Z#000000#029#000000 from sessionlog (sessionlog size=10000001) Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_add_slog: updating mincsn for sid=41 csn=20221007192836.058680Z#000000#029#000000 to 20221007192836.067967Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_queue_csn: queueing 0x7fa7278d9d00 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=reqStart=20221012140324.000068Z,cn=accesslog on opc=0x7fa81002dbf8 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=39500 op=1 syncprov_matchops: skipping original sid 029 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_graduate_commit_csn: removing 0x7fa7278d9d00 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_graduate_commit_csn: removing 0x7fa7278dd0e0 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: syncrepl_message_to_op: rid=901 be_modify cn=elafont,ou=bordeaux-inp.fr,ou=mailboxes,dc=ipb,dc=fr (0) Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_queue_csn: queueing 0x7fa7278de470 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_graduate_commit_csn: removing 0x7fa7278de470 20221012140303.663754Z#000000#029#000000 The behaviour that seems to occurs is that the logging sometimes stop (nothing more to do it seems) and when it stops the servers are in sync. So it seems the sync operations are very slow. Of course I do not log on normal operation. The directory as something like 70k entries (180Mb for the mdb file). Servers have plenty of memory : free total used free shared buff/cache available Mem: 8148668 3445380 125972 500 4577316 4390168 Swap: 2009084 183552 1825532 Servers are on an vmware cluster, from the vmware point of view cpu usage is very low. OS is ubuntu 20.04 I don’t know where to dig... Thanks in advance — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

3 3

Fwd: RE25 testing call (2.5.14)
by Lucio De Re 09 Oct '22

09 Oct '22

As requested by Quanah. If no other practical measure is available, the server I'm using can be accessed via SSH. I'll supply further details in return for an SSH-format public key and essential identification. Lucio. -------- Forwarded Message -------- Subject: Re: RE25 testing call (2.5.14) Date: Fri, 7 Oct 2022 18:53:42 +0200 From: Lucio De Re <lucio(a)ff.co.za> Organization: Future Foundation To: Quanah Gibson-Mount <quanah(a)fast-mail.org> On 2022/10/04 18:50, Quanah Gibson-Mount wrote: > This is the first testing call for OpenLDAP 2.5.14. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE25: > > <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, > cd tests && make its to run through the regression suite. > > Thanks! > On NetBSD 9.1... NetBSD jackal.proxima.alt.za 9.1 NetBSD 9.1 (GENERIC) #0: Sun Oct 18 19:24:30 UTC 2020 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/i386/compile/GENERIC i386 Fri 07 Oct 2022 18:51:30 SAST ... >>>>> Starting test049-sync-config for mdb... running defines.sh Starting provider slapd on TCP/IP port 9011... Using ldapsearch to check that provider slapd is running... Inserting syncprov overlay on provider... Starting consumer slapd on TCP/IP port 9012... Using ldapsearch to check that consumer slapd is running... Configuring syncrepl on consumer... Waiting 7 seconds for syncrepl to receive changes... Using ldapsearch to check that syncrepl received config changes... Adding schema and databases on provider... Using ldapadd to populate provider... Waiting 7 seconds for syncrepl to receive changes... Using ldapsearch to check that syncrepl received database changes... Replacing olcSyncrepl on provider... Waiting 7 seconds for syncrepl to receive changes... Using ldapsearch to read config from the provider... Using ldapsearch to read config from the consumer... Filtering provider results... Filtering consumer results... Comparing retrieved configs from provider and consumer... Using ldapsearch to read all the entries from the provider... Using ldapsearch to read all the entries from the consumer... Filtering provider results... Filtering consumer results... Comparing retrieved entries from provider and consumer... >>>>> Test succeeded >>>>> test049-sync-config completed OK for mdb after 27 seconds. >>>>> Starting test050-syncrepl-multiprovider for mdb... running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... ... It's been hanging at this point for quite a while. There were no build or compilation errors that I could notice. Lucio.

1 0

Can't query contextCSN ?
by Sander Smeenk 07 Oct '22

07 Oct '22

Hi, I have one master, one slave LDAP server. Syncprov is active and running. On the master or the slave (2.5), if i `slapcat` i get: | dn: dc=example,dc=nl | objectClass: top | objectClass: dcObject | objectClass: organization | o: example | dc: example | structuralObjectClass: organization | entryUUID: f55086bc-adb9-103c-9c47-456ab09d92ea | creatorsName: cn=admin,dc=example,dc=nl | createTimestamp: 20220811120747Z | entryCSN: 20220811120747.388919Z#000000#000#000000 | modifiersName: cn=admin,dc=example,dc=nl | modifyTimestamp: 20220811120747Z | contextCSN: 20221007075756.114574Z#000000#000#000000 | | [ .. ] So there is a 'contextCSN' in there, but i can't seem to query it: | # ldapsearch -xLLL -H ldaps://127.0.0.1 -b 'dc=example,dc=nl' -s 'base' contextCSN | dn: dc=example,dc=nl | | # While on a different set of servers (2.4), that ldapsearch does work: | # ldapsearch -xLLL -H ldap://127.0.0.1 -b 'dc=anotherexample,dc=nl' -s 'base' contextCSN | dn: dc=anotherexample,dc=nl | contextCSN: 20221007080803.057248Z#000000#000#000000 | | # What could be wrong here? Regards, -Sander. -- | On the other hand, you have different fingers. | 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2

1 1

RE26 testing call #1 (2.6.4)
by Quanah Gibson-Mount 05 Oct '22

05 Oct '22

This is the first testing call for OpenLDAP 2.6.4. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.4 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with controls (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed lloadd memory leaks (ITS#9907) Fixed lloadd shutdown code to protect memory correctly (ITS#9913) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd free of config item (ITS#9912) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-monitor memory leaks with lloadd (ITS#9906) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-remoteauth memory leaks (ITS#9438) Fixed slapo-rwm memory leaks (ITS#9817) Build Environment Fixed build process to not use gmake specific features (ITS#9894) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Documentation Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Regards, Quanah

4 3

LMDB key marshalling functions
by Søren Holm 28 Sep '22

28 Sep '22

Hi I am working on utilizing LMDB in a project of mine. However I am struggling a bit on how to manage marshalling of keys. - packing of C structure into array - and unpacking - handling parrtial keys for range traversals. Som months ago I read an article named "Shine and poverty key value database LMDB in applications for iOS". It contained some clever techniques. However the article is not longer to be found. I feel like if I do the handling in a wrong way it will be a nightmare. How to you handling your keys? /Søren Holm

1 0

slapo constraint - uri constraint on object DN
by Benjamin Renard 27 Sep '22

27 Sep '22

Hello, I try to affect an uri constraint on an attribute that storing the DN of another object but I don't know what I have to put on the attribute field of the URI. Have any of you already implemented such a constraint? Constraint example for a attribute that storing another attribute value: olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) Thank you in advance, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

2 2

how to add index in replication scenario
by Uwe Sauter 16 Sep '22

16 Sep '22

Dear list, I need to add an index for a new attribute in an active-active replication scenario. I know I need to run slapindex to create the index for existing entries after I changed the configuration file (yes, still on 2.4 with slapd.conf). But what is the correct procedure to update both servers? I'm a bit worried that the setup will become out-of-sync if I just update one server at a time. Would it be better to stop the service on both servers and re-index the databases at the same time before going online again? Regards, Uwe

4 8

no accesslog record on "delete" sync state control
by Zeus Panchenko 13 Sep '22

13 Sep '22

hi I face a weird situation with my LDAP syncrepl consumer [1], please advise ... on "delete" sync state control receiving, I'm trying to search for accesslog object with the just deleted object to use it in further processing, but it is not available yet though if I set delay (sleep) for 1 sec just before the search, then I successfully receive the object so, is it intended behavior? here is this search: https://github.com/z-eos/regather/blob/master/lib/App/Regather.pm#L439 [1] https://github.com/z-eos/regather -- Zeus V. Panchenko . jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC ..: GMT+2 (EET)

2 1

Re: Antw: [EXT] Re: LMDB 1.0 data.mdb format stability
by Howard Chu 09 Sep '22

09 Sep '22

Ulrich Windl wrote: >>>> Howard Chu <hyc(a)symas.com> schrieb am 08.09.2022 um 01:34 in Nachricht > <4bc80e7e-17f9-b385-6b11-2aab806edc43(a)symas.com>: >> Steffen Michels wrote: >>> Hi, >>> >>> We are considering using the mdb.master3 branch of LMDB, but it is not clear >> to me whether the data.mdb format will remain stable. Is there a chance that >>> another migration of all databases will be required in the future when >> switching now? >> >> Yes. It is still unreleased because additional changes to the freelist >> format are planned, >> and possibly a few other changes. >> >> In any case, mdb_dump/mdb_load will always work for migrating to a new >> version. > > I think at some point an inplace upgrade would be the way to go. > On Linux filesystems, you could even upgrade yout ext3 to btrfs ;-) That will never happen here. Supporting an in-place upgrade requires the library to support old and new formats simultaneously, which is a waste of RAM. Anything that pushes the object code size of the hot path over 64KB is a non-starter. > > Regards, > Ulrich > >> >>> >>> regards, >>> >>> Steffen >> >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ > > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 7

LMDB 1.0 data.mdb format stability
by Steffen Michels 07 Sep '22

07 Sep '22

Hi, We are considering using the mdb.master3 branch of LMDB, but it is not clear to me whether the data.mdb format will remain stable. Is there a chance that another migration of all databases will be required in the future when switching now? regards, Steffen

2 1

RE: Openldap policy not working on Ubuntu 22.04
by Mehmet Sağdıç 06 Sep '22

06 Sep '22

Hi, Is there anyone who can help on this issue? -- -- -- -- -- İyi Çalışmalar -- -- -- Mehmet Sağdıç Technical Support Expert | Computer Center Directorate +90 (392) 671 11 11 | 2829 - Gsm : 0548 858 95 43 <https://ciu.edu.tr/> Cyprus International University <https://www.facebook.com/CIUOfficial> <https://www.instagram.com/ciu.official/> <https://twitter.com/CIUOfficial> <https://www.youtube.com/user/uluslararasikibris> <https://www.linkedin.com/company/cyprus-international-university> <https://scholar.google.com/citations?view_op=view_org&hl=tr&org=39727957745 3037268> From: Mehmet Sağdıç [mailto:msagdic@ciu.edu.tr] Sent: Monday, August 22, 2022 4:30 PM To: 'openldap-technical(a)openldap.org' Subject: Openldap policy not working on Ubuntu 22.04 Hi, I am using openldap version 2.4.49 on ubuntu 20.04. I did the ubuntu 20.04 - 22.04 version update from the command line using the address below. <https://jumpcloud.com/blog/how-to-upgrade-ubuntu-20-04-to-ubuntu-22-04> https://jumpcloud.com/blog/how-to-upgrade-ubuntu-20-04-to-ubuntu-22-04 After the Ubuntu 22.04 update was finished, the Ldap version automatically changed to the openldap version 2.5.12 and the ldap service did not work. I made the Ldap service run by doing the following: <https://discourse.ubuntu.com/t/service-migrating-from-openldap-2-4-x-to-2-5 -x/23807> https://discourse.ubuntu.com/t/service-migrating-from-openldap-2-4-x-to-2-5- x/23807 But I saw that there is no policy.ldif in cn=config and the policy does not take action. The ldap service is running, but the policy is not working. How can I run policy on Openldap version 2.5.12.

2 1

Q: "Error: Invalid DN syntax (34), additional info: invalid new RDN"
by Ulrich Windl 30 Aug '22

30 Aug '22

Hi! I'm programming some automated changes to our LDAP database, and I have an issue: # Error: Invalid DN syntax (34), additional info: invalid new RDN dn: cn=subntbcst_tftp@247/tcp,dc=services,dc=net,dc=...,dc=de changetype: modrdn newrdn: subntbcst-tftp@247/tcp deleteoldrdn: 1 So is the new RDN "subntbcst-tftp@247/tcp" really invalid? If so it seems an older version of OpenLDAP accepted that as we have such an entry: dn: cn=subntbcst_tftp@247/tcp,dc=services,dc=net,dc=...,dc=de objectClass: ipService cn: subntbcst_tftp cn: subntbcst_tftp@247/tcp createTimestamp: 20130719093351Z ... I saw this exaple in RFC 2849 (so I thought my LDIF shuld be OK): # Modify an entry’s relative distinguished name dn: cn=Paul Jensen, ou=Product Development, dc=airius, dc=com changetype: modrdn newrdn: cn=Paula Jensen deleteoldrdn: 1 Regards, Ulrich

3 5

measurable slower result time with large subtree
by Norbert 26 Aug '22

26 Aug '22

Hi, with OpenLDAP 2.4.47 (running on Debian 10) but also with 2.5.13 from ltb-project.org (running on same Debian 10) I can observe the following: given following rough idea of a tree o=base |- bn=subtree1 | - handful of entries |- bn=subtree2 | - millions of entries |- bn=subtree3 | |- bn=sub-subtree1 | |- bn=sub-subtree2 | |- some entries |- bn=subtree4 ou is an indexed attribute with pres,eq,sub. When now searching with the filter bn=<value> then there is a significant difference when searching for either subtree1 and subtree2 as values in the range of seconds. This means on command line ldapsearch with subtree1 it is around 0.007 seconds and with subtree2 4.5 seconds before the fully finishes. When I change the search filter to "(&(objectClass=bnClass)(bn=<value>))" then this has no real impact to the time needed searching for subtree1 but improves searching subtree2, still it more than 2 times slower than searching for subtree1. Only entries with objectClass=bnClass have the bn attribute but no other entries. Changing the scope to one, yields similar times when searching for subtree1 and subtree2 but the search itself also to cover searching for sub-subtree1 or sub-subtree2 with the same search task as it is not known where such sub-subtree could be found. The only pattern I've found so far is that if there are millions of entries in a subtree then finishing the search takes much longer. The LDAP is using MDB, and has been completely rebuilt (means slapcat/slapadd) several times with always showing the same results. There was no difference between 2.4 and 2.5.13. Is there something which can be improved by changing the configuration? Thanks, Norbert

3 3

pcache makes slapd die after some seconds
by Norbert 25 Aug '22

25 Aug '22

Hi, when trying to use the pcache overlay for an MDB database instance, it seems to work, at least some first test search seem to be significantly improved but then the slapd process without anything in the logs (no segfault at least). Unfortunately it is not possible to restart the slapd process either, as it also soon dies after starting. The config used looks something like the following: dn: olcOverlay={0}pcache,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: mdb 1000 1 1000 100 olcPcacheAttrset: 0 bn attribute1 attribute2 objectClass olcPcacheTemplate: "(&(|(objectClass=)(objectClass=))(bn=))" 0 120 olcPcacheTemplate: "(bn=)" 0 120 dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={1}mdb,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: /data/pcache olcDbIndex: objectClass eq olcDbIndex: bn pres,eq,sub Is pcache supposed to work as an overlay for mdb database? Or does it only work with an ldap backend db? Thanks, Norbert

2 2

ipService anyone?
by Ulrich Windl 24 Aug '22

24 Aug '22

Hi! Several years ago I added ipService to our LDAP Database, then I thought it's time to update it. Now I have a conceptual problem: Some services have multiple protocols and port numbers. For example "compressnet". While it's possible to assign unique names like cn=compressnet@2/tcp,... cn=compressnet@2/tcp,... cn=compressnet@3/tcp,... cn=compressnet@3/udp,... I wonder how a standard query for "compressnet" should look like. Basically I'd like to leave out the port (@n), but the IANA registry is not unique. I identified these: compressnet mit-ml-dev sql-net rap meter pip csdmbase csdm nmsp uma raid-cd ... optohost004 It seems ipService can have multiple values for ipServiceProtocol, cn, and ipServiceProtocol, but wouldn't that silently assume that all port numbers are valid for all listed protocols? For the example it would be any combination of (UDP,TCP) and (2,3). To me the only solution seems to force IANA to clean up the mess. RFC-6335/BCP-165 claims: "Service names are the unique key in the Service Name and Transport Protocol Port Number registry." (page 8) Opinions? Regards, Ulrich

1 0

Empty error when configuring OpenLDAP
by Cezary Drożak 23 Aug '22

23 Aug '22

Hello, I am trying to set up OpenLDAP on Arch Linux on my server, following instruction on Arch Wiki[1]. I prepared the config.ldif file, replacing every $BASEDN and $PASSWD in the example configuration: # The root config entry dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcPidFile: /run/openldap/slapd.pid # Schemas dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # TODO: Include further schemas as necessary include: file:///etc/openldap/schema/core.ldif # The config database dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=Manager,dc=example,dc=com # The database for our entries dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcSuffix: dc=example,dc=com olcRootDN: cn=Manager,dc=example,dc=com olcRootPW: {SSHA}xZqSQN4wG4+C5I57dB/Qm02vJ+kQcwd7 olcDbDirectory: /var/lib/openldap/openldap-data # TODO: Create further indexes olcDbIndex: objectClass eq Then I executed the following command: sudo -u ldap slapadd -n 0 -F /etc/openldap/slapd.d/ -l ./config.ldif This gave me the following error: invalid config directory /etc/openldap/slapd.d/, error 2 slapadd: bad configuration directory! I checked that the directory did not exist, so I created it and changed owner to `ldap`. The wiki page did not mention that the directory should be created earlier, so maybe it should have been created by a post installation script. If that's the case, I will report it to package maintainers. After I created the directory, I ran the command again, this time having a different error message: slapadd: could not add entry dn="cn=config" (line=1): Closing DB... I have no idea what is wrong now and I cannot find anything useful on the internet. Does anyone have an idea what I may be doing wrong here? [1]: https://wiki.archlinux.org/title/OpenLDAP

3 4

slapo-variant and searching virtual attrs
by Michael Ströder 23 Aug '22

23 Aug '22

HI! I have the need to search a whole sub-tree for something like collective attributes which AFAIK slapo-collect does not support. Now I'm wondering whether it's possible to search for the virtual attributes generated by slapo-variant. And probably I'd like to use the regex variant. I've read the section LIMITATIONS in slapo-variant(5) which says that regex variants only support reading the virtual attributes with scope base. It also implies that searching for these virtual attributes is not possible at all. Is that correct? Ciao, Michael.

2 1

using memberof to authenticate Linux with PAM
by Alceu Rodrigues de Freitas Junior 22 Aug '22

22 Aug '22

Greetings, For a matter of studying OpenLDAP, I decided to create a CLI in Golang that is based on the migrationtools (https://gitlab.com/future-ad-laboratory/migrationtools), which is written in Bash and (very old) Perl code. All the Golang module is available here: https://github.com/glasswalk3r/aprendendo-openldap/tree/main/migration. After learning about the memberof overlay, I've being wondering if it is possible to use it to maintain the UNIX groups at /etc/group instead of just replicating the same information over an over. I've tried to find references in the documentation of using PAM and NSCD in the Linux clients for authenticating from a OpenLDAP server, but found nothing regarding those requirements, neither a detailed explanation (without resorting looking into the source code) of how those requests from a Linux client would be sent to OpenLDAP in order to check that. If any has any pointers on the subject, I would be glad to receive them. Thanks in advance, Alceu

3 7

Proxying an insecure LDAP and authenticate using another
by Kevin Olbrich 22 Aug '22

22 Aug '22

Hi! I have a case where I got access to a read-only LDAP that has no authentication (everything is public). It is located in a secure and trusted environment. Now I want to expose the directory to another network and like to add authentication but can not add it to the source (proprietary software). I need to proxy this server and authenticate the users using active directory. I know how to proxy AD including passthrough authentication but can I proxy another directory and authenticate using another? If yes, how? Thank you very much. Kind regards Kevin Olbrich

1 0

Re: Pass-through
by Stéphane Veyret 20 Aug '22

20 Aug '22

Could it be that the SASL global configuration (also given in first message) is wrong? I only set those 2 options: olcSaslHost: localhost olcSaslSecProps: none

2 4

Re: Error: Could not locate TLS/SSL package
by Jeffrey Walton 17 Aug '22

17 Aug '22

On Wed, Aug 17, 2022 at 12:16 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Wednesday, August 17, 2022 2:11 PM +0530 Vijay Maidarkar > <vmaidarkar(a)gmail.com> wrote: > > Hi, please keep replies on the list. > > Find below answers. > > > > Where is it installed? > > $ which openssl > > > > /usr/local/bin/openssl > > > > $ ldd /usr/local/bin/openssl > > linux-vdso.so.1 => (0x00007fff931e6000) > > libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f7f7a570000) > > libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f7f7a087000) > > libdl.so.2 => /lib64/libdl.so.2 (0x00007f7f79e83000) > > libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f7f79c67000) > > libc.so.6 => /lib64/libc.so.6 (0x00007f7f79899000) > > /lib64/ld-linux-x86-64.so.2 (0x00007f7f7a802000) > > > > How was it installed? > > I've downloaded the archive & done compilation from below cmds. > > > > $ ./config > > $ make > > $ make install There are other options you should be using for OpenSSL. At minimum, you probably want enable-ec_nistp_64_gcc_128 on x86_64. Also see https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_O… . > So, you built it yourself so there will be no development package. I'm not > sure why you built such an ancient version of OpenSSL (you listed OpenSSL > 1.1.1g when 1.1.1q is the most recent), since it's vulnerable to multiple > critical CVEs. > > I'd strongly advise using the packages from EPEL if you insist on staying > on CentOS7 (which is near end of life). > > If you are going to use your own OpenSSL build, I can't emphasize enough > the importance of using a current release. Since you're doing this in an > unpackaged way, maintenance is going to be a nightmare. > > Since you've built it yourself into its own location, you have to tell the > configure script where to find the development headers, like: > > CPPFLAGS="/usr/local/include" LDFLAGS="-L/usr/local/lib > -Wl,-rpath,/usr/local/lib" ./configure ... +1 for the RPATH. Linux (and other OSes) have a (mis)feature of building against one version of a library, and runtime linking against another version of the library. Be sure to specify the RPATH to avoid the bug. (If you want to see the effects of linking against the wrong library at runtime, see https://www.openwall.com/lists/oss-security/2020/07/20/1). Nowadays on Linux you should specify a RUNPATH, not a RPATH. The RUNPATH allows LD_LIBRARY overrides to search paths. It is recommended by the folks who write the runtime loaders. The options you need are: * -Wl,-rpath,<lib path> (enables RPATH) * -Wl,--enable-new-dtags (enables RUNPATH) Jeff

2 1

Re: Error: Could not locate TLS/SSL package
by Quanah Gibson-Mount 17 Aug '22

17 Aug '22

--On Wednesday, August 17, 2022 2:11 PM +0530 Vijay Maidarkar <vmaidarkar(a)gmail.com> wrote: > > > > > Hi Quanah, Hi, please keep replies on the list. > Find below answers. > > Where is it installed? > $ which openssl > > /usr/local/bin/openssl > > $ ldd /usr/local/bin/openssl > linux-vdso.so.1 => (0x00007fff931e6000) > libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f7f7a570000) > libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f7f7a087000) > libdl.so.2 => /lib64/libdl.so.2 (0x00007f7f79e83000) > libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f7f79c67000) > libc.so.6 => /lib64/libc.so.6 (0x00007f7f79899000) > /lib64/ld-linux-x86-64.so.2 (0x00007f7f7a802000) > > How was it installed? > I've downloaded the archive & done compilation from below cmds. > > $ ./config > $ make > $ make install So, you built it yourself so there will be no development package. I'm not sure why you built such an ancient version of OpenSSL (you listed OpenSSL 1.1.1g when 1.1.1q is the most recent), since it's vulnerable to multiple critical CVEs. I'd strongly advise using the packages from EPEL if you insist on staying on CentOS7 (which is near end of life). If you are going to use your own OpenSSL build, I can't emphasize enough the importance of using a current release. Since you're doing this in an unpackaged way, maintenance is going to be a nightmare. Since you've built it yourself into its own location, you have to tell the configure script where to find the development headers, like: CPPFLAGS="/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" ./configure ... However, I would again strongly advise you not go the route of building the software yourself unless you're going to do it in a packaged way (I.e. make RPMs) so that you can upgrade whenever there's a new vulnerability. Even more, I'd strongly advise just using the pre-built packages provided by either Symas (Which offers current builds of both OpenLDAP 2.5 and OpenLDAP 2.6 + supporting libraries) or the LTB project. <https://repo.symas.com/> <https://ltb-project.org/> Regards, Quanah

1 0

Error: Could not locate TLS/SSL package
by vmaidarkar＠gmail.com 16 Aug '22

16 Aug '22

Hi Team, I'm compiling OpenLDAP 2.5.13 on CentOS 7 & OpenSSL 1.1.1g is already installed & below is the command. ./configure --prefix=/opt/deployment/openldap_v13 --sysconfdir=/opt/deployment/openldap_v13/etc --localstatedir=/opt/deployment/openldap_v13/var --libexecdir=/opt/deployment/openldap_v13/libexec --enable-overlays=mod --enable-modules --enable-accesslog --enable-auditlog --enable-collect --enable-memberof --enable-syncprov --with-tls=openssl --enable-dynamic --enable-crypt --enable-slapd --enable-rlookups --disable-perl --enable-ppolicy --enable-backends=mod --disable-ndb --disable-sql --disable-shell --disable-bdb --disable-hdb I'm getting the below error of OpenSSL. checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package Could you please suggest how to fix this issue. Thanks, Vijay

4 6

Unable to connect to 636 secure port using LDAP library
by BANDANI MAHARANA 15 Aug '22

15 Aug '22

Hi Team, I am trying to connect to an Active directory server using 636 port for secure connection. I am using the openldap library to establish the connection. Implementation is completed for insecure connection using 389 port. Below is the code snippet I am using to establish the connection with ldap server in 636 port. LDAP * ldap_handler; int return_value = ldap_initialize(ldap_handler, "ldaps:// TestServer.mylab.com:636"); //server url if (return_value == LDAP_SUCCESS) { cout<<"LDAP initialized successfully"; // this is successful for me } else { cout<<"LDAP initialization failed"; } int return_value = ldap_set_option(*ldap_handler, LDAP_OPT_PROTOCOL_VERSION, LDAP_VERSION3); if(return_value == LDAP_SUCCESS) { cout<<"success"; // this is successful for me } else { cout<<"failed"; } const char * CACERT_FILE_PATH = "certificate/mylab-TESTSERVER-CA.cer"; //certificate path int return_value1 = ldap_set_option(*ldap_handler, LDAP_OPT_X_TLS_CACERTFILE, CACERT_FILE_PATH); if (return_value1 == LDAP_SUCCESS) { } else { // its failing here with error -1, and error string "Can't contact to LDAP server" } int return_value = ldap_simple_bind_s(*ldap_handler, "mylab\administrator", ""pwd@1234"); if (return_value == LDAP_SUCCESS) { //success } else { // its failing here with error -1, and error string "Can't contact to LDAP server" } I have verified the same thing is working when connecting to 389 port. Could you please suggest how to make this work for secure ldap connection over ssl? Please provide some examples or references. It will be helpful for me. Thanks & Regards, Bandani

3 4

LDAP Failure: {'desc': "Can't contact LDAP server}
by Shaheena Kazi 08 Aug '22

08 Aug '22

Hello, I am using Debian 11. Openldap : 2.4.57+dfsg-3+deb11u1 python3-ldap : 3.2.0-4+b3 python3-ldap3: 2.8.1-1 TLS - 1.3 Openssl - 1.1.1n-0+deb11u3 I am try to set a new connect and then import files using below commands: ldapcon = ldap.initialize('ldap://localhost') ldapcon.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION3) ldapcon.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER) ldapcon.set_option(ldap.OPT_X_TLS_NEWCTX, 0) dn_to_add = 'cn=test.user,ou=people,dc=framework,dc=protegrity,dc=com' modlist_to_add = [('uid', [b'test.user']), ('objectclass', [b'inetOrgPerson', b'posixAccount', b'top']), ('uidnumber', [b'1003']), ('gidnumber', [b'100']), ('homedirectory', [b'/home/test.user']), ('userpassword', [b'qwer1234']), ('givenname', [b'test']), ('sn', [b'user']), ('displayname', [b'test user']), ('loginshell', [b'/usr/local/sbin/manager']), ('cn', [b'test.user']), ('description', [b'testing']), ('pwdreset', [b'TRUE'])] ********* But when I run this - ldapcon.add_s(dn_to_add, modlist_to_add) The slapd service crashes and I get below error LDAP Failure: {'desc': "Can't contact LDAP server} ldap.CONFIDENTIALITY_REQUIRED: {'desc': 'Confidentiality required', 'info': 'TLS confidentiality required'} Can u guys help me here as in what am I missing on and why the add_s is causing my slapd to crash Regards, Shaheena K

2 1

symas pacakages on Debian
by Ulf Volmer 05 Aug '22

05 Aug '22

Hello, I'm running symas OpenLDA on Debian 11. Today we got an upgrade, which make the server unable to start: apt show symas-openldap-server Package: symas-openldap-server Version: 2.6.3-1bullseye1 sudo systemctl status slapd ● symas-openldap-server.service - Symas OpenLDAP Server Daemon Loaded: loaded (/etc/systemd/system/symas-openldap-server.service; enabled; vendor preset: enabled) Drop-In: /etc/systemd/system/symas-openldap-server.service.d └─override.conf /run/systemd/system/service.d └─zzz-lxc-service.conf Active: failed (Result: exit-code) since Fri 2022-08-05 13:20:57 CEST; 8min ago Docs: man:slapd man:slapd-config man:slapd-mdb Process: 536 ExecStart=/opt/symas/lib/slapd -d 0 -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=254) Main PID: 536 (code=exited, status=254) CPU: 13ms Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: Starting Symas OpenLDAP Server Daemon... Aug 05 13:20:57 ldap3.lan.u-v.de slapd[536]: ldap_int_sasl_init: SASL library version mismatch: expected 2.1.28, got 2.1.27 Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: symas-openldap-server.service: Main process exited, code=exited, status=254/n/a Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: symas-openldap-server.service: Failed with result 'exit-code'. Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: Failed to start Symas OpenLDAP Server Daemon. dpkg -l|grep sasl ii gsasl-common 1.10.0-4+deb11u1 all GNU SASL platform independent files ii libgsasl7:amd64 1.10.0-4+deb11u1 amd64 GNU SASL library ii libsasl2-2:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - authentication abstraction library ii libsasl2-modules:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - pluggable authentication modules ii libsasl2-modules-db:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - pluggable authentication modules (DB) ii libsasl2-modules-gssapi-mit:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - pluggable authentication modules (GSSAPI) rc sasl2-bin 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - administration programs for SASL users database ii symas-cyrus-sasl-lib 2.1.27-4bullseye1 amd64 Cyrus-SASL Libraries Any help is appreciated. Best regards Ulf

3 3

OpenLDAP on Debian 11: missing TLS ciphers?
by Jochen Keutel 03 Aug '22

03 Aug '22

Hello, we installed the standard OpenLDAP package on Debian 11. Checking the TLS ciphers offered by the server we could see that all six Camellia ciphers are gone (128 and 256, for TLS 1.0, 1.1, 1.2) compared with the standard OpenLDAP package on Debian 9. Is this special to the Debian package? Or: Has Gnutls changed something? We did run into this issue because some special devices (e.G. Cisco Prime Collaboration Assurance) cannot connect to the new OpenLDAP server. The server logfile states: TLS handshake: negotiation failure. It's not yet clear whether they really can "speak" only Camellia ... Regards Jochen.

5 7

Severe Performance Problems with dynlist on OpenLDAP 2.5+
by Bradley T Gill 02 Aug '22

02 Aug '22

We have been struggling with an upgrade of OpenLDAP 2.4.x to any version after 2.5. Our upgrade process was installing the binaries, removing our ppolicy schema and doing a slapcat of the old database and a slapadd to the new version. After doing so, response time shows a noticeable delay using an ldapsearch, the header on the response will pause long enough to read it before we get the result. This delay is causing the server to hang during heavy use and eventually crash. Through a lot of trouble shooting / trial and error, I have found that the cause is our dynlist definitions/usage. When they are removed, response time goes back to normal and there is a memory leak that stops. I can add the pertinent parts of the cn=config if needed. The question for now is has anyone else seen and hopefully resolved this issue or just know what changed for dynlist in 2.5 that might be effecting us? Thanks, Bradley Gill CISSP, CCSP

2 1

OpenLDAP 2.6 is holding connections open
by Bradley T Gill 02 Aug '22

02 Aug '22

All, I have been struggling with upgrading OpenLDAP from 2.4 to 2.5/2.6 for some time. We have finally found that we needed to rebuild the schema from scratch and re-add our customizations. The database is now running much better with one lingering problem. Our Established connections just continues to grow until we run out of resources. Below is our cn=config (minus some unrelated info). This is on the same server as where the previous version was running, so changes are openldap and openssl versions. Any insights as to what might be causing the ESTABLISHED connections to continually grow would be very appreciated. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 422b88f4 dn: cn=config objectClass: olcGlobal cn: config olcAttributeOptions: lang- olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexHash64: FALSE olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcLogLevel: 256 olcLogFileOnly: FALSE olcMaxFilterDepth: 1000 olcReadOnly: FALSE olcSaslAuxpropsDontUseCopyIgnore: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcThreadQueues: 1 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config createTimestamp: 20220726200129Z olcAuthzPolicy: any olcWriteTimeout: 30 olcSizeLimit: size.soft=unlimited size.hard=unlimited size.unchecked=unlimited size.pr=1000 size.prtotal=unlimited

3 5

SASL GSSAPI Channel Binding testing
by Andreas Hasenack 26 Jul '22

26 Jul '22

Hello, openldap 2.5.12 cyrus-sasl 2.1.28 + sasl channel binding patch[1] + gss-spnego maxssf=0 patch[2] openldap linked with gnutls libsasl2-modules-gssapi-mit I'm currently testing the patches[1][2] for sasl channel binding over GSSAPI + ssl/tls connection, and was wondering if I could get openldap to reject ldaps connections without sasl channel binding. Currently it seems to always accept it, but I can't be sure CB was even checked by the server by looking at logs (even with -d -1). I got windows 2016 AD to reject ldaps connections without CB over gssapi and gss-spnego, so the client part of openldap (ldapwhoami specifically) seems ok. I looked at test 077[3] and it runs the server with this configuration: dn: cn=config changetype: modify replace: olcSaslCBinding olcSaslCBinding: ${acb} Where `${acb}` loops over the 3 valid values of "none" "tls-unique" "tls-endpoint". Then a simple connection with ldapwhoami is attempted, also looping -o SASL_CBINDING=$icb over those values. I have seen the comment in that test script that it looks like tls-unique is broken when used with gnutls[4], and also a comment about MIT failing in another case[5]. When trying it manually, though, I could never get the client connection to be refused by the server. Before digging in deeper, let me just ask if my understanding is correct: - server configured with: dn: cn=config changetype: modify replace: olcSaslCBinding olcSaslCBinding: tls-endpoint - client connecting to that server over ldaps://, with GSSAPI, and with -o SASL_CBINDING=none Should that client be rejected? Sample run: $ sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcSaslCBinding=*)' olcSaslCBinding SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcSaslCBinding: tls-endpoint $ ldapwhoami -Y GSSAPI -H ldaps://k-slapd.lxd -o SASL_CBINDING=none SASL/GSSAPI authentication started SASL username: ubuntu@VMS SASL SSF: 256 SASL data security layer installed. dn:uid=ubuntu,cn=gssapi,cn=auth And the server logs (olcLogLevel: stats): Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 fd=14 ACCEPT from IP=10.0.100.36:33800 (IP=0.0.0.0:636) Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 fd=14 TLS established tls_ssf=256 ssf=256 tls_proto=TLS1.3 tls_cipher=AES-256-GCM Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=0 BIND dn="" method=163 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=0 RESULT tag=97 err=14 qtime=0.000011 etime=0.002447 text=SASL(0): successful result: Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=1 BIND dn="" method=163 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=1 RESULT tag=97 err=14 qtime=0.000012 etime=0.000069 text=SASL(0): successful result: Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 BIND dn="" method=163 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 BIND authcid="ubuntu" authzid="ubuntu" Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 BIND dn="uid=ubuntu,cn=gssapi,cn=auth" mech=GSSAPI bind_ssf=256 ssf=256 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 RESULT tag=97 err=0 qtime=0.000012 etime=0.000109 text= Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.3 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=3 WHOAMI Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=3 RESULT oid= err=0 qtime=0.000016 etime=0.000087 text= Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=4 UNBIND Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 fd=14 closed 1. https://github.com/cyrusimap/cyrus-sasl/commit/975edbb69070eba6b035f08776de… 2. https://github.com/cyrusimap/cyrus-sasl/pull/603/commits 3. https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/test… 4. https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/test… 5. https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/test…

2 3

help ldap_sasl_bind_s failed (-1)
by mohammad jamshidi 17 Jul '22

17 Jul '22

HiI have configured the openldap multimaster based on this guide: https://kifarunix.com/setup-openldap-master-master-replication-on-centos-8/ but the replication between two servers doesn't work. and I get these errors: on server1: slap_client_connect: URI=ldaps://ldapmaster02.kifarunix-demo.com DN="cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com" ldap_sasl_bind_s failed (-1) on server 2:slap_client_connect: URI=ldaps://ldapmaster01.kifarunix-demo.com DN="cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com" ldap_sasl_bind_s failed (-1). I didn't receive any reply from the article writer.what is wrong in the guide? Regards

1 0

Re: Pass-through
by Stéphane Veyret 14 Jul '22

14 Jul '22

> Ok, you may need to run slapd under debug mode (-1) and then try binding as > one of the users with userPassword set to the {SASL}username@realm value > to see what it's doing. Is this what I did in my first post (https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/…, the log is at the end of the message) or is there some missing information ? By the way, I don’t know why GMail is starting a new thread each time I answer to you… :-/

1 0

Re: Pass-through
by Stéphane Veyret 14 Jul '22

14 Jul '22

Le lun. 11 juil. 2022 à 17:22, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > Do the logs from saslauthd show that LDAP is actually forwarding the > requests to it? No, I have nothing at saslauthd side, except the starting logs : # saslauthd -d -a kerberos5 saslauthd[31345] :num_procs : 5 saslauthd[31345] :mech_option: NULL saslauthd[31345] :run_path : /run/saslauthd saslauthd[31345] :auth_mech : kerberos5 saslauthd[31345] :using accept lock file: /run/saslauthd/mux.accept saslauthd[31345] :master pid is: 0 saslauthd[31345] :listening on socket: /run/saslauthd/mux saslauthd[31345] :using process model saslauthd[31345] :forked child: 31346 saslauthd[31346] :acquired accept lock saslauthd[31345] :forked child: 31347 saslauthd[31345] :forked child: 31348 saslauthd[31345] :forked child: 31349 -- Bien cordialement, / Plej kore, Stéphane Veyret

2 1

pcacheOffline cache is expired and stale instead of indefinitely cached
by Tri Tu 14 Jul '22

14 Jul '22

Hello, I understand that with the pcacheOffline TRUE and the cache contents can be use indefinitely but its cache data never get refresh with remote DSA. It's not really useful once user is login 1st time and their user attributes would not get refresh with DSA after that. But the default configuration option of pcacheOffline FALSE, pcache would use the local cached data, refresh with remote DSA and continues to response with its cached data when the DSA is cut off/unreachable. However if remote DSA is offline and the existing cached is expired, the client would get the respond with error "Proxy operation retry failed" as "cache is stale", pcache is checking with remote DSA for refresh but remote DSA is unreacheable offline. Can we continue to use the existing expired cached data (the cache contents to be used indefinitely) with pcacheOffline FALSE until remote DSA is back online (days/weeks later)? Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 do_bind Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: >>> dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com> Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: do_bind: version=3 dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => bdb_entry_get: ndn: "uid=userX,ou=employees,o=mycompany.com" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => bdb_entry_get: oc: "(null)", at: "(null)" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => bdb_entry_get: found entry: "uid=userX,ou=employees,o=mycompany.com" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: bdb_entry_get: rc=0 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: str2filter "(uid=userX)" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: begin get_filter Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: EQUALITY Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: end get_filter 0 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: Lock QC index = 0x562be57eb700 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: QUERY ANSWERABLE (answered 115 times) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => hdb_search Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "entry" requested Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <= root access granted Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access granted by manage(=mwrscxd) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: base_candidates: base: "uid=userX,ou=employees,o=mycompany.com" (0x00000003) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => test_filter Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: EQUALITY Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "uid" requested Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <= root access granted Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access granted by manage(=mwrscxd) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <= test_filter 6 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: pc_bind_search: cache is stale, reftime: 1655318380, current time: 1655318385 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: send_ldap_result: conn=1115 op=0 p=3 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: send_ldap_result: err=0 matched="" text="" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: =>ldap_back_getconn: conn=1115 op=0: lc=0x7f2644105d10 inserted refcnt=1 rc=0 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: activity on 1 descriptor Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: activity on: Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=10 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=11 active_threads=0 tvp=zero Jun 15 18:39:55 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 ldap_back_retry: retrying URI="ldaps://dsa.mycompany.com" DN="" Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: send_ldap_result: conn=1115 op=0 p=3 Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: send_ldap_result: err=52 matched="" text="Proxy operation retry failed" Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: send_ldap_response: msgid=1 tag=97 err=52 Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 RESULT tag=97 err=52 text=Proxy operation retry failed Jun 15 18:40:06 prd-ldap1-euc1 slapd[12041]: daemon: activity on 1 descriptor Jun 15 18:40:06 prd-ldap1-euc1 slapd[12041]: daemon: activity on: Thanks

3 4

mdb_dbi_open
by Sam Dave 14 Jul '22

14 Jul '22

Hello, The docs for mdb_dbi_open mention: "This function must not be called from multiple concurrent transactions in the same process. A transaction that uses this function must finish (either commit or abort) before any other transaction in the process may use this function." Is this talking about a given environment, or does this text also hold across multiple environments? Thanks, S. Dave

2 1

TLS negotiation failure
by aRaviNd 14 Jul '22

14 Jul '22

Hi All, I am trying to debug an issue related to Chef-manage WebUI trying to authenticate users using LDAP. Authentication was working fine but after upgrading the LDAP server to the latest version of the OS we are getting authentication failures below are the errors showing in the log Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14) Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14): got connid=1003 Jul 13 20:26:52 ldap.local slapd[18572]: connection_read(14): checking for input on id=1003 Jul 13 20:26:52 ldap.local slapd[18572]: op tag 0x77, time 1657744012 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 do_extended Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 13 20:26:52 ldap.local slapd[18572]: do_extended: oid=1.3.6.1.4.1.1466.20037 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 STARTTLS Jul 13 20:26:52 ldap.local slapd[18572]: send_ldap_extended: err=0 oid= len=0 Jul 13 20:26:52 ldap.local slapd[18572]: send_ldap_response: msgid=0 tag=120 err=0 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 RESULT oid= err=0 text= Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on 1 descriptor Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on: Jul 13 20:26:52 ldap.local slapd[18572]: Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on 1 descriptor Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on: Jul 13 20:26:52 ldap.local slapd[18572]: 14r Jul 13 20:26:52 ldap.local slapd[18572]: Jul 13 20:26:52 ldap.local slapd[18572]: daemon: read active on 14 Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14) Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14): got connid=1003 Jul 13 20:26:52 ldap.local slapd[18572]: connection_read(14): checking for input on id=1003 Jul 13 20:26:52 ldap.local slapd[18572]: connection_read(14): TLS accept failure error=-1 id=1003, closing Jul 13 20:26:52 ldap.local slapd[18572]: connection_closing: readying conn=1003 sd=14 for close Jul 13 20:26:52 ldap.local slapd[18572]: connection_close: conn=1003 sd=14 Jul 13 20:26:52 ldap.local slapd[18572]: =>ldap_back_conn_destroy: fetching conn 1003 Jul 13 20:26:52 ldap.local slapd[18572]: daemon: removing 14 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 fd=14 closed (TLS negotiation failure) Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on 1 descriptor Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on:: We are not seeing the error while connecting to OpenLDAP servers using OpenSSL or LDAP client tools. How can we debug further to see why the server was not able to complete TLS negotiation? Package versions are openldap-2.4.44-25.el7_9.x86_64 openssl-1.0.2k-25.el7_9.x86_64 kernel-3.10.0-1160.66.1.el7.x86_64 Regards, Aravind M D

2 1

When pwdReset is set to TRUE
by Francesco Malvezzi 13 Jul '22

13 Jul '22

hi all, the pwdReset attribute is set to TRUE on password reset unless entry's pwdPolicySubentry's pwdMustChange is FALSE or missing? Does the default policy's pwdMustChange play a role (even on entries with valid pwdPolicySubentry)? thank you, Francesco

1 0

How to relay read and write requests to different ldap servers
by nagamani.chinnapaiyan＠viasat.com 13 Jul '22

13 Jul '22

Hi, I am new to ldap. We have 4 ldap servers, 2 of them are in mirror-mode providers, 2 of them are just consumers/replicas. I am working on loadbalancer for these 4 ldap servers using ldap/meta backend. I want to the ldap proxy/loadbalancer to, redirect write requests to one of the 2 mirror-mode providers. redirect read requests to any of the 2 replicas/consumers. I know ldap backend has uri list which can be used to redirect to mirror-mode providers. But I want to redirect only the write requests. Regards, Nagamani Chinnapaiyan

5 8

pwdChangedTime range query
by Francesco Malvezzi 13 Jul '22

13 Jul '22

hi all, I am using some pwdChangedTime range queries to warn users about password expiration. An example filter might be: (&(pwdChangedTime<=20211019000000Z)(pwdChangedTime>=20211018000001Z)(pwdPolicySubentry=cn=default270g,ou=policies,ou=people,dc=example,dc=edu)) since in-place upgrade to OpenLDAP-2.6.2 these queries return no entries. If I remove either comparison condition: (&(pwdChangedTime>=20211018000001Z)(pwdPolicySubentry=cn=default270g,ou=policies,ou=people,dc=example,dc=edu)) (&(pwdChangedTime<=20211019000000Z)(pwdPolicySubentry=cn=default270g,ou=policies,ou=people,dc=example,dc=edu)) they both work. Did I forget some re-index? thank you in advance for your time, Francesco

4 6

RE26 testing call #2 (OpenLDAP 2.6.3)
by Quanah Gibson-Mount 11 Jul '22

11 Jul '22

This is the second testing call for OpenLDAP 2.6.3. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.3 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap to check for NULL ld (ITS#9157) Fixed libldap memory leaks (ITS#9876) Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd lastbind replication with chaining (ITS#9863) Fixed slapd-ldap to correctly set authzid (ITS#9863) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapd-mdb indexer task with replicated config (ITS#9858) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-rwm to handle escaping special characters (ITS#9817) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Added slapo-ciboolean contrib module (ITS#9855) Fixed slapo-autogroup backwards compat (ITS#9020) Update ppm module to the 2.2 release (ITS#9846) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Regards, Quanah

2 1

RE25 testing call #2 (OpenLDAP 2.5.13)
by Quanah Gibson-Mount 11 Jul '22

11 Jul '22

This is the second testing call for OpenLDAP 2.5.13. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.13 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap memory leaks (ITS#9876) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Fixed slapo-autogroup backwards compat (ITS#9020) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Thanks! Regards, Quanah

2 1

Re: Pass-through
by Stéphane Veyret 11 Jul '22

11 Jul '22

Hello Quanah, Thank you for your answer (and sorry for double-reply, I forgot to answer to all at first time). > The way that SASL passthrough works is that you put the value {SASL} for > the userPassword. This tells slapd to pass the user authentication to SASL > to handle. You don't set an actual password value in the userPassword > attribute. Actually, I did not set a real password, only, as I saw in examples : userPassword: {SASL}user@realm (you don’t directly see it in the extracts I provided because the password there is base64 encoded). I tried setting only, as you suggested : userPassword: {SASL} but I don’t have any better result. Regards, Stéphane

2 1

dirSync syncrepl_dirsync_message: unknown attributeType member;range=1-1
by Christopher Paul 09 Jul '22

09 Jul '22

Hello OpenLDAP-Technical, I am testing the dirSync replication. I am trying to replicate Active Directory (Windows Server 2019) -> OpenLDAP 2.5.12 from symas-openldap-servers-2.5.12-1.el8.x86_64 RPM on RedHat 8.6. Group members are not replicating, and I am seeing this error: syncrepl_dirsync_message: rid=999 unknown attributeType member;range=1-1 In this case, "member" is a recognized attribute per "core.schema" and is not a problem unless sent with the range indicator, which seems not to be part of the protocol but rather be an AD "embellishment". Those responsible for AD call this "Searching Using Range Retrieval" if you care to look it up. I guess has this default now of 1500 max values for an LDAP response, and it will indicate that the attribute has greater than this number of values by sending "member;range=0-1499" instead of "member" as the attribute type in the result data if there are more than 1500 values, and subsequently, if the amount is greater than 3000, "member;range=1500-2999", etc. I also observed (using packet capture) that when using the dirSync control, all groups are sent with this range notation, even if below the limit, even if just one member, Windows Server 2019 AD DS sends a PartialAttributeList of type "member;range=1-1". Although using ldapsearch without the control only will send the range notation if the number of member values is greater than the 1500 limit. So I am wondering if anyone else has seen this? Am I doing something wrong or is this a bug? What version of Windows was the dirSync syncrepl functionality developed to work with and/or tested with? I can provide more info as needed as this issue is just testing right now in my local lab. Thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

2 2

Pass-through
by Stéphane Veyret 09 Jul '22

09 Jul '22

Hi, In my home network, I have a MIT Kerberos installation backed by OpenLDAP. Because some of my apps do not work using GSSAPI, I would like to be able to log into them directly using LDAP. So I tried to set-up Pass-through, but with no success. Here is what I did: * compiled OpenLDAP with --enable-spasswd (actually, it’s a Gentoo installation with use flag sasl), * setup Cyrus SASL to use Kerberos, * configured /usr/lib64/susl2/slapd.conf to use saslauth, * configured OpenLDAP with SASL host and secprops., * updated my user to have “userPassword:: e1NBU0x9c3RlcGhhbmVASE9NRS5MQU4=”, * restarted. SASL seems to be working correctly: > testsaslauthd -u stephane -p mypassword 0: OK "Success." But not LDAP : > ldapwhoami -x -D "uid=stephane,ou=user,dc=home,dc=lan" -Z -W Enter LDAP Password: ldap_bind: Invalid credentials (49) It seems to even not try to contact Cyrus SASL… I searched for hours accross the Internet but could not find any clue. So if someone here could help me, I would really appreciate. My LDAP config: # config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcLocalSSF: 256 olcLogLevel: stats olcPidFile: /run/openldap/slapd.pid olcSaslHost: localhost olcSaslSecProps: none > cat /usr/lib64/sasl2/slapd.conf pwcheck_method: saslauthd mech_list: plain saslauthd_path: /var/run/saslauthd/mux Here is an extract of the log I could get while attempting to bind: TLS trace: SSL_accept:SSLv3/TLS write session ticket 62af4376 connection_read(17): unable to get TLS client DN, error=49 id=1012 62af4376 conn=1012 fd=17 TLS established tls_ssf=256 ssf=256 62af4376 daemon: activity on 1 descriptor 62af4376 daemon: activity on: 62af4376 daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af4376 daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af4376 daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 17r 62af437b daemon: read active on 17 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b connection_get(17) 62af437b connection_get(17): got connid=1012 62af437b connection_read(17): checking for input on id=1012 ber_get_next tls_read: want=5, got=5 tls_read: want=97, got=97 ldap_read: want=8, got=8 ldap_read: want=72, got=72 ber_get_next: tag 0x30 len 78 contents: ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df81074e0 end=0x7f6df810752e len=78 62af437b op tag 0x60, time 1655653243 ber_get_next tls_read: want=5 error=Resource temporarily unavailable ldap_read: want=8 error=Resource temporarily unavailable 62af437b conn=1012 op=1 do_bind 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: ber_scanf fmt ({imt) ber: 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df81074e3 end=0x7f6df810752e len=75 ber_scanf fmt (m}) ber: ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df810751a end=0x7f6df810752e len=20 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b >>> dnPrettyNormal: <uid=stephane,ou=user,dc=home,dc=lan> => ldap_bv2dn(uid=stephane,ou=user,dc=home,dc=lan,0) <= ldap_bv2dn(uid=stephane,ou=user,dc=home,dc=lan)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=stephane,ou=user,dc=home,dc=lan)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=stephane,ou=user,dc=home,dc=lan)=0 62af437b <<< dnPrettyNormal: <uid=stephane,ou=user,dc=home,dc=lan>, <uid=stephane,ou=user,dc=home,dc=lan> 62af437b conn=1012 op=1 BIND dn="uid=stephane,ou=user,dc=home,dc=lan" method=128 62af437b do_bind: version=3 dn="uid=stephane,ou=user,dc=home,dc=lan" method=128 62af437b ==> mdb_bind: dn: uid=stephane,ou=user,dc=home,dc=lan 62af437b mdb_dn2entry("uid=stephane,ou=user,dc=home,dc=lan") 62af437b => mdb_dn2id("uid=stephane,ou=user,dc=home,dc=lan") 62af437b <= mdb_dn2id: got id=0xb 62af437b => mdb_entry_decode: 62af437b <= mdb_entry_decode 62af437b => access_allowed: result not in cache (userPassword) 62af437b => access_allowed: auth access to "uid=stephane,ou=user,dc=home,dc=lan" "userPassword" requested 62af437b => acl_get: [1] attr userPassword 62af437b => acl_mask: access to entry "uid=stephane,ou=user,dc=home,dc=lan", attr "userPassword" requested 62af437b => acl_mask: to value by "", (=0) 62af437b <= check a_dn_pat: cn=kerberos,ou=service,dc=home,dc=lan 62af437b <= check a_dn_pat: self 62af437b <= check a_dn_pat: anonymous 62af437b <= acl_mask: [3] applying auth(=xd) (stop) 62af437b <= acl_mask: [3] mask: auth(=xd) 62af437b => slap_access_allowed: auth access granted by auth(=xd) 62af437b => access_allowed: auth access granted by auth(=xd) 62af437b SASL Canonicalize [conn=1012]: authcid="stephane(a)HOME.LAN" 62af437b SASL Canonicalize [conn=1012]: authcid="stephane(a)HOME.LAN" 62af437b send_ldap_result: conn=1012 op=1 p=3 62af437b send_ldap_result: err=49 matched="" text="" 62af437b send_ldap_response: msgid=2 tag=97 err=49 ber_flush2: 14 bytes to sd 17 tls_write: want=36, written=36 ldap_write: want=14, written=14 62af437b conn=1012 op=1 RESULT tag=97 err=49 text= 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 17r 62af437b daemon: read active on 17 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b connection_get(17) 62af437b connection_get(17): got connid=1012 62af437b connection_read(17): checking for input on id=1012 ber_get_next tls_read: want=5, got=5 tls_read: want=24, got=24 ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x7f6e081065d0 ptr=0x7f6e081065d0 end=0x7f6e081065d5 len=5 62af437b op tag 0x42, time 1655653243 ber_get_next tls_read: want=5, got=5 tls_read: want=19, got=19 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 62af437b ber_get_next on fd 17 failed errno=0 (Success) 62af437b connection_read(17): input error=-2 id=1012, closing. 62af437b connection_closing: readying conn=1012 sd=17 for close 62af437b connection_close: deferring conn=1012 sd=17 62af437b conn=1012 op=2 do_unbind 62af437b conn=1012 op=2 UNBIND 62af437b connection_resched: attempting closing conn=1012 sd=17 62af437b connection_close: conn=1012 sd=17 62af437b daemon: removing 17 tls_write: want=24, written=24 TLS trace: SSL3 alert write:warning:close notify 62af437b conn=1012 fd=17 closed 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL -- Bien cordialement, / Plej kore, Stéphane Veyret

2 1

RE26 testing call #1 (OpenLDAP 2.6.3)
by Quanah Gibson-Mount 07 Jul '22

07 Jul '22

This is the first testing call for OpenLDAP 2.6.3. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.3 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap to check for NULL ld (ITS#9157) Fixed libldap memory leaks (ITS#9876) Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd lastbind replication with chaining (ITS#9863) Fixed slapd-ldap to correctly set authzid (ITS#9863) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapd-mdb indexer task with replicated config (ITS#9858) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-rwm to handle escaping special characters (ITS#9817) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Added slapo-ciboolean contrib module (ITS#9855) Fixed slapo-autogroup backwards compat (ITS#9020) Update ppm module to the 2.2 release (ITS#9846) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872)

3 4

RE25 testing call #1 (OpenLDAP 2.5.13)
by Quanah Gibson-Mount 07 Jul '22

07 Jul '22

This is the first testing call for OpenLDAP 2.5.13. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.13 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap memory leaks (ITS#9876) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Fixed slapo-autogroup backwards compat (ITS#9020) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Regards, Quanah

3 3

Re: dynlist overlay, memberURL not working on spcified attribiutes
by Bog Dan 07 Jul '22

07 Jul '22

Thanks for your reply, I try to explain. Populating memberOf attribiute to users entry working well using this: *olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf* User entry look as follow: *dn: uid=test1,ou=people,dc=test,dc=comsambaAcctFlags: [U ]sambaPwdLastSet: 9999999999sambaNTPassword: passo: testsambaSID: S-1-5-21-3945181060-1826002392-430723570pwdPolicySubentry: cn=noexpire,ou=ppolicy,dc=test,dc=comcreateTimestamp: 20220529070624.324Zdescription: User accountuserPassword:: passsambaPwdCanChange: 1528009736sambaPwdMustChange: 0mail: test1(a)test.com <test1(a)test.com>loginShell: /bin/bashgivenName: Test1sambaLogonTime: 0sn: Testcn: Test1 TestobjectClass: posixAccountobjectClass: topobjectClass: inetOrgPersonobjectClass: personobjectClass: organizationalPersonobjectClass: sambaSamAccountobjectClass: shadowAccounthomeDirectory: /home/test1pwdChangedTime: 20220529070856.504ZgidNumber: 1002uidNumber: 1002uid: test1structuralObjectClass: inetOrgPersonentryUUID: 348cd83e-7c6a-103c-8612-1918ce7a0bc4creatorsName: cn=admin,dc=test,dc=comlabeledURI: ldap:///ou=groups,dc=test,dc=com??sub?(|(&(objectclass=groupOfUniqueNames)(uniqueMember=uid=test1,ou=people,dc=test,dc=com))(&(objectClass=posixGroup)(memberUid=test1)))entryCSN: 20220609180738.487916Z#000000#001#000000modifiersName: cn=admin,dc=test,dc=commodifyTimestamp: 20220609180738ZmemberOf: cn=devops,ou=groups,dc=test,dc=comentryDN: uid=test1,ou=people,dc=test,dc=comsubschemaSubentry: cn=SubschemahasSubordinates: FALSE* Static group entry: *cn=devops,ou=groups,dc=test,dc=comcn: devopsobjectClass: groupOfUniqueNamesobjectClass: topdescription: devops groupuniqueMember: uid=test1,ou=people,dc=test,dc=comuniqueMember: uid=test2,ou=people,dc=test,dc=com* Next what I want to do is agregate multiple groups to one virtual using this: *olcDynListAttrSet: {0}groupOfURLs memberURL member* Then I create appropiate group: *cn=testluri,ou=groups,dc=test,dc=comcn: testluriobjectClass: topobjectClass: groupOfURLsdescription: test groupmemberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* but this don't add memeber entry to this group. When I changing memberURL as follow: *memberURL: ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2))* member attribute was added to testluri group: *cn=testluri,ou=groups,dc=test,dc=comcn: testluriobjectClass: topobjectClass: groupOfURLsdescription: test groupmemberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* *member: uid=test1,ou=people,dc=test,dc=com* *member: uid=test2,ou=people,dc=test,dc=com* but this is not the goal. As I mentioned I want to agregate multiple group to one using memberOf attribute in memberURL: *memberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* but this not working. What I'm doing wrong? Reagrds BS śr., 29 cze 2022 o 19:17 Quanah Gibson-Mount <quanah(a)fast-mail.org> napisał(a): > > > --On Tuesday, June 28, 2022 12:18 PM +0200 Bog Dan <bsiara.cgi(a)gmail.com> > wrote: > > > > > Hi All, > > I have problem with dynlist overlay, this is my configuration: > > > > > > > > olcOverlay={1}dynlist,olcDatabase={1}mdb,cn=config > > objectClass: olcOverlayConfig > > objectClass: olcDynListConfig > > olcOverlay: {1}dynlist > > olcDynListAttrSet: {0}groupOfURLs memberURL member > > olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf > > > > > > > > First I create static group: > > > > > > cn=devops,ou=groups,dc=test,dc=com > > cn: devops > > objectClass: groupOfUniqueNames > > objectClass: top > > description: devops group > > uniqueMember: uid=test1,ou=people,dc=test,dc=com > > uniqueMember: uid=test2,ou=people,dc=test,dc=com > > > > > > > > When I create new dynamic group: > > > > cn=testluri,ou=groups,dc=test,dc=com > > cn: testluri > > objectClass: top > > objectClass: groupOfURLs > > description: test group > > memberURL: > > ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=te > > st,dc=com) > > > > > > > > I don't get any member of group. Users test1 and test2 already have > > memberOf attribute: > > > > memberOf: cn=devops,ou=groups,dc=test,dc=com > > > > > > > > When I change memberURL to use not dynamic attributes (memberOf): > > > > > > memberURL: > ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2)) > > > > > > > > users added to testluri group and dynlist works well. > > What I should do to configure dynlist with memberOf? > > I've read your email multiple times, and quite frankly I don't understand > what your end goal is. > > If your end goal is to have static groups, where memberOf is dynamically > populated on the user entries (which is the usual use case for replacing > the 2.4 memberOf), then your configs are clearly incorrect. > > Can you better explain what your end goal is? > > Thanks, > Quanah > > > >

2 1

dynlist overlay, memberURL not working on spcified attribiutes
by Bog Dan 29 Jun '22

29 Jun '22

Hi All, I have problem with dynlist overlay, this is my configuration: olcOverlay={1}dynlist,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynListConfig olcOverlay: {1}dynlist olcDynListAttrSet: {0}groupOfURLs memberURL member olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf First I create static group: cn=devops,ou=groups,dc=test,dc=com cn: devops objectClass: groupOfUniqueNames objectClass: top description: devops group uniqueMember: uid=test1,ou=people,dc=test,dc=com uniqueMember: uid=test2,ou=people,dc=test,dc=com When I create new dynamic group: cn=testluri,ou=groups,dc=test,dc=com cn: testluri objectClass: top objectClass: groupOfURLs description: test group memberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com) I don't get any member of group. Users test1 and test2 already have memberOf attribute: memberOf: cn=devops,ou=groups,dc=test,dc=com When I change memberURL to use not dynamic attributes (memberOf): memberURL: ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2)) users added to testluri group and dynlist works well. What I should do to configure dynlist with memberOf? Openldap 2.5.12 Regards BS

2 1

Filter string with escaped forward slash
by Jeffrey Walton 29 Jun '22

29 Jun '22

Hi Everyone, Microsoft AD requires a forward slash ('/') be escaped with "\\2f". Confer, [1, 2]. However, escaping the forward slash is not required per the RFCs (if I am parsing the RFCs correctly). I would like to know if OpenLDAP recognizes an escaped forward slash and handles it properly. I suspect OpenLDAP does since slapd is just a front-end to different directories. The reason I would like to know is for a generic encoder. If MS Active Directory, Novell eDirectory and OpenLDAP handle the escaped forward slash as expected, then it makes it easier to write the encoder. Thanks in advance, Jeff [1] https://social.technet.microsoft.com/wiki/contents/articles/5312.active-dir… [2] https://docs.microsoft.com/en-us/windows/win32/adsi/ldap-dialect

3 2

role manage can bypass pwdCheckQuality with MOD but not with ADD op
by tempo＠net-c.com 28 Jun '22

28 Jun '22

Hi, I'm doing some testing on userPassword management actually with openldap 2.5.9 I noticed that I could MOD a userPassword without checking quality if my admin role was "manage" However, if I try to ADD a user with its attribute userPassword set, then quality is checked although the role "manage" ppolicy in both cases are the default one (policy subentry not set) Is it normal behavior ? Regards,

3 5

setting slapd logging to STDOUT only
by Alceu Rodrigues de Freitas Junior 26 Jun '22

26 Jun '22

Greetings, My name is Alceu and I'm new to this list. I'm experimenting with OpenLDAP at a Google Cloud, running it as a Pod inside a GKE cluster. I've being struggling to setup slapd to send it's logs to STDOUT only, but it seems in most cases the logs are sent to STDERR. The problem is, for GCP Log Explorer, everything that is sent to STDERR is considered an error, even when it's not. :-) Here is a reference: https://stackoverflow.com/questions/71158475/gcp-log-explorer-shows-wrong-s…. I'm using this open source project <https://github.com/osixia/docker-openldap> to deploy OpenLDAP as a Docker container, but there is no configuration option for that. I would like to make it clear that this project is not using the latest OpenLDAP stable version. AFAIK, slapd will use syslog facility for logging and will write to the terminal if the "-d" option is in use, which in fact it is: $ docker exec -ti openldap /bin/bash root@56529dea5931:/# ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.7 0.2 76528 47232 ? Ss 20:54 0:00 /usr/bin/python -u /container/tool/run --loglevel debug openldap 21 0.1 0.0 294932 14844 ? Sl 20:54 0:00 /usr/sbin/slapd -h ldap://56529dea5931 ldaps://56529dea5931 ldapi:/// -u openldap -g openldap -d 256 root 25 1.0 0.0 19868 3600 pts/0 Ss 20:54 0:00 /bin/bash root 32 0.0 0.0 38312 3364 pts/0 R+ 20:54 0:00 ps aux Is there any way to configure slapd to use STDOUT for everything, besides using shell redirection (2>&1)? Thanks in advance, Alceu

1 0

Setting to suppress "connection_read(XXX): no connection!"
by Uwe Sauter 24 Jun '22

24 Jun '22

Dear list, is there a way to configure slapd to not emit messages regarding "connection_read(XXX): no connection!"? Currently the configuration contails "loglevel none" but these messages are sent to syslog local4.debug regardless. In case the version is relevant, this is 2.4.59 on RHEL 8.4. slapd is started with URL list "ldap:/// ldaps:/// ldapi:///" Thanks, Uwe

1 0

rwm bindDN context and ppolicy issues
by Kartik Subbarao 23 Jun '22

23 Jun '22

I'm able to specify rwm bindDN rules without password-policy enabled just fine, like this one: rwm-rewriteContext bindDN rwm-rewriteRule "^([^=]+)=([^@]+)@olddomain.com(.+),dc=olddomain,dc=com$" "$1=$2(a)newdomain.com$3,dc=newdomain,dc=com" ":@" However, when I enable password policy (which also works fine on its own), slapd segfaults. From doing a backtrace and stepping through the code, it looks like the crux of the issue is that the mdb_info struct ends up with garbage data: struct mdb_info *mdb = (struct mdb_info *) op->o_bd->be_private; mi_dbenv_home and mi_monitor have random stuff in them. I'm mulling over how much additional time to spend on this. rwm is a very elegant solution to a current issue that could save me a bunch of time to set up additional LDAP servers with the renamed data. If this is an isolated bug for which a quick fix might be possible, I might investigate further. But if it's a thorny issue or just the tip of the iceberg of things where rwm might break unexpectedly, then it may be better for me to consider other options. OpenLDAP developers, what do your instincts say on this? Regards, -Kartik

2 3

Re: LDAP over TLS not doing hostname verification in version 2.4.59
by radiatejava 23 Jun '22

23 Jun '22

Anyone of these issues could be responsible? Just checking OpenLDAP 2.4.46 Release (2018/03/22) Fixed libldap connection delete callbacks when TLS fails to start (ITS#8717) Fixed libldap to not reuse tls_session if TLS hostname check fails (ITS#7373) Thanks On Wed, Jun 22, 2022 at 7:51 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Tuesday, June 21, 2022 11:29 PM -0700 radiatejava > <radiatejava(a)gmail.com> wrote: > > > I raised the issue https://bugs.openldap.org/show_bug.cgi?id=9869 but > > it has been set to verified/invalid state now. However, I do not know > > which version addresses the issue. Can anyone tell me which version > > would still verify the hostname when doing LDAP over TLS. > > The OpenLDAP 2.4 series is historic, no bug reports for it will be > considered. > > No changes have been made to OpenLDAP 2.4 series to disable hostname > verification by the OpenLDAP project. If you are using libraries provided > by downstream distributions, they may have made unauthorized changes to how > libldap functions in regards to TLS. Additionally, if you were using an > OpenSSL linked libldap and are now using a GnuTLS linked libldap, then some > behaviors are different as documented in the man pages. > > Generally I'd advise starting with a supported version of OpenLDAP. > > Regards, > Quanah > > > >

2 1

LDAP over TLS not doing hostname verification in version 2.4.59
by radiatejava 22 Jun '22

22 Jun '22

My software was using openldap client 2.4.44 to talk to the LDAP server. We have shifted to 2.4.59 now to address some issues. Ever since we shifted, the new version is allowing LDAP over TLS without hostname verification. In the older ver 2.4.44, I always got this error if hostname did not match the CN value: return code -1 - Can't contact LDAP server) diagnostic message TLS: hostname does not match CN in peer certificate But after the lib update, no such error even if I am using LDAP server IP to do LDAP bind while LDAP server certificate has CN set as some FQDN (say test.ldap.com). Our client side code has not changed while we updated the ldap lib. For our client, we are only doing these settings: ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR, lCertsDir) ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, lCert) Has there been any change in this regard? How do I enforce hostname verification now? I raised the issue https://bugs.openldap.org/show_bug.cgi?id=9869 but it has been set to verified/invalid state now. However, I do not know which version addresses the issue. Can anyone tell me which version would still verify the hostname when doing LDAP over TLS. Thanks.

2 1

OpenLDAP in Ubuntu Jammy (LTS)
by Sergio Durigan Junior 22 Jun '22

22 Jun '22

Hi there, I would like to inform the OpenLDAP community that, after a few months sorting out the details, the OpenLDAP package of the Ubuntu Jammy (LTS) release will now receive updates every time there's a new patch version released for the 2.5.x upstream series. In fact, if you are using Ubuntu Jammy you can start benefiting from this new policy right away: OpenLDAP 2.5.12 has just been accepted into the jammy-updates repository and should be available soon. I'd like to thank the community for changing your release process recently and electing 2.5.x as your LTS release; this really helped me making the case to obtain a Micro Release Exception from the Ubuntu SRU team :-). If I may, I would also like to make a small request here. It would be very helpful if the OpenLDAP website could also offer the "Release Documents" section (from https://openldap.org/software/) for OpenLDAP 2.5.x as well. Actually, it would also be great if the "Announcement" page could stay available "forever", and be made per-release (instead of having just one "announce.html" page that gets overwritten every time there's a new release). I don't know much about web stuff in general, but I can help with this if needed. Thank you very much, and I hope this email brings news to the Ubuntu OpenLDAP users out there. Cheers, -- Sergio GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

2 2

Upgrade config from 2.4.49 to 2.5.11 is failing.
by farooq.fortinet＠gmail.com 21 Jun '22

21 Jun '22

Current Openldap 2.4.49 is working fine with syncprov configuration. Planing to upgrade to recent versions. Took backup of system using slapcat. Upgraded the dev server to 2.5.11. Now when trying to import config using slapadd. It is failing with following error. overlay_config(): overlay "syncprov" already in list slapadd: could not add entry dn="olcOverlay={1}syncprov,olcDatabase={0}config,cn=config" (line=1900): slapadd shutdown: initiated slapadd destroy: freeing system resources. syncinfo_free: rid=100 Any help or tip? Thanks Farooq

2 1

LMDB: Estimate number of elements between two keys
by Ken Wenzel 17 Jun '22

17 Jun '22

Dear OpenLDAP-Community, is it possible to compute a rough estimate of the number of elements between two given keys for an LMDB database? Currently, I scan the first 1000 keys and extrapolate the count based on the average distance of the keys. Maybe it is also possible to use some information about the common b-tree pages that are shared by both keys? We need this functionality for query optimization within RDF4J. Thank you for your support and best regards, Ken Wenzel

2 2

need help to make OpenLDAP work as "this other directory, plus"
by jarett＠bioteam.net 17 Jun '22

17 Jun '22

Hi all. So, I'm trying to basically put a band-aid over an intentionally broken LDAP implementation. We use Okta as our single source of truth for directory services, and its implementation of LDAP intentionally leaves out uidNumber and gidNumber (and you can't change this) in order to force you to use their insanely expensive "Advanced Server Access" product. This $9500/yr expense for a minimum of 50 machines is a non-starter for the lab project we are trying to get working with LDAP. We're only talking about ~10 machines here and we very much want them to be ultimately authenticating against Okta for their passwords -- because this automatically MFAs them by default, and prevents credential proliferation for the services we run in the lab. So basically what I want to do is set up an LDAP server which passes just about everything through to Okta, but keeps consistent uidNumber and gidNumber values for each user in Okta who logs in. I think this is possible either with the "meta" backend or the "ldap" backend or both, but I'm not clear on how to configure these. I've followed this guide to get OpenLDAP working on a Rocky 8 server: https://kifarunix.com/install-and-setup-openldap-on-rocky-linux-8/ But that guide does not contain instructions for something like this, and even the OpenLDAP documentation is scarce when it comes to configuring backends. e.g.: https://www.openldap.org/doc/admin26/backends.html#LDAP even just for LDAP there is no indication of how I would introduce the bind DN for the backend LDAP or how it would know what to add, and the "meta" backend has no implementation details at all: https://www.openldap.org/doc/admin26/backends.html#Metadirectory Help? Thanks!

3 2

logsuccess FALSE vs. replica contextCSN
by Geert Hendrickx 17 Jun '22

17 Jun '22

Hi Some time ago we switched our MMR config to "logsuccess FALSE" to let us record and investigate some (client-side) issues with unique constraint. This records updates refused by unique constraint in the accesslog, so we can look into them. We have logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" in each syncrepl statement, so those failed updates don't propagate through the replication. We noticed though that other failed updates, not due to unique constraint, such as adding an already existing object, or deleting a non-existing one, do cause a contextCSN update *on all replica's* but *not* in the provider, leading to contextCSN divergence - at least when no further updates happen on that provider. This usually remains hidden as other updates to the same provider keep increasing its contextCSN, but becomes apparant when no further updates happen on that provider (in this case because we were switching providers). Eg. when adding an object that already exists, the provider refused the update (error 68, already exists) and logs the following to the accesslog: > dn: reqStart=20220616095229.000003Z,cn=accesslog > objectClass: auditAdd > reqStart: 20220616095229.000003Z > reqEnd: 20220616095229.000004Z > reqType: add > reqSession: 1498 > reqAuthzID: <...> > reqDN: <some already existing object> > reqResult: 68 > reqMod: <...> > reqMod: entryCSN:+ 20220616095229.618035Z#000000#001#000000 and its main db is not updated. But the replica's log the following: > dn: reqStart=20220616095229.000006Z,cn=accesslog > objectClass: auditModify > reqStart: 20220616095229.000006Z > reqEnd: 20220616095229.000007Z > reqType: modify > reqSession: 1 > reqAuthzID: <...> > reqDN: <root DN> > reqResult: 0 > reqMod: contextCSN:= 20220616095229.618035Z#000000#001#000000 And thus update the contextCSN of their root DN (despite no other changes to the main db) - their contextCSN is now different than the provider's. This obviously only happens with "logsuccess FALSE", but even in that case this should not be expected behaviour; refused updates should not change anything except getting logged to the accesslog? This is with OpenLDAP 2.5.12 (migrating from 2.4.x) Geert

2 8

[OPENLDAP 2.4] problem with cacert.pem certificates and its operation with openldap
by fredd fredddo 16 Jun '22

16 Jun '22

Hello, I have a problem understanding how cacert.pem works on openldap 2.4 under centos. I have an extremely heterogeneous machine park (with openldap customers and other owners) So I have 2 Certificates (CA and intermediate CA) self-signed with the MD5withRSA algorithm and the same 2 certificates self-signed with the SHA1withRSA algorithm. The 4 certificates are therefore in the cacert.pem of the server and the clients. (keystore) It works perfectly for old servers but for new ones I have to force the use of TLS 1.1 because of the algorithms. I have two problems: If I just paste the 2 certificates in MD5 in the client keystore, it works, but if I leave the 2 certificates in SHA1, it does not work (bad certificate). I don't understand how openldap reads the file when there are multiple choices . He starts with the first couple, if that doesn't work he goes to the next one? So the idea would be to generate 2 new certificates identical to the others but with a SHA254 signature for example to work in TLS 1.2/1.3 and keep ldap compatibility with old servers. The cacert.pem file of the OpenLDAP server would therefore have 6 certificates and the clients following their OS would have the appropriate pair of certificates. Could this work? or for clients I leave the cacert the same and it will choose what it needs to establish the TLS connection? I am a little lost ... best regards Fred,

2 1

OpenLDAP pcacheBind is not refresh
by Tri Tu 15 Jun '22

15 Jun '22

hello everyone, I'm having issue with the pcachBind that it's not getting update from the upstream proxy ldap. The use case is that after users have updated userPassword on the upstream LDAP, the new password is updated and it's authenticated correctly with the updated password when directly query the upstream LDAP. But with the proxyldap pcache setting that I have with 3 attributes set of pcache configuration as below: overlay pcache pcache hdb 100000 3 1000 60 pcacheAttrset 0 + pcacheTemplate (uid=) 0 120 0 0 30 pcacheTemplate (&(uid=)(objectClass=)) 0 60 0 0 30 pcacheTemplate (&(objectClass=)(uidNumber=)) 0 60 0 0 30 pcacheTemplate (&(uid=)(memberOf=)) 0 60 0 0 30 pcacheBind (uid=) 0 30 sub "o=mycompany.com" pcacheAttrset 1 memberOf pcacheTemplate (objectClass=*) 1 360 0 0 30 pcacheTemplate (uid=) 1 360 0 0 30 pcacheBind (uid=) 1 30 sub "o=mycompany.com" pcacheAttrset 2 memberOf member pcacheTemplate (uid=) 2 360 0 0 30 pcacheBind (uid=) 2 30 sub "o=mycompany.com" pcacheOffline TRUE pcacheValidate TRUE The cacheable template for uid= is set with TTL 120 and TTR at 30. The first time query to the proxy pcache server, it's cached uid= data Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: slap_listener_activate(8): Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 busy Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: >>> slap_listener(ldap:///) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: listen=8, new connection on 13 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: added 13r (active) listener=(nil) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: conn=1000 fd=13 ACCEPT from IP=10.239.134.126:60966 (IP=0.0.0.0:389) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on 2 descriptors Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1000 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1000 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: op tag 0x60, time 1655184692 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: conn=1000 op=0 do_bind Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: >>> dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: conn=1000 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: do_bind: version=3 dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: ndn: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: oc: "(null)", at: "(null)" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => hdb_dn2id("o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= hdb_dn2id: got id=0x1 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => hdb_dn2id("ou=employees,o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= hdb_dn2id: got id=0x2 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => hdb_dn2id("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= hdb_dn2id: got id=0x3 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: entry_decode: "" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= entry_decode() Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: found entry: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: bdb_entry_get: rc=0 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: str2filter "(uid=userX)" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: begin get_filter Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: EQUALITY Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: end get_filter 0 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Lock QC index = 0x5638d82e9910 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Not answerable: Unlock QC index=0x5638d82e9910 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: QUERY NOT ANSWERABLE Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: QUERY CACHEABLE Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: =>ldap_back_getconn: conn=1000 op=0: lc=0x7f8710109d80 inserted refcnt=1 rc=0 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: => ldap_back_munge_filter "(uid=userX)" Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <= ldap_back_munge_filter "(uid=userX)" (0) Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnPrettyNormal: <uid=userX,OU=employees,O=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnPretty: <CN=cie_ldap_test,OU=Groups,O=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnPretty: <cn=cie_ldap_test,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnPretty: <CN=hps_opsinf_admin,OU=Groups,O=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnPretty: <cn=hps_opsinf_admin,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnNormalize: <cn=cie_ldap_test,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnNormalize: <cn=cie_ldap_test,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnNormalize: <cn=hps_opsinf_admin,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnNormalize: <cn=hps_opsinf_admin,ou=Groups,o=mycompany.com> But any sub-sequence queries after that it's always using the entry that found in the cached (CACHED BIND) instead of re-query with new connection to the upstream LDAP as it's expired (longer that TTL/TTR). Same situation when users change password from the upstream LDAP, the proxy ldap doesn't take the update password. Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: slap_listener_activate(8): Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 busy Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: >>> slap_listener(ldap:///) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: listen=8, new connection on 13 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: added 13r (active) listener=(nil) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 fd=13 ACCEPT from IP=10.239.134.126:60993 (IP=0.0.0.0:389) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1001 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1001 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: op tag 0x60, time 1655184873 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 do_bind Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: >>> dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: do_bind: version=3 dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: ndn: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: oc: "(null)", at: "(null)" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: found entry: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_entry_get: rc=0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: str2filter "(uid=userX)" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: begin get_filter Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: EQUALITY Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: end get_filter 0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Lock QC index = 0x5638d82e9910 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: QUERY ANSWERABLE (answered 1 times) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => hdb_search Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "entry" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= root access granted Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access granted by manage(=mwrscxd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: base_candidates: base: "uid=userX,ou=employees,o=mycompany.com" (0x00000003) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => test_filter Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: EQUALITY Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "uid" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= root access granted Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access granted by manage(=mwrscxd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= test_filter 6 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: conn=1001 op=0 p=3 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: err=0 matched="" text="" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: pcache_op_bind: CACHED BIND for uid=userX,ou=employees,o=mycompany.com Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: ==> hdb_bind: dn: uid=userX,ou=employees,o=mycompany.com Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: result not in cache (userPassword) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: auth access to "uid=userX,ou=employees,o=mycompany.com" "userPassword" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => dn: [1] Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => dn: [2] cn=subschema Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => acl_get: [3] attr userPassword Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => acl_mask: access to entry "uid=userX,ou=employees,o=mycompany.com", attr "userPassword" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => acl_mask: to value by "", (=0) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= check a_dn_pat: self Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= check a_dn_pat: anonymous Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= acl_mask: [2] applying auth(=xd) (stop) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= acl_mask: [2] mask: auth(=xd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => slap_access_allowed: auth access granted by auth(=xd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: auth access granted by auth(=xd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" mech=SIMPLE ssf=0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: do_bind: v3 bind: "uid=userX,ou=employees,o=mycompany.com" to "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: conn=1001 op=0 p=3 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: err=0 matched="" text="" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_response: msgid=1 tag=97 err=0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 RESULT tag=97 err=0 text= Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: op tag 0x77, time 1655184874 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 do_extended Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.3 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: do_extended: oid=1.3.6.1.4.1.4203.1.11.3 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 WHOAMI Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: send_ldap_extended: err=0 oid= len=43 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: send_ldap_response: msgid=2 tag=120 err=0 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 RESULT oid= err=0 text= Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: op tag 0x42, time 1655184874 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: ber_get_next on fd 13 failed errno=0 (Success) Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_read(13): input error=-2 id=1001, closing. Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_closing: readying conn=1001 sd=13 for close Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_close: deferring conn=1001 sd=13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=2 do_unbind Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=2 UNBIND Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_resched: attempting closing conn=1001 sd=13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_close: conn=1001 sd=13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: =>ldap_back_conn_destroy: fetching conn 1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: removing 13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 fd=13 closed Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Wondering that if there is anything missing with configuration or if this is a bug that I can file for bug ticket. Thanks, -Tommy

3 5

Search for all user set as manager in my organizational units
by tempo＠net-c.com 15 Jun '22

15 Jun '22

Hi, I have an ldap directory tree with a lot of organizational units. For each of these OUs I set one or multiple "myManager" attributes having as value the DN of the users I want to. I have set dynlist in order to have an attribute myManagerOf on every user object. Now, with one search, I would like to have all the manager "(myManagerOf=*)". But substring filter does not work. Only equality as far as I understand. Of course, as I read in some different topics, it is not feasible using dynlist. I thought that the overlay autogroup would help on that point but at this stage, I'm not able to make it working. Here is my autogroup config so far: dn: olcOverlay={4}autogroup,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAutoGroupConfig olcOverlay: {4}autogroup olcAutoGroupAttrSet: myOrganizationalUnit memberUrl myManager olcAutoGroupMemberOfAd: myManagerOf I tried to play with this autogroup config and dynlist one, but since I added autogroup, no way to change the myManager attribute, I always face an error. Which I don't have without autogroup: ldap_modify: Constraint violation (19) additional info: attempt to modify dynamic group member attribute If autogroup considers that only "memberUrl" can touch myManager attribute then it sounds logical. However, how could I achieve my goal then ?

1 0

context of slapd service
by Carsten Jäckel 15 Jun '22

15 Jun '22

Hello experts, can you please give me some hints about best practice to run the slapd service? Is it advantageous to run the slapd with it's own service user/group (e. g. ldap:ldap) or is it recommended to run slapd as root (as it seems to be default)? Can you tell me something about advantages/disadvantages of each configuration? Thank you for your support, Carsten

4 3

Bind failures via open ldap proxy for few users -
by shekhar.shrinivasan＠gmail.com 11 Jun '22

11 Jun '22

Hi, We have setup a open ldap proxy with AD backend and we are seeing the following bind error for some users. The only difference in successful bind users versus the failed ones is the addition of square brackets "[]" in the user profile. As seen below for the failed users "X" is inside square brackets. Can you please provide some pointers on this issues. Thanks for your help as always. For example - cn=Terry\2C Troy [X],ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org --> BIND FAILED cn=CN=Meza\, Rosalinda X,ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org --> BIND SUCCESS slapd[15544]: conn=3206402 op=6 BIND dn="cn=Terry\2C Troy [X],ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org" method=128 slapd[15544]: conn=3206402 op=6 meta_back_search[3] match="OU=X Accounts,OU=Users,OU=Users & Groups,dc=or,dc=myorg,dc=org" err=32 (No such object) text="0000208D: NameErr: DSID-03100241, problem 2001 (NO_OBJECT), data 0, best match of:#012#011'OU=X Accounts,OU=Users,OU=Users & Groups,DC=or,dc=myorg,DC=org'#012". slapd[15544]: conn=3206402 op=6 meta_back_bind: no target for dn "cn=Terry\2C Troy [X],ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org" (32). slapd[15544]: conn=3206402 op=6 RESULT tag=97 err=49 text=

1 0

Failing to modify olcSizeLimit
by RAIMBAULT Alain - Contractor 10 Jun '22

10 Jun '22

Hi, I am trying to modify my DB parameters to fix following issue, root@laselainfldap01p:~# ldaplist passwd ldaplist: libsldap.so.1 internal error LDAP configuration problem: LDAP ERROR (4): Error occurred while receiving results. Size limit exceeded. and libldap returned: (4) using ldaps://laselainfldap01p:636 root@laselainfldap01p:~# To achieve this, I attempted the following but I got priviledge issue accessing the DB .... # cat sizelimit.ldif dn: cn=config changetype: modify replace: olcSizeLimit olcSizeLimit: -1 root@laselainfldap01p:/etc/openldap/slapd.d/cn=config# ldapmodify -v -H ldapi:/// -Y EXTERNAL -f sizelimit.ldif ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 replace olcSizeLimit: -1 modifying entry "cn=config" ldap_modify: Insufficient access (50) root@laselainfldap01p:/etc/openldap/slapd.d/cn=config# root@laselainfldap01p:/etc/openldap/slapd.d/cn=config# ldapmodify -v -h 10.136.16.197 -D "cn=Manager,dc=tosa,dc=thales" -w tco_tosa_thales -f sizelimit.ldif ldap_initialize( ldap://10.136.16.197 ) replace olcSizeLimit: -1 modifying entry "cn=config" ldap_modify: Insufficient access (50) root@laselainfldap01p:/etc/openldap/slapd.d/cn=config#<mailto:root@laselainfldap01p:/etc/openldap/slapd.d/cn=config#> Some priviledge access seems missing but I do not understand how to setup this. Could you, please, provide some directions on this. Kind regards, Alain

4 13

dynlist +memberOf loses casing in memberOf attribute
by Felix Schäfer 07 Jun '22

07 Jun '22

Good evening, We are currently in the process of upgrading our OpenLDAP installation and we have hit a behaviour we can’t explain by perusing the documentation. When using slapo-dynlist to set memberOf attributes the dn of the group the object is a member of gets lowercased. So for example the object that is a member of a group has: === memberOf: ou=kiosk,ou=ags,ou=groups,dc=fsinfo,dc=cs,dc=tu-dortmund,dc=de === Although the group has a dn of: === dn: ou=Kiosk,ou=AGs,ou=groups,dc=fsinfo,dc=cs,dc=tu-dortmund,dc=de === Is this expected behaviour? Is there a setting we overlooked? Is this is a bug in the version shipped with Ubuntu (2.5.6+dfsg-1~exp1ubuntu1.1)? Thank you, Felix

5 21

olcTLSProtocolMin not taking effect
by juan＠quantifind.com 06 Jun '22

06 Jun '22

Hi all - As part of routine security remediation my company asked me to remove the support for older TLS versions from my LDAP server. To this effect I restarted the service after running the following: sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -a -f olcTLSProtocolMin.ldif Here is the content of olcTLSProtocolMin.ldif dn: cn=config changetype: modify add: olcTLSProtocolMin olcTLSProtocolMin: 3.3 When I look at the /etc/ldap/slapd.d/cn=config.ldif file I can see the olcTLSProtocolMin: 3.3 entry. however, when I scan the LDAP server using Nessus, the scanner reports older versions of TLS still available. Also if I scan the supported TLS version using nmap it also reports TLS1.0-TLS1.2 If it helps here is the cn=config.ldif file is here dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: stats sync olcPidFile: /var/run/slapd/slapd.pid olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/my_cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/my_slapd_key.pem olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: SomeUUID creatorsName: cn=config createTimestamp: 20160311213839Z olcTLSProtocolMin: 3.3 entryCSN: 20220601202658.429433Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber Any help will be greatly appreciated. JRosario

2 4

Re: Antw: [EXT] Re: slow memberOf queries in 2.5 with dynlist overlay
by Paul B. Henson 03 Jun '22

03 Jun '22

On 5/30/2022 11:53 PM, Ulrich Windl wrote: > I wonder: Would forcing a core dump help in that situation, or would a > gprof-compile be helpful? Unfortunately I can't reproduce it; it just happens randomly on my production boxes, less frequently since I increased the amount of memory on them. I'm not sure I could run a debug or profiling build in production for an extended amount of time waiting for it to happen. And with my luck it would be a heisenbug anyway 8-/. > Maybe one could track down the page fault to some code (function) using tools > from the valgrind family (Cachegrind, callgrind, etc.) > http://www.valgrind.org/docs/manual/manual-core-adv.html#manual-core-adv.va…

1 0

OpenLDAP 2.6.2 on RHEL8: add password policy
by Real Villafan, Elizabeth (US 392K) 01 Jun '22

01 Jun '22

Hello, I'm upgrading from openldap 2.4 running on RHEL7 up to 2.6.2 and RHEL8 on new hardware, apparently the way to configure password policy now is by configuring the slapd.conf file rather than loading the ppolicy schema. How do I modify that file properly? I read https://www.openldap.org/doc/admin26/overlays.html#Password%20Policies on section 12.10.2. Password Policy Configuration, what does it mean to "Instantiate the module in the database"? do you have a sample slapd.conf file I can refer to? Thank you, Liz

2 3

2.5 LTS release with OpenSSL 3.0
by barry.greenberg＠oracle.com 01 Jun '22

01 Jun '22

Is there any information about the release of OpenLDAP 2.5.x that includes support for OpenSSL 3.0? I see that it's now supported in 2.6.2 but we'd prefer to stay on the 2.5 branch for the foreseeable future. Thanks.

1 0

slow memberOf queries in 2.5 with dynlist overlay
by Paul B. Henson 30 May '22

30 May '22

I'm still trying to figure out why my servers sometimes get into a state where queries requesting the memberOf attribute take an exceedingly long time to process, for example: Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 fd=104 ACCEPT from PATH=/var/symas/run/ldapi (PATH=/var/symas/run/ldapi) Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" method=128 Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" mech=SIMPLE bind_ssf=0 ssf=71 Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=0 RESULT tag=97 err=0 qtime=0.000006 etime=0.000050 text= Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=1 SRCH base="dc=cpp,dc=edu" scope=2 deref=0 filter="(uid=henson)" Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=1 SRCH attr=memberOf Feb 13 19:46:42 ldap-02 slapd[13564]: conn=297643 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000012 etime=36.955710 nentries=1 text= How is the qtime calculated? It is nice and short, despite the wall clock reading over 30 seconds :(. Usually I have to reboot the server completely to clear this up, but this time I just had to restart it, and then the queries were lickity split again: Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 fd=40 ACCEPT from PATH=/var/symas/run/ldapi (PATH=/var/symas/run/ldapi) Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" method=128 Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" mech=SIMPLE bind_ssf=0 ssf=71 Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000088 text= Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=1 SRCH base="dc=cpp,dc=edu" scope=2 deref=0 filter="(uid=henson)" Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=1 SRCH attr=memberOf Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000013 etime=0.213149 nentries=1 text= Over 30 seconds elapsed time to .2 seconds? I'd like to see the .2 all the time :). When the server gets like this, there's a very high read IO load, 200-300Mb/s, compared to generally less than 1Mb/s when things are working right. It almost seems like it's doing a full disk scan searching for members every time. Any suggestions on what to dig into? Thanks...

5 16

rewriting non-DN attribute values with rwm?
by Kartik Subbarao 29 May '22

29 May '22

I'd like to rewrite the following entry: dn: uid=user(a)olddomain.com,dc=olddomain,dc=com uid: user(a)olddomain.com mail: user(a)olddomain.com to appear and behave like this: dn: uid=user(a)newdomain.com,dc=newdomain,dc=com uid: user(a)newdomain.com mail: user(a)newdomain.com I can get the DN rewritten with slapd-relay and rwm-suffixmassage, and can use rwm-rewriterule with the searchFilter and searchEntryDN contexts to return the entry when querying for mail=user(a)newdomain.com. But I can't figure out how to rewrite the *values* of the uid and mail attributes in the returned entry to user(a)newdomain.com. What is the best way to achieve this? Thanks, -Kartik

2 2

result not in cache
by Stefan Kania 29 May '22

29 May '22

I'm testing the openldap cache module pcache with OpenLDAP 2.6 on Debian11 (symas-packages). The proxy has the following config: (I'm testing caching so no security is set) -------------- include /opt/symas/etc/openldap/schema/core.schema include /opt/symas/etc/openldap/schema/cosine.schema include /opt/symas/etc/openldap/schema/nis.schema include /opt/symas/etc/openldap/schema/inetorgperson.schema pidfile /var/symas/run/slapd.pid argsfile /var/symas/run/slapd.args loglevel any modulepath /opt/symas/lib/openldap moduleload back_mdb.la moduleload argon2.la moduleload back_ldap moduleload pcache sizelimit 500 tool-threads 1 database ldap suffix "dc=example,dc=net" uri "ldap://ldap-server.example.net" rootdn "cn=admin,dc=example,dc=net" protocol-version 3 rebind-as-user overlay pcache pcachePersist TRUE pcache mdb 100000 2 1000 100 pcacheAttrset 0 mail postaladdress telephonenumber givenname pcacheAttrset 1 uid employeetype pcacheTemplate (sn=) 0 3600 pcacheTemplate (&(sn=)(givenName=)) 0 3600 pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600 directory /var/symas/cache index objectclass eq index uid,cn,sn,mail,givenname pres,eq,sub -------------- The following host are involved: ldap-server<----->ldap-proxy<----->ldap-client The ldap-client can only access the ldap-proxy. (ldap.conf ist pointing to the ldap-proxy) Now I do a: ldapsearch -x '(&(sn=Kania)(givenName=Stefan))' givenname The first time I can see that the proxy is asking the ldap-server and is giving the result to the ldap-client. Each time I repeat the command on the ldap-client, only the log from the ldap-proxy is showing the access from the ldap-client. The ldap-client is getting the result from the proxy. I can even shutdown the ldap-server and the client is still getting the result from the proxy. Up to this point I understand the log but if I set "loglevel any" I see: ------------ access_allowed: result not in cache (givenName) ------------ But I think the result IS in the cache otherwise I would not get the result with the ldap-server turned off. So why do I get this messages?

2 1

Made a change to cn=schema,cn=config, can't revert?
by Sander Smeenk 25 May '22

25 May '22

Hi, I'm trying to add an 'olcAttributeType' to an already existing LDAP schema. I wrote this LDIF, which was wrong as it turns out: | dn: cn=schema,cn=config | changetype: modify | add: olcAttributetypes | olcAttributetypes: ( bitHttpAttribute:26.2008.07.29.1 NAME | 'testEntry' DESC 'Test' EQUALITY integerMatch SYNTAX | LDAPInteger SINGLE-VALUE ) This changed my 'dn: cn=schema,cn=config' from: | dn: cn=schema,cn=config | objectClass: olcSchemaConfig | cn: schema | structuralObjectClass: olcSchemaConfig | entryUUID: 9faa0e66-41f5-1032-82e1-974d55020d34 | creatorsName: cn=config | createTimestamp: 20130425131311Z | entryCSN: 20130425131311.204787Z#000000#000#000000 | modifiersName: cn=config | modifyTimestamp: 20130425131311Z To: | dn: cn=schema,cn=config | objectClass: olcSchemaConfig | cn: schema | structuralObjectClass: olcSchemaConfig | entryUUID: 9faa0e66-41f5-1032-82e1-974d55020d34 | creatorsName: cn=config | createTimestamp: 20130425131311Z | olcAttributeTypes: {0}( bitHttpAttribute:26.2008.07.29.1 NAME | 'testEntry' DESC 'Test' EQUALITY integerMatch SYNTAX | LDAPInteger SINGLE-VALUE ) | entryCSN: 20220525132055.795116Z#000000#000#000000 | modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth | modifyTimestamp: 20220525132055Z Which is not what i wanted but it happened, so now i want it gone. But it seems i can't remove that olcAttributeTypes entry? This LDIF won't work: | dn: cn=schema,cn=config | changetype: modify | delete: olcAttributeTypes Yielding: | # ldapmodify -Y EXTERNAL -H ldapi:/// -f kak.ldif | [..] | modifying entry "cn=schema,cn=config" | ldap_modify: Other (e.g., implementation specific) error (80) When i put in the exact olcAttributeType line i want to remove (instead of all of 'em) like this: | dn: cn=schema,cn=config | changetype: modify | delete: olcAttributeTypes | olcAttributeTypes: ( bitHttpAttribute:26.2008.07.29.1 NAME 'testEntry' DESC 'Test' EQUALITY integerMatch SYNTAX LDAPInteger SINGLE-VALUE ) Now the same ldapmodify command yields: | # ldapmodify -Y EXTERNAL -H ldapi:/// -f kak.ldif | [..] | modifying entry "cn=schema,cn=config" | ldap_modify: Operations error (1) Can anyone explain what i am doing wrong and how to revert my change to the 'cn=schema,cn=config' dn? Thanks a bunch! Regards, -Sander. -- | I did a theatrical performance about puns. It was a play on words. | 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2

2 3

consumer state is newer than provider
by Rallavagu Kon 24 May '22

24 May '22

Hello All, Running OpenLDAP version 2.4.58 on Ubuntu 20.04 in multicaster mode. Replication Configuration: olcSyncrepl: {0}rid=101 provider=ldaps://<host1>:10636 binddn="<binddn>" bindm ethod=simple credentials=<creds> searchbase="dc=company,dc=com" type =refreshAndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive= "240:10:30" olcSyncrepl: {1}rid=102 provider=ldaps://<host2>:10636 binddn="<binddn>" bindm ethod=simple credentials=<creds> searchbase="dc=company,dc=com" type =refreshAndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive= "240:10:30" olcSyncrepl: {2}rid=103 provider=ldaps://<host3>:10636 binddn="<binddn>" bindm ethod=simple credentials=<creds> searchbase="dc=company,dc=com" type =refreshAndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive= "240:10:30" olcSyncrepl: {3}rid=104 provider=ldaps://<host4>:636 binddn="<binddn>" bindmethod=si mple credentials=<creds> searchbase="dc=company,dc=com" type=refresh AndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive="240:10: 30" olcMirrorMode: TRUE # {1}syncprov, {2}mdb, config dn: olcOverlay={1}syncprov,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 10 Under normal conditions, all operations perform normally in terms of replication consistency. However, when performing a stream of “ADD” operations eventually producer/consumer go out of sync where consumer thinks it has latest state than producer. All the write operations including ADD are pointed to a producer node (not load balancing the writes). Introduced 30 second delay to “ADD” operations (for the sake of testing) and experiencing the same behavior. The issue is manifesting after adding around 4k entries (sometimes even sooner). Here are the log snippets. May 4 23:06:47 openldap-service-0 slapd[199]: do_syncrep2: rid=102 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform May 4 23:06:47 openldap-service-0 slapd[199]: do_syncrep2: rid=102 (53) Server is unwilling to perform May 4 23:06:37 openldap-service-1 slapd[199]: conn=1046 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! Checked for the clock synchronization and verified that all instances have NTP enabled. Wondering where and what I should be looking for. Thanks in advance.

2 3

slapo-syncprov on read-only consumers
by Michael Ströder 21 May '22

21 May '22

HI! Is it still highly recommended to configure slapo-syncprov on read-only consumers? Background: I have a tier of read-only consumers with "lastbind on" and slapo-ppolicy configured, but no chaining to the writeable providers (e.g. no ppolicy_forward_updates). All providers and consumers are 2.6.2. In case of a simple bind to this read-only consumer it makes local modification to the user's entry (pwdFailureTime and pwdLastSuccess) and it's ok for me that this is local to this consumer. But with slapo-syncprov configured on the consumer slapd generates a new entryCSN with server ID 0 which results in a contextCSN value with SID 0. This is what I'd like to avoid. Hence my above question. Ciao, Michael.

1 0

Query on CVE-2022-29155
by Venkat Kandhari -X (khvenkat - INFOSYS LIMITED＠Cisco) 18 May '22

18 May '22

3 2

Solution for syncrepl & memberof replacement with non-dynamic group and users
by René Gallati 17 May '22

17 May '22

Hello list, I have an openldap 2.4.49 (ubuntu 20.04 LTS) server pair running with syncrepl. I also have memberof overlay activated and during a debug session found out that this is a no-go. I was debugging a problem where an user record that is in two groups only shows one memberOf attribute value whereas other users show the expected amount of memberOf values. Now I'm looking into replacing the memberof overlay but it appears that for my use case there is no replacement at all. dynlist seems made to create dynamic groups or lists respectively but everything in my DIT is a static group and static users. They are created by a commercial product and I am unable to add further specific URL attributes there when new entries are created. I stumbled upon https://www.mail-archive.com/openldap-technical@openldap.org/msg26067.html via google search, but blindly copying the dynlist-attrset merely causes the slapd to reply with "/etc/ldap/slapd.conf: line 149: "dynlist-attrset <oc> [uri] <URL-ad> [[<mapped-ad>:]<member-ad> ...]": unable to find AttributeDescription #0 "member+memberOf@groupOfNames"#012. " on startup and stopping immediately. I suppose it needs some schema extension but of what I don't understand and neither will I have a trigger objectClass unless I could just use inetOrgPerson as trigger and have it work. Is there a way to get back "synthetic" memberOf entries on static user records (which are inetOrgPerson) with static groups (which are groupOfNames) on openldap 2.4.49 without adding any special attributes into users and/or groups themselves ? Kind regards, René -- rene.gallati(a)ergon.ch T +41 44 268 83 10 Ergon Informatik AG, Merkurstrasse 43, CH-8032 Zürich www.ergon.ch smart people – smart software * * * * * * * * * * * * * * * * * * * * * * * * * DELIVERING TECHNOLOGY ADVANTAGE SINCE 1984

2 5

changes in own schema in multi provider setup
by Stefan Kania 17 May '22

17 May '22

Good morning, we having a own schema with a lot of own attributes. We have a multi provider replication of cn=config. What is the right way to add a new attribute to our schema and get it into the configuration? Stefan

2 1

Can a Bind result in a Referral?
by Mike Stevens 16 May '22

16 May '22

Good day. I’m an LDAP novice and am attempting to modify an LDAP client to accommodate an LDAP server environment that makes use of referrals. I have installed openLDAP 2.4.44 on 2 RHEL 7.9 servers. The initial entries in the tree on serverA contains : # xxx.com dn: dc=xxx,dc=com description: xxx.com dc: xxx o: xxx.com objectClass: top objectClass: dcObject objectClass: organization # Users, xxx.com dn: ou=Users,dc=xxx,dc=com ou: Users description: xxx Users objectClass: organizationalUnit # search reference *ref: ldap://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com??sub <http://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com??sub>* # mike, Users, xxx.com dn: uid=mike,ou=Users,dc=xxx,dc=com cn: mike ou: Users uid: mike givenName: Mike mail: mike(a)uk.xxx.com objectClass: Person objectClass: organizationalPerson objectClass: inetOrgPerson I believe the "ref" entry is known as a subordinate referral; it was created by populating the tree from an LDIF file that contained the following: dn: dc=uk,dc=xxx,dc=com objectClass: referral objectClass: extensibleObject dc: uk ref: ldap://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com The intent is to redirect any requests received by serverA that refer to the subtree uk.xxx.com to serverB. The tree on serverB contains: # xxx.com dn: dc=xxx,dc=com description: xxx.com dc: xxx o: xxx.com objectClass: top objectClass: dcObject objectClass: organization # uk.xxx.com dn: dc=uk,dc=xxx,dc=com dc: uk o: uk.xxx.com description: xxx Users in the UK objectClass: dcObject objectClass: organization # mike, uk.xxx.com dn: uid=mike,dc=uk,dc=xxx,dc=com cn: mike uid: mike givenName: Mike mail: mike(a)uk.xxx.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson Now, if I perform a search on serverA specifying a base of uk.xxx.com, I get an RC=10 Referral result as expected: [root@serverA ~]# ldapsearch -x '(uid=mike)' -b dc=uk,dc=xxx,dc=com -LL version: 1 Referral (10) Matched DN: dc=uk,dc=xxx,dc=com Referral: ldap://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com??sub ... and I can chase that referral using the -C option to retrieve the entry from serverB: [root@Mike21 ~]# ldapsearch -x '(uid=mike)' -b dc=uk,dc=ibm,dc=com -LL -C version: 1 dn: uid=mike,dc=uk,dc=xxx,dc=com cn: mike uid: mike givenName: Mike mail: mike(a)uk.xxx.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson But, if I attempt a bind to serverA using the user that exists in serverB, I get an authentication failure: [root@serverA ~]# ldapsearch -x -b 'dc=uk,dc=xxx,dc=com' -D uid=mike,dc=uk,dc=xxx,dc=com -w passw0rD ldap_bind: Invalid credentials (49) Now, I realise that the failure would be expected as the bind DN doesn't exist at serverA. But I read that every request apart from unbind and abandon can result in a referral. So why doesn't the bind follow the "ref" to serverB? Is that possible and have I not configured my server correctly? Ultimately, what I'd like to do in my client is something like: ld_user = ldap_init( "ldap://serverA:389/dc=uk,dc=xxx,dc=com" , 0 ); ... followed by : err = ldap_simple_bind_s( ld_user, "uid=mike,dc=uk,dc=xxx,dc=com" , password); ... and have LDAP authenticate the given user against serverB based on the referral in serverA. Is this sort of set up possible? Many thanks for your advice, Mike

2 4

issues with kqueue on OpenBSD
by Stuart Henderson 15 May '22

15 May '22

I'm working on updating the OpenBSD port of OpenLDAP to 2.6.2 (it's currently stuck at 2.4.59). In 2.5 kqueue support was added to slapd for BSDs, but it's not working correctly on OpenBSD. If slapd runs as a daemon, errors like these are seen: slap_client_connect: URI=ldaps://XXX Warning, ldap_start_tls failed (1) mdb_opinfo_get: err Invalid argument(22) However if slapd is run in the foreground with -d, things are ok. They are also OK if kqueue is disabled (by neutering the autoconf check) so this isn't blocking me updating the port but I thought I'd write up what I have in case someone has any ideas what might be up or anything they'd like me to try and report back on. Here are some log excerpts: 17:23:44.692: slapd starting 17:23:44.692: daemon: added 3r listener=0x0 17:23:44.692: daemon: added 6r listener=0x100263797200 17:23:44.692: daemon: added 7r listener=0x100263785400 17:23:44.692: daemon: kqueue: listen=6 active_threads=0 tvp=zero 17:23:44.692: daemon: kqueue: listen=7 active_threads=0 tvp=zero 17:23:44.692: daemon: activity on 1 descriptor 17:23:44.692: daemon: activity on: 17:23:44.692: 17:23:44.692: daemon: kqueue: listen=6 active_threads=0 tvp=zero 17:23:44.692: daemon: kqueue: listen=7 active_threads=0 tvp=zero 17:23:44.692: >>> dnNormalize: <cn=Consumer 101> 17:23:44.692: <<< dnNormalize: <cn=consumer 101> 17:23:44.692: =>do_syncrepl rid=101 17:23:44.763: slap_client_connect: URI=ldaps://XXXXXXXXXXXXXXX Warning, ldap_start_tls failed (1) 17:23:44.781: => mdb_entry_get: ndn: "dc=XXXXXXX,dc=XXX" 17:23:44.782: => mdb_entry_get: oc: "(null)", at: "contextCSN" 17:23:44.782: mdb_opinfo_get: err Invalid argument(22) 17:23:44.782: =>do_syncrep2 rid=101 17:23:44.782: daemon: added 9r listener=0x0 17:23:44.783: daemon: activity on 1 descriptor 17:23:44.783: daemon: activity on: 17:23:44.783: 17:23:44.783: daemon: kqueue: listen=6 active_threads=0 tvp=NULL 17:23:44.783: daemon: kqueue: listen=7 active_threads=0 tvp=NULL 17:23:44.800: daemon: activity on 1 descriptor 17:23:44.800: daemon: activity on: 17:23:44.800: 9r 17:23:44.800: 17:23:44.800: daemon: read active on 9 17:23:44.800: daemon: kqueue: listen=6 active_threads=0 tvp=NULL 17:23:44.800: daemon: kqueue: listen=7 active_threads=0 tvp=NULL 17:23:44.800: connection_get(9) 17:23:44.800: connection_get(9): got connid=0 17:23:44.801: =>do_syncrepl rid=101 17:23:44.801: =>do_syncrep2 rid=101 Not sure if it's any help but looking at kdump(1) output after a run under ktrace(1) I didn't spot the immediate problem resulting in "ldap_start_tls failed (1)" however the "mdb_opinfo_get: err Invalid argument(22)" occurs after attempting to call fcntl with F_SETLK on the fd 5 which is the kqueue fd: 65304 slapd RET write 97/0x61 65304 slapd CALL poll(0x89d39cb9004,1,INFTIM) 65304 slapd STRU struct kevent [2] { ident=9, filter=EVFILT_READ, flags=0x1005<EV_ADD|EV_ENABLE>, fflags=0<>, data=0, udata=0x231a1bea } { ident=9, filter=EVFILT_EXCEPT, flags=0x1005<EV_ADD|EV_ENABLE>, fflags=0x4<>, data=0, udata=0x231a1bea } 65304 slapd STRU struct kevent { ident=9, filter=EVFILT_READ, flags=0x1005<EV_ADD|EV_ENABLE>, fflags=0<>, data=36, udata=0x231a1bea } 65304 slapd STRU struct pollfd { fd=9, events=0x3<POLLIN|POLLPRI>, revents=0x1<POLLIN> } 65304 slapd RET poll 1 65304 slapd CALL read(9,0x89ccfb103e0,0x5) 65304 slapd GIO fd 9 read 5 bytes "\^W\^C\^C\0\^_" 65304 slapd RET read 5 65304 slapd CALL read(9,0x89ccfb349c5,0x1f) 65304 slapd GIO fd 9 read 31 bytes "\M^W\M-r\M-f\M^C\M-2\M^V\M-E\^O\M-hdgq\M-"\M-o\M-&\M^[*\M-9\M^E\M-Sd\M^A2\M-QE\M-cb |\M^VI" 65304 slapd RET read 31/0x1f 65304 slapd CALL mmap(0,0x2000,0x3<PROT_READ|PROT_WRITE>,0x1002<MAP_PRIVATE|MAP_ANON>,-1,0) 65304 slapd RET mmap 9468564512768/0x89c926ca000 65304 slapd CALL fcntl(5,F_SETLK,0x8ef465d0) 65304 slapd RET fcntl -1 errno 22 Invalid argument 65304 slapd CALL getpid() 65304 slapd RET getpid 65304/0xff18 65304 slapd CALL sendsyslog(0x89c8ef44040,59,0<>) 65304 slapd GIO fd -1 wrote 59 bytes "<167>slapd[65304]: mdb_opinfo_get: err Invalid argument(22)" Any suggestions would be welcome. Thanks!

2 2

set LDAPI_SOCK
by Michael Ströder 15 May '22

15 May '22

HI! I'm trying to get rid of this old patch by Ralf Haferkamp: https://build.opensuse.org/package/view_file/network:ldap/openldap2/0003-LD… Background: Today Linux distros prefer that you place temporary run-time files in a directory like /run/<service-name> with appropriate ownership and permissions. And also systemd can create a temporary run-time directory on-the-fly and removes it after service stopped. But if I e.g. use configure --runstatedir=/run/slapd the default pathname of the LDAPI socket is /run/slapd/run/ldapi Any way to set LDAPI_SOCK directly during build? Ciao, Michael.

1 0

(Updated) License issue about sleepycat license.
by s1k2c3＠naver.com 13 May '22

13 May '22

[박주현 / Ju Hyun Park] 2022-05-13 18:27 I am sorry I change my question like below... I just wonder license issue about sleepycat license. In sleepycat License, "Redistributions in any form must be accompanied by information on how to obtain complete source code for the DB software and any accompanying software that uses the DB software." I do not know " any accompanying software that uses the DB software" When commercial SW uses OpenLDAP and OpenLDAP uses BDB, commercial SW should be disclosed? What was user's obligation? I want to know about it exactly about sleepycat License. This SW does not link with OpenLDAP directy.. For example, SW using GPL Licese does not need to disclose source code of SW, because it executes on seperate process. How about OpenLDAP? When SW connect to OpenLDAP on seperate process, source code of SW should be disclosed? please do not care about deprecated version.. I just want to know about Sleepycat License.. Thank you.

3 3

question on replica IDs
by A. Schulze 13 May '22

13 May '22

Hello, I'm running a Cluster of 4 Servers of openldap-2.6.1 ServerID 1 ldaps://member1.example/ ServerID 2 ldaps://member2.example/ ServerID 3 ldaps://member3.example/ ServerID 4 ldaps://member4.example/ syncrepl rid=1 provider=ldaps://member1.example/ syncrepl rid=2 provider=ldaps://member2.example/ syncrepl rid=3 provider=ldaps://member3.example/ syncrepl rid=4 provider=ldaps://member4.example/ multiprovider on the servers 1 and 2 are offline since a week or so. Now I like to remove servers 1 and 2 finally to fall back to a cluster of two members. The new config will look this way: ServerID 1 ldaps://member3.example/ ServerID 1 ldaps://member4.example/ syncrepl rid=1 provider=ldaps://member3.example/ syncrepl rid=2 provider=ldaps://member4.example/ multiprovider on Is this change of ID numbers a potential source of trouble? Andreas

2 3

BDB and License
by s1k2c3＠naver.com 12 May '22

12 May '22

Hi I want to use OpenLDAP.(GitHub - openldap/openldap: Mirror of OpenLDAP repository, The OpenLDAP Public License Version 2.8) OpenLDAP uses berkeley DB 5.3.21. In addition,, openLDAP version is 2.4.49. 1. Berkeley DB(BDB) 5.3.21 is sleepycat license, right? 2. When I use OpenLDAP, should I disclose source code of commercial SW? or Can I use OpenLDAP without disclosing source code of commercial SW? 3. When I do not link with OpenLDAP directly. I connect to another open source without link such as http, jmx etc and it connects to OpenLDAP, should I disclose source code of commercial SW? 4. When I distribute commercial SW using OpenLDAP, should I use sleepycat license for berkeley DB or should I purchase BDB? Thank you.

2 1

upgrade from Debian 2.4.x
by Udo Rader 09 May '22

09 May '22

Hi, we've been long using OpenLDAP as a backbone for almost everything (users, groups, DNS, DHCP, ...) and we've finally reached the point where we want or better NEED to migrate away from the vanilla debian packages. This is mostly due to the fact that our sync-repl based replication loses data every now and then, which is a real pain to detect and then to fix. So, as far as I understand, our best bet is to migrate to the latest packages from Symas :) However, I think to remember a discussion about the membersOf overlay not working reliably with sync-repl even with the Symas packages. Is this correct and if so, what would be the best way to have membersOf functionality? And, what would be the best way to upgrade? Are the symas packages just a drop in replacement from the debian packages or is better to start from scratch and import the LDAP tree? Thanks Udo -- Udo Rader, MBA, CTO BestSolution.at EDV Systemhaus GmbH Salurner Straße 15, A-6020 Innsbruck http://www.bestsolution.at/ Reg. Nr. FN 222302s am Firmenbuchgericht Innsbruck

2 1

RE Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs
by Dr. Ogg 06 May '22

06 May '22

Any idea when the Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs book will be available on kindle?

1 0

LDAP Proxy
by guillaume.briere＠bell.ca 05 May '22

05 May '22

Hello, Sorry if it has already been asked in the past. We have a use-case and I'm having difficulties to find if openldap could be a good fit for us. Let's say that we have 2 vlan. LDAP and active directory is inside the first vlan. The servers is inside the other vlan. We want to have a "ldap proxy" server inside the server vlan where only this server could communicate with the LDAP and active directory server. This ldap proxy server needs to listen on 3 ports (or could be 3 different instances), example:636,637 and 638 If we hit the port 636: The user password needs to be validate against the active directory and the user's membership needs to be validate against the LDAP server If we hit the port 637: The user password and user's group membership needs to be validate against LDAP If we hit the port 638: The user password and user's membership needs to be validate against Active Directory The LDAP server and ldap proxy would be openldap. Thanks in advance

1 0

Win32 file size
by Søren Holm 04 May '22

04 May '22

Hi Mapsize on windows apparently creates a database file of the exact size of map-size. This is inconvenient. But I can see that Howard has been nice and done the commit below back in 2015 - it is not in any tag however. What are your recommendations - is mdb.master safe for productions? commit fb5a768a77ca5330e15a3a34ceb694bc11cb216a Author: Howard Chu <hyc(a)openldap.org> Date: Mon Nov 30 18:46:19 2015 +0000 ITS#8324 incremental DB file growth for Windows

1 0

Re: Migrating from Debian 6 to Ubuntu 20
by Tan Mientras 03 May '22

03 May '22

just figure it out whats going on: a comment line (starting with #) in the middle of a ACL breaks the ACL. On Tue, May 3, 2022 at 11:52 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, May 3, 2022 10:05 AM +0200 Tan Mientras > <tanimientras(a)gmail.com> wrote: > > > > > > > OLD SERVER:ii ldap-utils > > 2.4.23-7.3 OpenLDAP utilities > > ii ldapscripts 1.9.0-2 > > Add and remove user and groups (stored in a LDAP > > directory) > > ii libldap-2.4-2 2.4.23-7.3 > > OpenLDAP libraries > > ii libnet-ldap-perl 1:0.4001-2 > > client interface to LDAP servers > > ii libnss-ldap 264-2.2 > > NSS module for using LDAP as a naming service > > ii libpam-ldap 184-8.5 > > Pluggable Authentication Module for LDAP > > > > ii postfix-ldap 2.7.1-1+squeeze1 > > LDAP map support for Postfix > > > > > > vs > > > > > > NEW SERVER: > > > > ii ldap-utils > > 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP > > utilities > > ii ldapscripts 2.0.8-1ubuntu1 > > all Add and remove users and > > groups (stored in a LDAP directory) > > ii libldap-2.4-2:amd64 > > 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP > > libraries > > ii libldap-common > > 2.4.49+dfsg-2ubuntu1.8 all OpenLDAP > > common files for libraries > > None of the above shows what the slapd version is, but I'll assume 2.4.23 > to 2.4.49. Are you using the exact same OpenLDAP slapd.conf with both? > > Regards, > Quanah > > > >

1 0

Re: Migrating from Debian 6 to Ubuntu 20
by Tan Mientras 03 May '22

03 May '22

OLD SERVER: ii ldap-utils 2.4.23-7.3 OpenLDAP utilities ii ldapscripts 1.9.0-2 Add and remove user and groups (stored in a LDAP directory) ii libldap-2.4-2 2.4.23-7.3 OpenLDAP libraries ii libnet-ldap-perl 1:0.4001-2 client interface to LDAP servers ii libnss-ldap 264-2.2 NSS module for using LDAP as a naming service ii libpam-ldap 184-8.5 Pluggable Authentication Module for LDAP ii postfix-ldap 2.7.1-1+squeeze1 LDAP map support for Postfix vs NEW SERVER: ii ldap-utils 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP utilities ii ldapscripts 2.0.8-1ubuntu1 all Add and remove users and groups (stored in a LDAP directory) ii libldap-2.4-2:amd64 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP libraries ii libldap-common 2.4.49+dfsg-2ubuntu1.8 all OpenLDAP common files for libraries On Fri, Apr 29, 2022 at 5:16 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, April 29, 2022 3:06 PM +0200 Tan Mientras > <tanimientras(a)gmail.com> wrote: > > > > > > > Hello. > > > > > > Trying to migrate our ldap from one server to a new one I did: > > What OpenLDAP release was the old server running? What OpenLDAP release is > the new server running? > > --Quanah > > > >

2 1

LMDB compaction
by Søren Holm 03 May '22

03 May '22

Hi I know that LMDB currently does not support compaction, but I'm interested in knowing if such a feature is being worked on. And if not, is it a feature that can be merged into LMDB if implemented? /Søren Holm

2 4

cannot use RootDN to modify cn=config: Insufficient access
by butterfly-cry＠qq.com 02 May '22

02 May '22

Hi guys, I have google a lot to modify cn=config but all failed. Hope someone can help. Thanks. [openldap2.6.1 CentOS7.9] My initial ldif is like below: `[root@rayc01 openldap]# more slapd.ldif |grep -v ^# dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /usr/local/openldap-2.6.1/var/run/slapd.args olcPidFile: /usr/local/openldap-2.6.1/var/run/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/openldap-2.6.1/libexec/openldap olcModuleload: back_mdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/core.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/collective.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/corba.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/cosine.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/dsee.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/duaconf.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/dyngroup.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/inetorgperson.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/java.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/misc.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/namedobject.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/nis.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/openldap.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/pmi.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=domain,dc=com olcRootDN: cn=root,dc=domain,dc=com olcRootPW: {SSHA}N/Zg9jqjoL1E4xEHc1dGdyTzZiOlEsrs olcDbDirectory: /usr/local/openldap-2.6.1/var/openldap-data olcDbIndex: objectClass eq dn: olcDatabase=monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: monitor olcRootDN: cn=config olcMonitoring: FALSE [root@rayc01 openldap]# ` After import by slapadd and after slapd start, i can add my ou with cn=root by ldapadd. like below: `[root@rayc01 ~]# more base.ldif dn: dc=domain,dc=com dc: domain objectClass: top objectClass: domain dn: ou=People,dc=domain,dc=com objectClass: organizationalUnit ou: People dn: ou=Group,dc=domain,dc=com objectClass: organizationalUnit ou: Group dn: ou=Mounts,dc=domain,dc=com objectClass: organizationalUnit ou: Mounts` But when I try to modify olcLogLevel and olcIdleTimeout in cn=config, I get errors: [root@rayc01 ~]# more log.ldif dn: cn=config changeType: modify replace: olcIdleTimeout olcIdleTimeout: 60 dn: cn=config changeType: modify replace: olcLogLevel olcLogLevel: 256 [root@rayc01 ~]# ldapmodify -Y external -H ldapi:/// -f 1.ldif ldap_sasl_interactive_bind: Can't contact LDAP server (-1) [root@rayc01 ~]# ldapmodify -x -D cn=root,dc=domain,dc=com -w "xxx@123" -f log.ldif modifying entry "cn=config" ldap_modify: Insufficient access (50) [root@rayc01 ~]# ldapmodify -x -D cn=config -f log.ldif ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed [root@rayc01 ~]# [root@rayc01 ~]# more 1.ldif dn: olcDatabase={0}config,cn=config #olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=r oot,dc=huawei,dc=com" read by * none [root@rayc01 ~]# ldapmodify -Y external -H ldapi:/// -f 1.ldif ldap_sasl_interactive_bind: Can't contact LDAP server (-1) [root@rayc01 ~]#

3 6

RE26 testing call #2 (OpenLDAP 2.6.2)
by Quanah Gibson-Mount 02 May '22

02 May '22

This is the second testing call for OpenLDAP 2.6.2. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Fixes since last testing call: ITS#9802 (further fixes) ITS#9820 ITS#9825 ITS#9831 ITS#9832 Thanks! OpenLDAP 2.6.2 Engineering Added libldap support for OpenSSL 3.0 (ITS#9436) Added slapd support for OpenSSL 3.0 (ITS#9436) Fixed ldapdelete to prune LDAP subentries (ITS#9737) Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd to correctly init global_host earlier (ITS#9787) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd idletimeout handling (ITS#9820) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd to correctly advance connections index (ITS#9831) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Fixed slapd-monitor crash when hitting sizelimit (ITS#9832) Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) Added slapo-otp support for OpenSSL 3.0 (ITS#9436) Fixed slapo-dynlist dynamic group regression (ITS#9825) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Fixed slapo-translucent to correctly duplicate substring filters (ITS#9818) Build Enviornment Add ability to override default compile time paths (ITS#9675) Fix compiliation with certain versions of gcc (ITS#9790) Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Contrib Update ppm module to the 2.1 release (ITS#9814) Documentation admin26 Document new lloadd features (ITS#9780) Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804) Fixed slapd-sock(5) to clarify "sockresps result" behavior (ITS#8255)

2 4

How to allow openldap searches for all just one group
by gerson.garcia＠itron.com 01 May '22

01 May '22

All, I am inheriting the support of small openldap deployment and I am new to it. I have a request to create a security group to this implementation and only users in this group should have access to manage objects in the ldap. We have something like this: +-dc=nocinbox,dc=com +---ou=groups +---cn=admin +---cn=app-admin +---cn=sec-admin +---ou=users +---cn=admin +---cn=appadmin +---cn=appadmin2 +---cn=secadmin In the olcDatabase configuration I have the following: olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.subtree="dc=nocinbox,dc=inc" by set="[cn=sec-admin,ou=groups,dc=nocinbox,dc=inc]/memberUid & user/uid" write by * read And only secadmin can make changes in the LDAP, that is great. However, all other users can ldapsearch: $ ldapsearch -x -v -H ldaps://openldap:636 -b "dc=nocinbox,dc=inc" -D "cn=admin,ou=users,dc=nocinbox,dc=inc" -W | grep numResponses ldap_initialize( ldaps://openldap:636/??base ) Enter LDAP Password: filter: (objectclass=*) requesting: All userApplication attributes # numResponses: 29 Is there any olcAccess configuration I can used to not allow any user to run ldapsearch but still able to authenticate them? They still need to ssh and access some web servers. Thank you very much, Gerson

3 4

Could not find admin user after setup slapd on Debian
by sparkcyf＠foxmail.com 30 Apr '22

30 Apr '22

After install the openldap (slapd) from Debian package repository (using the version 2.4.57+dfsg-3~bpo10+1, database created by the dpkg configuration script provide by apt), the admin user (cn=admin,dc=example,dc=com) in could not be found either when performing ldapsearch or viewing the structure of the organisation in phpldapadmin / Apache directory studio. result of ldapsearch: ------------ root@ldap:~# ldapsearch -x -b "dc=example,dc=com" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: example.com dc: exmaple # search result search: 2 result: 0 Success ------------ However, using ldapwhoami (ldapwhoami -vvv -h ldap.example.com -D cn=admin,dc=example,dc=com -x -w password) can return a successful result. result of ldapwhoami: ------------ ldap_initialize( ldap://localhost ) dn:cn=admin,dc=example,dc=com Result: Success (0) ------------ A similar issue can be found here: https://github.com/osixia/docker-openldap/issues/555 on Github. According to the user in Github, this issue is first occurred in openldap 2.4.57 (https://github.com/osixia/docker-openldap/releases/tag/v1.5.0 I'm not sure whether it is a feature or a bug of slapd. Thanks in advance!

5 8

Migrating from Debian 6 to Ubuntu 20
by Tan Mientras 29 Apr '22

29 Apr '22

Hello. Trying to migrate our ldap from one server to a new one I did: old-server# slapcat -f /etc/ldap/slapd.conf > ldap.txt new-server# slapadd -f /etc/ldap/slapd.conf -l ldap.txt (yes, I'm still using legacy configuration format) Migration seems fine and tree is visible and valid using phpldapadmin, however third party applications aren't login-in/integrating with the new server. I have narrowed it to this: - querying with admin user works in both servers - ldapsearch -x -h old-server -b "dc=domain,dc=root" -D "uid=query,ou=people,dc=domain,dc=root" -W works and, password provided, it returns results - ldapsearch -x -h new-server -b "dc=domain,dc=root" -D "uid=query,ou=people,dc=domain,dc=root" -W results in *result: 32 No such object *(so login works, but the query user cant find results) Did I miss something for migration? a required step apart from copying configuration files and slapcat+slapadd? Thanks in advance

2 1

slapd (Symas 2.6.1) does not start with syncprov
by Magnus Morén 28 Apr '22

28 Apr '22

Migrating to new ldap server and getting problems. OS: Rocky Linux 8 (== RHEL/CentOS 8). Fully updated. LDAP software: symas-openldap-servers-2.6.1-2.el8.x86_64 cn=config and and data import (via ldif) on master. Everything look good. start/stop/restart is working. ldap access is working. Adding "syncprov" on master (to enable producer/consumer mode). Now the slapd on the master/producer crashes on start! Apr 26 18:31:27 apollo11 systemd[1]: Started Symas OpenLDAP Server Daemon. Apr 26 18:31:27 apollo11 kernel: traps: slapd[1379] general protection fault ip:7fa53a499f38 sp:7fa4f8e3d1b0 error:0 in back_mdb.so.2.0.200[7fa53a471000+40000] Apr 26 18:31:27 apollo11 systemd[1]: Started Process Core Dump (PID 1380/UID 0). Apr 26 18:31:27 apollo11 systemd-coredump[1381]: Resource limits disable core dumping for process 1377 (slapd). Apr 26 18:31:27 apollo11 systemd-coredump[1381]: Process 1377 (slapd) of user 0 dumped core. Apr 26 18:31:27 apollo11 systemd[1]: symas-openldap-servers.service: Main process exited, code=killed, status=11/SEGV Apr 26 18:31:27 apollo11 systemd[1]: symas-openldap-servers.service: Failed with result 'signal'. Apr 26 18:31:27 apollo11 systemd[1]: systemd-coredump(a)3-1380-0.service: Succeeded. The syncprov ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov.la dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryCSN,entryUUID eq Magnus Morén

5 12

RE25 Testing call #2 (OpenLDAP 2.5.12)
by Quanah Gibson-Mount 27 Apr '22

27 Apr '22

This is the second testing call for OpenLDAP 2.5.12. Depending on the results, this may be the final testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Fixes since last testing call: ITS#9802 (further fixes) ITS#9820 ITS#9825 ITS#9831 Thanks! OpenLDAP 2.5.12 Engineering Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd idletimeout handling (ITS#9820) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd to correctly advance connections index (ITS#9831) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Fixed slapo-dynlist dynamic group regression (ITS#9825) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Fixed slapo-translucent to correctly duplicate substring filters (ITS#9818) Build Environment Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Fix compiliation with certain versions of gcc (ITS#9790) Documentation Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804)

2 1

OpenLDAP 2.5 and smbkrb5pwd module
by Abdelkader Chelouah 25 Apr '22

25 Apr '22

I used to build *smbkrb5pwd* module (https://github.com/opinsys/smbkrb5pwd) under OpenLDAP 2.4 and everything was working as expected. Starting from OpenLDAP 2.5, building the module still succeeds but an error 80 occurs when the module is loaded ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 modifying entry "cn=module{0},cn=config" 2022-04-22T08:50:40.501922+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71 2022-04-22T08:50:40.501945+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000066 text= 2022-04-22T08:50:40.502151+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=1 MOD dn="cn=module{0},cn=config" 2022-04-22T08:50:40.502181+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=1 MOD attr=olcModuleLoad 2022-04-22T08:50:40.503892+00:00 arrakis slapd-2.5-aa[8947]: lt_dlopenext failed: (smbkrb5pwd_srv.la) file not found 2022-04-22T08:50:40.503923+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=1 RESULT tag=103 err=80 qtime=0.000006 etime=0.001772 text=<olcModuleLoad> handler exited with 1 2022-04-22T08:50:40.504117+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=2 UNBIND (the error message is misleading since file *smbkrb5pwd_srv.la* is really in the modules directory) I'm wondering if someone has experienced the same issue and was able to overcome it ? Regards

3 5

OPENLDAP client API option to capture the communication traces in a file
by chou.ravin177＠gmail.com 24 Apr '22

24 Apr '22

How client can leverage this LBER_OPT_LOG_PRINT_FILE option to redirect the log to the file? I had tried setting this option after ldap_initalize from the client end. But still, I couldn't get any traces in the supplied logfile. The traces works fine in the console mode with DEBUG_OPENLDAP. But they seem not to be working with this. Could you suggest any other approach or configuration which can be used to capture the underlying OpenLDAP communication from the client-side? @hyc/@openldap-technical-owner@openldap.org: Would appreciate it if you can share any thoughts?

1 0

Attempting to build docker image with symas RPMs
by thomaswilliampritchard＠gmail.com 24 Apr '22

24 Apr '22

I tried searching before posting but was getting a gateway timeout - apologies if this was answered previously. I am attempting to build a docker image from debian using symas RPMs to facilitate local testing. I am new to RPMs / Linux Package Management so forgive me if this is an obvious answer. ``` FROM debian:buster RUN apt update RUN apt install --yes --quiet wget RUN apt install --yes --quiet gnupg RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys DA26A148887DCBEB RUN wget -q https://repo.symas.com/configs/SOLDAP/d10/release25.list -O /etc/apt/sources.list.d/soldap-release25.list RUN apt update RUN apt install symas-openldap-clients symas-openldap-server RUN rm --force --recursive /var/lib/apt/lists/* ``` This fails on the symas-openldap-clients and symas-openldap-server installation with #11 0.600 E: Unable to locate package symas-openldap-clients #11 0.600 E: Unable to locate package symas-openldap-server If I skip that step I can build and sanity check the debian version ``` root@fc0489d57cd4:/# cat /etc/issue Debian GNU/Linux 10 \n \l ``` Any advice how to make this work for Debian? Is it possible to make this work for centos7 image? I understand symas only publishes for RHEL but curious if centos7 can work with the REHL repo information. I was unable to get it to work failing with a similar issue.

4 7

Re: SASL Authentication Pass-through
by Quanah Gibson-Mount 21 Apr '22

21 Apr '22

--On Monday, April 11, 2022 7:23 PM +0000 Dean Lewis <deanlewis(a)nexus-people.com> wrote: > > > If I had a choice, I wouldn't be using this version at all. As with most > packages, I'd run the very latest. But I don't have a choice here so this > question is about getting pass-through auth working with OpenLDAP 2.4 and > AD. > > > If that's possible, what am I missing in the configuration? No idea. Remoteauth was written because of a number of issues around using SASL passthrough. If your OpenLDAP servers are running RedHat (or derivatives), Debian, or Ubuntu, there are freely available options that allow you to be using current releases of OpenLDAP, such as the LTB project and the builds from Symas. Regards, Quanah

2 4

issues configuring SASL EXTERNAL and proxyauth with chain used for ppolicy_forward_updates
by Kartik Subbarao 18 Apr '22

18 Apr '22

I have a consumer server (2.4.57) that successfully forwards pwdFailureTime modifications to the master server using GSSAPI authentication. I want to replace GSSAPI with certificate-based (SASL EXTERNAL) authentication along with proxy authorization. Basically, I want to configure the equivalent of the following command line: LDAPTLS_KEY=server.key LDAPTLS_CERT=server.crt \ ldapmodify -Z -Y EXTERNAL \ -e '!authzid=dn:cn=proxydn,dc=example,dc=com' -e relax \ -h ldap-master.example.com -f update_pwdfailuretime.ldif The command line works as expected -- it authenticates successfully using the server certificate, and then does PROXYAUTHZ to cn=proxydn,dc=example,dc=com to perform the modify operation. The issue is when I try to configure this behavior with chain on the consumer server. I've tried various incantations along these lines: chain-idassert-bind bindmethod=SASL saslmech=EXTERNAL tls_cert=server.crt tls_key=tls.key authzId=dn:cn=proxydn,dc=example,dc=com The SASL EXTERNAL authentication works fine -- It binds to the master with the DN mapped from the certificate's subject. But it doesn't do the proxyauthz to cn=proxydn,dc=example,dc=com. I've read through the docs in detail and tried various modes, flags and other settings, but I can't get it to do the proxy authz. Does anyone have a known working config for this kind of setup that they can share? Otherwise, any suggestions on the best way to troubleshoot this further would be great. Thanks, -Kartik

4 5

Re: Understanding bind_anon_dn and update_anon
by Dave Macias 18 Apr '22

18 Apr '22

> > What you want is not possible with a simple bind (bind as a user without > providing a password). You could use something like client certificate > authentication (SASL/EXTERNAL). > > Regards, > Quanah > Thank you for the explanation! Appreciate it I'll explore this route. Best, Dave

1 0

Parameter for choosing algorithm in module "argon2.la"
by Juergen.Sprenger＠swisscom.com 18 Apr '22

18 Apr '22

Hi, Currently I am trying to use argon2 password hashes with OpenLDAP 2.6.1. Everything works fine so far, but I can't get module argon2.la to create argon2id hashes. In argon2 command is a switch to use Argon2id instead of Argon2i: echo -n "password" | argon2 somesalt -id -e $argon2id$v=19$m=4096,t=3,p=1$c29tZXNhbHQ$qLml5cbqFAO6YxVHhrSBHP0UWdxrIxkNcM8aMX3blzU slappasswd -o module-load="argon2.la" -h {ARGON2} -s password {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$P3r67PwtSB5fq2JvTaGZfw$WNup4MZcRkvGwIVWFKjU92nHiM/vu6DUTnSOVpLYwVM Is it possible to use choose between argon2i, argon2d and argon2id in that library? Regards Juergen Sprenger

2 1

Understanding bind_anon_dn and update_anon
by Dave Macias 18 Apr '22

18 Apr '22

Hello, Running: 2.6.1 Looking at the slapd.conf man page we have this interesting paragraph: *bind_anon_cred allows anonymous bind when credentials are not empty (e.g. when DN is empty). bind_anon_dn allows unauthenticated (anonymous) bind when DN is not empty. update_anon allows unauthenticated (anonymous) update operations to be processed (subject to access controls and other administrative limits).* *My goal is to have a dn who is a memberof a group to be able to add/edit/deletes (write) operations to a subtree by only using the binddn (no password).* I have no issues with the below acl when we ldapmodify/delete/add with binddn+password *olcAccess: {2}to dn.subtree="ou=dns,dc=example,dc=net" filter="(!(|(idnsName=*'.')(objectClass=organizationalUnit)))" by dn="cn=dnsmanager,dc=example,dc=net" write by group.expand="cn=dns,ou=group,dc=example,dc=net" write by * read* I added the below to my* dn: cn=config* *olcAllows: bind_anon_dnolcAllows: update_anon* Since I still could not make any write operations with simple binddn I changed the ACL to below. (adding anonymous write) olcAccess: {2}to dn.subtree="ou=dns,dc=example,dc=net" filter="(!(|(idnsName=*'.')(objectClass=organizationalUnit)))" by dn="cn=dnsmanager,dc=example,dc=net" write by group.expand="cn=dns,ou=group,dc=example,dc=net" write by anonymous write by * read This of course still was not my end goal since I could use a nonexisting binddn to make changes. > ldapsearch -xLLL "filter" dn | awk '{print $NF}' | sed '/^$/d' | ldapdelete -D uid=*someuserthatdoesnotexist*,ou=people,dc=example,dc=net So I'm guessing I'm not understanding or not configuring this correctly. Is it even possible to do this? Any input is appreciated. Thank you, Dave

2 1

MemberOf group in group search not working
by erikdewaard＠gmail.com 15 Apr '22

15 Apr '22

Hi, On openldap 2.5.11 I have some weird behavior with group in group searches using memberOf. #Working # ldapsearch -LLL -H ldap:// -x -b 'dc=example,dc=com' '(uid=user5)' memberOf dn: uid=user5,ou=People,dc=example,dc=com memberOf: cn=groupingroup,ou=groups,dc=example,dc=com #Working # ldapsearch -LLL -H ldap:// -x -b 'dc=example,dc=com' '(uid=user1)' memberOf dn: uid=user1,ou=People,dc=example,dc=com memberOf: cn=group1,ou=groups,dc=example,dc=com memberOf: cn=groupingroup,ou=groups,dc=example,dc=com Now the weird behavior part when querying if user1 is indeed a memberOf groupingroup i sometimes get 0 results, need to query multiple times before i indeed get the correct answer. # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid dn: uid=user1,ou=People,dc=example,dc=com uid: user1 user5 completely fell of the map. # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user5)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid When querying memberOf groupingroup, it looks like its randomly returning just one group. #only returning group2 # ldapsearch -H ldap:// -LLL -x -b 'dc=example,dc=com' "(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)" uid dn: uid=user3,ou=People,dc=example,dc=com uid: user3 dn: uid=user4,ou=People,dc=example,dc=com uid: user4 dn: cn=group1,ou=Groups,dc=example,dc=com dn: cn=group2,ou=Groups,dc=example,dc=com #only returning group1 # ldapsearch -H ldap:// -LLL -x -b 'dc=example,dc=com' "(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)" uid dn: uid=user1,ou=People,dc=example,dc=com uid: user1 dn: uid=user2,ou=People,dc=example,dc=com uid: user2 dn: cn=group1,ou=Groups,dc=example,dc=com dn: cn=group2,ou=Groups,dc=example,dc=com --conf # stand-alone slapd config include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/dyngroup.schema # allow big PDUs from anonymous (for testing purposes) sockbuf_max_incoming 4194303 moduleload back_ldap moduleload dynlist ####################################################################### # database definitions ####################################################################### database config database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap lastbind off overlay dynlist dynlist-attrset groupOfURLs memberURL uniqueMember+memberOf@groupOfUniqueNames* database monitor --conf --data dn: dc=example,dc=com structuralObjectClass: domain dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=com structuralObjectClass: organizationalUnit ou: People objectClass: top objectClass: organizationalUnit dn: ou=Groups,dc=example,dc=com ou: Groups structuralObjectClass: organizationalUnit objectClass: organizationalUnit objectClass: top dn: uid=user1,ou=People,dc=example,dc=com displayName: User 1 cn: User 1 loginShell: /bin/bash uidNumber: 2001 gidNumber: 3000 homeDirectory: /home/user1 mail: user1(a)example.com uid: user1 sn: user1 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user2,ou=People,dc=example,dc=com displayName: User 2 cn: User 2 loginShell: /bin/bash uidNumber: 2002 gidNumber: 3000 homeDirectory: /home/user2 mail: user2(a)example.com uid: user2 sn: user2 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user3,ou=People,dc=example,dc=com displayName: User 3 cn: User 3 loginShell: /bin/bash uidNumber: 2003 gidNumber: 3000 homeDirectory: /home/user3 mail: user3(a)example.com uid: user3 sn: user3 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user4,ou=People,dc=example,dc=com displayName: User 4 cn: User 4 loginShell: /bin/bash uidNumber: 2004 gidNumber: 3000 homeDirectory: /home/user4 mail: user4(a)example.com uid: user4 sn: user4 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user5,ou=People,dc=example,dc=com displayName: User 5 cn: User 5 loginShell: /bin/bash uidNumber: 2005 gidNumber: 3000 homeDirectory: /home/user5 mail: user5(a)example.com uid: user5 sn: user5 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: cn=group1,ou=Groups,dc=example,dc=com cn: group1 gidNumber: 3001 objectClass: groupOfUniqueNames objectClass: top objectClass: posixGroup ou: group1 structuralObjectClass: groupOfUniqueNames uniqueMember: uid=user1,ou=People,dc=example,dc=com uniqueMember: uid=user2,ou=People,dc=example,dc=com dn: cn=group2,ou=Groups,dc=example,dc=com cn: group2 gidNumber: 3002 objectClass: groupOfUniqueNames objectClass: top objectClass: posixGroup ou: group2 structuralObjectClass: groupOfUniqueNames uniqueMember: uid=user3,ou=People,dc=example,dc=com uniqueMember: uid=user4,ou=People,dc=example,dc=com dn: cn=groupingroup,ou=Groups,dc=example,dc=com cn: groupingroup gidNumber: 3003 objectClass: groupOfUniqueNames objectClass: top objectClass: posixGroup ou: groupingroup structuralObjectClass: groupOfUniqueNames uniqueMember: uid=user5,ou=People,dc=example,dc=com uniqueMember: cn=group1,ou=Groups,dc=example,dc=com uniqueMember: cn=group2,ou=Groups,dc=example,dc=com

4 5

inplace modification of objectclasses?
by Ede Wolf 12 Apr '22

12 Apr '22

Hello again, I am wondering, wether it is possible, to replace/overwrite an item without changing its index number, or wether for this case I do have to manually edit the schema.ldif (and thereby ruin the CRC)? Assuming I have this example: olcObjectClasses: {4}( 1.1.1 NAME 'myoc' DESC 'My objectclass' SUP top ABSTRACT MAY ( myAttribute ) ) olcObjectClasses: {5}( 1.1.2 NAME 'myotheroc' DESC 'My other objectclass' SUP myoc STRUCTURAL MUST ( myotherAttribute ) ) So the lower one(5) depends upon the preceeding one (4). Now I would like to modify the first (4) objectclass definition to f.e. MUST (myAttribute). Using ldapmodify the classical way: delete: olcObjectClasses olcObjectClasses: (1.1.1....old) - add: olcObjectClasses olcObjectClasses: (1.1.1....new) does of course not work, as it will get a new, higher index and therefore any subsequential startup of openldap will fail, as our current index 5 has a reference to an objectclass that now however comes later and has an index of f.e. 17. However, I have not been able to figure out, how to use "replace: olcObjectClasses" to only replace a single instance and keep it in place. Therefore I am wondering, is there a way to use ldapmodify, or any other tool, to modify entries without changing the index, that in turn of course would break ldif? Thanks Ede

2 2

ppolicy related migration issues
by Ede Wolf 12 Apr '22

12 Apr '22

Hello I am having issues migrating my configdb from 2.4.57 to 2.6.1. The issue being the ppolicy schema, that upon import claims a duplicate attribute type, that I cannot track down. A recursive grep does not reveal the attribute oid anywhere as duplicate. This happens with a 2.6.0 instance on alpine as well as with 2.6.1 on arch. In addidtion, I can happily import that configdb.ldif into another 2.4.x openldap instance, so I doubt it is corrupt. Coming from a working instance anyway. So I assume, I might have missed some reading, but my search skills did not produce any results. Removing the ppolicy schema part from the config_db.ldif makes the import finish errorfree, but well, but later it is being used. Here is the output of my trying, the oid in question is the "pwdAttribute", but removing just that makes just the next attribute fail. # slapadd -n0 -F /etc/openldap/slapd.d/ -v -l config_db.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}dyngroup,cn=schema,cn=config" (00000001) added: "cn={3}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={4}nis,cn=schema,cn=config" (00000001) added: "cn={5}openldap,cn=schema,cn=config" (00000001) added: "cn={6}pmi,cn=schema,cn=config" (00000001) olcAttributeTypes: value #0 olcAttributeTypes: Duplicate attributeType: "1.3.6.1.4.1.42.2.27.8.1.1" slapadd: could not add entry dn="cn={7}ppolicy,cn=schema,cn=config" (line=396): olcAttributeTypes: Duplicate attributeType: "1.3.6.1.4.1.42.2.27.8.1.1" Closing DB... The slapd.d directory is of course empty before import. Anything I might have missed? Thanks Ede P.S. Most likely well known, as I have not altered it, but here is the offending part alltogether: dn: cn={7}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {7}ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALI TY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALI TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQU ALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALI TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQ UALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQU ALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInt erval' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQU ALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange ' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQU ALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'Loadable module that instantiates "check_password() function' EQUALITY cas eExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFail ure' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.27 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP t op AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AU XILIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdC heckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLoc kout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMu stChange $ pwdAllowUserChange $ pwdSafeModify $ pwdMaxRecordedFailure ) ) structuralObjectClass: olcSchemaConfig

2 2

Re: SASL Authentication Pass-through
by Quanah Gibson-Mount 11 Apr '22

11 Apr '22

--On Monday, April 11, 2022 5:00 PM +0000 Dean Lewis <deanlewis(a)thomas-march.com> wrote: > > Thanks, that sounds like an easier method but I'm running 2.4.47 > unfortunately. I would strongly advise upgrading to OpenLDAP 2.5 or later and using remoteauth for this. Regards, Quanah

1 0

SASL Authentication Pass-through
by t04s＠thomas-march.com 10 Apr '22

10 Apr '22

Hi, Hopefully someone can help. I'm trying to get SASL passthrough working in OpenLDAP to Active Directory. AD is the primary directory but I need Linux users to be able to authenticate to AD (via OpenLDAP) such that they don't have to manage multiple passwords. However, I've set things up as per various guidance (here<https://www.openldap.com/doc/admin21/sasl.html>, here<https://archive.camratus.com/2017/01/24/openldap-lsc-active-directory-sync-…>, here<https://www.ltb-project.org/documentation/sasl_delegation.html> and here<https://www.hellovinoth.com/pass-through-openldap-authentication-using-sasl…>) and it doesn't seem to work for me on Debian 10. After configuring everything I can run the following successfully: ldapsearch -x -H ldap://server.company.com:389 -D cn=ldapbind,cn=Users,DC=company,DC=com -w examplebindpassword -b '' -s base ldapsearch -x -H ldap://server.company.com:389 -D cn=ldapbind,cn=Users,DC=company,DC=com -w examplebindpassword -b "OU=Users,OU=IT,OU=Departments,OU=Group,DC=company,DC=com" "(userPrincipalName=testuser(a)company.com)" ldapsearch -x -H ldap://server.company.com:389 -D "CN=Test User,OU=Users,OU=IT,OU=Departments,OU=Group,DC=company,DC=com" -w exampleuserpassword -b "CN=Test User,OU=Users,OU=IT,OU=Departments,OU=Group,DC=company,DC=com" -s base "(objectclass=*)" These all return the correct results from Active Directory, so this works fine. Finally, I can run: sudo testsaslauthd -u testuser(a)company.com<mailto:grahambrooke@thomas-march.com> -p exampleuserpassword and I get: 0: OK "Success." So finally I create the same user in local OpenLDAP as Test User and add the password as {SASL}testuser(a)company.com<mailto:{SASL}testuser@thomas-march.com> and try to test pass-through authentication to AD: ldapsearch -x -H ldap://localhost -b dc=testing-prod,dc=com -D uid=testuser,ou=users,dc=testing-prod,dc=com -w exampleuserpassword But this doesn't work. I get the error: ldap_bind: Invalid credentials (49) So SASL passthrough just isn't working and it isn't reading the password attribute as such because if I do: ldapsearch -x -H ldap://localhost -b dc=testing-prod,dc=com -D uid=testuser,ou=users,dc=testing-prod,dc=com -w {SASL}testuser(a)company.com This returns the local LDAP user. So it's reading the password literally as a password instead of interpreting it as SASL passthrough to AD. Have I missed some steps here? What am I missing? I have checked that --enable-spasswd has been compiled in by running ldd /usr/sbin/slapd: linux-vdso.so.1 (0x00007ffcbd7b8000) libldap_r-2.4.so.2 => /lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f3e72bc2000) liblber-2.4.so.2 => /lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007f3e72bb1000) libdb-5.3.so => /lib/x86_64-linux-gnu/libdb-5.3.so (0x00007f3e729f5000) libodbc.so.2 => /lib/x86_64-linux-gnu/libodbc.so.2 (0x00007f3e72785000) libsasl2.so.2 => /lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f3e72768000) libgnutls.so.30 => /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f3e725bb000) libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f3e7257f000) libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f3e72565000) libslapi-2.4.so.2 => /lib/x86_64-linux-gnu/libslapi-2.4.so.2 (0x00007f3e72543000) libltdl.so.7 => /lib/x86_64-linux-gnu/libltdl.so.7 (0x00007f3e72538000) libwrap.so.0 => /lib/x86_64-linux-gnu/libwrap.so.0 (0x00007f3e7252c000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f3e7250b000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3e72349000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3e72344000) libp11-kit.so.0 => /lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f3e72215000) libidn2.so.0 => /lib/x86_64-linux-gnu/libidn2.so.0 (0x00007f3e721f6000) libunistring.so.2 => /lib/x86_64-linux-gnu/libunistring.so.2 (0x00007f3e72072000) libtasn1.so.6 => /lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f3e71e5f000) libnettle.so.6 => /lib/x86_64-linux-gnu/libnettle.so.6 (0x00007f3e71e25000) libhogweed.so.4 => /lib/x86_64-linux-gnu/libhogweed.so.4 (0x00007f3e71dec000) libgmp.so.10 => /lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f3e71d69000) /lib64/ld-linux-x86-64.so.2 (0x00007f3e72dac000) libnsl.so.1 => /lib/x86_64-linux-gnu/libnsl.so.1 (0x00007f3e71d50000) libffi.so.6 => /lib/x86_64-linux-gnu/libffi.so.6 (0x00007f3e71d46000) I can see libsasl2.so.2 there so I think that's fine. And, I've also run both saslauthd and slapd in debug mode but I get no useful output that I can see. It looks like saslauthd and slapd just aren't talking. Any help or pointers are really appreciated. t04s /---

2 1

Official way to import schema with cn=config
by David Timber 05 Apr '22

05 Apr '22

I had to write my own schema for my application and I was struggling to figure out how to import the schema I wrote to cn=config. I had though I was missing something until I found this. https://gist.github.com/jaseg/8577024 Notice the name of the script. Someone had to write this because there's no tool that you can use to import schemas when the slapd is configured with cn=config. You can get away with it by using include directive with slapd.conf. I know there's a way to do it with slaptest, but that method is just unacceptable. So, how I understood is, either you have to use slaptest to rebuild the entirety of the schema in ldif format, or you have to handcraft the schema in ldif by figuring out with {} index to start with. This is all backwards. slapadd and slapmodify are just cranky tools you can only use in specific cases(eg: restoring from mdb_copy backup data). In most cases, using those tools to manipulate cn=config is near impossible. I like the idea behind cn=config, but I believe that calling slapd.conf deprecated is just unfair with problems like these. Is there a set date/version for the drop of support for slapd.conf? I'd like to stick with slapd.conf if it's not going to happen in like 5 years time.

8 23

STARTTLS vs LDAPS
by thomaswilliampritchard＠gmail.com 01 Apr '22

01 Apr '22

At risk of beating a dead horse, I'd like to hear considerations on STARTTLS vs LDAPS. I'm also particularly interested if openldap plans to support LDAPS long term or if there's actually a deprecation effort going on around LDAPS where it would one day no longer be supported by openldap. This seems to be the most comprehensive post discussing the virtue of the two. https://security.stackexchange.com/questions/257749/is-ldaps-or-starttls-mo… I also found a post in this Archive from 2018 that seems to indicate a change of opinion where LDAPS should be preferred, and not deprecated. https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/… Does openldap agree that LDAPS should now be the preferred implementation and STARTLS should be discouraged? I do not have a security background and there is certainly a lot of room for me to misunderstand, but it seems like STARTTLS leaves the door open for a "tls downgrade attack" where a man in the middle could essentially reply to a client effectively saying start tls is not supported and then the client falls back to non tls communication (which is obviously unfortunate). Even if the backend server is properly not responding to clients until STARTTLS is initiated, the man in the middle could initiate a connection with STARTTLS to the ldap server and be talking plaintext to the client. Is that legitimately possible or am I missing a nuance? If one were to only support clients over LDAPS it seems this would be mitigated? Thanks for the considerations, looking forward to hearing the expert opinions on the topic.

9 20

delete glue entry
by Michael Ströder 01 Apr '22

01 Apr '22

HI! Had a MDB database with a glue entry in it on all replicas in a multi-provider setup (release 2.6.1). I could not update this entry anymore. Is it possible to delete a glue entry via LDAP? All subordinate entries were already removed before. Ciao, Michael.

2 1

RE26 testing call #1 (OpenLDAP 2.6.2)
by Quanah Gibson-Mount 01 Apr '22

01 Apr '22

This is the first testing call for OpenLDAP 2.6.2. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.2 Engineering Added libldap support for OpenSSL 3.0 (ITS#9436) Added slapd support for OpenSSL 3.0 (ITS#9436) Fixed ldapdelete to prune LDAP subentries (ITS#9737) Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd to correctly init global_host earlier (ITS#9787) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) Added slapo-otp support for OpenSSL 3.0 (ITS#9436) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Build Enviornment Add ability to override default compile time paths (ITS#9675) Fix compiliation with certain versions of gcc (ITS#9790) Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Documentation admin26 Document new lloadd features (ITS#9780) Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804) Fixed slapd-sock(5) to clarify "sockresps result" behavior (ITS#8255) Regards, Quanah

6 9

RE25 Testing call #1 (OpenLDAP 2.5.12)
by Quanah Gibson-Mount 01 Apr '22

01 Apr '22

This is the first testing call for OpenLDAP 2.5.12. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.12 Engineering Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Build Environment Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Fix compiliation with certain versions of gcc (ITS#9790) Documentation Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804) Regards, Quanah

2 1

Re: STARTTLS vs LDAPS
by Braiam 31 Mar '22

31 Mar '22

On Thu, Mar 31, 2022 at 11:46 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, March 31, 2022 12:16 PM -0400 Braiam <braiamp(a)gmail.com> > wrote: > > > What would be the process to modify content on the openldap.org page? > > Depends on the content. The main web pages are in the OpenLDAP Web git > repository. > This repository seems to be the FAQ: https://git.openldap.org/project/faq/-/tree/master/data/item There's a website project too. I couldn't figure out what markup language items on the faq project uses. > --Quanah > -- Braiam

2 1

multiple TOTP token for one user in otp overlay slapo-otp
by Rene Zeipelt 31 Mar '22

31 Mar '22

Hello, is it possible to save multiple TOTP token (with different sha algorithms and different secrets) to one user with the otp overlay? In the totp module multi values like {TOTP1}XXXXXXX and {TOTP256}XXXXXX are working. Thanks for any help. Best regards Rene Zeipelt ps. system is debian bookworm with slapd 2.5.11 -- _________________________________________________________ BERGISCHE UNIVERSITÄT WUPPERTAL Zentrum fuer Informations- und Medienverarbeitung - ZIM

2 1

Deny write access to new accounts
by beren beren 30 Mar '22

30 Mar '22

Hi. Is it possible to make admin Bob unable to edit accounts (delete, create, change passwords)created this year ? There is an idea to move them to a group or OU and give Bob the rights to write only there. Is there a more elegant solution ?

2 1

olclimit dn.base <> group/groupOfNames/member
by bourguijl＠gmail.com 29 Mar '22

29 Mar '22

Dears, Openldap version : 2.5.7 env 2 MMR 2 Replicas (test env) I've set and olclimit for one user (dn.base) on my DB and it works fine but in order to move it on my production env, I decided to modify my olclimit by using (group/groupOfNames/member) and place this user as member of the group. This is also works fine on my test env. I did the same config on my production env which is 4 MMR 4 Replicas and it didn't work :-( I did a lot of checks to see if there was any difference but it was exactly the same configuration. I did some other test on replicas first by adding a new olclimit for the concerned user ( dn.base) which solved the issue. I decided to remove this newly user olclimit, the olclimit (group/groupOfNames/member) was still there, and was not my surprise, the limitation for my user was still set to unlimited as expected. I did the same on all replicas, adding concerned user, remove it and limits were OK .... very strange. As it was working on replicas, I did try the same on master but no luck, my user stay still limited to 500 entries. Questions : Is there an order to respect in olclimit type ? why the config is working on test env and not on production one ? Thx to advice, Jean-Luc

3 6

slapo-translucent overlay crashes during wildcard search with subordinate
by jeremy.diaz＠rexconsulting.net 29 Mar '22

29 Mar '22

Hello openldap-technical, I found that slapd 2.5.11 w/slapo-translucent will crash when queried with a wildcard search. It looks like any wildcard search on any attribute specified in "translucent_local" will cause the SIGSEGV on the latest version of Symas OpenLDAP slapd, 2.5.11, MDB databases, running on CentOS7. It seems that the SIGSEGV problem does not occur w the 2.4.44 from the RHEL7 distribution, and so the problem may have be a regression. I have not tested any other versions but have verified that, with the exact same config, the problem does not happen on the RHEL7 2.4.44 version, but does happen w/Symas OpenLDAP 2.5.11. It's an interesting config here. There are two database+suffixes defined in the instance. The first one is subordinate (ou=someorg,dc=corp,dc=com) to the second one (dc=corp,dc=com). The "subordinate" option is set to "True". The second database section loads the translucent overlay which is pointed to the upstream Active Directory instance and has the same suffix of AD. The problem is administrative. The group want their admins who manage LDAP data to be able to search using wildcard "cn=xyx*" filters. Besides crashing, we have noticed that these work, but only when setting the basedn of the subordinate database. I tried a few things in a test lab and was able to reproduce the issue. with "cn" in "translucent_local" and sublevel search of translucent superior basedn dc=corp,dc=com "(cn=jed)" filter returns subordinate database entry "(cn=je*)" filter crashes slapd with "cn" not in "translucent_local" and sublevel search of translucent superior basedn dc=corp,dc=com "(cn=jed)" filter return referrals from upstream Active Directory "(cn=je*)" filter return referrals from upstream Active Directory with "cn" in "translucent_local" and sublevel search of subordinate basedn ou=someorg,dc=corp,dc=com "(cn=jed)" filter returns subordinate database entry from ou=someorg "(cn=je*)" filter returns subordinate database entry(ies) from ou=someorg with "cn" not in "translucent_local" and sublevel search of subordinate dbasedn ou=someorg,dc=corp,dc=com "(cn=jed)" filter returns subordinate database entry from ou=someorg "(cn=je*)" filter returns subordinate database entry(ies) from ou=someorg Here's what the crash looks like: 622eb2f7.0393c4d6 0x7fcf15e89880 slapd starting 622eb2fd.32371976 0x7fce8d9f3700 slap_listener_activate(8): 622eb2fd.323bb364 0x7fce8d1f2700 >>> slap_listener(ldap:///) 622eb2fd.3247761c 0x7fce8d1f2700 connection_get(15): got connid=1000 622eb2fd.3247962c 0x7fce8d1f2700 connection_read(15): checking for input on id=1000 622eb2fd.3247b177 0x7fce8d1f2700 ber_get_next 622eb2fd.3247e0b8 0x7fce8d1f2700 ber_get_next: tag 0x30 len 12 contents: 622eb2fd.3247f6f1 0x7fce8d1f2700 op tag 0x60, time 1647227645 622eb2fd.32480615 0x7fce8d1f2700 ber_get_next 622eb2fd.32484eca 0x7fce8d1f2700 conn=1000 op=0 do_bind 622eb2fd.324861e8 0x7fce8d1f2700 ber_scanf fmt ({imt) ber: 622eb2fd.324871c1 0x7fce8d1f2700 ber_scanf fmt (m}) ber: 622eb2fd.32488890 0x7fce8d1f2700 >>> dnPrettyNormal: <> 622eb2fd.32489324 0x7fce8d1f2700 <<< dnPrettyNormal: <>, <> 622eb2fd.3248ce51 0x7fce8d1f2700 do_bind: version=3 dn="" method=128 622eb2fd.3248efc7 0x7fce8d1f2700 send_ldap_result: conn=1000 op=0 p=3 622eb2fd.324906be 0x7fce8d1f2700 send_ldap_response: msgid=1 tag=97 err=0 622eb2fd.32492605 0x7fce8d1f2700 ber_flush2: 14 bytes to sd 15 622eb2fd.324ab763 0x7fce8d1f2700 do_bind: v3 anonymous bind 622eb2fd.325dc3b4 0x7fce8d1f2700 connection_get(15): got connid=1000 622eb2fd.325de12a 0x7fce8d1f2700 connection_read(15): checking for input on id=1000 622eb2fd.325dec44 0x7fce8d1f2700 ber_get_next 622eb2fd.325e0856 0x7fce8d1f2700 ber_get_next: tag 0x30 len 63 contents: 622eb2fd.325e1663 0x7fce8d1f2700 op tag 0x63, time 1647227645 622eb2fd.325e22e8 0x7fce8d1f2700 ber_get_next 622eb2fd.325e500c 0x7fce8d1f2700 conn=1000 op=1 do_search 622eb2fd.325e5ae0 0x7fce8d1f2700 ber_scanf fmt ({miiiib) ber: 622eb2fd.325e69ea 0x7fce8d1f2700 >>> dnPrettyNormal: <dc=corp,dc=com> 622eb2fd.325e98bd 0x7fce8d1f2700 <<< dnPrettyNormal: <dc=corp,dc=com>, <dc=corp,dc=com> 622eb2fd.325eaad7 0x7fce8d1f2700 ber_scanf fmt ({m) ber: 622eb2fd.325ebce5 0x7fce8d1f2700 ber_scanf fmt (m) ber: 622eb2fd.325eddcb 0x7fce8d1f2700 ber_scanf fmt ({M}}) ber: 622eb2fd.325f334c 0x7fce8d1f2700 ==> limits_get: conn=1000 op=1 self="[anonymous]" this="dc=corp,dc=com" 622eb2fd.325f4dcc 0x7fce8d1f2700 ==> translucent_search: <dc=corp,dc=com> (cn=jed*) Segmentation fault Thanks! Jeremy Diaz | Rex Consulting | https://www.rexconsulting.net

2 1

Official symas docker image? Or what others do?
by Dave Macias 29 Mar '22

29 Mar '22

Hello, Wondering if there is a plan to do an official image. Also what others in the community doing? Finally, there is this project that seems to be updated/supported but obviously not official https://github.com/bitnami/bitnami-docker-openldap anyone here used/seen this? Why am i asking? We simply looking to dockerize our infra and want to see what people here have experienced. Our ldap env: 3-way MMR (syncrepl) on v2.6.1 Thank you, Dave

6 9

openldap-ltb segmentation fault
by Aaron Bennett 29 Mar '22

29 Mar '22

Hi, I've got a new openldlap-ltb 2.5 system (running on rocky 8), and when I try to start it with "slapt-cli start", it dumps core: [root@kt-ldap-01 slapd.d]$ journalctl -xe Mar 28 16:13:06 kt-ldap-01 systemd-coredump[54716]: Resource limits disable core dumping for process 54714 (slapd). Mar 28 16:13:06 kt-ldap-01 systemd-coredump[54716]: Process 54714 (slapd) of user 0 dumped core. -- Subject: Process 54714 (slapd) dumped core -- Defined-By: systemd -- Support: https://access.redhat.com/support -- Documentation: man:core(5) -- -- Process 54714 (slapd) crashed and dumped core. -- -- This usually indicates a programming error in the crashing program and -- should be reported to its vendor as a bug. Mar 28 16:13:06 kt-ldap-01 slapd-cli[54688]: /usr/local/openldap/sbin/slapd-cli: line 350: 54714 Segmentation fault (core dumped) $SLA> Mar 28 16:13:06 kt-ldap-01 systemd[1]: systemd-coredump(a)13-54715-0.service: Succeeded. -- Subject: Unit succeeded -- Defined-By: systemd -- Support: https://access.redhat.com/support From debugging the shell script it looks like it's running slapd with these arguments: SLAPD_PARAMS='-h ldaps://kt-ldap-01-665.test.clarku.edu -F /usr/local/openldap/etc/openldap/slapd.d -u ldap -g ldap -l local4' So if I run: /usr/local/openldap/libexec/slapd -h ldaps://kt-ldap-01-665.test.clarku.edu -F /usr/local/openldap/etc/openldap/slapd.d -u ldap -g ldap -l local4 It works -- no segfault, no nothing. I can pretty easily write a systemd script that runs that command instead of wasting time with the slapd-cli stuff if that's a better approach. -Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 4

Re: OpenLDAP and Oracle backend
by Julián Sosa 28 Mar '22

28 Mar '22

** I wrote erroneously about working versions. Up to OpenLDAP 2.4.23 it works great with Oracle DB as backend. From version 2.4.25 onwards integration does not work. El lun, 28 mar 2022 a las 15:33, Julián Sosa (<docldap(a)gmail.com>) escribió: > Hi all. As a demand from some client, we have to implement the Oracle > backend, with idea of using an existing schema for authenticating users > using some mfa tool that only supports ldap. > > I began for last version at this date (2.6.1), but have this error: > > 6241cb6b backsql_oc_get_attr_mapping(): error executing at_query > "SELECT > name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u > FROM ldap_attr_mappings WHERE oc_map_id=?" > for objectClass "organization" > with param oc_id=3 > 6241cb6b Return code: -1 > 6241cb6b <==backsql_load_schema_map() > > In order for doing some debugging, I changed slapd and unixodbc to point > to an mysql, and works fine. So I found some entry on internet from a > person who had it working on some version, but when changing it does not > work. Also, I monitored with sys user last queries on v$sql. and last query > that reached DB was , so it appears that error occurs at preparing the > attribute mapping query, and code breaks before sending the query. > > I found another entry about this, where someone told that he have it > working on version 2.3.24 and he could not make it work on other version. > So I begin installing several OpenLDAP versions since mentioned one, and > from there to version 2.3.24 I found that Oracle backend is working fine. > Beginning 2.4.24, and onwards versions, it starts to show mentioned error. > I tried both on my Mint 20.3 personal machine, and with client's server > which is a CentOS 7.8. > > For tests, I used same Oracle DB instance. Only copy the slapd.conf from > working OpenLDAP/Oracle to the version I tested. > >

1 0

Response Ordering
by thomaswilliampritchard＠gmail.com 28 Mar '22

28 Mar '22

I'm looking to better understand the relationship in packet ordering when it comes to bind requests. As far as I've learned so far I can send a few ldap requests and potentially get responses in an order that doesn't match what i've sent. When it comes to, for example, sending a bind, a search, a bind (different user), and a search, when I send those serially without waiting for a response, are there any guarantees around getting successful bind responses before search results? Is it guaranteed that I would get a bind result from the second bind before search results from the second search? Is it guaranteed the second bind result would come after the end of the first search results, or might I receive the second bind result before the end of the first set of search results (or even in the middle of the second set of search results)? Then when it comes to server side processing, is it guaranteed that the first search is executed with the authorization of the first bind, and second search executed with the authorization of the second bind? Or is there a way the second search is processed before the second bind? How does openldap manage changing authorization in the middle of an executing search? If the first search is in flight and the second bind request comes in, does the first search continue to execute and finish with the authorization of the first bind? Are you aware of clients or tools that leverage that multi request (without waiting for a response) capacity of ldap? In what types of applications might a client send many requests without waiting for any responses? Thanks for the consideration Tom

4 4

ACL deny list anonymous
by beren beren 25 Mar '22

25 Mar '22

Hi, Sorry for the trivial question. How can I prevent a user who has not authenticated from viewing ? That is, the query ldapsearch -x -H ldap://infra-ldap.wildberries.ru -b "dc=test,dc=com" shows everything.

2 1

ldap bind response
by Gustavo Rios 23 Mar '22

23 Mar '22

Hi folks ? I am writing an ldap library for accessing openldap server. I have written a function that implements an ldap bind request and decode the openldap response. The program output is given below. sioux@etosha:~/msc/it/cnf/ldap/programs/ldp$ ./ldp 127.0.0.1.389 30 c 2 1 3 61 7 a 1 0 4 0 4 0 Tag: 48, Length: 12 Left: 12 bytes ================================ Tag: 2, Length: 1 Left: 10 bytes Value: 3 ================================ Tag: 97, Length: 7 Left: 7 bytes My question is: how to "read" de last seven bytes ? I have read the ldap rfc but it is still confusing. May you help me ? Thanks a lot! -- The lion and the tiger may be more powerful, but the wolves do not perform in the circus

1 0

slapi plug-in does not work after update of OpenLDAP from 2.4 to 2.6.1
by Matthias Apitz 22 Mar '22

22 Mar '22

Hello, We're running since ages with an OpenLDAP server 2.4 a plugin which publishes changes (add, modify, delete) in LDAP to an Identity Management Server (IDM). The plugin is written in C and configured in slpad.conf as a shared lib: plugin postoperation /opt/openldap-2.6.1/lib64/idm.so idm_init "IDM Plugin" 10.23.33.52 3001 The function idm_init() registers static C functions the supposed way: int idm_init(Slapi_PBlock * pb) { int rc = LDAP_SUCCESS; log("idm-plugin:","now in idm_init()\n"); // first call, create new list and register the functions ... rc |= slapi_pblock_set( /* Plug-in API version */ pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_CURRENT_VERSION); rc |= slapi_pblock_set( /* Plug-in description */ pb, SLAPI_PLUGIN_DESCRIPTION, (void *) &desc); rc |= slapi_pblock_set( /* Modify function */ pb, SLAPI_PLUGIN_POST_MODIFY_FN, (void *) modify_user); ... // read arguments and add list entry rc |= read_arguments(pb); log("idm-plugin", "idm_init() return rc:%d\n", rc); return rc; } The function for modify_user() will later publish the change via network and without going into the details the start of the function looks like this: static int modify_user(Slapi_PBlock * pb) { Slapi_Entry *entry; log("idm-plugin:", "now in modify_user\n"); if (slapi_pblock_get(pb, SLAPI_SEARCH_TARGET, &entry) != LDAP_SUCCESS) { log("IDM-Connector Plugin", "entry modified, but couldn't get entry"); return -1; } ... The problem is, that after an update in LDAP this function is not called. The log shows only the attach and initialisation of the plugin but no further actions: 03/16/22 10:52:26 idm-plugin:: now in idm_init() 03/16/22 10:52:26 IDM-Connector Plugin: idm_init: Initializing plugin 03/16/22 10:52:26 idm-plugin:: now in read_arguments() 03/16/22 10:52:26 IDM Plugin: added idm connector: ip=10.23.33.52, port=3001 03/16/22 10:52:26 idm-plugin: idm_init() returns rc:0 03/16/22 10:52:26 plugin_pblock_new: Registered plugin OCLC-IDM-Connector-Notifier 1.0 [OCLC.org] (Notify the OCLC IDM-Connector of changes) As I said, with OpenLDAP 2.4 this works fine. It does not work anymore with 2.6.1. Is there some change in the slapi interface of which we are not aware off? What could be done as debugging/logging to nail this down? Thanks in advance and Regards matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, http://www.unixarea.de/ +49-176-38902045 Public GnuPG key: http://www.unixarea.de/key.pub

5 5

Re: RE26 testing call #1 (OpenLDAP 2.6.2)
by Nick Folino 22 Mar '22

22 Mar '22

Looking good on Fedora 35 On Tue, Mar 22, 2022 at 1:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the first testing call for OpenLDAP 2.6.2. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.2 Engineering > Added libldap support for OpenSSL 3.0 (ITS#9436) > Added slapd support for OpenSSL 3.0 (ITS#9436) > Fixed ldapdelete to prune LDAP subentries (ITS#9737) > Fixed libldap to drop connection when non-LDAP data is received > (ITS#9803) > Fixed libldap to allow newlines at end of included file (ITS#9811) > Fixed slapd slaptest conversion of olcLastBind (ITS#9808) > Fixed slapd to correctly init global_host earlier (ITS#9787) > Fixed slapd bconfig locking for cn=config replication (ITS#9584) > Fixed slapd usage of thread local counters (ITS#9789) > Fixed slapd to clear runqueue task correctly (ITS#9785) > Fixed slapd syncrepl handling of new sessions (ITS#9584) > Fixed slapd to clear connections on bind (ITS#9799) > Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) > Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) > Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) > Fixed slapd-meta SEGV on config rewrite (ITS#9802) > Fixed slapd-meta ordering on config rewrite (ITS#9802) > Fixed slapd-meta memory leak in keepalive setting (ITS#9802) > Fixed slapd-monitor SEGV on shutdown (ITS#9809) > Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) > Added slapo-otp support for OpenSSL 3.0 (ITS#9436) > Fixed slapo-pcache SEGV on shutdown (ITS#9809) > Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) > Build Enviornment > Add ability to override default compile time paths (ITS#9675) > Fix compiliation with certain versions of gcc (ITS#9790) > Fix compilation with openssl exclusions (ITS#9791) > Fix warnings from make jobserver (ITS#9788) > Documentation > admin26 Document new lloadd features (ITS#9780) > Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit > documentation (ITS#9804) > Fixed slapd-sock(5) to clarify "sockresps result" behavior > (ITS#8255) > > > > Regards, > Quanah >

1 0

OpenLDAP proxy for samba-usage
by lists＠zxt10d.de 22 Mar '22

22 Mar '22

Hello :) Hopefully I'm not completly wrong on this ml, as its not only ldap related, but also samba related. I work at a Chair of a german university. University uses a central LDAP-system for all students, employees, scientists, scientific guests, etc., providing an unique UID for all these peoples, plus many more information. My idea was: setting-up a local OpenLDAP-proxy, so that people of our Chair get access to ressources (eg. via samba) using their unique UID and password, but without setting-up an AD. Many system here are owned by the Chair or University, but lots of students are using their own laptop, so using a AD (and adding them) is not very handy for them ... so, something like a stand-alone samba-server with authentification versus ldap. Is there a chance to get this running? There is no chance to add the schema on a proxy? What I did so far: - I can establish a connection to the central LDAP-system using /etc/pam_ldap.conf uri ldaps://ldap.DOMAIN.de host ldap.DOMAIN.de base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de ldap_version 3 binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de bindpw PASSWORD pam_password crypt ssl start_tls ssl on - I configured /etc/libnss-ldap.conf, and a 'getent passwd' shows all local users plus the members uri ldaps://ldap.DOMAIN.de host ldap.DOMAIN.de base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de ldap_version 3 binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de bindpw PASSWORD - I also configured /etc/ldap/slapd.conf for proxy usage (I think I did ...), but I learned 2 days ago I can't add any schemata on a proxy ... # Schema includes include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # include /etc/ldap/schema/misc.schema include /etc/ldap/schema/openldap.schema # # # Module modulepath /usr/lib/ldap moduleload back_ldap.la moduleload back_hdb.la moduleload back_mdb moduleload rwm moduleload pcache.la moduleload memberof.la # # Main settings pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args conn_max_pending 1000 sockbuf_max_incoming 4194303 logfile /var/log/ldap/logfile.log #loglevel stats conns filter loglevel any sizelimit unlimited limits * size.pr=0 size.prtotal=none tool-threads 1 # readonly on access to * by * read # # Database defs (proxy to AD) database ldap chase-referrals no rootdn ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de suffix "dc=DOMAIN,dc=de" uri ldap://localhost/ uri ldap://ldap.DOMAIN.de/ uri ldaps://ldap.DOMAIN.de/ acl-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes idassert-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes #cancel abandon overlay pcache #proxycache hdb 100000 3 1000 100 proxycache mdb 100000 3 1000 100 pcachePersist TRUE proxyAttrset 0 mail uid gecos proxyTemplate (sn=) 0 3600 proxyTemplate (&(sn=)(givenName=)) 0 3600 #cachesize 20 index objectClass eq index cn,sn,uid,mail pres,eq,sub pcacheAttrset 0 1.1 pcacheTemplate (&(|(objectClass=))) 0 3600 pcacheTemplate (objectClass=*) 0 3600 pcacheAttrset 1 displayname pcacheTemplate (objectClass=*) 1 3600 pcacheAttrset 2 memberOf pcacheTemplate (objectClass=*) 2 3600 conn-ttl 3600 # directory /var/lib/ldap Testing the config works: root@ldap:~# /usr/sbin/slapd -Tt -f /etc/ldap/slapd.conf config file testing succeeded 62398f56 mdb_opinfo_get: err Permission denied(13) root@ldap:~# (I have no idea which Permission is denied) slapd can be started via /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf ldapsearch works fine using '-h localhost' or '-H ldap://ldap.DOMAIN.de', so I think the basic config is not bad at all ... Thanks in advance! Cheers, Torsten

1 0

Re: Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Am Mi., 16. März 2022 um 21:39 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 10:23 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > > > We are still using the bdb backend and the latest 2.4.59 (don't ask, > > it will be replaced soon) and I remember, a "few" years ago, I had > > problems with slapcat and online databases, because the server was > > stucking for a while and answers were delayed .. > > (The Admin Guide tells, that "Backups are managed slightly differently" > > ...) Secondly, while offline, I can copy the whole database directory > > including the transaction logs .. > > Ah, ok. Yes, you could set up a read-only consumer node to take backups > from. I'd highly prioritize moving to a supported release of OpenLDAP with > the back-mdb backend as well (I see you say it should be replaced soon). :) > Quanah, thanks for guiding me! Meike

1 0

Re: Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Am Mi., 16. März 2022 um 19:31 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 7:59 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > Hello, > > > > what is the right solution to backup a Mirromode setup? > > I've a simple setup with two servers, running in mirromode and a > > virtual IP is moved on "request" between the two servers (nodes). The > > DNS-Name of the virtual IP is used for the client ldap requests. The > > server certificate is issued to the DNS name of the virtual IP, but > > has two SANs for the both node names. The node names will be used for > > replication in mirrormode. Everything is running well. > > Can I set up a third (readonly) server, who only replicates the > > Database from the "mirromode cluster'' using the DNS-Name without > > problems and then shutdown slapd temporarily and splacat the database? > > You don't need to shut down slapd to slapcat the database, so I'm not clear > what the concern is here? You should just do a periodic slapcat. > We are still using the bdb backend and the latest 2.4.59 (don't ask, it will be replaced soon) and I remember, a "few" years ago, I had problems with slapcat and online databases, because the server was stucking for a while and answers were delayed .. (The Admin Guide tells, that "Backups are managed slightly differently" ...) Secondly, while offline, I can copy the whole database directory including the transaction logs .. Thanks Meike

2 1

Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Hello, what is the right solution to backup a Mirromode setup? I've a simple setup with two servers, running in mirromode and a virtual IP is moved on "request" between the two servers (nodes). The DNS-Name of the virtual IP is used for the client ldap requests. The server certificate is issued to the DNS name of the virtual IP, but has two SANs for the both node names. The node names will be used for replication in mirrormode. Everything is running well. Can I set up a third (readonly) server, who only replicates the Database from the "mirromode cluster'' using the DNS-Name without problems and then shutdown slapd temporarily and splacat the database? Thanks Meike

2 1

migrate from RedHat openldap 2.4 to LTB OpenLdap 2.5
by Aaron Bennett 15 Mar '22

15 Mar '22

Hi, I'm moving from a two-node CentOS 7 cluster running essentially the RedHat openldap-servers build (which I rebuild to use OpenSSL, but otherwise, left alone). I've provisioned a new Rocky Linux 8 system and have installed OpenLDAP 2.5 from the LTB repository, and have moved the old slapd.d directory out of the way and put the slapd.d directory from the old servers in place. If I try to run slapd-cli status, it throws this: olcAttributeTypes: value #8 olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" config error processing cn={5}samba,cn=schema,cn=config: olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" slapcat: bad configuration directory! olcAttributeTypes: value #8 olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" config error processing cn={5}samba,cn=schema,cn=config: olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" slapcat: bad configuration directory! Looking here: https://ltb-project.org/documentation/migrate_openldap_ltb_24_openldap_ltb_…, it looks like there's more going on. Does anyone have any input as to how to accomplish this? I do need to bring the old data in, ideally without having to make changes to the samba scheme under the hood. Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 5

olcLastBind default to true
by Erik de Waard 14 Mar '22

14 Mar '22

$OpenLDAP: slapd 2.5.11 Hi, i've a weird case where olcLastBind defaults to TRUE. When using convert (slaptest) method. and explicit lastbind to off/false has no effect. #Initialize slapd with convert method slaptest -f /etc/openldap/slapd.conf.init -F /etc/openldap/slapd.d/ slapcat -n0 | grep LastBind olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S olcLastMod $ olcLastBind $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcRea olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE Tested with minimal config: # stand-alone slapd config include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema #include /etc/openldap/schema/test.schema # allow big PDUs from anonymous (for testing purposes) sockbuf_max_incoming 4194303 moduleload back_ldap ####################################################################### # database definitions ####################################################################### database config database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap lastbind off database monitor Best regards,

2 1

syncprov-sessionlog-source cn=accesslog
by Michael Ströder 14 Mar '22

14 Mar '22

HI! I wonder what the operational requirements are when using syncprov-sessionlog-source cn=accesslog instead of the in-memory session log. E.g. what about configured logpurge? What happens if the accesslog DB is completely deleted? Ciao, Michael.

3 5

slapo-translucent and syncprov
by Christopher Paul 13 Mar '22

13 Mar '22

Hello openldap-technical, I am wondering about slapo-translucent and syncprov. I am using it to merge RFC2307bis data with an upstream Active Directory Service. It seems to work pretty well. But I notice that the entries added do not get entryuuid or entrycsn values. I guess this sort of makes sense, because the source of truth for (most of) this data is upstream. And so, this means then that syncprov overlay will not work for translucent entries. So I am wondering, what others are doing to replicate and synchronize their translucent data across an OpenLDAP service? I am guessing people probably use some dump and load schemes, which is about all I can think to do at the moment. many thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

1 0

secrets storage: userPassword,TLS keys best practices
by Christopher Paul 12 Mar '22

12 Mar '22

Hello openldap-technical, I'm wondering what the OpenLDAP-technical World thinks about LDAP authentication secrets. A couple observations and questions: 1. RFC 4519 allows userPassword to be multi-valued and it gives some rationale which is logical, but it also seems to lack imagination. There seem to be more possibilities for abuse by defining attributeType this way than legitimate use cases. Is there any way to force userPassword to be single-valued? Has anyone attempted this? 2. Assuming you decide to ditch passwords, and use TLS EXTERNAL, you still have the problem of storing the key, and the risk that if the key is stolen, than someone other than you can authenticate as you. Of course store it on storage with permissions and ownership of files set correctly. That goes without being said, but storage is not always perfectly secure or private, so let's not trust it completely. Short lifetimes would be one mitigation. And CRLs of course. What else do people do? 3. Is there anyway to have ldap* commands read the key in from an environment variable or call to gpg/secrets store /etc? Funky alias / bash-wrapper yeah but I'm looking for something less clunky. many thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

3 8

Accesslog and Ppolicy overlays
by Benjamin Renard 11 Mar '22

11 Mar '22

Hello, I try to enable accesslog overlay on a database with the overlay ppolicy enabled (with brute-force protection). My goal is to build an historic of users authentication fails and the effect of the ppolicy overlay on their account. I enabled accesslog on the database with logging of the "session" operations and in this case, all users authentication fails are stored as modification of the pwdFailureTime attribute. It's great but I also would also like to have an explicit trace of the bind operation failure (with the error message of ppolicy in reqMessage). I also tried to configure the accesslog overlay on frontend and in this case, I had an explicit trace of the bind failure but no trace of the pwdFailureTime attribute modification. Finally, I tried to configure the accesslog overlay on both frontend and database levels, but accesslog on database seems to take over the other and the result is identical with accesslog configured only on database level. Do you known how I could configure the accesslog overlay to log both bind failure and the pwdFailureTime attribute modification ? Regards, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

1 0

Using logfile-format causes segfault
by Juergen.Sprenger＠swisscom.com 11 Mar '22

11 Mar '22

When using option 'logfile-format' in my config, slaptest, slapadd, slapcat, slapindex, ... will segfault and cause a coredump. This occurs with all available options for 'logfile-format'. slapd itself is running fine, logs are written as expected with any option for 'logfile-format'. I am using OpenLDAP 2.6.1, configure options: ./configure --enable-overlays=mod --enable-modules --with-tls=openssl

2 2

Re: Antw: [EXT] creatorsname not correctly updated
by Jean-Luc Bourguignon 10 Mar '22

10 Mar '22

hello Quanah, 2.5.7. Brgds, J-L. On Thu, Mar 10, 2022 at 11:08 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, March 10, 2022 3:44 PM +0100 Jean-Luc Bourguignon > <bourguijl(a)gmail.com> wrote: > > > > > Hello Ulrich, > > > > > > After a deep analyze of this "problem", it seems the chaining > > process doesn't work when I use rootdn user to add entries in the DB via > > the replicas. > > If I add them via providers, creatorsname takes the correct rootdn (as > > no chaining action here) but if I do it via replicas, I get replication > > user's DN. > > The chaining process works fine for normal users and gets proxied from > > replicas to providers as I've authzto (regex) rules in the configuration > > of my replication user. > > I've tried to add a second authzto rule to my replication user as > > authzto {1} dn.exact: cn="rootdn" but it didn't work. Besides that, I > > created a fake rootdn entry in my DB, but same result. > > > What OpenLDAP release are you using? > > --Quanah > > > >

1 0

creatorsname not correctly updated
by bourguijl＠gmail.com 10 Mar '22

10 Mar '22

Dears, I've a tricky issue with this attribute. I context of 4 MMR & 4 replicas, I've defined a rootdn and a replication user. When I create "ADD" a new entry in my DB with rootdn as user, the creatorsname is filled up with the replication username instead of rootdn one :-| I've another configuration with 2 MMR & 2 replicas, normally same config as above, but there, the ADD is correctly managed. In both configuration, replicas send their ADD request to masters VIP with olcUpdateRef attribut. and received update via masters VIP with olcSyncrepl attribut. Any idea of any parameter, acl, schema to check ? Thx, J-L.

4 5

syncprov olcSpNoPresent not being honoured
by lisa.parratt＠bjss.com 10 Mar '22

10 Mar '22

Hi, I have an OpenLDAP server I'm upgrading from 2.4.58 to 2.6.0. The server is configured with the syncprov plugin, with "olcSpNoPresent: TRUE". Previously, on 2.4.58, we would never see any Present phase data originating from the server. However, post upgrade, we are seeing this, and it's causing problems with the consumers. I've tried looking at the code, but I must admit I got lost trying to trace through the propagation of this flag. Are there undocumented circumstances where olcSpNoPresent will not be obeyed, or is this a regression? Thanks! Lisa

4 7

how to set LDAP ACL permissions on one subtree for a groups without modifying it for other users or groups?
by International Security Providers 04 Mar '22

04 Mar '22

I use commands like this to set permissions for some custom gorups/users.. now I want to set the permissions without overwriting them for all the other groups/users, what do I need to add to my ACL-Entrys?: ``` access to dn.subtree="cn=myContainer,dc=mydomain,dc=tld" by set="user & [cn=myGroup,cn=groups,dc=mydomain,dc=tld]/uniqueMember*" write by set="user & [cn=Domain Users,cn=groups,dc=mydomain,dc=tld]/uniqueMember*" read ```

1 0

Delta-sync replication: is it possible to force resync delta?
by skeletor 03 Mar '22

03 Mar '22

Hi. I use delta-sync replication on version 2.4. Sometimes, some records don't send to slave. Insofar as this is delta-sync after a new update slave receive only last update. Therefore slave and master are not consistent. Is it possible run force resync from accesslog to consistent check if all records are present on slave? May be this is a bug on version 2.4 and it already has been fixed in newer version? master 2.4.57 slave 2.4.55

6 10

disable SSL/TLS renegotiation
by Stefan Bauer 03 Mar '22

03 Mar '22

Hi, our security scanner reports SSL/TLS: Renegotiation DoS Vulnerability (CVE-2011-1473, CVE-2011-5094) for port TCP/636. I could not find a way to disable SSL/TLS renogitation for openldap. How can this be disabled? Any help is greatly appreciated. Thank you. Stefan

2 1

Problem with ppolicy overlay and userPassword attribute
by Frederic Dussurget 01 Mar '22

01 Mar '22

Hi, We're facing the following issue : * From one side, we have to store two values (same password with two different encodings) within the userPassword attribute (eg. https://datatracker.ietf.org/doc/html/rfc4519#section-2.41) * On the other side, we do have to use the ppolicy overlay in order to hash to Argon2 automatically passwords that are sent in cleartext, in order to to use the pwdLastSuccess attribute (storing last authentication date) and pwdAccountLockedTime (account deactivation), but this overlay does not seem to support multiple values in the userPassword attribute as it looks to be described in the following abstract : https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10#… and https://www.openldap.org/software/man.cgi?query=slapo-ppolicy&sektion=5&apr… We're not able to add a user account with two values in the userPassword attribute : [root@openldap25 ~]# cat testuser_add.ldif dn: uid=testuser,ou=people,dc=my-domain,dc=fr objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: top uid: testuser cn: testuserCN sn: testuserSN userPassword: password userPassword: drowssap [root@openldap25 ~]# ldapadd -H ldaps://localhost:636 -x -D "cn=Manager,dc=my-domain,dc=fr" -W -f testuser_add.ldif Enter LDAP Password: adding new entry "uid=testuser,ou=people,dc=my-domain,dc=fr" ldap_add: Constraint violation (19) additional info: Password policy only allows one password value However, we're able to add a user with a single value in the userPassword attribute, then, adding a second value thru the next LDAP request : [root@openldap25 ~]# cat testuser_add.ldif dn: uid=testuser,ou=people,dc=my-domain,dc=fr objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: top uid: testuser cn: testuserCN sn: testuserSN userPassword : password [root@openldap25 ~]# ldapadd -H ldaps://localhost:636 -x -D "cn=Manager,dc=my-domain,dc=fr" -W -f testuser_add.ldif Enter LDAP Password: adding new entry "uid=testuser,ou=people,dc=my-domain,dc=fr" [root@openldap25 ~]# cat testuser_mod.ldif dn: uid=testuser,ou=people,dc=my-domain,dc=fr changetype: modify add: userPassword userPassword: drowssap [root@openldap25 ~]# ldapmodify -H ldaps://localhost:636 -x -D "cn=Manager,dc=my-domain,dc=fr" -W -f testuser_mod.ldif Enter LDAP Password: modifying entry "uid=testuser,ou=people,dc=my-domain,dc=fr" [root@openldap25 ~]# ldapsearch -x -H ldaps://localhost:636 -D "cn=Manager,dc=my-domain,dc=fr" -W -LLL -b "ou=people,dc=my-domain,dc=fr" "(uid=testuser)" userPassword Enter LDAP Password: dn: uid=testuser,ou=people,dc=my-domain,dc=fr userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MixwPTEkZjlPc3NtRFZ DWmlzQk1IVEhWczRMZyRsMVAvbWdEdTA1bEpBc2pxcVF6aERYaENMV1BudnQyeDlRTDdweXFnVDFV userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MixwPTEkVk5ST1FMZFp 2Q0ptajNIcHQxYWtZdyRRcjJDYUpKSjZSWlhvZjFicDJmNGNOaGlRa3E5czlCU0FTbEtVNFoxYjBj Considering configuration, we're running an OpenLDAP 2.5.7 server (LTB project) on a RHEL8 OS. * ppolicy overlay dn: olcOverlay={0}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE olcPPolicyDisableWrite: FALSE olcPPolicySendNetscapeControls: FALSE olcPPolicyDefault: cn=default,ou=ppolicies,dc=my-domain,dc=fr * default password policy dn: ou=ppolicies,dc=my-domain,dc=fr objectClass: organizationalUnit objectClass: top ou: ppolicies dn: cn=default,ou=ppolicies,dc=my-domain,dc=fr objectClass: pwdPolicy objectClass: organizationalRole cn: default pwdAttribute: userPassword pwdLockout: TRUE * password storage dn: olcDatabase={-1}frontend,cn=config olcPasswordHash: {ARGON2} Question : * Is that behaviour normal ? * May we keep on leaning on this behaviour without fearing that this ability of adding a second value to the userPassword attribute will be revoked in the future versions/fix/patches of the service ? Thank you in advance for your assistance. Best regards, Frédéric Dussurget / Maxime Schmutz Université Lumière Lyon 2

3 15

LMDB storage layout and page structure
by Ivan Unknown 28 Feb '22

28 Feb '22

Hello! I have been looking at the LMDB project code trying to learn and understand how a database could be implemented; however, I have been struggling to answer the questions below for quite some time, partially due to my limited knowledge of C: - How does LMDB store keys and values in the page? I have learned that a page consists of the header, slots, and key-value pairs but how does the database handle keys and values that are too large to fit within a page? - I found that LMDB does not keep a fixed number of keys per page, so that would depend on the key-value pairs' sizes already inserted into the page. Is this correct? Does it mean that B+tree pages (branch or leaf) could have a different number of keys depending on the key size? How does it affect performance or implementation of the B+tree? - Are there any limitations on the size of a key? Can it be of an arbitrary length? - What is the difference between IS_LEAF and IS_LEAF2 flags in the page header? What is the difference between these pages? - How do overflow pages work in LMDB? From what I could understand, if a key or a value does not fit in the page, it will be stored in the overflow page (the entire page is allocated for that specific key or value). Is this correct? What happens when the key size is several times larger than the page size, e.g. 1MB value with 4KB pages? - What is a sub-page in LMDB (F_SUBDATA)? How does it work? I would greatly appreciate it if someone could share links to the documentation that covers internals of the database, online videos, research papers, mailing lists, or any notes you could share to help me understand the above. Thank you very much! Cheers, Ivan

2 1

Password policies and hashed passwords
by Felix Natter 26 Feb '22

26 Feb '22

Dear openldap-technical users, my password policies (openldap 2.5.11) are not enforced and Roland Gruber (author of LAM (Pro)) kindly advised me that passwords must be stored in plaintext (Hash=PLAIN) in order to be able to enforce password minimal length, password quality etc (i.e. when using passwd(1) on Linux or an LDAP client on Windows). Currently we are storing passwords as base64 encoded (::*) Salted SHA1 hashes ("{SSHA}*") (according to slapcat -n 1). tl;dr: For enforcing password policies, what is the role of "password-hash:PLAIN"(?) and olcPPolicyHashCleartext: TRUE (applied to dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config) and what is the security implication of these changes (we are using starttls on linux / ssl on windows with a self-signed certificate in intranet)? - Is it (necessary and) enough to switch to "password-hash:PLAIN" to be able to enforce password policies? Does olcPPolicyHashCleartext: TRUE [alone] help as written in this post [1]? [1] https://www.openldap.org/lists/openldap-technical/201708/msg00024.html EDIT: I think that olcPPolicyHashCleartext==ppolicy_hash_cleartext (one is OLC, one is trad. config)? -> can we update the documentation [2]? [2] https://www.openldap.org/doc/admin25/guide.html#Password%20Policies - I am worried about security when storing/transferring pwds in plain text (we are using starttls on linux / ssl on windows with a self-signed certificate in intranet) [3]. Will "ppolicy_hash_cleartext" [2] help with this? [3] The manual states "Unfortunately, as dictionary and brute force attacks are generally quite easy for attackers to successfully mount, this advantage is marginal at best (this is why all modern Unix systems use shadow password files)." Many Thanks and Best Regards, Felix -- Felix Natter

3 11

ldap_start_tls_s fails
by James Gordon 25 Feb '22

25 Feb '22

Hi, I have just installed symas openldap v2.6. Everything seems to be running ok, except that I cannot get C interface ldap_start_tls_s() to work. If I do something like this the program works fine: ldap_initialize(&ld, HOST)); rc = ldap_simple_bind_s(ld, BASEDN, BASEPWD); ldap_unbind(ld); However, if I do something like this the program fails with ldap error string "local error": ldap_initialize(&ld, HOST)); ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE); ldap_start_tls_s(ld, NULL, NULL); rc = ldap_simple_bind_s(ld, BASEDN, BASEPWD); ldap_unbind(ld); From the command line, TLS seems to work fine: The following works ok: ldapsearch -H ldap://ldap.domain.com:389 -D "cn=admin,dc=domain,dc=com" -w secret -b “ou=users,dc=domain,dc=com” -ZZ This also works ok from a different server openssl s_client -verify 10 -starttls ldap -showcerts -connect ldap.domain.com:389 -CApath /etc/ssl/certs (verification = ok): However, if I omit the CApath it fails, not sure if that is a clue to the problem: openssl s_client -verify 10 -starttls ldap -showcerts -connect ldap.domain.com:389 (Verification error: unable to get local issuer certificate). Any help would be appreciated. If this is the wrong list, let me know. ldapsearch -H ldap://ldap.red0rb.com:389 -D "cn=admin,dc=red0rb,dc=com" -w MdKlUIGYm0o63HxQ0RWYuKWkRkgr3Ohy -b “ou=users,dc=red0rb,dc=com” -ZZ

1 0

Re: 2.5 Quick-Start guide roadblock: ldap_bind: Confidentiality required (13)
by Ben Poliakoff 24 Feb '22

24 Feb '22

> > Steps 1-7 involve building the software, which I would not expect you to > be > doing if you're using Symas' packages? > You are, of course, correct about my having not compiled slapd, I misspoke. > In any case, I have no idea what changes you made to the original LDIF. I > have no such issue doing only the changes advised in the quickstart guide: > I sorted out what was happening. I was using the ldapadd command syntax from the Quick-Start guide, which doesn't use the '-H ldap:///' parameter, so ldapadd was picking up defaults from /etc/ldap/ldap.conf and happily talking to our existing production slapd, running on a different server (which of course does require secure binds). However, when I added '-H ldap:///' to the ldapadd command, ensuring that the ldap traffic was now going to the correct server (headpalm), the command fails with "ldap_bind: Invalid credentials (49)". At this point the olcRootPW in my slapd.ldif is the default ("secret"), and I can see that the base64 encoded olcRootPW in "slapd.d/cn=config/olcDatabase={1}mdb.ldif" is "olcRootPW:: c2VjcmV0" (which is, in fact the base64 encoding for "secret"). Does anyone have debugging approaches that might help me sort out why slapd isn't happy with the password? Also with regard to this mailing list's protocol, would it be better to ask this question in a separate thread? (It's humbling to be asking such phenomenally basic questions, having built and managed our existing openldap servers for many many years.) Ben

2 1

Is there a way to expose SLDAP Server Metrics to Prometheus?
by vtejaswini1＠gmail.com 24 Feb '22

24 Feb '22

It would be interesting if there were any official Prometheus exporter to monitor LDAP metrics. If we have one such exporter, does it authenticate LDAP Server to aggregate/formulate/capture metrics? Thanks, Teja

3 4

Unable to change ssl version on openldap 2.6.0
by Frédéric Goudal 24 Feb '22

24 Feb '22

Hello, For a legacy application we need to drop the ssl version available on our openldap server. Currently it supports TLSv1.2, checked with nmap --script ssl-enum-ciphers -p 636 host What ever value I put on olcTLSProtocolmin the ssl version does not change… I have tried 3.0 3.1 3.2… What do I miss ? Or is it a feature ? Thanks in advance f.g. — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 6

Is there a way to silence or redirect BIND Operation Logs in SLDAP?
by vtejaswini1＠gmail.com 23 Feb '22

23 Feb '22

Hi, For each LDAP BIND Operation, SLDAP Server logs a significant amount of logs (> 10 Log Lines). Is there a way to silence or redirect or configure these logs or BIND Operation itself? Thanks, Teja

2 5

2.5 Quick-Start guide roadblock: ldap_bind: Confidentiality required (13)
by Ben Poliakoff 23 Feb '22

23 Feb '22

I've been using the Symas OpenLDAP debian packages, and following the Quick-Start guide for 2.5: https://www.openldap.org/doc/admin25/quickstart.html Following steps 1 - 10 has been straight forward, but when I get to step 11 (Add initial entries to your directory), I run into trouble when running the ldapadd command: root@openldap-x:/opt/symas/etc/openldap# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f bootstrap.ldif Enter LDAP Password: ldap_bind: Confidentiality required (13) additional info: confidentiality required root@openldap-x:/opt/symas/etc/openldap# I used the provided slapd.ldif.default to seed the cn=config (updating it with the appropriate domain components), as per the instructions in the Quick-Start, so slapd isn't yet configured to run with ssl or starttls. Is there a default SSF factor that I should adjust to get past this bootstrapping failure? I don't see anything like that explicitly set in the configs that were rendered into /opt/symas/etc/openldap/slapd.d, from my slapd.ldif. I'm not new to openldap, but this is the first time I've used the Symas packages and also the first time trying to use olc instead of a slapd.conf based configuration. Ben

2 1

OpenLdap on Rocky 8 -- suggestions?
by Aaron Bennett 23 Feb '22

23 Feb '22

Hi, I'm migrating a small two-node OpenLDAP cluster from CentOS 7 to Rocky 8. I've been maintaining my own openldap rpms forked off of the RHEL 7 srpms, edited to link against OpenSSL instead of the never-to-be-sufficiently-d*mned GnuTLS. Now that there is no official openldap build from RedHat, I'm evaluating my choices. Essentially it comes down to these: 1. Build from source every time. Not difficult and I'm comfortable with it, but I prefer when possible to not drop non-rpm packaged files into production 2. Package it myself. If we still used it super extensively like we did in the past, I would do this, but it's a lot of work. 3. Look for third-party packages that are frequently updated. My preference is 3, which of course leads me to Symas OpenLdap. Looking at the symas page, it looks like there are two branches, the LTS 2.5 branch and the 2.6 branch. If this is accurate and the 2.5 branch is updated with security backports, etc, and is still gratis, that's the direction I'm looking to go. Any gotchas, or am I totally missing something obvious? Best, Aaron Bennett --- Aaron Bennett Manager of Systems Administration Clark University ITS

2 1

Re: log analysis tools
by Clément OUDOT 22 Feb '22

22 Feb '22

Le sam. 5 févr. 2022 à 20:57, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > > > --On Friday, February 4, 2022 10:12 PM -0500 Dave Macias <davama(a)gmail.com> > > wrote: > > > > > > > https://www.ltb-project.org/documentation/ldap-stats.html > > Is that the one I used to help maintain? I don't believe it's been updated > for 2.5 and later, unless it was forked and someone else has started > working on it. > Hello Quanah, this is indeed a fork done inside LTB project, there was no git repo for this script (or I did not found it). Of course if there are changes in 2.5 log format, we can update the script. Clément.

4 8

str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38)
by gpaz＠iter.es 21 Feb '22

21 Feb '22

````` [root@ldap ~]# slapcat The first database does not allow slapcat; using the first available one (2) dn: dc=ldap,dc=test objectClass: top objectClass: dcObject objectClass: organization dc: ldap o: ldap_test_iter description: ldap_test_iter structuralObjectClass: organization entryUUID: 4a04a984-1dfc-103c-8835-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209135948Z entryCSN: 20220209135948.842285Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209135948Z dn: ou=users,dc=ldap,dc=test objectClass: organizationalUnit ou: users structuralObjectClass: organizationalUnit entryUUID: 4a09e624-1dfc-103c-8836-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209135948Z entryCSN: 20220209135948.876561Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209135948Z dn: ou=groups,dc=ldap,dc=test objectClass: organizationalUnit ou: groups structuralObjectClass: organizationalUnit entryUUID: 4a0dc5fa-1dfc-103c-8837-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209135948Z entryCSN: 20220209135948.901999Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209135948Z dn: uid=pedro,ou=users,dc=ldap,dc=test uid: pedro cn: pedro sn: pedro objectClass: top objectClass: posixAccount objectClass: inetOrgPerson loginShell: /bin/bash uidNumber: 500 gidNumber: 500 mail: pedro(a)example.com gecos: pedro user homeDirectory: /home/pedro structuralObjectClass: inetOrgPerson entryUUID: 908089be-1dfc-103c-8838-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209140147Z userPassword:: e1NTSEF9eWdWaGZSMFhKY3N3blpLREdMbm9TU0VlanVWK01jL0s= entryCSN: 20220217123622.452494Z#000000#000#000000 modifiersName: uid=pedro,ou=users,dc=ldap,dc=test modifyTimestamp: 20220217123622Z dn: cn=pedro,ou=groups,dc=ldap,dc=test objectClass: posixGroup objectClass: top cn: pedro userPassword:: e2NyeXB0fXg= gidNumber: 500 memberUid: uid=pedro structuralObjectClass: posixGroup entryUUID: 9096c90e-1dfc-103c-8839-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209140147Z entryCSN: 20220209140147.240435Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209140147Z dn: cn=module,dc=ldap,dc=test cn: module objectClass: top objectClass: olcModuleList olcModuleLoad: ppolicy.la olcModulePath: /usr/lib64/openldap structuralObjectClass: olcModuleList entryUUID: 8ffa80b4-243f-103c-809a-d143605cbb0e creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220217131629Z entryCSN: 20220217131629.473761Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220217131629Z dn: ou=ppolicy,dc=ldap,dc=test objectClass: organizationalUnit ou: ppolicy structuralObjectClass: organizationalUnit entryUUID: aeeed796-2443-103c-9d36-4f3e029afe7a creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220217134559Z entryCSN: 20220217134559.393630Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220217134559Z ````` When I try enable the modulo I obtain the next error: ````` [root@ldap ldap]# slapadd -n2 -l 2.2_ppolicy-bdb-ldap.test.ldif str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=1) _#################### 100.00% eta none elapsed none fast! Closing DB... ````` File 2.2_ppolicy-bdb-ldap.test.ldif: ````` [root@ldap ldap]# cat 2.2_ppolicy-bdb-ldap.test.ldif dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=ppolicy,dc=ldap,dc=test olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE ````` Could anyone help me?

2 3

slapcat truncates slapd.log
by Jose Garcia 21 Feb '22

21 Feb '22

Hello, openldap.org community! This is my first thread here, in the hopes of finding a better understanding of a problem I'm having with OpenLDAP after several hours of unsuccessful troubleshooting. I'm in no way an expert on the matter so maybe someone more experienced here could help me get things a bit clearer. I recently found this issue in two Ubuntu 18.04 servers I'm running with OpenLDAP 2.4 and bdb backend for their databases. I want to export my LDAP database to an LDIF file by running: # slapcat -l database.ldif This works just fine. However, I realized every time I run such slapcat command, my slapd.log file gets truncated (i.e. all previous log entries are deleted). This happens on both servers, no matter if the slapd daemon is running or not. I don't know if this is normal or expected behavior, but it is weird to me that slapcat is wiping the log files. From what I understood slapd is in charge of the logging, so why is slapcat messing with that? Is this just normal/expected behavior, or am I experiencing some kind of weird issue here?

2 1

RE: Error when running make test or slapd after building on windows
by Joshua Dunbar 21 Feb '22

21 Feb '22

I see this issue here as well: https://www.mail-archive.com/openldap-bugs@openldap.org/msg08059.html But not sure I understand what the resolution is -----Original Message----- From: Joshua Dunbar Sent: Friday, February 18, 2022 11:19 AM To: Howard Chu <hyc(a)symas.com>; Dr. Ogg <ogg(a)sr375.com> Cc: Quanah Gibson-Mount <quanah(a)fast-mail.org>; openldap-technical(a)openldap.org Subject: RE: Error when running make test or slapd after building on windows I've attached the config.log -----Original Message----- From: Joshua Dunbar Sent: Friday, February 18, 2022 11:12 AM To: 'Howard Chu' <hyc(a)symas.com>; 'Dr. Ogg' <ogg(a)sr375.com> Cc: 'Quanah Gibson-Mount' <quanah(a)fast-mail.org>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> Subject: RE: Error when running make test or slapd after building on windows I installed Msys and ran the pacman commands via the instructions here: https://www.msys2.org/. I then opened a MSYS MinGW 64-bit command prompt and ran configure, make depend, and make. Make ends with the following error C:/msys64/mingw64/bin/../lib/gcc/x86_64-w64-mingw32/11.2.0/../../../../x86_64-w64-mingw32/bin/ld.exe: .libs/os-ip.o: in function `ldap_int_poll': C:/Users/USAF_Admin/Desktop/openldap-2.6.1/openldap-2.6.1/libraries/libldap/os-ip.c:391: undefined reference to `ber_pvt_wsa_err2string' collect2.exe: error: ld returned 1 exit status make[2]: *** [Makefile:437: libldap.la] Error 1 make[2]: Leaving directory '/home/USAF_Admin/libraries/libldap' make[1]: *** [Makefile:312: all-common] Error 1 make[1]: Leaving directory '/home/USAF_Admin/libraries' make: *** [Makefile:320: all-common] Error 1 Any ideas? -----Original Message----- From: Joshua Dunbar Sent: Thursday, February 17, 2022 6:17 PM To: Howard Chu <hyc(a)symas.com>; Dr. Ogg <ogg(a)sr375.com> Cc: Quanah Gibson-Mount <quanah(a)fast-mail.org>; openldap-technical(a)openldap.org Subject: RE: Error when running make test or slapd after building on windows Unfortunately this is for a government contract project and we are being mandated to use windows and not a containerized environment. Docker for windows was also booted. I have MSYS installed, as well as latest openldap source. -----Original Message----- From: Howard Chu <hyc(a)symas.com> Sent: Thursday, February 17, 2022 6:06 PM To: Dr. Ogg <ogg(a)sr375.com>; Joshua Dunbar <jdunbar(a)montereytechnologies.com> Cc: Quanah Gibson-Mount <quanah(a)fast-mail.org>; openldap-technical(a)openldap.org Subject: Re: Error when running make test or slapd after building on windows Dr. Ogg wrote: > Why not run in a Linux VM or a docker container? and avoid Cygwin? Or WSL2. I hear that works pretty well these days. > > >> On Feb 17, 2022, at 2:48 PM, Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >> >> Are there up to date instructions on how to build with Cygwin or Msys somewhere? I am trying to do this on a 64 bit Windows 10 computer. The way I am doing it with Cygwin with default configure options must be wrong. I am new to both Cygwin and OpenLDAP so apologies for my inexperience. >> >> -----Original Message----- >> From: Howard Chu <hyc(a)symas.com> >> Sent: Thursday, February 17, 2022 5:40 PM >> To: Quanah Gibson-Mount <quanah(a)fast-mail.org>; Joshua Dunbar >> <jdunbar(a)montereytechnologies.com>; openldap-technical(a)openldap.org >> Subject: Re: Error when running make test or slapd after building on >> windows >> >> Quanah Gibson-Mount wrote: >>> >>> >>> --On Thursday, February 17, 2022 8:00 PM +0000 Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >>> >>>> >>>> >>>> Hello, >>>> >>>> >>>> >>>> I am attempting to install openldap (latest version 2.6.1) on >>>> windows using Cygwin where I have installed dependencies of gcc >>>> core and make in order to get configure to run. I then run >>>> configure from a Cygwin terminal (without any arguments). Configure >>>> seems to run fine, and so does make depend, and make. Then when I >>>> attempt to run make test (or slapd with any other well formatted >>>> slapd.conf file) I get the following error message. I >>> >>> Hi Joshua, >>> >>> It's likely related to this discussion: >>> >>> <https://cygwin.com/pipermail/cygwin/2019-July/241961.html> >> >> More than just that. OpenLDAP code supports real POSIX environments and native WIN32 environments. >> It doesn't support Cygwin, which is a partially-working fake POSIX environment. >> >> You can use Cygwin or MSYS as the build platform, but the binaries will only work if built with the MinGW toolchain for native WIN32 output. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 5

Setup password policies: problem when adding OU
by Felix Natter 19 Feb '22

19 Feb '22

hello, I am trying to setup PPs using this guide: https://tylersguides.com/guides/openldap-password-policy-overlay/ Everything went fine up to adding the OU for the PP: policyou.ldif: dn: ou=policies,dc=company,dc=com objectClass: organizationalUnit ou: policies ldapadd -Y EXTERNAL -Q -H ldapi:/// -f policyou.ldif (1) which results in https://ldapwiki.com/wiki/LDAP_INSUFFICIENT_ACCESS (with "additional info: no write access to parent") Now I tried _several_ commands to fix this, then I did: ldapadd -H ldapi:/// -D cn=admin,cn=config -W -f policyou.ldif (2) which works. But I have to fix this on the production server now, and I don't know whether (2) fixed this or some other command. What could be the problem with (1)? Previously I used this guide to change the admin password twice: https://www.digitalocean.com/community/tutorials/how-to-change-account-pass… Do I have to set the password for cn=admin,cn=config separately? If yes, could you suggest a HOWTO? Many Thanks and Best Regards, Felix -- Felix Natter

3 4

Re: Error when running make test or slapd after building on windows
by Howard Chu 18 Feb '22

18 Feb '22

Dr. Ogg wrote: > Why not run in a Linux VM or a docker container? and avoid Cygwin? Or WSL2. I hear that works pretty well these days. > > >> On Feb 17, 2022, at 2:48 PM, Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >> >> Are there up to date instructions on how to build with Cygwin or Msys somewhere? I am trying to do this on a 64 bit Windows 10 computer. The way I am doing it with Cygwin with default configure options must be wrong. I am new to both Cygwin and OpenLDAP so apologies for my inexperience. >> >> -----Original Message----- >> From: Howard Chu <hyc(a)symas.com> >> Sent: Thursday, February 17, 2022 5:40 PM >> To: Quanah Gibson-Mount <quanah(a)fast-mail.org>; Joshua Dunbar <jdunbar(a)montereytechnologies.com>; openldap-technical(a)openldap.org >> Subject: Re: Error when running make test or slapd after building on windows >> >> Quanah Gibson-Mount wrote: >>> >>> >>> --On Thursday, February 17, 2022 8:00 PM +0000 Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >>> >>>> >>>> >>>> Hello, >>>> >>>> >>>> >>>> I am attempting to install openldap (latest version 2.6.1) on windows >>>> using Cygwin where I have installed dependencies of gcc core and make >>>> in order to get configure to run. I then run configure from a Cygwin >>>> terminal (without any arguments). Configure seems to run fine, and so >>>> does make depend, and make. Then when I attempt to run make test (or >>>> slapd with any other well formatted slapd.conf file) I get the >>>> following error message. I >>> >>> Hi Joshua, >>> >>> It's likely related to this discussion: >>> >>> <https://cygwin.com/pipermail/cygwin/2019-July/241961.html> >> >> More than just that. OpenLDAP code supports real POSIX environments and native WIN32 environments. >> It doesn't support Cygwin, which is a partially-working fake POSIX environment. >> >> You can use Cygwin or MSYS as the build platform, but the binaries will only work if built with the MinGW toolchain for native WIN32 output. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

DNS/ldap
by pascal.jakobi＠gmail.com 18 Feb '22

18 Feb '22

Just a question (quick). You probably saw the relatively new CAA record for DNS. This (great) record provides a means to get the address of a CA for a given DNS domain. Firstly, it is unclear to me why the old SRV records are not used as they essentially do the same. You may think of creating an SRV record for _pkica.<domain> that would provide a CA's IP address. Then my question is : why is this SRV not used on linux boxes ? This would provide a means to retrieve automatically a certificate/public key for a given user and avoid setting configs (i.e. ldap.conf) on the client side. In other tertms, don't we need a CAA equivalent for Directories ?

1 0

Error when running make test or slapd after building on windows
by Joshua Dunbar 17 Feb '22

17 Feb '22

Hello, I am attempting to install openldap (latest version 2.6.1) on windows using Cygwin where I have installed dependencies of gcc core and make in order to get configure to run. I then run configure from a Cygwin terminal (without any arguments). Configure seems to run fine, and so does make depend, and make. Then when I attempt to run make test (or slapd with any other well formatted slapd.conf file) I get the following error message. I have turned on the highest level of logging and don't get any additional useful information and have been going at this for a couple days now without any luck. I have tried manipulating permissions on the db folder as well as using different folder names and locations. I can see the lock.mdb file being generated in the /tests/testrun/db.1.a folder, but nothing else. Any insight or help would be very appreciated. 620dab00.2d2e09dc 0x800000010 config_build_entry: "olcDatabase={2}monitor" 620dab00.2d2e359c 0x800000010 slap_get_csn: conn=-1 op=0 generated new csn=20220217015512.758001Z#000000#000#000000 manage=0 620dab00.2d2ecdf4 0x800000010 backend_startup_one: starting "o=OpenLDAP Project,l=Internet" 620dab00.2d2edba0 0x800000010 mdb_db_open: "o=OpenLDAP Project,l=Internet" 620dab00.2d3072a8 0x800000010 mdb_db_open: database "o=OpenLDAP Project,l=Internet": dbenv_open(/tests/testrun/db.1.a). 620dab00.2d3a1894 0x800000010 mdb_db_open: database "o=OpenLDAP Project,l=Internet" cannot be opened: Invalid argument (22). Restore from backup! 620dab00.2d3a37d4 0x800000010 backend_startup_one (type=mdb, suffix="o=OpenLDAP Project,l=Internet"): bi_db_open failed! (22) 620dab00.2d3a42c4 0x800000010 slapd shutdown: initiated 620dab00.2d3c25f8 0x800000010 slapd destroy: freeing system resources. 620dab00.2d5278d0 0x800000010 slapd stopped. Thanks, Josh

3 4

Re: How to restrict access to pwdHistory attributes
by Chandeshwar Mishra 16 Feb '22

16 Feb '22

Hi Quanah, Thanks for your response. Our setup is a very old one and we are planning to migrate it to the latest stable version but Since this openldap is deployed in Production it is not possible for us to upgrade it suddenly. As you mentioned that ppolicy schema is missing in configuration, so is it possible that without having ppolicy schema, Openldap will remember the pwdHistory of the user ? In my case pwdHistory is visible to users, for which I want to apply ACL so that a user can only see his/her pwdHistory , not other users pwdHistory. Below are my configuration related to ppolicy configuration in config file:- include /etc/openldap/schema/ppolicy.schema --- more include directive related to schema ---- moduleload ppolicy.la moduleload memberof.la overlay memberof overlay syncprov overlay auditlog #overlay accesslog overlay ppolicy ppolicy_default "cn=passwordDefault,dc=example,dc=com" Thanks & Regards, Chandeshwar Kumar On Mon, Feb 14, 2022 at 11:24 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Saturday, February 12, 2022 5:22 AM +0000 > kumarchandeshwar99(a)gmail.com > wrote: > > > Hi, > > I am trying to restrict access to pwdHistory attributes provided by > > ppolicy overlay. I have applied the below ACL > > > > access to attrs=pwdHistory > > by * none > > but while doing slaptest, its throwing below error:- > > /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to > clause > > <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> > > ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] > > [attrs=<attrspec>] <attrspec> ::= <attrname> > > [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= > > <attr> [ , <attrlist> ] > > <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | > children > > <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] > > [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> > ] > > [dnattr=<attrname>] > > [realdnattr=<attrname>] > > [group[/<objectclass>[/<attrname>]][.<style>]=<group>] > > [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] > > [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] > > [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] > > > > Before posting here I searched archive and found one similar, issue , but > > it did not resolve my issue. I have running openldap-servers-2.4.23 on > > RHEL-6.5. > > You are missing the ppolicy schema in your configuration. > > However, I would note that both RHEL6 and OpenLDAP 2.4 are historic and no > longer in support. I'd strongly advise upgrading to both an OS that is > under support and a version of OpenLDAP that's under support. > > Regards, > Quanah > > > >

4 3

Re: OpenLDAP and NTLM
by Marc Boorshtein 15 Feb '22

15 Feb '22

> > > > NTLM has been obsoleted and shouldn't be used at all. SASL/GSSAPI or > SASL/GSS-SPNEGO should be fine. > I understand, but this is a legacy (really legacy) application that can't be changed. Is NTLM still working? >

2 1

OpenLDAP and NTLM
by Marc Boorshtein 15 Feb '22

15 Feb '22

I see that NTLM is supported as an authentication mechanism for supportedSASLMechanisms, but I'm not seeing any docs. Do I configure GSSAPI and NTLM is now available? Thanks Marc

3 2

slapo-memberof -> slapo-dynlist and value-based ACLs
by Michael Ströder 14 Feb '22

14 Feb '22

HI! I'm experimenting to replace slapo-memberof to slapo-dynlist in Æ-DIR's slapd.conf. Ok, basically it works but... Æ-DIR trys hard to follow need-to-know-principle. This means that memberOf values are only made visible to clients which they have defined to be visible on. Thus I have ACLs like this and which don't work for these clients (lines wrapped): access to dn.subtree="ou=ae-dir" filter="(objectClass=posixAccount)" attrs=memberOf val.regex="^.+$" [..] by set.expand="(user/-1 | user/aeSrvGroup | user/-1/aeProxyFor) & [ldap:///ou=ae-dir?entryDN?sub?(&(objectClass=aeSrvGroup)(aeStatus=0)(aeVisibleGroups=${v0}))]/entryDN" read [..] by * none I'm aware that this is quite special. But is there any chance that something like this will be ever supported? The alternative would be to implement an external update process for maintaining 'memberOf'. :-/ Ciao, Michael.

3 3

How to restrict access to pwdHistory attributes
by kumarchandeshwar99＠gmail.com 14 Feb '22

14 Feb '22

Hi, I am trying to restrict access to pwdHistory attributes provided by ppolicy overlay. I have applied the below ACL access to attrs=pwdHistory by * none but while doing slaptest, its throwing below error:- /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to clause <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] Before posting here I searched archive and found one similar, issue , but it did not resolve my issue. I have running openldap-servers-2.4.23 on RHEL-6.5. If any further details requires , Please let me know. Thanks.

2 1

issue with importing the samba3 schema
by Ulf Volmer 08 Feb '22

08 Feb '22

Hello, I'm trying to migrate an old openldap installation to a new one. OS of the new one is SLES15SP3, we are using the symas 2.5 packages. Sadly I got an error by importing the samba3 schema: # /opt/symas/bin/ldapadd -Y EXTERNAL -H ldapi:/// -f /opt/symas/etc/openldap/schema/samba3.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=samba3,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed I'm able to import other schemas in the same way, si I don't think that I hold the tool in the wrong way. Any pointers for me? Best regards Ulf

2 2

log analysis tools
by Paul B. Henson 07 Feb '22

07 Feb '22

Does anybody know of any good tools that can rip through an openldap log file and analyze it, creating a report of what queries are being made and how long they are taking to process? All of the information I'm interested in is included in the log: Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 fd=84 ACCEPT from IP=134.71.247.28:46592 (IP=0.0.0.0:636) Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 fd=84 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.2 tls_cipher=ECDHE-RSA-AES256-GCM-SHA384 Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=0 BIND dn="cn=it_boomi,ou=user,ou=service,dc=cpp,dc=edu" method=128 Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=0 BIND dn="cn=it_boomi,ou=user,ou=service,dc=cpp,dc=edu" mech=SIMPLE bind_ssf=0 ssf=256 Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=0 RESULT tag=97 err=0 qtime=0.000031 etime=0.000189 text= Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=1 SRCH base="ou=user,dc=cpp,dc=edu" scope=2 deref=3 filter="(&(objectClass=person)(calstateEduPersonEmplID=014532336))" Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=1 SRCH attr=memberOf Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=2 UNBIND Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000016 etime=0.192994 nentries=1 text= Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 fd=84 closed but split up into a number of different lines which need to be correlated to summarize it. Before I try it myself I was hoping somebody else had already scratched that itch :). The only things I can find searching are either really old or commercial products. Thanks much…

8 14

intermittent memberOf performance issues
by Paul B. Henson 04 Feb '22

04 Feb '22

I've run into another problem with the memberOf implementation on my 2.5 servers. After I sorted out the proper configuration, queries requesting memberOf were very performant: Feb 4 13:26:44 ldap-01 slapd[1207]: conn=23393 op=1 SRCH base="ou=user,dc=cpp,dc=edu" scope=2 deref=3 filter="(&(objectClass=person)(calstateEduPersonEmplID=013522522))" Feb 4 13:26:44 ldap-01 slapd[1207]: conn=23393 op=1 SRCH attr=memberOf Feb 4 13:26:44 ldap-01 slapd[1207]: conn=23393 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000015 etime=0.191860 nentries=1 text= However, intermittently the server gets into a state where the exact same query takes over 30 seconds: Feb 4 08:05:11 ldap-01 slapd[1425456]: conn=40797 op=1 SRCH base="ou=user,dc=cpp,dc=edu" scope=2 deref=3 filter="(&(objectClass=person)(calstateEduPersonEmplID=015559557))" Feb 4 08:05:11 ldap-01 slapd[1425456]: conn=40797 op=1 SRCH attr=memberOf Feb 4 08:05:50 ldap-01 slapd[1425456]: conn=40797 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000019 etime=39.435523 nentries=1 text= When this occurs, the only way to resolve the issue that I have found is to reboot the server. Simply restarting slapd results in the same degraded performance on these queries. Normally there is very low read I/O load on the servers during operation, probably averaging less than 1M/s, peaking up to maybe 20-30M/s for just an instant occasionally. When the memberOf query performance is degraded, there is a very high read I/O load on the server, continuously about 200-300M/s. Any thoughts on this? It seems like for some reason the server gets into a state where it is not using the cache or memory map for doing the search required to construct the memberOf results? But instead is doing a full disk read of the entire database? It's also weird that restarting the service is not resolve this, but rebooting the server does. I'm not intimately familiar with the internals of lmdb, is there some state that persists with the environment or memory map in between service runs that is only cleared by a reboot? I initially thought I might have had a theory on it, relating to an unrelated bug in RHEL 8.5 that broke the "needs-rebooting" command resulting in servers not properly rebooting after kernel/library updates. The most recent occurrence of this issue started up after such an update without the required reboot, but upon reviewing historic occurrences it has occurred at times that don't meet that criteria, so I find myself clueless again as to what's going on. Any advice on how to fix or do further debugging on this issue much appreciated, thanks…

1 0

Fwd: [Issue 9795] New: Remove memberof overlay
by patrick+openldap.org＠laimbock.com 03 Feb '22

03 Feb '22

Hi Quanah, Has the memberof overlay been replaced with something else? I couldn't find anything in overlays/README and the roadmap. Best, Patrick -------- Forwarded Message -------- Subject: [Issue 9795] New: Remove memberof overlay Date: Wed, 02 Feb 2022 20:02:51 +0000 From: openldap-its(a)openldap.org To: openldap-bugs(a)openldap.org https://bugs.openldap.org/show_bug.cgi?id=9795 Issue ID: 9795 Summary: Remove memberof overlay Product: OpenLDAP Version: 2.6.1 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- The memberof overlay was deprecated with the release of OpenLDAP 2.5. It should be removed prior for the next minor release (i.e., 2.7) -- You are receiving this mail because: You are on the CC list for the issue.

2 2

2.6 MMR 4-way with one master different flavor of linux
by Dave Macias 02 Feb '22

02 Feb '22

Hello, Hope everyone is doing well. Our current environment: 3-way MMR (syncrepl) with centos 7 using v2.6 We want to add a 4th master but with Rocky Linux 8. Why rocky? because eventually we will migrate the 3 masters to rocky linux too. But that will take some time… Any concerns with mixing linux flavor but using same openldap version? Dont do it? Any input is appreciated. Thank you, Dave

3 6

[LMDB] mdb_env_set_mapsize and read transactions
by Ken Wenzel 31 Jan '22

31 Jan '22

Hello, I like to implement an autogrow functionality for LMDB. The documentation for mdb_env_set_mapsize says that no transactions should be active when using this function. When looking at the code I can see that the function only checks if there is an active WRITE transaction and in this case it returns an error. Is it possible to reuse existing READ transactions or even associated cursors after mdb_env_set_mapsize has been called? Thank you and best regards, Ken

3 4

Minor typo in slapo-ppolicy
by Ulrich Windl 31 Jan '22

31 Jan '22

Hi! I just discovered a minor typo in my version of the slapo-ppolicy manual page (possibly it's fixed alrerady): The manual page lists "pwdGraceAuthnLimit", but the attribute returned by slapcat is "pwdGraceAuthNLimit" (different case for 'N') The name from the schema also is "pwdGraceAuthNLimit". Regards, Ulrich

2 1

Question regarding password dictionary rule in OpenLDAP
by Alan Andrea 31 Jan '22

31 Jan '22

I have a question regarding password rules that are enforced when a user changes their password in OpenLDAP. We have a need to implement a dictionary rule whereby words and phrases in a dictionary are not allowed in a users password. I am not able to see currently where such functionality exists in OpenLDAP and am wondering if there are any extensions to OPenLDAP that were developed to support this or if it would be required to write code to support this feature? Thanks,Alan

3 3

Need to define behaviour when storing pwdChangedTime
by David Coutadeur 31 Jan '22

31 Jan '22

Hi, When doing a backup / restore on my OpenLDAP 2.5.9 instance, I faced a behaviour that I think must be defined explicitely, in draft-behera-ldap-password-policy, or at least in OpenLDAP documentation. My backup contains an entry like this: dn: uid=test,ou=people,ou=branch,dc=example,dc=com cn: test sn: test givenName: test uid: test userPassword: secret pwdChangedTime: 20220110153431Z mail: test(a)domain.com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person There is also a valid default password policy: (which must be defined before the users in the backup file) dn: cn=default,ou=ppolicies,dc=example,dc=com objectClass: pwdPolicy objectClass: pwdPolicyChecker objectClass: organizationalRole cn: default pwdMaxAge: 7776000 pwdAttribute: userPassword pwdCheckQuality: 2 pwdLockout: TRUE pwdMaxFailure: 5 pwdMinLength: 6 pwdMustChange: TRUE pwdCheckModule: /usr/local/openldap/lib64/ppm.so When restoring the backup with this command: ldapadd -x -h '127.0.0.1:389' -D 'cn=Manager,dc=example,dc=com' -w 'secret' -f backup.ldif -e relax I have an error showing that the attribute pwdChangedTime is duplicated and must not be defined twice. I assume that the password policy does not replace my pwdChangedTime value with the current date, but duplicates the attribute. Could you define this behaviour somewhere? 1/ Is it possible to update the pwdChangedTime attribute along with the userPassword ? 2/ If so, what value should be stored? (the given value or the current date?) 3/ Optionally, update OpenLDAP code according to the defined behaviour Thanks in advance for your answer. Regards, David

5 7

How to properly test whether an asynchronous ldap_connect() has fully connected?
by nickpelling＠nickpelling.com 27 Jan '22

27 Jan '22

I'm trying to run OpenLDAP on a Cortex-M7 processor, but to be a "good citizen" my LDAP client code needs to connect asynchronously. (The code connects synchronously fine.) Stripped down to the bare minimum (i.e. no error handling) for clarity here (the actual code has tons of error handling), my asynchronous connection code looks like this: ldap_set_option(pstContext->ld, LDAP_OPT_CONNECT_ASYNC, LDAP_OPT_ON); // Enable async connection ldap_connect(ld); // Do the LDAP connection As you'd expect, the next step is to test (asynchronously) whether the connection has completed, but it can't see any OpenLDAP functionality to do this directly. So here's what my test currently looks like: /** * Determine whether a connection has yet connected * * @param[in] LDAP connection instance to test * * @retval 0 if connection has connected * @retval -2 if connection is still waiting * @return ...otherwise an unexpected problem was encountered */ int ldap_connection_connected(LDAP * ld) { ber_socket_t sd; int iRetVal; iRetVal = -99; // Default to "an unexpected problem was encountered" if (ld->ld_defconn != NULL) { if (ld->ld_defconn->lconn_status == LDAP_CONNST_CONNECTED) { iRetVal = 0; // i.e. the connection has already connected, so exit early! } else { // Get the connection's sockbuffer ber_sockbuf_ctrl( ld->ld_defconn->lconn_sb, LBER_SB_OPT_GET_FD, &sd ); // Check to see if a result has yet been received via this sockbuffer iRetVal = ldap_int_check_async_open( ld, sd ); } } return iRetVal; } However, my bind code (i.e. that executes immediately after this) fails to connect to the server after an asynchronous ldap_connect(), even though it works fine after a synchronous ldap_connect(). Moreover, it looks to me (from the timings) as though my test for asynchronous connection is signalling completion earlier than I'm expecting, so I'm wondering if this is not waiting properly, e.g. if it's returning after the very first message response when it should be waiting for a whole series of message responses to arrive. Am I missing some clever OpenLDAP trick for correctly detecting when asynchronous ldap_connect() calls have fully connected? Thanks!

1 0

mdb_txn_begin() before mdb_dbi_open()
by Sam Dave 25 Jan '22

25 Jan '22

Hello, 1. I create a read-only transaction on an environment with mdb_txn_begin(). 2.Then I get a database handle on the same environment (using mdb_dbi_open() within a separate transaction). 3. Finally I try to create and use a cursor using the database in 2. and transaction in 1. but I get various runtime errors ("Segmentation fault" or "double free or corruption"). However, if I switch 1. and 2., everything works. Must a database really be created before a transaction? If so, curious to learn if this is mentioned anywhere in the docs (I didn't see it) Regards, Sam

2 1

mdb_cursor_close and mdb_txn_close/abort for read-only transactions
by Sam Dave 24 Jan '22

24 Jan '22

Hello, The mdb_cursor_close() documentation says: "Its transaction must still be live if it is a write-transaction." This leads me to my question: For *read-only* transactions, is it allowed to run mdb_cursor_close() *after* mdb_txn_close() or mdb_txn_abort()? Regards, Sam

2 2

Problem with connection on localhost for push replication
by frederic.goudal＠bordeaux-inp.fr 21 Jan '22

21 Jan '22

Hello, I have a strange problem : I have a push replication setup and delta-sync on a 2.6.0 instance. My replication is broken. What I find in the log is the following : slap_client_connect: URI=ldap://localhost DN="uid=ldapsync,ou=people,dc=ipb,dc=fr" ldap_sasl_bind_s failed (-5) than it retries 5 times, and in the log I just find : ldapa2021 slapd[265608]: do_syncrep1: rid=415 starting refresh (sending cookie=rid=415,csn=20130927152219.157851Z#000000#001#000000;20131127140429.597497Z#000000#002#00000\ 0;20141208130549.278599Z#000000#004#000000;20220120073003.212785Z#000000#00a#000000;20220119182551.334341Z#000000#018#000000) ldapa2021 slapd[265608]: conn=1008 op=1 syncprov_op_search: got a persistent search with a cookie=rid=415,csn=20130927152219.157851Z#000000#001#000000;20131127140429.59749\ 7Z#000000#002#000000;20141208130549.278599Z#000000#004#000000;20220120073003.212785Z#000000#00a#000000;20220119182551.334341Z#000000#018#000000 slapd[265608]: do_syncrep2: rid=415 LDAP_RES_SEARCH_RESULT slapd[265608]: do_syncrep2: rid=415 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform ldapa2021 slapd[265608]: do_syncrep2: rid=415 (53) Server is unwilling to perform ldapa2021 slapd[265608]: do_syncrepl: rid=415 rc -101 retrying every five minutes. The problem is that if I do an external ldapsearch with the same bind_dn and the password in the syncrepl definition, the bind is correct. my syncrelpl entry is {0}rid=415 provider=ldap://localhost binddn="uid=ldapsync,ou=people,dc=ipb,dc=fr" bindmethod=simple credentials=****** filter="(objectclass=*)" searchbase="dc=ipb,dc=fr" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 exattrs=hasSubordinates I'm a bit lost... -- Frédéric Goudal DSI Bordeaux-INP 05 56 84 23 11

1 0

2.6.1 with olcTLSVerifyClient=demand fails - TLS accept failure error, error=-1
by patrick+openldap.org＠laimbock.com 21 Jan '22

21 Jan '22

Hi, I'm having trouble getting OpenLDAP 2.6.1 on AlmaLinux 8.5 to work with olcTLSVerifyClient=demand which results in: connection_read(11): TLS accept failure error=-1 id=1001, closing ... conn=1001 fd=11 closed (TLS negotiation failure). With olcTLSVerifyClient=try I get: error unable to get TLS client DN, error 49. I tried various Google suggestions: check certificate permissions, SELinux AVCs (there are none), created CA, server and client certificates with EasyRSA and manually created the same certificates, ran slapd as root and tried with a python-ldap script. [root@ldap1 openldap]# ldapwhoami -d 1 -H ldaps://<FQDN> -x ... connect success TLS trace: SSL_connect:before SSL initialization TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS read server hello TLS trace: SSL_connect:TLSv1.3 read encrypted extensions TLS trace: SSL_connect:SSLv3/TLS read server certificate request TLS certificate verification: depth: 1, err: 0, subject: /C=NL/O=Example/OU=IT/CN=OpenLDAP-CA, issuer: /C=NL/O=Example/OU=IT/CN=OpenLDAP-CA TLS certificate verification: depth: 0, err: 0, subject: /C=NL/O=Example/OU=IT/CN=<FQDN>, issuer: /C=NL/O=Example/OU=IT/CN=OpenLDAP-CA TLS trace: SSL_connect:SSLv3/TLS read server certificate TLS trace: SSL_connect:TLSv1.3 read server certificate verify TLS trace: SSL_connect:SSLv3/TLS read finished TLS trace: SSL_connect:SSLv3/TLS write change cipher spec TLS trace: SSL_connect:SSLv3/TLS write client certificate TLS trace: SSL_connect:SSLv3/TLS write finished ... TLS trace: SSL3 alert read:fatal:unknown ldap_err2string ldap_result: Can't contact LDAP server (-1) There is only one ldap.conf and it's in /etc/openldap: BASE dc=example,dc=ldap URI ldaps://<FQDN> TLS_CACERT /etc/openldap/certs/openldap-CA.crt TLS_CERT /etc/openldap/certs/ldap-admin.crt TLS_KEY /etc/openldap/certs/ldap-admin.key TLS_REQCERT demand Certificates (slapd runs with -u ldap): [root@ldap1 certs]# ll /etc/openldap/certs total 20 -rw-r--r--. 1 root root 1980 21 jan 15:24 <FQDN>.crt -r--------. 1 ldap root 2484 21 jan 15:24 <FQDN>_nopass.key.crt -rw-r--r--. 1 root root 1984 21 jan 15:24 ldap-admin.crt -r--------. 1 patrick root 2484 21 jan 15:24 ldap-admin_nopass.key.crt -rw-r--r--. 1 root root 1952 21 jan 15:24 openldap-CA.crt dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcPidFile: /run/openldap/slapd.pid olcPasswordCryptSaltFormat: $6$%s olcLogLevel: -1 olcTLSCACertificateFile: /etc/openldap/certs/openldap-CA.crt olcTLSCertificateFile: /etc/openldap/certs/ldap-server.crt olcTLSCertificateKeyFile: /etc/openldap/certs/ldap-server.key olcTLSDHParamFile: /etc/pki/tls/certs/dhparam2048 olcTLSVerifyClient: demand The certificates are attached (the keys have no password) plus the output of 'openssl x509 -text -noout -in <cert> > <cert>.txt'. The python script test.py that I used is also attached. Thank you for any suggestions how to make this work or where to look. Best, Patrick

2 1

Reason behind "OPENLDAP_2.200" version number for openldap 2.6 version?
by thrivikram.rage＠gmail.com 21 Jan '22

21 Jan '22

Hi There , Is there any reason behind "OPENLDAP_2.200" version number for openldap 2.6 version ? , For earlier versions of "openldap 2.5.7 " the generated file was "OPENLDAP_2.5.7". Thanks, Vikram

2 1

OpenLDAP 2.6.1 testing call #1 (OpenLDAP 2.6.1)
by Quanah Gibson-Mount 20 Jan '22

20 Jan '22

This is the first testing call for OpenLDAP 2.6.1. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. We are aware of two issues with the regression suite tests failing (its4448 and its8752), so no need to report failures for those. Thanks! OpenLDAP 2.6.1 Engineering Fixed libldap to init client socket port (ITS#9743) Added slapd config keyword for logfile format (ITS#9745) Fixed slapd to allow objectClass edits with no net change (ITS#9772) Fixed slapd configtable population (ITS#9576) Fixed slapd to only set loglevel in server mode (ITS#9715) Fixed slapd logfile-rotate use of uninitialized variable (ITS#9730) Fixed slapd passwd scheme handling with slapd.conf (ITS#9750) Fixed slapd postread support for modrdn (ITS#7080) Fixed slapd syncrepl recreation of deleted entries (ITS#9282) Fixed slapd syncrepl replication with ODSEE (ITS#9707) Fixed slapd syncrepl to properly replicate glue entries (ITS#9647) Fixed slapd syncrepl to reject REFRESH for precise resync (ITS#9742) Fixed slapd syncrepl to avoid busy loop during refresh (ITS#9584) Fixed slapd syncrepl when X-ORDERED is specified (ITS#9761) Fixed slapd syncrepl to better handle out of order delete ops (ITS#9751) Fixed slapd syncrepl to correctly close connections when config is deleted (ITS#9776) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapd-wt to set correct flags (ITS#9760) Fixed slapo-accesslog to fix assertion due to deprecated code (ITS#9738) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapo-accesslog delete handling of multi-valued config attrs (ITS#9493) Fixed slapo-autogroup to maintain values in insertion order (ITS#9766) Fixed slapo-constraint to maintain values in insertion order (ITS#9770) Fixed slapo-dyngroup to maintain values in insertion order (ITS#9762) Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-dynlist static group filter with multiple members (ITS#9779) Fixed slapo-ppolicy when not built modularly (ITS#9733) Fixed slapo-refint to maintain values in insertion order (ITS#9763) Fixed slapo-retcode to honor requested insert position (ITS#9759) Fixed slapo-sock cn=config support (ITS#9758) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) Fixed slapo-syncprov to allow empty DB to host persistent syncrepl connections (ITS#9691) Fixed slapo-syncprov to consider all deletes for sycnInfo messages (ITS#5972) Fixed slapo-translucent to warn on invalid config (ITS#9768) Fixed slapo-unique to warn on invalid config (ITS#9767) Fixed slapo-valsort to maintain values in insertion order (ITS#9764) Build Environment Fix test022 to preserve DELAY search output (ITS#9718) Fix slapd-watcher to allow startup when servers are down (ITS#9727) Contrib Fixed slapo-lastbind to work with 2.6 lastbind-precision configuration (ITS#9725) Documentation Fixed slapd.conf(5)/slapd-config(5) documentation on lastbind-precision (ITS#9728) Fixed slapo-accesslog(5) to clarify logoldattr usage (ITS#9749) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 3

CRL refresh in OpenLDAP
by Xabier Berasategui Cano 19 Jan '22

19 Jan '22

Hi, We have an application that uses a client certificate to authenticate to OpenLDAP server 2.4.46 at SSL/TLS level. Among other things, olcTLSCRLCheck directive is configured to "peer" value to verify if the client certificate has not been revoked and the CRL is updated every day via script and expires after 15 days. Everything works well until the 15 days are exceeded and the authentication of the application fails since the server has not been restarted to refresh the CRL. Is there a way to refresh the CRL without restarting the server? Thanks in advance Regards P Please consider the environment before printing this e-mail.

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical