- openldap-technical - openldap.org

rewriting non-DN attribute values with rwm?
by Kartik Subbarao 30 May '22

30 May '22

I'd like to rewrite the following entry: dn: uid=user(a)olddomain.com,dc=olddomain,dc=com uid: user(a)olddomain.com mail: user(a)olddomain.com to appear and behave like this: dn: uid=user(a)newdomain.com,dc=newdomain,dc=com uid: user(a)newdomain.com mail: user(a)newdomain.com I can get the DN rewritten with slapd-relay and rwm-suffixmassage, and can use rwm-rewriterule with the searchFilter and searchEntryDN contexts to return the entry when querying for mail=user(a)newdomain.com. But I can't figure out how to rewrite the *values* of the uid and mail attributes in the returned entry to user(a)newdomain.com. What is the best way to achieve this? Thanks, -Kartik

2 2

result not in cache
by Stefan Kania 29 May '22

29 May '22

I'm testing the openldap cache module pcache with OpenLDAP 2.6 on Debian11 (symas-packages). The proxy has the following config: (I'm testing caching so no security is set) -------------- include /opt/symas/etc/openldap/schema/core.schema include /opt/symas/etc/openldap/schema/cosine.schema include /opt/symas/etc/openldap/schema/nis.schema include /opt/symas/etc/openldap/schema/inetorgperson.schema pidfile /var/symas/run/slapd.pid argsfile /var/symas/run/slapd.args loglevel any modulepath /opt/symas/lib/openldap moduleload back_mdb.la moduleload argon2.la moduleload back_ldap moduleload pcache sizelimit 500 tool-threads 1 database ldap suffix "dc=example,dc=net" uri "ldap://ldap-server.example.net" rootdn "cn=admin,dc=example,dc=net" protocol-version 3 rebind-as-user overlay pcache pcachePersist TRUE pcache mdb 100000 2 1000 100 pcacheAttrset 0 mail postaladdress telephonenumber givenname pcacheAttrset 1 uid employeetype pcacheTemplate (sn=) 0 3600 pcacheTemplate (&(sn=)(givenName=)) 0 3600 pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600 directory /var/symas/cache index objectclass eq index uid,cn,sn,mail,givenname pres,eq,sub -------------- The following host are involved: ldap-server<----->ldap-proxy<----->ldap-client The ldap-client can only access the ldap-proxy. (ldap.conf ist pointing to the ldap-proxy) Now I do a: ldapsearch -x '(&(sn=Kania)(givenName=Stefan))' givenname The first time I can see that the proxy is asking the ldap-server and is giving the result to the ldap-client. Each time I repeat the command on the ldap-client, only the log from the ldap-proxy is showing the access from the ldap-client. The ldap-client is getting the result from the proxy. I can even shutdown the ldap-server and the client is still getting the result from the proxy. Up to this point I understand the log but if I set "loglevel any" I see: ------------ access_allowed: result not in cache (givenName) ------------ But I think the result IS in the cache otherwise I would not get the result with the ldap-server turned off. So why do I get this messages?

2 1

Made a change to cn=schema,cn=config, can't revert?
by Sander Smeenk 25 May '22

25 May '22

Hi, I'm trying to add an 'olcAttributeType' to an already existing LDAP schema. I wrote this LDIF, which was wrong as it turns out: | dn: cn=schema,cn=config | changetype: modify | add: olcAttributetypes | olcAttributetypes: ( bitHttpAttribute:26.2008.07.29.1 NAME | 'testEntry' DESC 'Test' EQUALITY integerMatch SYNTAX | LDAPInteger SINGLE-VALUE ) This changed my 'dn: cn=schema,cn=config' from: | dn: cn=schema,cn=config | objectClass: olcSchemaConfig | cn: schema | structuralObjectClass: olcSchemaConfig | entryUUID: 9faa0e66-41f5-1032-82e1-974d55020d34 | creatorsName: cn=config | createTimestamp: 20130425131311Z | entryCSN: 20130425131311.204787Z#000000#000#000000 | modifiersName: cn=config | modifyTimestamp: 20130425131311Z To: | dn: cn=schema,cn=config | objectClass: olcSchemaConfig | cn: schema | structuralObjectClass: olcSchemaConfig | entryUUID: 9faa0e66-41f5-1032-82e1-974d55020d34 | creatorsName: cn=config | createTimestamp: 20130425131311Z | olcAttributeTypes: {0}( bitHttpAttribute:26.2008.07.29.1 NAME | 'testEntry' DESC 'Test' EQUALITY integerMatch SYNTAX | LDAPInteger SINGLE-VALUE ) | entryCSN: 20220525132055.795116Z#000000#000#000000 | modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth | modifyTimestamp: 20220525132055Z Which is not what i wanted but it happened, so now i want it gone. But it seems i can't remove that olcAttributeTypes entry? This LDIF won't work: | dn: cn=schema,cn=config | changetype: modify | delete: olcAttributeTypes Yielding: | # ldapmodify -Y EXTERNAL -H ldapi:/// -f kak.ldif | [..] | modifying entry "cn=schema,cn=config" | ldap_modify: Other (e.g., implementation specific) error (80) When i put in the exact olcAttributeType line i want to remove (instead of all of 'em) like this: | dn: cn=schema,cn=config | changetype: modify | delete: olcAttributeTypes | olcAttributeTypes: ( bitHttpAttribute:26.2008.07.29.1 NAME 'testEntry' DESC 'Test' EQUALITY integerMatch SYNTAX LDAPInteger SINGLE-VALUE ) Now the same ldapmodify command yields: | # ldapmodify -Y EXTERNAL -H ldapi:/// -f kak.ldif | [..] | modifying entry "cn=schema,cn=config" | ldap_modify: Operations error (1) Can anyone explain what i am doing wrong and how to revert my change to the 'cn=schema,cn=config' dn? Thanks a bunch! Regards, -Sander. -- | I did a theatrical performance about puns. It was a play on words. | 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2

2 3

consumer state is newer than provider
by Rallavagu Kon 24 May '22

24 May '22

Hello All, Running OpenLDAP version 2.4.58 on Ubuntu 20.04 in multicaster mode. Replication Configuration: olcSyncrepl: {0}rid=101 provider=ldaps://<host1>:10636 binddn="<binddn>" bindm ethod=simple credentials=<creds> searchbase="dc=company,dc=com" type =refreshAndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive= "240:10:30" olcSyncrepl: {1}rid=102 provider=ldaps://<host2>:10636 binddn="<binddn>" bindm ethod=simple credentials=<creds> searchbase="dc=company,dc=com" type =refreshAndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive= "240:10:30" olcSyncrepl: {2}rid=103 provider=ldaps://<host3>:10636 binddn="<binddn>" bindm ethod=simple credentials=<creds> searchbase="dc=company,dc=com" type =refreshAndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive= "240:10:30" olcSyncrepl: {3}rid=104 provider=ldaps://<host4>:636 binddn="<binddn>" bindmethod=si mple credentials=<creds> searchbase="dc=company,dc=com" type=refresh AndPersist interval=00:00:00:30 retry="5 5 60 +" timeout=1 keepalive="240:10: 30" olcMirrorMode: TRUE # {1}syncprov, {2}mdb, config dn: olcOverlay={1}syncprov,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 10 Under normal conditions, all operations perform normally in terms of replication consistency. However, when performing a stream of “ADD” operations eventually producer/consumer go out of sync where consumer thinks it has latest state than producer. All the write operations including ADD are pointed to a producer node (not load balancing the writes). Introduced 30 second delay to “ADD” operations (for the sake of testing) and experiencing the same behavior. The issue is manifesting after adding around 4k entries (sometimes even sooner). Here are the log snippets. May 4 23:06:47 openldap-service-0 slapd[199]: do_syncrep2: rid=102 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform May 4 23:06:47 openldap-service-0 slapd[199]: do_syncrep2: rid=102 (53) Server is unwilling to perform May 4 23:06:37 openldap-service-1 slapd[199]: conn=1046 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! Checked for the clock synchronization and verified that all instances have NTP enabled. Wondering where and what I should be looking for. Thanks in advance.

2 3

slapo-syncprov on read-only consumers
by Michael Ströder 21 May '22

21 May '22

HI! Is it still highly recommended to configure slapo-syncprov on read-only consumers? Background: I have a tier of read-only consumers with "lastbind on" and slapo-ppolicy configured, but no chaining to the writeable providers (e.g. no ppolicy_forward_updates). All providers and consumers are 2.6.2. In case of a simple bind to this read-only consumer it makes local modification to the user's entry (pwdFailureTime and pwdLastSuccess) and it's ok for me that this is local to this consumer. But with slapo-syncprov configured on the consumer slapd generates a new entryCSN with server ID 0 which results in a contextCSN value with SID 0. This is what I'd like to avoid. Hence my above question. Ciao, Michael.

1 0

Query on CVE-2022-29155
by Venkat Kandhari -X (khvenkat - INFOSYS LIMITED＠Cisco) 18 May '22

18 May '22

3 2

Solution for syncrepl & memberof replacement with non-dynamic group and users
by René Gallati 17 May '22

17 May '22

Hello list, I have an openldap 2.4.49 (ubuntu 20.04 LTS) server pair running with syncrepl. I also have memberof overlay activated and during a debug session found out that this is a no-go. I was debugging a problem where an user record that is in two groups only shows one memberOf attribute value whereas other users show the expected amount of memberOf values. Now I'm looking into replacing the memberof overlay but it appears that for my use case there is no replacement at all. dynlist seems made to create dynamic groups or lists respectively but everything in my DIT is a static group and static users. They are created by a commercial product and I am unable to add further specific URL attributes there when new entries are created. I stumbled upon https://www.mail-archive.com/openldap-technical@openldap.org/msg26067.html via google search, but blindly copying the dynlist-attrset merely causes the slapd to reply with "/etc/ldap/slapd.conf: line 149: "dynlist-attrset <oc> [uri] <URL-ad> [[<mapped-ad>:]<member-ad> ...]": unable to find AttributeDescription #0 "member+memberOf@groupOfNames"#012. " on startup and stopping immediately. I suppose it needs some schema extension but of what I don't understand and neither will I have a trigger objectClass unless I could just use inetOrgPerson as trigger and have it work. Is there a way to get back "synthetic" memberOf entries on static user records (which are inetOrgPerson) with static groups (which are groupOfNames) on openldap 2.4.49 without adding any special attributes into users and/or groups themselves ? Kind regards, René -- rene.gallati(a)ergon.ch T +41 44 268 83 10 Ergon Informatik AG, Merkurstrasse 43, CH-8032 Zürich www.ergon.ch smart people – smart software * * * * * * * * * * * * * * * * * * * * * * * * * DELIVERING TECHNOLOGY ADVANTAGE SINCE 1984

2 5

changes in own schema in multi provider setup
by Stefan Kania 17 May '22

17 May '22

Good morning, we having a own schema with a lot of own attributes. We have a multi provider replication of cn=config. What is the right way to add a new attribute to our schema and get it into the configuration? Stefan

2 1

Can a Bind result in a Referral?
by Mike Stevens 16 May '22

16 May '22

Good day. I’m an LDAP novice and am attempting to modify an LDAP client to accommodate an LDAP server environment that makes use of referrals. I have installed openLDAP 2.4.44 on 2 RHEL 7.9 servers. The initial entries in the tree on serverA contains : # xxx.com dn: dc=xxx,dc=com description: xxx.com dc: xxx o: xxx.com objectClass: top objectClass: dcObject objectClass: organization # Users, xxx.com dn: ou=Users,dc=xxx,dc=com ou: Users description: xxx Users objectClass: organizationalUnit # search reference *ref: ldap://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com??sub <http://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com??sub>* # mike, Users, xxx.com dn: uid=mike,ou=Users,dc=xxx,dc=com cn: mike ou: Users uid: mike givenName: Mike mail: mike(a)uk.xxx.com objectClass: Person objectClass: organizationalPerson objectClass: inetOrgPerson I believe the "ref" entry is known as a subordinate referral; it was created by populating the tree from an LDIF file that contained the following: dn: dc=uk,dc=xxx,dc=com objectClass: referral objectClass: extensibleObject dc: uk ref: ldap://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com The intent is to redirect any requests received by serverA that refer to the subtree uk.xxx.com to serverB. The tree on serverB contains: # xxx.com dn: dc=xxx,dc=com description: xxx.com dc: xxx o: xxx.com objectClass: top objectClass: dcObject objectClass: organization # uk.xxx.com dn: dc=uk,dc=xxx,dc=com dc: uk o: uk.xxx.com description: xxx Users in the UK objectClass: dcObject objectClass: organization # mike, uk.xxx.com dn: uid=mike,dc=uk,dc=xxx,dc=com cn: mike uid: mike givenName: Mike mail: mike(a)uk.xxx.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson Now, if I perform a search on serverA specifying a base of uk.xxx.com, I get an RC=10 Referral result as expected: [root@serverA ~]# ldapsearch -x '(uid=mike)' -b dc=uk,dc=xxx,dc=com -LL version: 1 Referral (10) Matched DN: dc=uk,dc=xxx,dc=com Referral: ldap://serverB.xxx.com:389/dc=uk,dc=xxx,dc=com??sub ... and I can chase that referral using the -C option to retrieve the entry from serverB: [root@Mike21 ~]# ldapsearch -x '(uid=mike)' -b dc=uk,dc=ibm,dc=com -LL -C version: 1 dn: uid=mike,dc=uk,dc=xxx,dc=com cn: mike uid: mike givenName: Mike mail: mike(a)uk.xxx.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson But, if I attempt a bind to serverA using the user that exists in serverB, I get an authentication failure: [root@serverA ~]# ldapsearch -x -b 'dc=uk,dc=xxx,dc=com' -D uid=mike,dc=uk,dc=xxx,dc=com -w passw0rD ldap_bind: Invalid credentials (49) Now, I realise that the failure would be expected as the bind DN doesn't exist at serverA. But I read that every request apart from unbind and abandon can result in a referral. So why doesn't the bind follow the "ref" to serverB? Is that possible and have I not configured my server correctly? Ultimately, what I'd like to do in my client is something like: ld_user = ldap_init( "ldap://serverA:389/dc=uk,dc=xxx,dc=com" , 0 ); ... followed by : err = ldap_simple_bind_s( ld_user, "uid=mike,dc=uk,dc=xxx,dc=com" , password); ... and have LDAP authenticate the given user against serverB based on the referral in serverA. Is this sort of set up possible? Many thanks for your advice, Mike

2 4

issues with kqueue on OpenBSD
by Stuart Henderson 15 May '22

15 May '22

I'm working on updating the OpenBSD port of OpenLDAP to 2.6.2 (it's currently stuck at 2.4.59). In 2.5 kqueue support was added to slapd for BSDs, but it's not working correctly on OpenBSD. If slapd runs as a daemon, errors like these are seen: slap_client_connect: URI=ldaps://XXX Warning, ldap_start_tls failed (1) mdb_opinfo_get: err Invalid argument(22) However if slapd is run in the foreground with -d, things are ok. They are also OK if kqueue is disabled (by neutering the autoconf check) so this isn't blocking me updating the port but I thought I'd write up what I have in case someone has any ideas what might be up or anything they'd like me to try and report back on. Here are some log excerpts: 17:23:44.692: slapd starting 17:23:44.692: daemon: added 3r listener=0x0 17:23:44.692: daemon: added 6r listener=0x100263797200 17:23:44.692: daemon: added 7r listener=0x100263785400 17:23:44.692: daemon: kqueue: listen=6 active_threads=0 tvp=zero 17:23:44.692: daemon: kqueue: listen=7 active_threads=0 tvp=zero 17:23:44.692: daemon: activity on 1 descriptor 17:23:44.692: daemon: activity on: 17:23:44.692: 17:23:44.692: daemon: kqueue: listen=6 active_threads=0 tvp=zero 17:23:44.692: daemon: kqueue: listen=7 active_threads=0 tvp=zero 17:23:44.692: >>> dnNormalize: <cn=Consumer 101> 17:23:44.692: <<< dnNormalize: <cn=consumer 101> 17:23:44.692: =>do_syncrepl rid=101 17:23:44.763: slap_client_connect: URI=ldaps://XXXXXXXXXXXXXXX Warning, ldap_start_tls failed (1) 17:23:44.781: => mdb_entry_get: ndn: "dc=XXXXXXX,dc=XXX" 17:23:44.782: => mdb_entry_get: oc: "(null)", at: "contextCSN" 17:23:44.782: mdb_opinfo_get: err Invalid argument(22) 17:23:44.782: =>do_syncrep2 rid=101 17:23:44.782: daemon: added 9r listener=0x0 17:23:44.783: daemon: activity on 1 descriptor 17:23:44.783: daemon: activity on: 17:23:44.783: 17:23:44.783: daemon: kqueue: listen=6 active_threads=0 tvp=NULL 17:23:44.783: daemon: kqueue: listen=7 active_threads=0 tvp=NULL 17:23:44.800: daemon: activity on 1 descriptor 17:23:44.800: daemon: activity on: 17:23:44.800: 9r 17:23:44.800: 17:23:44.800: daemon: read active on 9 17:23:44.800: daemon: kqueue: listen=6 active_threads=0 tvp=NULL 17:23:44.800: daemon: kqueue: listen=7 active_threads=0 tvp=NULL 17:23:44.800: connection_get(9) 17:23:44.800: connection_get(9): got connid=0 17:23:44.801: =>do_syncrepl rid=101 17:23:44.801: =>do_syncrep2 rid=101 Not sure if it's any help but looking at kdump(1) output after a run under ktrace(1) I didn't spot the immediate problem resulting in "ldap_start_tls failed (1)" however the "mdb_opinfo_get: err Invalid argument(22)" occurs after attempting to call fcntl with F_SETLK on the fd 5 which is the kqueue fd: 65304 slapd RET write 97/0x61 65304 slapd CALL poll(0x89d39cb9004,1,INFTIM) 65304 slapd STRU struct kevent [2] { ident=9, filter=EVFILT_READ, flags=0x1005<EV_ADD|EV_ENABLE>, fflags=0<>, data=0, udata=0x231a1bea } { ident=9, filter=EVFILT_EXCEPT, flags=0x1005<EV_ADD|EV_ENABLE>, fflags=0x4<>, data=0, udata=0x231a1bea } 65304 slapd STRU struct kevent { ident=9, filter=EVFILT_READ, flags=0x1005<EV_ADD|EV_ENABLE>, fflags=0<>, data=36, udata=0x231a1bea } 65304 slapd STRU struct pollfd { fd=9, events=0x3<POLLIN|POLLPRI>, revents=0x1<POLLIN> } 65304 slapd RET poll 1 65304 slapd CALL read(9,0x89ccfb103e0,0x5) 65304 slapd GIO fd 9 read 5 bytes "\^W\^C\^C\0\^_" 65304 slapd RET read 5 65304 slapd CALL read(9,0x89ccfb349c5,0x1f) 65304 slapd GIO fd 9 read 31 bytes "\M^W\M-r\M-f\M^C\M-2\M^V\M-E\^O\M-hdgq\M-"\M-o\M-&\M^[*\M-9\M^E\M-Sd\M^A2\M-QE\M-cb |\M^VI" 65304 slapd RET read 31/0x1f 65304 slapd CALL mmap(0,0x2000,0x3<PROT_READ|PROT_WRITE>,0x1002<MAP_PRIVATE|MAP_ANON>,-1,0) 65304 slapd RET mmap 9468564512768/0x89c926ca000 65304 slapd CALL fcntl(5,F_SETLK,0x8ef465d0) 65304 slapd RET fcntl -1 errno 22 Invalid argument 65304 slapd CALL getpid() 65304 slapd RET getpid 65304/0xff18 65304 slapd CALL sendsyslog(0x89c8ef44040,59,0<>) 65304 slapd GIO fd -1 wrote 59 bytes "<167>slapd[65304]: mdb_opinfo_get: err Invalid argument(22)" Any suggestions would be welcome. Thanks!

2 2

set LDAPI_SOCK
by Michael Ströder 15 May '22

15 May '22

HI! I'm trying to get rid of this old patch by Ralf Haferkamp: https://build.opensuse.org/package/view_file/network:ldap/openldap2/0003-LD… Background: Today Linux distros prefer that you place temporary run-time files in a directory like /run/<service-name> with appropriate ownership and permissions. And also systemd can create a temporary run-time directory on-the-fly and removes it after service stopped. But if I e.g. use configure --runstatedir=/run/slapd the default pathname of the LDAPI socket is /run/slapd/run/ldapi Any way to set LDAPI_SOCK directly during build? Ciao, Michael.

1 0

(Updated) License issue about sleepycat license.
by s1k2c3＠naver.com 13 May '22

13 May '22

[박주현 / Ju Hyun Park] 2022-05-13 18:27 I am sorry I change my question like below... I just wonder license issue about sleepycat license. In sleepycat License, "Redistributions in any form must be accompanied by information on how to obtain complete source code for the DB software and any accompanying software that uses the DB software." I do not know " any accompanying software that uses the DB software" When commercial SW uses OpenLDAP and OpenLDAP uses BDB, commercial SW should be disclosed? What was user's obligation? I want to know about it exactly about sleepycat License. This SW does not link with OpenLDAP directy.. For example, SW using GPL Licese does not need to disclose source code of SW, because it executes on seperate process. How about OpenLDAP? When SW connect to OpenLDAP on seperate process, source code of SW should be disclosed? please do not care about deprecated version.. I just want to know about Sleepycat License.. Thank you.

3 3

question on replica IDs
by A. Schulze 13 May '22

13 May '22

Hello, I'm running a Cluster of 4 Servers of openldap-2.6.1 ServerID 1 ldaps://member1.example/ ServerID 2 ldaps://member2.example/ ServerID 3 ldaps://member3.example/ ServerID 4 ldaps://member4.example/ syncrepl rid=1 provider=ldaps://member1.example/ syncrepl rid=2 provider=ldaps://member2.example/ syncrepl rid=3 provider=ldaps://member3.example/ syncrepl rid=4 provider=ldaps://member4.example/ multiprovider on the servers 1 and 2 are offline since a week or so. Now I like to remove servers 1 and 2 finally to fall back to a cluster of two members. The new config will look this way: ServerID 1 ldaps://member3.example/ ServerID 1 ldaps://member4.example/ syncrepl rid=1 provider=ldaps://member3.example/ syncrepl rid=2 provider=ldaps://member4.example/ multiprovider on Is this change of ID numbers a potential source of trouble? Andreas

2 3

BDB and License
by s1k2c3＠naver.com 12 May '22

12 May '22

Hi I want to use OpenLDAP.(GitHub - openldap/openldap: Mirror of OpenLDAP repository, The OpenLDAP Public License Version 2.8) OpenLDAP uses berkeley DB 5.3.21. In addition,, openLDAP version is 2.4.49. 1. Berkeley DB(BDB) 5.3.21 is sleepycat license, right? 2. When I use OpenLDAP, should I disclose source code of commercial SW? or Can I use OpenLDAP without disclosing source code of commercial SW? 3. When I do not link with OpenLDAP directly. I connect to another open source without link such as http, jmx etc and it connects to OpenLDAP, should I disclose source code of commercial SW? 4. When I distribute commercial SW using OpenLDAP, should I use sleepycat license for berkeley DB or should I purchase BDB? Thank you.

2 1

upgrade from Debian 2.4.x
by Udo Rader 09 May '22

09 May '22

Hi, we've been long using OpenLDAP as a backbone for almost everything (users, groups, DNS, DHCP, ...) and we've finally reached the point where we want or better NEED to migrate away from the vanilla debian packages. This is mostly due to the fact that our sync-repl based replication loses data every now and then, which is a real pain to detect and then to fix. So, as far as I understand, our best bet is to migrate to the latest packages from Symas :) However, I think to remember a discussion about the membersOf overlay not working reliably with sync-repl even with the Symas packages. Is this correct and if so, what would be the best way to have membersOf functionality? And, what would be the best way to upgrade? Are the symas packages just a drop in replacement from the debian packages or is better to start from scratch and import the LDAP tree? Thanks Udo -- Udo Rader, MBA, CTO BestSolution.at EDV Systemhaus GmbH Salurner Straße 15, A-6020 Innsbruck http://www.bestsolution.at/ Reg. Nr. FN 222302s am Firmenbuchgericht Innsbruck

2 1

RE Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs
by Dr. Ogg 06 May '22

06 May '22

Any idea when the Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs book will be available on kindle?

1 0

LDAP Proxy
by guillaume.briere＠bell.ca 05 May '22

05 May '22

Hello, Sorry if it has already been asked in the past. We have a use-case and I'm having difficulties to find if openldap could be a good fit for us. Let's say that we have 2 vlan. LDAP and active directory is inside the first vlan. The servers is inside the other vlan. We want to have a "ldap proxy" server inside the server vlan where only this server could communicate with the LDAP and active directory server. This ldap proxy server needs to listen on 3 ports (or could be 3 different instances), example:636,637 and 638 If we hit the port 636: The user password needs to be validate against the active directory and the user's membership needs to be validate against the LDAP server If we hit the port 637: The user password and user's group membership needs to be validate against LDAP If we hit the port 638: The user password and user's membership needs to be validate against Active Directory The LDAP server and ldap proxy would be openldap. Thanks in advance

1 0

Win32 file size
by Søren Holm 05 May '22

05 May '22

Hi Mapsize on windows apparently creates a database file of the exact size of map-size. This is inconvenient. But I can see that Howard has been nice and done the commit below back in 2015 - it is not in any tag however. What are your recommendations - is mdb.master safe for productions? commit fb5a768a77ca5330e15a3a34ceb694bc11cb216a Author: Howard Chu <hyc(a)openldap.org> Date: Mon Nov 30 18:46:19 2015 +0000 ITS#8324 incremental DB file growth for Windows

1 0

Re: Migrating from Debian 6 to Ubuntu 20
by Tan Mientras 04 May '22

04 May '22

just figure it out whats going on: a comment line (starting with #) in the middle of a ACL breaks the ACL. On Tue, May 3, 2022 at 11:52 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, May 3, 2022 10:05 AM +0200 Tan Mientras > <tanimientras(a)gmail.com> wrote: > > > > > > > OLD SERVER:ii ldap-utils > > 2.4.23-7.3 OpenLDAP utilities > > ii ldapscripts 1.9.0-2 > > Add and remove user and groups (stored in a LDAP > > directory) > > ii libldap-2.4-2 2.4.23-7.3 > > OpenLDAP libraries > > ii libnet-ldap-perl 1:0.4001-2 > > client interface to LDAP servers > > ii libnss-ldap 264-2.2 > > NSS module for using LDAP as a naming service > > ii libpam-ldap 184-8.5 > > Pluggable Authentication Module for LDAP > > > > ii postfix-ldap 2.7.1-1+squeeze1 > > LDAP map support for Postfix > > > > > > vs > > > > > > NEW SERVER: > > > > ii ldap-utils > > 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP > > utilities > > ii ldapscripts 2.0.8-1ubuntu1 > > all Add and remove users and > > groups (stored in a LDAP directory) > > ii libldap-2.4-2:amd64 > > 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP > > libraries > > ii libldap-common > > 2.4.49+dfsg-2ubuntu1.8 all OpenLDAP > > common files for libraries > > None of the above shows what the slapd version is, but I'll assume 2.4.23 > to 2.4.49. Are you using the exact same OpenLDAP slapd.conf with both? > > Regards, > Quanah > > > >

1 0

Re: Migrating from Debian 6 to Ubuntu 20
by Tan Mientras 03 May '22

03 May '22

OLD SERVER: ii ldap-utils 2.4.23-7.3 OpenLDAP utilities ii ldapscripts 1.9.0-2 Add and remove user and groups (stored in a LDAP directory) ii libldap-2.4-2 2.4.23-7.3 OpenLDAP libraries ii libnet-ldap-perl 1:0.4001-2 client interface to LDAP servers ii libnss-ldap 264-2.2 NSS module for using LDAP as a naming service ii libpam-ldap 184-8.5 Pluggable Authentication Module for LDAP ii postfix-ldap 2.7.1-1+squeeze1 LDAP map support for Postfix vs NEW SERVER: ii ldap-utils 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP utilities ii ldapscripts 2.0.8-1ubuntu1 all Add and remove users and groups (stored in a LDAP directory) ii libldap-2.4-2:amd64 2.4.49+dfsg-2ubuntu1.8 amd64 OpenLDAP libraries ii libldap-common 2.4.49+dfsg-2ubuntu1.8 all OpenLDAP common files for libraries On Fri, Apr 29, 2022 at 5:16 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, April 29, 2022 3:06 PM +0200 Tan Mientras > <tanimientras(a)gmail.com> wrote: > > > > > > > Hello. > > > > > > Trying to migrate our ldap from one server to a new one I did: > > What OpenLDAP release was the old server running? What OpenLDAP release is > the new server running? > > --Quanah > > > >

2 1

LMDB compaction
by Søren Holm 03 May '22

03 May '22

Hi I know that LMDB currently does not support compaction, but I'm interested in knowing if such a feature is being worked on. And if not, is it a feature that can be merged into LMDB if implemented? /Søren Holm

2 4

cannot use RootDN to modify cn=config: Insufficient access
by butterfly-cry＠qq.com 02 May '22

02 May '22

Hi guys, I have google a lot to modify cn=config but all failed. Hope someone can help. Thanks. [openldap2.6.1 CentOS7.9] My initial ldif is like below: `[root@rayc01 openldap]# more slapd.ldif |grep -v ^# dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /usr/local/openldap-2.6.1/var/run/slapd.args olcPidFile: /usr/local/openldap-2.6.1/var/run/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/openldap-2.6.1/libexec/openldap olcModuleload: back_mdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/core.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/collective.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/corba.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/cosine.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/dsee.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/duaconf.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/dyngroup.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/inetorgperson.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/java.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/misc.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/namedobject.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/nis.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/openldap.ldif include: file:///usr/local/openldap-2.6.1/etc/openldap/schema/pmi.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=domain,dc=com olcRootDN: cn=root,dc=domain,dc=com olcRootPW: {SSHA}N/Zg9jqjoL1E4xEHc1dGdyTzZiOlEsrs olcDbDirectory: /usr/local/openldap-2.6.1/var/openldap-data olcDbIndex: objectClass eq dn: olcDatabase=monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: monitor olcRootDN: cn=config olcMonitoring: FALSE [root@rayc01 openldap]# ` After import by slapadd and after slapd start, i can add my ou with cn=root by ldapadd. like below: `[root@rayc01 ~]# more base.ldif dn: dc=domain,dc=com dc: domain objectClass: top objectClass: domain dn: ou=People,dc=domain,dc=com objectClass: organizationalUnit ou: People dn: ou=Group,dc=domain,dc=com objectClass: organizationalUnit ou: Group dn: ou=Mounts,dc=domain,dc=com objectClass: organizationalUnit ou: Mounts` But when I try to modify olcLogLevel and olcIdleTimeout in cn=config, I get errors: [root@rayc01 ~]# more log.ldif dn: cn=config changeType: modify replace: olcIdleTimeout olcIdleTimeout: 60 dn: cn=config changeType: modify replace: olcLogLevel olcLogLevel: 256 [root@rayc01 ~]# ldapmodify -Y external -H ldapi:/// -f 1.ldif ldap_sasl_interactive_bind: Can't contact LDAP server (-1) [root@rayc01 ~]# ldapmodify -x -D cn=root,dc=domain,dc=com -w "xxx@123" -f log.ldif modifying entry "cn=config" ldap_modify: Insufficient access (50) [root@rayc01 ~]# ldapmodify -x -D cn=config -f log.ldif ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed [root@rayc01 ~]# [root@rayc01 ~]# more 1.ldif dn: olcDatabase={0}config,cn=config #olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=r oot,dc=huawei,dc=com" read by * none [root@rayc01 ~]# ldapmodify -Y external -H ldapi:/// -f 1.ldif ldap_sasl_interactive_bind: Can't contact LDAP server (-1) [root@rayc01 ~]#

3 6

RE26 testing call #2 (OpenLDAP 2.6.2)
by Quanah Gibson-Mount 02 May '22

02 May '22

This is the second testing call for OpenLDAP 2.6.2. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Fixes since last testing call: ITS#9802 (further fixes) ITS#9820 ITS#9825 ITS#9831 ITS#9832 Thanks! OpenLDAP 2.6.2 Engineering Added libldap support for OpenSSL 3.0 (ITS#9436) Added slapd support for OpenSSL 3.0 (ITS#9436) Fixed ldapdelete to prune LDAP subentries (ITS#9737) Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd to correctly init global_host earlier (ITS#9787) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd idletimeout handling (ITS#9820) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd to correctly advance connections index (ITS#9831) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Fixed slapd-monitor crash when hitting sizelimit (ITS#9832) Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) Added slapo-otp support for OpenSSL 3.0 (ITS#9436) Fixed slapo-dynlist dynamic group regression (ITS#9825) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Fixed slapo-translucent to correctly duplicate substring filters (ITS#9818) Build Enviornment Add ability to override default compile time paths (ITS#9675) Fix compiliation with certain versions of gcc (ITS#9790) Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Contrib Update ppm module to the 2.1 release (ITS#9814) Documentation admin26 Document new lloadd features (ITS#9780) Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804) Fixed slapd-sock(5) to clarify "sockresps result" behavior (ITS#8255)

2 4

How to allow openldap searches for all just one group
by gerson.garcia＠itron.com 02 May '22

02 May '22

All, I am inheriting the support of small openldap deployment and I am new to it. I have a request to create a security group to this implementation and only users in this group should have access to manage objects in the ldap. We have something like this: +-dc=nocinbox,dc=com +---ou=groups +---cn=admin +---cn=app-admin +---cn=sec-admin +---ou=users +---cn=admin +---cn=appadmin +---cn=appadmin2 +---cn=secadmin In the olcDatabase configuration I have the following: olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.subtree="dc=nocinbox,dc=inc" by set="[cn=sec-admin,ou=groups,dc=nocinbox,dc=inc]/memberUid & user/uid" write by * read And only secadmin can make changes in the LDAP, that is great. However, all other users can ldapsearch: $ ldapsearch -x -v -H ldaps://openldap:636 -b "dc=nocinbox,dc=inc" -D "cn=admin,ou=users,dc=nocinbox,dc=inc" -W | grep numResponses ldap_initialize( ldaps://openldap:636/??base ) Enter LDAP Password: filter: (objectclass=*) requesting: All userApplication attributes # numResponses: 29 Is there any olcAccess configuration I can used to not allow any user to run ldapsearch but still able to authenticate them? They still need to ssh and access some web servers. Thank you very much, Gerson

3 4

Could not find admin user after setup slapd on Debian
by sparkcyf＠foxmail.com 30 Apr '22

30 Apr '22

After install the openldap (slapd) from Debian package repository (using the version 2.4.57+dfsg-3~bpo10+1, database created by the dpkg configuration script provide by apt), the admin user (cn=admin,dc=example,dc=com) in could not be found either when performing ldapsearch or viewing the structure of the organisation in phpldapadmin / Apache directory studio. result of ldapsearch: ------------ root@ldap:~# ldapsearch -x -b "dc=example,dc=com" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: example.com dc: exmaple # search result search: 2 result: 0 Success ------------ However, using ldapwhoami (ldapwhoami -vvv -h ldap.example.com -D cn=admin,dc=example,dc=com -x -w password) can return a successful result. result of ldapwhoami: ------------ ldap_initialize( ldap://localhost ) dn:cn=admin,dc=example,dc=com Result: Success (0) ------------ A similar issue can be found here: https://github.com/osixia/docker-openldap/issues/555 on Github. According to the user in Github, this issue is first occurred in openldap 2.4.57 (https://github.com/osixia/docker-openldap/releases/tag/v1.5.0 I'm not sure whether it is a feature or a bug of slapd. Thanks in advance!

5 8

Migrating from Debian 6 to Ubuntu 20
by Tan Mientras 29 Apr '22

29 Apr '22

Hello. Trying to migrate our ldap from one server to a new one I did: old-server# slapcat -f /etc/ldap/slapd.conf > ldap.txt new-server# slapadd -f /etc/ldap/slapd.conf -l ldap.txt (yes, I'm still using legacy configuration format) Migration seems fine and tree is visible and valid using phpldapadmin, however third party applications aren't login-in/integrating with the new server. I have narrowed it to this: - querying with admin user works in both servers - ldapsearch -x -h old-server -b "dc=domain,dc=root" -D "uid=query,ou=people,dc=domain,dc=root" -W works and, password provided, it returns results - ldapsearch -x -h new-server -b "dc=domain,dc=root" -D "uid=query,ou=people,dc=domain,dc=root" -W results in *result: 32 No such object *(so login works, but the query user cant find results) Did I miss something for migration? a required step apart from copying configuration files and slapcat+slapadd? Thanks in advance

2 1

slapd (Symas 2.6.1) does not start with syncprov
by Magnus Morén 28 Apr '22

28 Apr '22

Migrating to new ldap server and getting problems. OS: Rocky Linux 8 (== RHEL/CentOS 8). Fully updated. LDAP software: symas-openldap-servers-2.6.1-2.el8.x86_64 cn=config and and data import (via ldif) on master. Everything look good. start/stop/restart is working. ldap access is working. Adding "syncprov" on master (to enable producer/consumer mode). Now the slapd on the master/producer crashes on start! Apr 26 18:31:27 apollo11 systemd[1]: Started Symas OpenLDAP Server Daemon. Apr 26 18:31:27 apollo11 kernel: traps: slapd[1379] general protection fault ip:7fa53a499f38 sp:7fa4f8e3d1b0 error:0 in back_mdb.so.2.0.200[7fa53a471000+40000] Apr 26 18:31:27 apollo11 systemd[1]: Started Process Core Dump (PID 1380/UID 0). Apr 26 18:31:27 apollo11 systemd-coredump[1381]: Resource limits disable core dumping for process 1377 (slapd). Apr 26 18:31:27 apollo11 systemd-coredump[1381]: Process 1377 (slapd) of user 0 dumped core. Apr 26 18:31:27 apollo11 systemd[1]: symas-openldap-servers.service: Main process exited, code=killed, status=11/SEGV Apr 26 18:31:27 apollo11 systemd[1]: symas-openldap-servers.service: Failed with result 'signal'. Apr 26 18:31:27 apollo11 systemd[1]: systemd-coredump(a)3-1380-0.service: Succeeded. The syncprov ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov.la dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryCSN,entryUUID eq Magnus Morén

5 12

RE25 Testing call #2 (OpenLDAP 2.5.12)
by Quanah Gibson-Mount 27 Apr '22

27 Apr '22

This is the second testing call for OpenLDAP 2.5.12. Depending on the results, this may be the final testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Fixes since last testing call: ITS#9802 (further fixes) ITS#9820 ITS#9825 ITS#9831 Thanks! OpenLDAP 2.5.12 Engineering Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd idletimeout handling (ITS#9820) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd to correctly advance connections index (ITS#9831) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Fixed slapo-dynlist dynamic group regression (ITS#9825) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Fixed slapo-translucent to correctly duplicate substring filters (ITS#9818) Build Environment Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Fix compiliation with certain versions of gcc (ITS#9790) Documentation Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804)

2 1

OpenLDAP 2.5 and smbkrb5pwd module
by Abdelkader Chelouah 25 Apr '22

25 Apr '22

I used to build *smbkrb5pwd* module (https://github.com/opinsys/smbkrb5pwd) under OpenLDAP 2.4 and everything was working as expected. Starting from OpenLDAP 2.5, building the module still succeeds but an error 80 occurs when the module is loaded ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 modifying entry "cn=module{0},cn=config" 2022-04-22T08:50:40.501922+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71 2022-04-22T08:50:40.501945+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000066 text= 2022-04-22T08:50:40.502151+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=1 MOD dn="cn=module{0},cn=config" 2022-04-22T08:50:40.502181+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=1 MOD attr=olcModuleLoad 2022-04-22T08:50:40.503892+00:00 arrakis slapd-2.5-aa[8947]: lt_dlopenext failed: (smbkrb5pwd_srv.la) file not found 2022-04-22T08:50:40.503923+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=1 RESULT tag=103 err=80 qtime=0.000006 etime=0.001772 text=<olcModuleLoad> handler exited with 1 2022-04-22T08:50:40.504117+00:00 arrakis slapd-2.5-aa[8947]: conn=1026 op=2 UNBIND (the error message is misleading since file *smbkrb5pwd_srv.la* is really in the modules directory) I'm wondering if someone has experienced the same issue and was able to overcome it ? Regards

3 5

OPENLDAP client API option to capture the communication traces in a file
by chou.ravin177＠gmail.com 25 Apr '22

25 Apr '22

How client can leverage this LBER_OPT_LOG_PRINT_FILE option to redirect the log to the file? I had tried setting this option after ldap_initalize from the client end. But still, I couldn't get any traces in the supplied logfile. The traces works fine in the console mode with DEBUG_OPENLDAP. But they seem not to be working with this. Could you suggest any other approach or configuration which can be used to capture the underlying OpenLDAP communication from the client-side? @hyc/@openldap-technical-owner@openldap.org: Would appreciate it if you can share any thoughts?

1 0

Attempting to build docker image with symas RPMs
by thomaswilliampritchard＠gmail.com 25 Apr '22

25 Apr '22

I tried searching before posting but was getting a gateway timeout - apologies if this was answered previously. I am attempting to build a docker image from debian using symas RPMs to facilitate local testing. I am new to RPMs / Linux Package Management so forgive me if this is an obvious answer. ``` FROM debian:buster RUN apt update RUN apt install --yes --quiet wget RUN apt install --yes --quiet gnupg RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys DA26A148887DCBEB RUN wget -q https://repo.symas.com/configs/SOLDAP/d10/release25.list -O /etc/apt/sources.list.d/soldap-release25.list RUN apt update RUN apt install symas-openldap-clients symas-openldap-server RUN rm --force --recursive /var/lib/apt/lists/* ``` This fails on the symas-openldap-clients and symas-openldap-server installation with #11 0.600 E: Unable to locate package symas-openldap-clients #11 0.600 E: Unable to locate package symas-openldap-server If I skip that step I can build and sanity check the debian version ``` root@fc0489d57cd4:/# cat /etc/issue Debian GNU/Linux 10 \n \l ``` Any advice how to make this work for Debian? Is it possible to make this work for centos7 image? I understand symas only publishes for RHEL but curious if centos7 can work with the REHL repo information. I was unable to get it to work failing with a similar issue.

4 7

Re: SASL Authentication Pass-through
by Quanah Gibson-Mount 21 Apr '22

21 Apr '22

--On Monday, April 11, 2022 7:23 PM +0000 Dean Lewis <deanlewis(a)nexus-people.com> wrote: > > > If I had a choice, I wouldn't be using this version at all. As with most > packages, I'd run the very latest. But I don't have a choice here so this > question is about getting pass-through auth working with OpenLDAP 2.4 and > AD. > > > If that's possible, what am I missing in the configuration? No idea. Remoteauth was written because of a number of issues around using SASL passthrough. If your OpenLDAP servers are running RedHat (or derivatives), Debian, or Ubuntu, there are freely available options that allow you to be using current releases of OpenLDAP, such as the LTB project and the builds from Symas. Regards, Quanah

2 4

issues configuring SASL EXTERNAL and proxyauth with chain used for ppolicy_forward_updates
by Kartik Subbarao 18 Apr '22

18 Apr '22

I have a consumer server (2.4.57) that successfully forwards pwdFailureTime modifications to the master server using GSSAPI authentication. I want to replace GSSAPI with certificate-based (SASL EXTERNAL) authentication along with proxy authorization. Basically, I want to configure the equivalent of the following command line: LDAPTLS_KEY=server.key LDAPTLS_CERT=server.crt \ ldapmodify -Z -Y EXTERNAL \ -e '!authzid=dn:cn=proxydn,dc=example,dc=com' -e relax \ -h ldap-master.example.com -f update_pwdfailuretime.ldif The command line works as expected -- it authenticates successfully using the server certificate, and then does PROXYAUTHZ to cn=proxydn,dc=example,dc=com to perform the modify operation. The issue is when I try to configure this behavior with chain on the consumer server. I've tried various incantations along these lines: chain-idassert-bind bindmethod=SASL saslmech=EXTERNAL tls_cert=server.crt tls_key=tls.key authzId=dn:cn=proxydn,dc=example,dc=com The SASL EXTERNAL authentication works fine -- It binds to the master with the DN mapped from the certificate's subject. But it doesn't do the proxyauthz to cn=proxydn,dc=example,dc=com. I've read through the docs in detail and tried various modes, flags and other settings, but I can't get it to do the proxy authz. Does anyone have a known working config for this kind of setup that they can share? Otherwise, any suggestions on the best way to troubleshoot this further would be great. Thanks, -Kartik

4 5

Re: Understanding bind_anon_dn and update_anon
by Dave Macias 18 Apr '22

18 Apr '22

> > What you want is not possible with a simple bind (bind as a user without > providing a password). You could use something like client certificate > authentication (SASL/EXTERNAL). > > Regards, > Quanah > Thank you for the explanation! Appreciate it I'll explore this route. Best, Dave

1 0

Parameter for choosing algorithm in module "argon2.la"
by Juergen.Sprenger＠swisscom.com 18 Apr '22

18 Apr '22

Hi, Currently I am trying to use argon2 password hashes with OpenLDAP 2.6.1. Everything works fine so far, but I can't get module argon2.la to create argon2id hashes. In argon2 command is a switch to use Argon2id instead of Argon2i: echo -n "password" | argon2 somesalt -id -e $argon2id$v=19$m=4096,t=3,p=1$c29tZXNhbHQ$qLml5cbqFAO6YxVHhrSBHP0UWdxrIxkNcM8aMX3blzU slappasswd -o module-load="argon2.la" -h {ARGON2} -s password {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$P3r67PwtSB5fq2JvTaGZfw$WNup4MZcRkvGwIVWFKjU92nHiM/vu6DUTnSOVpLYwVM Is it possible to use choose between argon2i, argon2d and argon2id in that library? Regards Juergen Sprenger

2 1

Understanding bind_anon_dn and update_anon
by Dave Macias 18 Apr '22

18 Apr '22

Hello, Running: 2.6.1 Looking at the slapd.conf man page we have this interesting paragraph: *bind_anon_cred allows anonymous bind when credentials are not empty (e.g. when DN is empty). bind_anon_dn allows unauthenticated (anonymous) bind when DN is not empty. update_anon allows unauthenticated (anonymous) update operations to be processed (subject to access controls and other administrative limits).* *My goal is to have a dn who is a memberof a group to be able to add/edit/deletes (write) operations to a subtree by only using the binddn (no password).* I have no issues with the below acl when we ldapmodify/delete/add with binddn+password *olcAccess: {2}to dn.subtree="ou=dns,dc=example,dc=net" filter="(!(|(idnsName=*'.')(objectClass=organizationalUnit)))" by dn="cn=dnsmanager,dc=example,dc=net" write by group.expand="cn=dns,ou=group,dc=example,dc=net" write by * read* I added the below to my* dn: cn=config* *olcAllows: bind_anon_dnolcAllows: update_anon* Since I still could not make any write operations with simple binddn I changed the ACL to below. (adding anonymous write) olcAccess: {2}to dn.subtree="ou=dns,dc=example,dc=net" filter="(!(|(idnsName=*'.')(objectClass=organizationalUnit)))" by dn="cn=dnsmanager,dc=example,dc=net" write by group.expand="cn=dns,ou=group,dc=example,dc=net" write by anonymous write by * read This of course still was not my end goal since I could use a nonexisting binddn to make changes. > ldapsearch -xLLL "filter" dn | awk '{print $NF}' | sed '/^$/d' | ldapdelete -D uid=*someuserthatdoesnotexist*,ou=people,dc=example,dc=net So I'm guessing I'm not understanding or not configuring this correctly. Is it even possible to do this? Any input is appreciated. Thank you, Dave

2 1

MemberOf group in group search not working
by erikdewaard＠gmail.com 16 Apr '22

16 Apr '22

Hi, On openldap 2.5.11 I have some weird behavior with group in group searches using memberOf. #Working # ldapsearch -LLL -H ldap:// -x -b 'dc=example,dc=com' '(uid=user5)' memberOf dn: uid=user5,ou=People,dc=example,dc=com memberOf: cn=groupingroup,ou=groups,dc=example,dc=com #Working # ldapsearch -LLL -H ldap:// -x -b 'dc=example,dc=com' '(uid=user1)' memberOf dn: uid=user1,ou=People,dc=example,dc=com memberOf: cn=group1,ou=groups,dc=example,dc=com memberOf: cn=groupingroup,ou=groups,dc=example,dc=com Now the weird behavior part when querying if user1 is indeed a memberOf groupingroup i sometimes get 0 results, need to query multiple times before i indeed get the correct answer. # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user1)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid dn: uid=user1,ou=People,dc=example,dc=com uid: user1 user5 completely fell of the map. # ldapsearch -H ldap:/// -LLL -x -b 'dc=example,dc=com' '(&(uid=user5)(|(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)))' uid When querying memberOf groupingroup, it looks like its randomly returning just one group. #only returning group2 # ldapsearch -H ldap:// -LLL -x -b 'dc=example,dc=com' "(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)" uid dn: uid=user3,ou=People,dc=example,dc=com uid: user3 dn: uid=user4,ou=People,dc=example,dc=com uid: user4 dn: cn=group1,ou=Groups,dc=example,dc=com dn: cn=group2,ou=Groups,dc=example,dc=com #only returning group1 # ldapsearch -H ldap:// -LLL -x -b 'dc=example,dc=com' "(memberOf=cn=groupingroup,ou=groups,dc=example,dc=com)" uid dn: uid=user1,ou=People,dc=example,dc=com uid: user1 dn: uid=user2,ou=People,dc=example,dc=com uid: user2 dn: cn=group1,ou=Groups,dc=example,dc=com dn: cn=group2,ou=Groups,dc=example,dc=com --conf # stand-alone slapd config include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/dyngroup.schema # allow big PDUs from anonymous (for testing purposes) sockbuf_max_incoming 4194303 moduleload back_ldap moduleload dynlist ####################################################################### # database definitions ####################################################################### database config database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap lastbind off overlay dynlist dynlist-attrset groupOfURLs memberURL uniqueMember+memberOf@groupOfUniqueNames* database monitor --conf --data dn: dc=example,dc=com structuralObjectClass: domain dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=com structuralObjectClass: organizationalUnit ou: People objectClass: top objectClass: organizationalUnit dn: ou=Groups,dc=example,dc=com ou: Groups structuralObjectClass: organizationalUnit objectClass: organizationalUnit objectClass: top dn: uid=user1,ou=People,dc=example,dc=com displayName: User 1 cn: User 1 loginShell: /bin/bash uidNumber: 2001 gidNumber: 3000 homeDirectory: /home/user1 mail: user1(a)example.com uid: user1 sn: user1 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user2,ou=People,dc=example,dc=com displayName: User 2 cn: User 2 loginShell: /bin/bash uidNumber: 2002 gidNumber: 3000 homeDirectory: /home/user2 mail: user2(a)example.com uid: user2 sn: user2 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user3,ou=People,dc=example,dc=com displayName: User 3 cn: User 3 loginShell: /bin/bash uidNumber: 2003 gidNumber: 3000 homeDirectory: /home/user3 mail: user3(a)example.com uid: user3 sn: user3 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user4,ou=People,dc=example,dc=com displayName: User 4 cn: User 4 loginShell: /bin/bash uidNumber: 2004 gidNumber: 3000 homeDirectory: /home/user4 mail: user4(a)example.com uid: user4 sn: user4 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: uid=user5,ou=People,dc=example,dc=com displayName: User 5 cn: User 5 loginShell: /bin/bash uidNumber: 2005 gidNumber: 3000 homeDirectory: /home/user5 mail: user5(a)example.com uid: user5 sn: user5 structuralObjectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount dn: cn=group1,ou=Groups,dc=example,dc=com cn: group1 gidNumber: 3001 objectClass: groupOfUniqueNames objectClass: top objectClass: posixGroup ou: group1 structuralObjectClass: groupOfUniqueNames uniqueMember: uid=user1,ou=People,dc=example,dc=com uniqueMember: uid=user2,ou=People,dc=example,dc=com dn: cn=group2,ou=Groups,dc=example,dc=com cn: group2 gidNumber: 3002 objectClass: groupOfUniqueNames objectClass: top objectClass: posixGroup ou: group2 structuralObjectClass: groupOfUniqueNames uniqueMember: uid=user3,ou=People,dc=example,dc=com uniqueMember: uid=user4,ou=People,dc=example,dc=com dn: cn=groupingroup,ou=Groups,dc=example,dc=com cn: groupingroup gidNumber: 3003 objectClass: groupOfUniqueNames objectClass: top objectClass: posixGroup ou: groupingroup structuralObjectClass: groupOfUniqueNames uniqueMember: uid=user5,ou=People,dc=example,dc=com uniqueMember: cn=group1,ou=Groups,dc=example,dc=com uniqueMember: cn=group2,ou=Groups,dc=example,dc=com

4 5

inplace modification of objectclasses?
by Ede Wolf 12 Apr '22

12 Apr '22

Hello again, I am wondering, wether it is possible, to replace/overwrite an item without changing its index number, or wether for this case I do have to manually edit the schema.ldif (and thereby ruin the CRC)? Assuming I have this example: olcObjectClasses: {4}( 1.1.1 NAME 'myoc' DESC 'My objectclass' SUP top ABSTRACT MAY ( myAttribute ) ) olcObjectClasses: {5}( 1.1.2 NAME 'myotheroc' DESC 'My other objectclass' SUP myoc STRUCTURAL MUST ( myotherAttribute ) ) So the lower one(5) depends upon the preceeding one (4). Now I would like to modify the first (4) objectclass definition to f.e. MUST (myAttribute). Using ldapmodify the classical way: delete: olcObjectClasses olcObjectClasses: (1.1.1....old) - add: olcObjectClasses olcObjectClasses: (1.1.1....new) does of course not work, as it will get a new, higher index and therefore any subsequential startup of openldap will fail, as our current index 5 has a reference to an objectclass that now however comes later and has an index of f.e. 17. However, I have not been able to figure out, how to use "replace: olcObjectClasses" to only replace a single instance and keep it in place. Therefore I am wondering, is there a way to use ldapmodify, or any other tool, to modify entries without changing the index, that in turn of course would break ldif? Thanks Ede

2 2

ppolicy related migration issues
by Ede Wolf 12 Apr '22

12 Apr '22

Hello I am having issues migrating my configdb from 2.4.57 to 2.6.1. The issue being the ppolicy schema, that upon import claims a duplicate attribute type, that I cannot track down. A recursive grep does not reveal the attribute oid anywhere as duplicate. This happens with a 2.6.0 instance on alpine as well as with 2.6.1 on arch. In addidtion, I can happily import that configdb.ldif into another 2.4.x openldap instance, so I doubt it is corrupt. Coming from a working instance anyway. So I assume, I might have missed some reading, but my search skills did not produce any results. Removing the ppolicy schema part from the config_db.ldif makes the import finish errorfree, but well, but later it is being used. Here is the output of my trying, the oid in question is the "pwdAttribute", but removing just that makes just the next attribute fail. # slapadd -n0 -F /etc/openldap/slapd.d/ -v -l config_db.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}dyngroup,cn=schema,cn=config" (00000001) added: "cn={3}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={4}nis,cn=schema,cn=config" (00000001) added: "cn={5}openldap,cn=schema,cn=config" (00000001) added: "cn={6}pmi,cn=schema,cn=config" (00000001) olcAttributeTypes: value #0 olcAttributeTypes: Duplicate attributeType: "1.3.6.1.4.1.42.2.27.8.1.1" slapadd: could not add entry dn="cn={7}ppolicy,cn=schema,cn=config" (line=396): olcAttributeTypes: Duplicate attributeType: "1.3.6.1.4.1.42.2.27.8.1.1" Closing DB... The slapd.d directory is of course empty before import. Anything I might have missed? Thanks Ede P.S. Most likely well known, as I have not altered it, but here is the offending part alltogether: dn: cn={7}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {7}ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALI TY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALI TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQU ALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALI TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQ UALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQU ALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInt erval' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQU ALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange ' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQU ALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'Loadable module that instantiates "check_password() function' EQUALITY cas eExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFail ure' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.27 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP t op AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AU XILIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdC heckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLoc kout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMu stChange $ pwdAllowUserChange $ pwdSafeModify $ pwdMaxRecordedFailure ) ) structuralObjectClass: olcSchemaConfig

2 2

Re: SASL Authentication Pass-through
by Quanah Gibson-Mount 11 Apr '22

11 Apr '22

--On Monday, April 11, 2022 5:00 PM +0000 Dean Lewis <deanlewis(a)thomas-march.com> wrote: > > Thanks, that sounds like an easier method but I'm running 2.4.47 > unfortunately. I would strongly advise upgrading to OpenLDAP 2.5 or later and using remoteauth for this. Regards, Quanah

1 0

SASL Authentication Pass-through
by t04s＠thomas-march.com 10 Apr '22

10 Apr '22

Hi, Hopefully someone can help. I'm trying to get SASL passthrough working in OpenLDAP to Active Directory. AD is the primary directory but I need Linux users to be able to authenticate to AD (via OpenLDAP) such that they don't have to manage multiple passwords. However, I've set things up as per various guidance (here<https://www.openldap.com/doc/admin21/sasl.html>, here<https://archive.camratus.com/2017/01/24/openldap-lsc-active-directory-sync-…>, here<https://www.ltb-project.org/documentation/sasl_delegation.html> and here<https://www.hellovinoth.com/pass-through-openldap-authentication-using-sasl…>) and it doesn't seem to work for me on Debian 10. After configuring everything I can run the following successfully: ldapsearch -x -H ldap://server.company.com:389 -D cn=ldapbind,cn=Users,DC=company,DC=com -w examplebindpassword -b '' -s base ldapsearch -x -H ldap://server.company.com:389 -D cn=ldapbind,cn=Users,DC=company,DC=com -w examplebindpassword -b "OU=Users,OU=IT,OU=Departments,OU=Group,DC=company,DC=com" "(userPrincipalName=testuser(a)company.com)" ldapsearch -x -H ldap://server.company.com:389 -D "CN=Test User,OU=Users,OU=IT,OU=Departments,OU=Group,DC=company,DC=com" -w exampleuserpassword -b "CN=Test User,OU=Users,OU=IT,OU=Departments,OU=Group,DC=company,DC=com" -s base "(objectclass=*)" These all return the correct results from Active Directory, so this works fine. Finally, I can run: sudo testsaslauthd -u testuser(a)company.com<mailto:grahambrooke@thomas-march.com> -p exampleuserpassword and I get: 0: OK "Success." So finally I create the same user in local OpenLDAP as Test User and add the password as {SASL}testuser(a)company.com<mailto:{SASL}testuser@thomas-march.com> and try to test pass-through authentication to AD: ldapsearch -x -H ldap://localhost -b dc=testing-prod,dc=com -D uid=testuser,ou=users,dc=testing-prod,dc=com -w exampleuserpassword But this doesn't work. I get the error: ldap_bind: Invalid credentials (49) So SASL passthrough just isn't working and it isn't reading the password attribute as such because if I do: ldapsearch -x -H ldap://localhost -b dc=testing-prod,dc=com -D uid=testuser,ou=users,dc=testing-prod,dc=com -w {SASL}testuser(a)company.com This returns the local LDAP user. So it's reading the password literally as a password instead of interpreting it as SASL passthrough to AD. Have I missed some steps here? What am I missing? I have checked that --enable-spasswd has been compiled in by running ldd /usr/sbin/slapd: linux-vdso.so.1 (0x00007ffcbd7b8000) libldap_r-2.4.so.2 => /lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f3e72bc2000) liblber-2.4.so.2 => /lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007f3e72bb1000) libdb-5.3.so => /lib/x86_64-linux-gnu/libdb-5.3.so (0x00007f3e729f5000) libodbc.so.2 => /lib/x86_64-linux-gnu/libodbc.so.2 (0x00007f3e72785000) libsasl2.so.2 => /lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f3e72768000) libgnutls.so.30 => /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f3e725bb000) libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f3e7257f000) libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f3e72565000) libslapi-2.4.so.2 => /lib/x86_64-linux-gnu/libslapi-2.4.so.2 (0x00007f3e72543000) libltdl.so.7 => /lib/x86_64-linux-gnu/libltdl.so.7 (0x00007f3e72538000) libwrap.so.0 => /lib/x86_64-linux-gnu/libwrap.so.0 (0x00007f3e7252c000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f3e7250b000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3e72349000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3e72344000) libp11-kit.so.0 => /lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f3e72215000) libidn2.so.0 => /lib/x86_64-linux-gnu/libidn2.so.0 (0x00007f3e721f6000) libunistring.so.2 => /lib/x86_64-linux-gnu/libunistring.so.2 (0x00007f3e72072000) libtasn1.so.6 => /lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f3e71e5f000) libnettle.so.6 => /lib/x86_64-linux-gnu/libnettle.so.6 (0x00007f3e71e25000) libhogweed.so.4 => /lib/x86_64-linux-gnu/libhogweed.so.4 (0x00007f3e71dec000) libgmp.so.10 => /lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f3e71d69000) /lib64/ld-linux-x86-64.so.2 (0x00007f3e72dac000) libnsl.so.1 => /lib/x86_64-linux-gnu/libnsl.so.1 (0x00007f3e71d50000) libffi.so.6 => /lib/x86_64-linux-gnu/libffi.so.6 (0x00007f3e71d46000) I can see libsasl2.so.2 there so I think that's fine. And, I've also run both saslauthd and slapd in debug mode but I get no useful output that I can see. It looks like saslauthd and slapd just aren't talking. Any help or pointers are really appreciated. t04s /---

2 1

Official way to import schema with cn=config
by David Timber 05 Apr '22

05 Apr '22

I had to write my own schema for my application and I was struggling to figure out how to import the schema I wrote to cn=config. I had though I was missing something until I found this. https://gist.github.com/jaseg/8577024 Notice the name of the script. Someone had to write this because there's no tool that you can use to import schemas when the slapd is configured with cn=config. You can get away with it by using include directive with slapd.conf. I know there's a way to do it with slaptest, but that method is just unacceptable. So, how I understood is, either you have to use slaptest to rebuild the entirety of the schema in ldif format, or you have to handcraft the schema in ldif by figuring out with {} index to start with. This is all backwards. slapadd and slapmodify are just cranky tools you can only use in specific cases(eg: restoring from mdb_copy backup data). In most cases, using those tools to manipulate cn=config is near impossible. I like the idea behind cn=config, but I believe that calling slapd.conf deprecated is just unfair with problems like these. Is there a set date/version for the drop of support for slapd.conf? I'd like to stick with slapd.conf if it's not going to happen in like 5 years time.

8 23

STARTTLS vs LDAPS
by thomaswilliampritchard＠gmail.com 01 Apr '22

01 Apr '22

At risk of beating a dead horse, I'd like to hear considerations on STARTTLS vs LDAPS. I'm also particularly interested if openldap plans to support LDAPS long term or if there's actually a deprecation effort going on around LDAPS where it would one day no longer be supported by openldap. This seems to be the most comprehensive post discussing the virtue of the two. https://security.stackexchange.com/questions/257749/is-ldaps-or-starttls-mo… I also found a post in this Archive from 2018 that seems to indicate a change of opinion where LDAPS should be preferred, and not deprecated. https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/… Does openldap agree that LDAPS should now be the preferred implementation and STARTLS should be discouraged? I do not have a security background and there is certainly a lot of room for me to misunderstand, but it seems like STARTTLS leaves the door open for a "tls downgrade attack" where a man in the middle could essentially reply to a client effectively saying start tls is not supported and then the client falls back to non tls communication (which is obviously unfortunate). Even if the backend server is properly not responding to clients until STARTTLS is initiated, the man in the middle could initiate a connection with STARTTLS to the ldap server and be talking plaintext to the client. Is that legitimately possible or am I missing a nuance? If one were to only support clients over LDAPS it seems this would be mitigated? Thanks for the considerations, looking forward to hearing the expert opinions on the topic.

9 20

delete glue entry
by Michael Ströder 01 Apr '22

01 Apr '22

HI! Had a MDB database with a glue entry in it on all replicas in a multi-provider setup (release 2.6.1). I could not update this entry anymore. Is it possible to delete a glue entry via LDAP? All subordinate entries were already removed before. Ciao, Michael.

2 1

RE26 testing call #1 (OpenLDAP 2.6.2)
by Quanah Gibson-Mount 01 Apr '22

01 Apr '22

This is the first testing call for OpenLDAP 2.6.2. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.2 Engineering Added libldap support for OpenSSL 3.0 (ITS#9436) Added slapd support for OpenSSL 3.0 (ITS#9436) Fixed ldapdelete to prune LDAP subentries (ITS#9737) Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd to correctly init global_host earlier (ITS#9787) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) Added slapo-otp support for OpenSSL 3.0 (ITS#9436) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Build Enviornment Add ability to override default compile time paths (ITS#9675) Fix compiliation with certain versions of gcc (ITS#9790) Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Documentation admin26 Document new lloadd features (ITS#9780) Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804) Fixed slapd-sock(5) to clarify "sockresps result" behavior (ITS#8255) Regards, Quanah

6 9

RE25 Testing call #1 (OpenLDAP 2.5.12)
by Quanah Gibson-Mount 01 Apr '22

01 Apr '22

This is the first testing call for OpenLDAP 2.5.12. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.12 Engineering Fixed libldap to drop connection when non-LDAP data is received (ITS#9803) Fixed libldap to allow newlines at end of included file (ITS#9811) Fixed slapd slaptest conversion of olcLastBind (ITS#9808) Fixed slapd usage of thread local counters (ITS#9789) Fixed slapd to clear runqueue task correctly (ITS#9785) Fixed slapd bconfig locking for cn=config replication (ITS#9584) Fixed slapd syncrepl handling of new sessions (ITS#9584) Fixed slapd to clear connections on bind (ITS#9799) Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) Fixed slapd-meta SEGV on config rewrite (ITS#9802) Fixed slapd-meta ordering on config rewrite (ITS#9802) Fixed slapd-meta memory leak in keepalive setting (ITS#9802) Fixed slapd-monitor SEGV on shutdown (ITS#9809) Fixed slapo-pcache SEGV on shutdown (ITS#9809) Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) Build Environment Fix compilation with openssl exclusions (ITS#9791) Fix warnings from make jobserver (ITS#9788) Fix compiliation with certain versions of gcc (ITS#9790) Documentation Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit documentation (ITS#9804) Regards, Quanah

2 1

Re: STARTTLS vs LDAPS
by Braiam 31 Mar '22

31 Mar '22

On Thu, Mar 31, 2022 at 11:46 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, March 31, 2022 12:16 PM -0400 Braiam <braiamp(a)gmail.com> > wrote: > > > What would be the process to modify content on the openldap.org page? > > Depends on the content. The main web pages are in the OpenLDAP Web git > repository. > This repository seems to be the FAQ: https://git.openldap.org/project/faq/-/tree/master/data/item There's a website project too. I couldn't figure out what markup language items on the faq project uses. > --Quanah > -- Braiam

2 1

multiple TOTP token for one user in otp overlay slapo-otp
by Rene Zeipelt 31 Mar '22

31 Mar '22

Hello, is it possible to save multiple TOTP token (with different sha algorithms and different secrets) to one user with the otp overlay? In the totp module multi values like {TOTP1}XXXXXXX and {TOTP256}XXXXXX are working. Thanks for any help. Best regards Rene Zeipelt ps. system is debian bookworm with slapd 2.5.11 -- _________________________________________________________ BERGISCHE UNIVERSITÄT WUPPERTAL Zentrum fuer Informations- und Medienverarbeitung - ZIM

2 1

Deny write access to new accounts
by beren beren 30 Mar '22

30 Mar '22

Hi. Is it possible to make admin Bob unable to edit accounts (delete, create, change passwords)created this year ? There is an idea to move them to a group or OU and give Bob the rights to write only there. Is there a more elegant solution ?

2 1

olclimit dn.base <> group/groupOfNames/member
by bourguijl＠gmail.com 29 Mar '22

29 Mar '22

Dears, Openldap version : 2.5.7 env 2 MMR 2 Replicas (test env) I've set and olclimit for one user (dn.base) on my DB and it works fine but in order to move it on my production env, I decided to modify my olclimit by using (group/groupOfNames/member) and place this user as member of the group. This is also works fine on my test env. I did the same config on my production env which is 4 MMR 4 Replicas and it didn't work :-( I did a lot of checks to see if there was any difference but it was exactly the same configuration. I did some other test on replicas first by adding a new olclimit for the concerned user ( dn.base) which solved the issue. I decided to remove this newly user olclimit, the olclimit (group/groupOfNames/member) was still there, and was not my surprise, the limitation for my user was still set to unlimited as expected. I did the same on all replicas, adding concerned user, remove it and limits were OK .... very strange. As it was working on replicas, I did try the same on master but no luck, my user stay still limited to 500 entries. Questions : Is there an order to respect in olclimit type ? why the config is working on test env and not on production one ? Thx to advice, Jean-Luc

3 6

slapo-translucent overlay crashes during wildcard search with subordinate
by jeremy.diaz＠rexconsulting.net 29 Mar '22

29 Mar '22

Hello openldap-technical, I found that slapd 2.5.11 w/slapo-translucent will crash when queried with a wildcard search. It looks like any wildcard search on any attribute specified in "translucent_local" will cause the SIGSEGV on the latest version of Symas OpenLDAP slapd, 2.5.11, MDB databases, running on CentOS7. It seems that the SIGSEGV problem does not occur w the 2.4.44 from the RHEL7 distribution, and so the problem may have be a regression. I have not tested any other versions but have verified that, with the exact same config, the problem does not happen on the RHEL7 2.4.44 version, but does happen w/Symas OpenLDAP 2.5.11. It's an interesting config here. There are two database+suffixes defined in the instance. The first one is subordinate (ou=someorg,dc=corp,dc=com) to the second one (dc=corp,dc=com). The "subordinate" option is set to "True". The second database section loads the translucent overlay which is pointed to the upstream Active Directory instance and has the same suffix of AD. The problem is administrative. The group want their admins who manage LDAP data to be able to search using wildcard "cn=xyx*" filters. Besides crashing, we have noticed that these work, but only when setting the basedn of the subordinate database. I tried a few things in a test lab and was able to reproduce the issue. with "cn" in "translucent_local" and sublevel search of translucent superior basedn dc=corp,dc=com "(cn=jed)" filter returns subordinate database entry "(cn=je*)" filter crashes slapd with "cn" not in "translucent_local" and sublevel search of translucent superior basedn dc=corp,dc=com "(cn=jed)" filter return referrals from upstream Active Directory "(cn=je*)" filter return referrals from upstream Active Directory with "cn" in "translucent_local" and sublevel search of subordinate basedn ou=someorg,dc=corp,dc=com "(cn=jed)" filter returns subordinate database entry from ou=someorg "(cn=je*)" filter returns subordinate database entry(ies) from ou=someorg with "cn" not in "translucent_local" and sublevel search of subordinate dbasedn ou=someorg,dc=corp,dc=com "(cn=jed)" filter returns subordinate database entry from ou=someorg "(cn=je*)" filter returns subordinate database entry(ies) from ou=someorg Here's what the crash looks like: 622eb2f7.0393c4d6 0x7fcf15e89880 slapd starting 622eb2fd.32371976 0x7fce8d9f3700 slap_listener_activate(8): 622eb2fd.323bb364 0x7fce8d1f2700 >>> slap_listener(ldap:///) 622eb2fd.3247761c 0x7fce8d1f2700 connection_get(15): got connid=1000 622eb2fd.3247962c 0x7fce8d1f2700 connection_read(15): checking for input on id=1000 622eb2fd.3247b177 0x7fce8d1f2700 ber_get_next 622eb2fd.3247e0b8 0x7fce8d1f2700 ber_get_next: tag 0x30 len 12 contents: 622eb2fd.3247f6f1 0x7fce8d1f2700 op tag 0x60, time 1647227645 622eb2fd.32480615 0x7fce8d1f2700 ber_get_next 622eb2fd.32484eca 0x7fce8d1f2700 conn=1000 op=0 do_bind 622eb2fd.324861e8 0x7fce8d1f2700 ber_scanf fmt ({imt) ber: 622eb2fd.324871c1 0x7fce8d1f2700 ber_scanf fmt (m}) ber: 622eb2fd.32488890 0x7fce8d1f2700 >>> dnPrettyNormal: <> 622eb2fd.32489324 0x7fce8d1f2700 <<< dnPrettyNormal: <>, <> 622eb2fd.3248ce51 0x7fce8d1f2700 do_bind: version=3 dn="" method=128 622eb2fd.3248efc7 0x7fce8d1f2700 send_ldap_result: conn=1000 op=0 p=3 622eb2fd.324906be 0x7fce8d1f2700 send_ldap_response: msgid=1 tag=97 err=0 622eb2fd.32492605 0x7fce8d1f2700 ber_flush2: 14 bytes to sd 15 622eb2fd.324ab763 0x7fce8d1f2700 do_bind: v3 anonymous bind 622eb2fd.325dc3b4 0x7fce8d1f2700 connection_get(15): got connid=1000 622eb2fd.325de12a 0x7fce8d1f2700 connection_read(15): checking for input on id=1000 622eb2fd.325dec44 0x7fce8d1f2700 ber_get_next 622eb2fd.325e0856 0x7fce8d1f2700 ber_get_next: tag 0x30 len 63 contents: 622eb2fd.325e1663 0x7fce8d1f2700 op tag 0x63, time 1647227645 622eb2fd.325e22e8 0x7fce8d1f2700 ber_get_next 622eb2fd.325e500c 0x7fce8d1f2700 conn=1000 op=1 do_search 622eb2fd.325e5ae0 0x7fce8d1f2700 ber_scanf fmt ({miiiib) ber: 622eb2fd.325e69ea 0x7fce8d1f2700 >>> dnPrettyNormal: <dc=corp,dc=com> 622eb2fd.325e98bd 0x7fce8d1f2700 <<< dnPrettyNormal: <dc=corp,dc=com>, <dc=corp,dc=com> 622eb2fd.325eaad7 0x7fce8d1f2700 ber_scanf fmt ({m) ber: 622eb2fd.325ebce5 0x7fce8d1f2700 ber_scanf fmt (m) ber: 622eb2fd.325eddcb 0x7fce8d1f2700 ber_scanf fmt ({M}}) ber: 622eb2fd.325f334c 0x7fce8d1f2700 ==> limits_get: conn=1000 op=1 self="[anonymous]" this="dc=corp,dc=com" 622eb2fd.325f4dcc 0x7fce8d1f2700 ==> translucent_search: <dc=corp,dc=com> (cn=jed*) Segmentation fault Thanks! Jeremy Diaz | Rex Consulting | https://www.rexconsulting.net

2 1

Official symas docker image? Or what others do?
by Dave Macias 29 Mar '22

29 Mar '22

Hello, Wondering if there is a plan to do an official image. Also what others in the community doing? Finally, there is this project that seems to be updated/supported but obviously not official https://github.com/bitnami/bitnami-docker-openldap anyone here used/seen this? Why am i asking? We simply looking to dockerize our infra and want to see what people here have experienced. Our ldap env: 3-way MMR (syncrepl) on v2.6.1 Thank you, Dave

6 9

openldap-ltb segmentation fault
by Aaron Bennett 29 Mar '22

29 Mar '22

Hi, I've got a new openldlap-ltb 2.5 system (running on rocky 8), and when I try to start it with "slapt-cli start", it dumps core: [root@kt-ldap-01 slapd.d]$ journalctl -xe Mar 28 16:13:06 kt-ldap-01 systemd-coredump[54716]: Resource limits disable core dumping for process 54714 (slapd). Mar 28 16:13:06 kt-ldap-01 systemd-coredump[54716]: Process 54714 (slapd) of user 0 dumped core. -- Subject: Process 54714 (slapd) dumped core -- Defined-By: systemd -- Support: https://access.redhat.com/support -- Documentation: man:core(5) -- -- Process 54714 (slapd) crashed and dumped core. -- -- This usually indicates a programming error in the crashing program and -- should be reported to its vendor as a bug. Mar 28 16:13:06 kt-ldap-01 slapd-cli[54688]: /usr/local/openldap/sbin/slapd-cli: line 350: 54714 Segmentation fault (core dumped) $SLA> Mar 28 16:13:06 kt-ldap-01 systemd[1]: systemd-coredump(a)13-54715-0.service: Succeeded. -- Subject: Unit succeeded -- Defined-By: systemd -- Support: https://access.redhat.com/support From debugging the shell script it looks like it's running slapd with these arguments: SLAPD_PARAMS='-h ldaps://kt-ldap-01-665.test.clarku.edu -F /usr/local/openldap/etc/openldap/slapd.d -u ldap -g ldap -l local4' So if I run: /usr/local/openldap/libexec/slapd -h ldaps://kt-ldap-01-665.test.clarku.edu -F /usr/local/openldap/etc/openldap/slapd.d -u ldap -g ldap -l local4 It works -- no segfault, no nothing. I can pretty easily write a systemd script that runs that command instead of wasting time with the slapd-cli stuff if that's a better approach. -Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 4

Re: OpenLDAP and Oracle backend
by Julián Sosa 28 Mar '22

28 Mar '22

** I wrote erroneously about working versions. Up to OpenLDAP 2.4.23 it works great with Oracle DB as backend. From version 2.4.25 onwards integration does not work. El lun, 28 mar 2022 a las 15:33, Julián Sosa (<docldap(a)gmail.com>) escribió: > Hi all. As a demand from some client, we have to implement the Oracle > backend, with idea of using an existing schema for authenticating users > using some mfa tool that only supports ldap. > > I began for last version at this date (2.6.1), but have this error: > > 6241cb6b backsql_oc_get_attr_mapping(): error executing at_query > "SELECT > name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u > FROM ldap_attr_mappings WHERE oc_map_id=?" > for objectClass "organization" > with param oc_id=3 > 6241cb6b Return code: -1 > 6241cb6b <==backsql_load_schema_map() > > In order for doing some debugging, I changed slapd and unixodbc to point > to an mysql, and works fine. So I found some entry on internet from a > person who had it working on some version, but when changing it does not > work. Also, I monitored with sys user last queries on v$sql. and last query > that reached DB was , so it appears that error occurs at preparing the > attribute mapping query, and code breaks before sending the query. > > I found another entry about this, where someone told that he have it > working on version 2.3.24 and he could not make it work on other version. > So I begin installing several OpenLDAP versions since mentioned one, and > from there to version 2.3.24 I found that Oracle backend is working fine. > Beginning 2.4.24, and onwards versions, it starts to show mentioned error. > I tried both on my Mint 20.3 personal machine, and with client's server > which is a CentOS 7.8. > > For tests, I used same Oracle DB instance. Only copy the slapd.conf from > working OpenLDAP/Oracle to the version I tested. > >

1 0

Response Ordering
by thomaswilliampritchard＠gmail.com 28 Mar '22

28 Mar '22

I'm looking to better understand the relationship in packet ordering when it comes to bind requests. As far as I've learned so far I can send a few ldap requests and potentially get responses in an order that doesn't match what i've sent. When it comes to, for example, sending a bind, a search, a bind (different user), and a search, when I send those serially without waiting for a response, are there any guarantees around getting successful bind responses before search results? Is it guaranteed that I would get a bind result from the second bind before search results from the second search? Is it guaranteed the second bind result would come after the end of the first search results, or might I receive the second bind result before the end of the first set of search results (or even in the middle of the second set of search results)? Then when it comes to server side processing, is it guaranteed that the first search is executed with the authorization of the first bind, and second search executed with the authorization of the second bind? Or is there a way the second search is processed before the second bind? How does openldap manage changing authorization in the middle of an executing search? If the first search is in flight and the second bind request comes in, does the first search continue to execute and finish with the authorization of the first bind? Are you aware of clients or tools that leverage that multi request (without waiting for a response) capacity of ldap? In what types of applications might a client send many requests without waiting for any responses? Thanks for the consideration Tom

4 4

ACL deny list anonymous
by beren beren 25 Mar '22

25 Mar '22

Hi, Sorry for the trivial question. How can I prevent a user who has not authenticated from viewing ? That is, the query ldapsearch -x -H ldap://infra-ldap.wildberries.ru -b "dc=test,dc=com" shows everything.

2 1

ldap bind response
by Gustavo Rios 23 Mar '22

23 Mar '22

Hi folks ? I am writing an ldap library for accessing openldap server. I have written a function that implements an ldap bind request and decode the openldap response. The program output is given below. sioux@etosha:~/msc/it/cnf/ldap/programs/ldp$ ./ldp 127.0.0.1.389 30 c 2 1 3 61 7 a 1 0 4 0 4 0 Tag: 48, Length: 12 Left: 12 bytes ================================ Tag: 2, Length: 1 Left: 10 bytes Value: 3 ================================ Tag: 97, Length: 7 Left: 7 bytes My question is: how to "read" de last seven bytes ? I have read the ldap rfc but it is still confusing. May you help me ? Thanks a lot! -- The lion and the tiger may be more powerful, but the wolves do not perform in the circus

1 0

slapi plug-in does not work after update of OpenLDAP from 2.4 to 2.6.1
by Matthias Apitz 23 Mar '22

23 Mar '22

Hello, We're running since ages with an OpenLDAP server 2.4 a plugin which publishes changes (add, modify, delete) in LDAP to an Identity Management Server (IDM). The plugin is written in C and configured in slpad.conf as a shared lib: plugin postoperation /opt/openldap-2.6.1/lib64/idm.so idm_init "IDM Plugin" 10.23.33.52 3001 The function idm_init() registers static C functions the supposed way: int idm_init(Slapi_PBlock * pb) { int rc = LDAP_SUCCESS; log("idm-plugin:","now in idm_init()\n"); // first call, create new list and register the functions ... rc |= slapi_pblock_set( /* Plug-in API version */ pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_CURRENT_VERSION); rc |= slapi_pblock_set( /* Plug-in description */ pb, SLAPI_PLUGIN_DESCRIPTION, (void *) &desc); rc |= slapi_pblock_set( /* Modify function */ pb, SLAPI_PLUGIN_POST_MODIFY_FN, (void *) modify_user); ... // read arguments and add list entry rc |= read_arguments(pb); log("idm-plugin", "idm_init() return rc:%d\n", rc); return rc; } The function for modify_user() will later publish the change via network and without going into the details the start of the function looks like this: static int modify_user(Slapi_PBlock * pb) { Slapi_Entry *entry; log("idm-plugin:", "now in modify_user\n"); if (slapi_pblock_get(pb, SLAPI_SEARCH_TARGET, &entry) != LDAP_SUCCESS) { log("IDM-Connector Plugin", "entry modified, but couldn't get entry"); return -1; } ... The problem is, that after an update in LDAP this function is not called. The log shows only the attach and initialisation of the plugin but no further actions: 03/16/22 10:52:26 idm-plugin:: now in idm_init() 03/16/22 10:52:26 IDM-Connector Plugin: idm_init: Initializing plugin 03/16/22 10:52:26 idm-plugin:: now in read_arguments() 03/16/22 10:52:26 IDM Plugin: added idm connector: ip=10.23.33.52, port=3001 03/16/22 10:52:26 idm-plugin: idm_init() returns rc:0 03/16/22 10:52:26 plugin_pblock_new: Registered plugin OCLC-IDM-Connector-Notifier 1.0 [OCLC.org] (Notify the OCLC IDM-Connector of changes) As I said, with OpenLDAP 2.4 this works fine. It does not work anymore with 2.6.1. Is there some change in the slapi interface of which we are not aware off? What could be done as debugging/logging to nail this down? Thanks in advance and Regards matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, http://www.unixarea.de/ +49-176-38902045 Public GnuPG key: http://www.unixarea.de/key.pub

5 5

Re: RE26 testing call #1 (OpenLDAP 2.6.2)
by Nick Folino 23 Mar '22

23 Mar '22

Looking good on Fedora 35 On Tue, Mar 22, 2022 at 1:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the first testing call for OpenLDAP 2.6.2. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.2 Engineering > Added libldap support for OpenSSL 3.0 (ITS#9436) > Added slapd support for OpenSSL 3.0 (ITS#9436) > Fixed ldapdelete to prune LDAP subentries (ITS#9737) > Fixed libldap to drop connection when non-LDAP data is received > (ITS#9803) > Fixed libldap to allow newlines at end of included file (ITS#9811) > Fixed slapd slaptest conversion of olcLastBind (ITS#9808) > Fixed slapd to correctly init global_host earlier (ITS#9787) > Fixed slapd bconfig locking for cn=config replication (ITS#9584) > Fixed slapd usage of thread local counters (ITS#9789) > Fixed slapd to clear runqueue task correctly (ITS#9785) > Fixed slapd syncrepl handling of new sessions (ITS#9584) > Fixed slapd to clear connections on bind (ITS#9799) > Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) > Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) > Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) > Fixed slapd-meta SEGV on config rewrite (ITS#9802) > Fixed slapd-meta ordering on config rewrite (ITS#9802) > Fixed slapd-meta memory leak in keepalive setting (ITS#9802) > Fixed slapd-monitor SEGV on shutdown (ITS#9809) > Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) > Added slapo-otp support for OpenSSL 3.0 (ITS#9436) > Fixed slapo-pcache SEGV on shutdown (ITS#9809) > Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) > Build Enviornment > Add ability to override default compile time paths (ITS#9675) > Fix compiliation with certain versions of gcc (ITS#9790) > Fix compilation with openssl exclusions (ITS#9791) > Fix warnings from make jobserver (ITS#9788) > Documentation > admin26 Document new lloadd features (ITS#9780) > Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit > documentation (ITS#9804) > Fixed slapd-sock(5) to clarify "sockresps result" behavior > (ITS#8255) > > > > Regards, > Quanah >

1 0

OpenLDAP proxy for samba-usage
by lists＠zxt10d.de 22 Mar '22

22 Mar '22

Hello :) Hopefully I'm not completly wrong on this ml, as its not only ldap related, but also samba related. I work at a Chair of a german university. University uses a central LDAP-system for all students, employees, scientists, scientific guests, etc., providing an unique UID for all these peoples, plus many more information. My idea was: setting-up a local OpenLDAP-proxy, so that people of our Chair get access to ressources (eg. via samba) using their unique UID and password, but without setting-up an AD. Many system here are owned by the Chair or University, but lots of students are using their own laptop, so using a AD (and adding them) is not very handy for them ... so, something like a stand-alone samba-server with authentification versus ldap. Is there a chance to get this running? There is no chance to add the schema on a proxy? What I did so far: - I can establish a connection to the central LDAP-system using /etc/pam_ldap.conf uri ldaps://ldap.DOMAIN.de host ldap.DOMAIN.de base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de ldap_version 3 binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de bindpw PASSWORD pam_password crypt ssl start_tls ssl on - I configured /etc/libnss-ldap.conf, and a 'getent passwd' shows all local users plus the members uri ldaps://ldap.DOMAIN.de host ldap.DOMAIN.de base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de ldap_version 3 binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de bindpw PASSWORD - I also configured /etc/ldap/slapd.conf for proxy usage (I think I did ...), but I learned 2 days ago I can't add any schemata on a proxy ... # Schema includes include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # include /etc/ldap/schema/misc.schema include /etc/ldap/schema/openldap.schema # # # Module modulepath /usr/lib/ldap moduleload back_ldap.la moduleload back_hdb.la moduleload back_mdb moduleload rwm moduleload pcache.la moduleload memberof.la # # Main settings pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args conn_max_pending 1000 sockbuf_max_incoming 4194303 logfile /var/log/ldap/logfile.log #loglevel stats conns filter loglevel any sizelimit unlimited limits * size.pr=0 size.prtotal=none tool-threads 1 # readonly on access to * by * read # # Database defs (proxy to AD) database ldap chase-referrals no rootdn ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de suffix "dc=DOMAIN,dc=de" uri ldap://localhost/ uri ldap://ldap.DOMAIN.de/ uri ldaps://ldap.DOMAIN.de/ acl-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes idassert-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes #cancel abandon overlay pcache #proxycache hdb 100000 3 1000 100 proxycache mdb 100000 3 1000 100 pcachePersist TRUE proxyAttrset 0 mail uid gecos proxyTemplate (sn=) 0 3600 proxyTemplate (&(sn=)(givenName=)) 0 3600 #cachesize 20 index objectClass eq index cn,sn,uid,mail pres,eq,sub pcacheAttrset 0 1.1 pcacheTemplate (&(|(objectClass=))) 0 3600 pcacheTemplate (objectClass=*) 0 3600 pcacheAttrset 1 displayname pcacheTemplate (objectClass=*) 1 3600 pcacheAttrset 2 memberOf pcacheTemplate (objectClass=*) 2 3600 conn-ttl 3600 # directory /var/lib/ldap Testing the config works: root@ldap:~# /usr/sbin/slapd -Tt -f /etc/ldap/slapd.conf config file testing succeeded 62398f56 mdb_opinfo_get: err Permission denied(13) root@ldap:~# (I have no idea which Permission is denied) slapd can be started via /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf ldapsearch works fine using '-h localhost' or '-H ldap://ldap.DOMAIN.de', so I think the basic config is not bad at all ... Thanks in advance! Cheers, Torsten

1 0

Re: Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Am Mi., 16. März 2022 um 21:39 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 10:23 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > > > We are still using the bdb backend and the latest 2.4.59 (don't ask, > > it will be replaced soon) and I remember, a "few" years ago, I had > > problems with slapcat and online databases, because the server was > > stucking for a while and answers were delayed .. > > (The Admin Guide tells, that "Backups are managed slightly differently" > > ...) Secondly, while offline, I can copy the whole database directory > > including the transaction logs .. > > Ah, ok. Yes, you could set up a read-only consumer node to take backups > from. I'd highly prioritize moving to a supported release of OpenLDAP with > the back-mdb backend as well (I see you say it should be replaced soon). :) > Quanah, thanks for guiding me! Meike

1 0

Re: Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Am Mi., 16. März 2022 um 19:31 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 7:59 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > Hello, > > > > what is the right solution to backup a Mirromode setup? > > I've a simple setup with two servers, running in mirromode and a > > virtual IP is moved on "request" between the two servers (nodes). The > > DNS-Name of the virtual IP is used for the client ldap requests. The > > server certificate is issued to the DNS name of the virtual IP, but > > has two SANs for the both node names. The node names will be used for > > replication in mirrormode. Everything is running well. > > Can I set up a third (readonly) server, who only replicates the > > Database from the "mirromode cluster'' using the DNS-Name without > > problems and then shutdown slapd temporarily and splacat the database? > > You don't need to shut down slapd to slapcat the database, so I'm not clear > what the concern is here? You should just do a periodic slapcat. > We are still using the bdb backend and the latest 2.4.59 (don't ask, it will be replaced soon) and I remember, a "few" years ago, I had problems with slapcat and online databases, because the server was stucking for a while and answers were delayed .. (The Admin Guide tells, that "Backups are managed slightly differently" ...) Secondly, while offline, I can copy the whole database directory including the transaction logs .. Thanks Meike

2 1

Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Hello, what is the right solution to backup a Mirromode setup? I've a simple setup with two servers, running in mirromode and a virtual IP is moved on "request" between the two servers (nodes). The DNS-Name of the virtual IP is used for the client ldap requests. The server certificate is issued to the DNS name of the virtual IP, but has two SANs for the both node names. The node names will be used for replication in mirrormode. Everything is running well. Can I set up a third (readonly) server, who only replicates the Database from the "mirromode cluster'' using the DNS-Name without problems and then shutdown slapd temporarily and splacat the database? Thanks Meike

2 1

migrate from RedHat openldap 2.4 to LTB OpenLdap 2.5
by Aaron Bennett 15 Mar '22

15 Mar '22

Hi, I'm moving from a two-node CentOS 7 cluster running essentially the RedHat openldap-servers build (which I rebuild to use OpenSSL, but otherwise, left alone). I've provisioned a new Rocky Linux 8 system and have installed OpenLDAP 2.5 from the LTB repository, and have moved the old slapd.d directory out of the way and put the slapd.d directory from the old servers in place. If I try to run slapd-cli status, it throws this: olcAttributeTypes: value #8 olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" config error processing cn={5}samba,cn=schema,cn=config: olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" slapcat: bad configuration directory! olcAttributeTypes: value #8 olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" config error processing cn={5}samba,cn=schema,cn=config: olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" slapcat: bad configuration directory! Looking here: https://ltb-project.org/documentation/migrate_openldap_ltb_24_openldap_ltb_…, it looks like there's more going on. Does anyone have any input as to how to accomplish this? I do need to bring the old data in, ideally without having to make changes to the samba scheme under the hood. Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 5

olcLastBind default to true
by Erik de Waard 14 Mar '22

14 Mar '22

$OpenLDAP: slapd 2.5.11 Hi, i've a weird case where olcLastBind defaults to TRUE. When using convert (slaptest) method. and explicit lastbind to off/false has no effect. #Initialize slapd with convert method slaptest -f /etc/openldap/slapd.conf.init -F /etc/openldap/slapd.d/ slapcat -n0 | grep LastBind olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S olcLastMod $ olcLastBind $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcRea olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE Tested with minimal config: # stand-alone slapd config include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema #include /etc/openldap/schema/test.schema # allow big PDUs from anonymous (for testing purposes) sockbuf_max_incoming 4194303 moduleload back_ldap ####################################################################### # database definitions ####################################################################### database config database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap lastbind off database monitor Best regards,

2 1

syncprov-sessionlog-source cn=accesslog
by Michael Ströder 14 Mar '22

14 Mar '22

HI! I wonder what the operational requirements are when using syncprov-sessionlog-source cn=accesslog instead of the in-memory session log. E.g. what about configured logpurge? What happens if the accesslog DB is completely deleted? Ciao, Michael.

3 5

slapo-translucent and syncprov
by Christopher Paul 14 Mar '22

14 Mar '22

Hello openldap-technical, I am wondering about slapo-translucent and syncprov. I am using it to merge RFC2307bis data with an upstream Active Directory Service. It seems to work pretty well. But I notice that the entries added do not get entryuuid or entrycsn values. I guess this sort of makes sense, because the source of truth for (most of) this data is upstream. And so, this means then that syncprov overlay will not work for translucent entries. So I am wondering, what others are doing to replicate and synchronize their translucent data across an OpenLDAP service? I am guessing people probably use some dump and load schemes, which is about all I can think to do at the moment. many thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

1 0

secrets storage: userPassword,TLS keys best practices
by Christopher Paul 13 Mar '22

13 Mar '22

Hello openldap-technical, I'm wondering what the OpenLDAP-technical World thinks about LDAP authentication secrets. A couple observations and questions: 1. RFC 4519 allows userPassword to be multi-valued and it gives some rationale which is logical, but it also seems to lack imagination. There seem to be more possibilities for abuse by defining attributeType this way than legitimate use cases. Is there any way to force userPassword to be single-valued? Has anyone attempted this? 2. Assuming you decide to ditch passwords, and use TLS EXTERNAL, you still have the problem of storing the key, and the risk that if the key is stolen, than someone other than you can authenticate as you. Of course store it on storage with permissions and ownership of files set correctly. That goes without being said, but storage is not always perfectly secure or private, so let's not trust it completely. Short lifetimes would be one mitigation. And CRLs of course. What else do people do? 3. Is there anyway to have ldap* commands read the key in from an environment variable or call to gpg/secrets store /etc? Funky alias / bash-wrapper yeah but I'm looking for something less clunky. many thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

3 8

Accesslog and Ppolicy overlays
by Benjamin Renard 11 Mar '22

11 Mar '22

Hello, I try to enable accesslog overlay on a database with the overlay ppolicy enabled (with brute-force protection). My goal is to build an historic of users authentication fails and the effect of the ppolicy overlay on their account. I enabled accesslog on the database with logging of the "session" operations and in this case, all users authentication fails are stored as modification of the pwdFailureTime attribute. It's great but I also would also like to have an explicit trace of the bind operation failure (with the error message of ppolicy in reqMessage). I also tried to configure the accesslog overlay on frontend and in this case, I had an explicit trace of the bind failure but no trace of the pwdFailureTime attribute modification. Finally, I tried to configure the accesslog overlay on both frontend and database levels, but accesslog on database seems to take over the other and the result is identical with accesslog configured only on database level. Do you known how I could configure the accesslog overlay to log both bind failure and the pwdFailureTime attribute modification ? Regards, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

1 0

Using logfile-format causes segfault
by Juergen.Sprenger＠swisscom.com 11 Mar '22

11 Mar '22

When using option 'logfile-format' in my config, slaptest, slapadd, slapcat, slapindex, ... will segfault and cause a coredump. This occurs with all available options for 'logfile-format'. slapd itself is running fine, logs are written as expected with any option for 'logfile-format'. I am using OpenLDAP 2.6.1, configure options: ./configure --enable-overlays=mod --enable-modules --with-tls=openssl

2 2

Re: Antw: [EXT] creatorsname not correctly updated
by Jean-Luc Bourguignon 11 Mar '22

11 Mar '22

hello Quanah, 2.5.7. Brgds, J-L. On Thu, Mar 10, 2022 at 11:08 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, March 10, 2022 3:44 PM +0100 Jean-Luc Bourguignon > <bourguijl(a)gmail.com> wrote: > > > > > Hello Ulrich, > > > > > > After a deep analyze of this "problem", it seems the chaining > > process doesn't work when I use rootdn user to add entries in the DB via > > the replicas. > > If I add them via providers, creatorsname takes the correct rootdn (as > > no chaining action here) but if I do it via replicas, I get replication > > user's DN. > > The chaining process works fine for normal users and gets proxied from > > replicas to providers as I've authzto (regex) rules in the configuration > > of my replication user. > > I've tried to add a second authzto rule to my replication user as > > authzto {1} dn.exact: cn="rootdn" but it didn't work. Besides that, I > > created a fake rootdn entry in my DB, but same result. > > > What OpenLDAP release are you using? > > --Quanah > > > >

1 0

creatorsname not correctly updated
by bourguijl＠gmail.com 10 Mar '22

10 Mar '22

Dears, I've a tricky issue with this attribute. I context of 4 MMR & 4 replicas, I've defined a rootdn and a replication user. When I create "ADD" a new entry in my DB with rootdn as user, the creatorsname is filled up with the replication username instead of rootdn one :-| I've another configuration with 2 MMR & 2 replicas, normally same config as above, but there, the ADD is correctly managed. In both configuration, replicas send their ADD request to masters VIP with olcUpdateRef attribut. and received update via masters VIP with olcSyncrepl attribut. Any idea of any parameter, acl, schema to check ? Thx, J-L.

4 5

syncprov olcSpNoPresent not being honoured
by lisa.parratt＠bjss.com 10 Mar '22

10 Mar '22

Hi, I have an OpenLDAP server I'm upgrading from 2.4.58 to 2.6.0. The server is configured with the syncprov plugin, with "olcSpNoPresent: TRUE". Previously, on 2.4.58, we would never see any Present phase data originating from the server. However, post upgrade, we are seeing this, and it's causing problems with the consumers. I've tried looking at the code, but I must admit I got lost trying to trace through the propagation of this flag. Are there undocumented circumstances where olcSpNoPresent will not be obeyed, or is this a regression? Thanks! Lisa

4 7

how to set LDAP ACL permissions on one subtree for a groups without modifying it for other users or groups?
by International Security Providers 04 Mar '22

04 Mar '22

I use commands like this to set permissions for some custom gorups/users.. now I want to set the permissions without overwriting them for all the other groups/users, what do I need to add to my ACL-Entrys?: ``` access to dn.subtree="cn=myContainer,dc=mydomain,dc=tld" by set="user & [cn=myGroup,cn=groups,dc=mydomain,dc=tld]/uniqueMember*" write by set="user & [cn=Domain Users,cn=groups,dc=mydomain,dc=tld]/uniqueMember*" read ```

1 0

Delta-sync replication: is it possible to force resync delta?
by skeletor 03 Mar '22

03 Mar '22

Hi. I use delta-sync replication on version 2.4. Sometimes, some records don't send to slave. Insofar as this is delta-sync after a new update slave receive only last update. Therefore slave and master are not consistent. Is it possible run force resync from accesslog to consistent check if all records are present on slave? May be this is a bug on version 2.4 and it already has been fixed in newer version? master 2.4.57 slave 2.4.55

6 10

disable SSL/TLS renegotiation
by Stefan Bauer 03 Mar '22

03 Mar '22

Hi, our security scanner reports SSL/TLS: Renegotiation DoS Vulnerability (CVE-2011-1473, CVE-2011-5094) for port TCP/636. I could not find a way to disable SSL/TLS renogitation for openldap. How can this be disabled? Any help is greatly appreciated. Thank you. Stefan

2 1

Problem with ppolicy overlay and userPassword attribute
by Frederic Dussurget 01 Mar '22

01 Mar '22

Hi, We're facing the following issue : * From one side, we have to store two values (same password with two different encodings) within the userPassword attribute (eg. https://datatracker.ietf.org/doc/html/rfc4519#section-2.41) * On the other side, we do have to use the ppolicy overlay in order to hash to Argon2 automatically passwords that are sent in cleartext, in order to to use the pwdLastSuccess attribute (storing last authentication date) and pwdAccountLockedTime (account deactivation), but this overlay does not seem to support multiple values in the userPassword attribute as it looks to be described in the following abstract : https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10#… and https://www.openldap.org/software/man.cgi?query=slapo-ppolicy&sektion=5&apr… We're not able to add a user account with two values in the userPassword attribute : [root@openldap25 ~]# cat testuser_add.ldif dn: uid=testuser,ou=people,dc=my-domain,dc=fr objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: top uid: testuser cn: testuserCN sn: testuserSN userPassword: password userPassword: drowssap [root@openldap25 ~]# ldapadd -H ldaps://localhost:636 -x -D "cn=Manager,dc=my-domain,dc=fr" -W -f testuser_add.ldif Enter LDAP Password: adding new entry "uid=testuser,ou=people,dc=my-domain,dc=fr" ldap_add: Constraint violation (19) additional info: Password policy only allows one password value However, we're able to add a user with a single value in the userPassword attribute, then, adding a second value thru the next LDAP request : [root@openldap25 ~]# cat testuser_add.ldif dn: uid=testuser,ou=people,dc=my-domain,dc=fr objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: top uid: testuser cn: testuserCN sn: testuserSN userPassword : password [root@openldap25 ~]# ldapadd -H ldaps://localhost:636 -x -D "cn=Manager,dc=my-domain,dc=fr" -W -f testuser_add.ldif Enter LDAP Password: adding new entry "uid=testuser,ou=people,dc=my-domain,dc=fr" [root@openldap25 ~]# cat testuser_mod.ldif dn: uid=testuser,ou=people,dc=my-domain,dc=fr changetype: modify add: userPassword userPassword: drowssap [root@openldap25 ~]# ldapmodify -H ldaps://localhost:636 -x -D "cn=Manager,dc=my-domain,dc=fr" -W -f testuser_mod.ldif Enter LDAP Password: modifying entry "uid=testuser,ou=people,dc=my-domain,dc=fr" [root@openldap25 ~]# ldapsearch -x -H ldaps://localhost:636 -D "cn=Manager,dc=my-domain,dc=fr" -W -LLL -b "ou=people,dc=my-domain,dc=fr" "(uid=testuser)" userPassword Enter LDAP Password: dn: uid=testuser,ou=people,dc=my-domain,dc=fr userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MixwPTEkZjlPc3NtRFZ DWmlzQk1IVEhWczRMZyRsMVAvbWdEdTA1bEpBc2pxcVF6aERYaENMV1BudnQyeDlRTDdweXFnVDFV userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MixwPTEkVk5ST1FMZFp 2Q0ptajNIcHQxYWtZdyRRcjJDYUpKSjZSWlhvZjFicDJmNGNOaGlRa3E5czlCU0FTbEtVNFoxYjBj Considering configuration, we're running an OpenLDAP 2.5.7 server (LTB project) on a RHEL8 OS. * ppolicy overlay dn: olcOverlay={0}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE olcPPolicyDisableWrite: FALSE olcPPolicySendNetscapeControls: FALSE olcPPolicyDefault: cn=default,ou=ppolicies,dc=my-domain,dc=fr * default password policy dn: ou=ppolicies,dc=my-domain,dc=fr objectClass: organizationalUnit objectClass: top ou: ppolicies dn: cn=default,ou=ppolicies,dc=my-domain,dc=fr objectClass: pwdPolicy objectClass: organizationalRole cn: default pwdAttribute: userPassword pwdLockout: TRUE * password storage dn: olcDatabase={-1}frontend,cn=config olcPasswordHash: {ARGON2} Question : * Is that behaviour normal ? * May we keep on leaning on this behaviour without fearing that this ability of adding a second value to the userPassword attribute will be revoked in the future versions/fix/patches of the service ? Thank you in advance for your assistance. Best regards, Frédéric Dussurget / Maxime Schmutz Université Lumière Lyon 2

3 15

LMDB storage layout and page structure
by Ivan Unknown 28 Feb '22

28 Feb '22

Hello! I have been looking at the LMDB project code trying to learn and understand how a database could be implemented; however, I have been struggling to answer the questions below for quite some time, partially due to my limited knowledge of C: - How does LMDB store keys and values in the page? I have learned that a page consists of the header, slots, and key-value pairs but how does the database handle keys and values that are too large to fit within a page? - I found that LMDB does not keep a fixed number of keys per page, so that would depend on the key-value pairs' sizes already inserted into the page. Is this correct? Does it mean that B+tree pages (branch or leaf) could have a different number of keys depending on the key size? How does it affect performance or implementation of the B+tree? - Are there any limitations on the size of a key? Can it be of an arbitrary length? - What is the difference between IS_LEAF and IS_LEAF2 flags in the page header? What is the difference between these pages? - How do overflow pages work in LMDB? From what I could understand, if a key or a value does not fit in the page, it will be stored in the overflow page (the entire page is allocated for that specific key or value). Is this correct? What happens when the key size is several times larger than the page size, e.g. 1MB value with 4KB pages? - What is a sub-page in LMDB (F_SUBDATA)? How does it work? I would greatly appreciate it if someone could share links to the documentation that covers internals of the database, online videos, research papers, mailing lists, or any notes you could share to help me understand the above. Thank you very much! Cheers, Ivan

2 1

Password policies and hashed passwords
by Felix Natter 26 Feb '22

26 Feb '22

Dear openldap-technical users, my password policies (openldap 2.5.11) are not enforced and Roland Gruber (author of LAM (Pro)) kindly advised me that passwords must be stored in plaintext (Hash=PLAIN) in order to be able to enforce password minimal length, password quality etc (i.e. when using passwd(1) on Linux or an LDAP client on Windows). Currently we are storing passwords as base64 encoded (::*) Salted SHA1 hashes ("{SSHA}*") (according to slapcat -n 1). tl;dr: For enforcing password policies, what is the role of "password-hash:PLAIN"(?) and olcPPolicyHashCleartext: TRUE (applied to dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config) and what is the security implication of these changes (we are using starttls on linux / ssl on windows with a self-signed certificate in intranet)? - Is it (necessary and) enough to switch to "password-hash:PLAIN" to be able to enforce password policies? Does olcPPolicyHashCleartext: TRUE [alone] help as written in this post [1]? [1] https://www.openldap.org/lists/openldap-technical/201708/msg00024.html EDIT: I think that olcPPolicyHashCleartext==ppolicy_hash_cleartext (one is OLC, one is trad. config)? -> can we update the documentation [2]? [2] https://www.openldap.org/doc/admin25/guide.html#Password%20Policies - I am worried about security when storing/transferring pwds in plain text (we are using starttls on linux / ssl on windows with a self-signed certificate in intranet) [3]. Will "ppolicy_hash_cleartext" [2] help with this? [3] The manual states "Unfortunately, as dictionary and brute force attacks are generally quite easy for attackers to successfully mount, this advantage is marginal at best (this is why all modern Unix systems use shadow password files)." Many Thanks and Best Regards, Felix -- Felix Natter

3 11

ldap_start_tls_s fails
by James Gordon 25 Feb '22

25 Feb '22

Hi, I have just installed symas openldap v2.6. Everything seems to be running ok, except that I cannot get C interface ldap_start_tls_s() to work. If I do something like this the program works fine: ldap_initialize(&ld, HOST)); rc = ldap_simple_bind_s(ld, BASEDN, BASEPWD); ldap_unbind(ld); However, if I do something like this the program fails with ldap error string "local error": ldap_initialize(&ld, HOST)); ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE); ldap_start_tls_s(ld, NULL, NULL); rc = ldap_simple_bind_s(ld, BASEDN, BASEPWD); ldap_unbind(ld); From the command line, TLS seems to work fine: The following works ok: ldapsearch -H ldap://ldap.domain.com:389 -D "cn=admin,dc=domain,dc=com" -w secret -b “ou=users,dc=domain,dc=com” -ZZ This also works ok from a different server openssl s_client -verify 10 -starttls ldap -showcerts -connect ldap.domain.com:389 -CApath /etc/ssl/certs (verification = ok): However, if I omit the CApath it fails, not sure if that is a clue to the problem: openssl s_client -verify 10 -starttls ldap -showcerts -connect ldap.domain.com:389 (Verification error: unable to get local issuer certificate). Any help would be appreciated. If this is the wrong list, let me know. ldapsearch -H ldap://ldap.red0rb.com:389 -D "cn=admin,dc=red0rb,dc=com" -w MdKlUIGYm0o63HxQ0RWYuKWkRkgr3Ohy -b “ou=users,dc=red0rb,dc=com” -ZZ

1 0

Re: 2.5 Quick-Start guide roadblock: ldap_bind: Confidentiality required (13)
by Ben Poliakoff 24 Feb '22

24 Feb '22

> > Steps 1-7 involve building the software, which I would not expect you to > be > doing if you're using Symas' packages? > You are, of course, correct about my having not compiled slapd, I misspoke. > In any case, I have no idea what changes you made to the original LDIF. I > have no such issue doing only the changes advised in the quickstart guide: > I sorted out what was happening. I was using the ldapadd command syntax from the Quick-Start guide, which doesn't use the '-H ldap:///' parameter, so ldapadd was picking up defaults from /etc/ldap/ldap.conf and happily talking to our existing production slapd, running on a different server (which of course does require secure binds). However, when I added '-H ldap:///' to the ldapadd command, ensuring that the ldap traffic was now going to the correct server (headpalm), the command fails with "ldap_bind: Invalid credentials (49)". At this point the olcRootPW in my slapd.ldif is the default ("secret"), and I can see that the base64 encoded olcRootPW in "slapd.d/cn=config/olcDatabase={1}mdb.ldif" is "olcRootPW:: c2VjcmV0" (which is, in fact the base64 encoding for "secret"). Does anyone have debugging approaches that might help me sort out why slapd isn't happy with the password? Also with regard to this mailing list's protocol, would it be better to ask this question in a separate thread? (It's humbling to be asking such phenomenally basic questions, having built and managed our existing openldap servers for many many years.) Ben

2 1

Is there a way to expose SLDAP Server Metrics to Prometheus?
by vtejaswini1＠gmail.com 24 Feb '22

24 Feb '22

It would be interesting if there were any official Prometheus exporter to monitor LDAP metrics. If we have one such exporter, does it authenticate LDAP Server to aggregate/formulate/capture metrics? Thanks, Teja

3 4

Unable to change ssl version on openldap 2.6.0
by Frédéric Goudal 24 Feb '22

24 Feb '22

Hello, For a legacy application we need to drop the ssl version available on our openldap server. Currently it supports TLSv1.2, checked with nmap --script ssl-enum-ciphers -p 636 host What ever value I put on olcTLSProtocolmin the ssl version does not change… I have tried 3.0 3.1 3.2… What do I miss ? Or is it a feature ? Thanks in advance f.g. — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 6

Is there a way to silence or redirect BIND Operation Logs in SLDAP?
by vtejaswini1＠gmail.com 23 Feb '22

23 Feb '22

Hi, For each LDAP BIND Operation, SLDAP Server logs a significant amount of logs (> 10 Log Lines). Is there a way to silence or redirect or configure these logs or BIND Operation itself? Thanks, Teja

2 5

2.5 Quick-Start guide roadblock: ldap_bind: Confidentiality required (13)
by Ben Poliakoff 23 Feb '22

23 Feb '22

I've been using the Symas OpenLDAP debian packages, and following the Quick-Start guide for 2.5: https://www.openldap.org/doc/admin25/quickstart.html Following steps 1 - 10 has been straight forward, but when I get to step 11 (Add initial entries to your directory), I run into trouble when running the ldapadd command: root@openldap-x:/opt/symas/etc/openldap# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f bootstrap.ldif Enter LDAP Password: ldap_bind: Confidentiality required (13) additional info: confidentiality required root@openldap-x:/opt/symas/etc/openldap# I used the provided slapd.ldif.default to seed the cn=config (updating it with the appropriate domain components), as per the instructions in the Quick-Start, so slapd isn't yet configured to run with ssl or starttls. Is there a default SSF factor that I should adjust to get past this bootstrapping failure? I don't see anything like that explicitly set in the configs that were rendered into /opt/symas/etc/openldap/slapd.d, from my slapd.ldif. I'm not new to openldap, but this is the first time I've used the Symas packages and also the first time trying to use olc instead of a slapd.conf based configuration. Ben

2 1

OpenLdap on Rocky 8 -- suggestions?
by Aaron Bennett 23 Feb '22

23 Feb '22

Hi, I'm migrating a small two-node OpenLDAP cluster from CentOS 7 to Rocky 8. I've been maintaining my own openldap rpms forked off of the RHEL 7 srpms, edited to link against OpenSSL instead of the never-to-be-sufficiently-d*mned GnuTLS. Now that there is no official openldap build from RedHat, I'm evaluating my choices. Essentially it comes down to these: 1. Build from source every time. Not difficult and I'm comfortable with it, but I prefer when possible to not drop non-rpm packaged files into production 2. Package it myself. If we still used it super extensively like we did in the past, I would do this, but it's a lot of work. 3. Look for third-party packages that are frequently updated. My preference is 3, which of course leads me to Symas OpenLdap. Looking at the symas page, it looks like there are two branches, the LTS 2.5 branch and the 2.6 branch. If this is accurate and the 2.5 branch is updated with security backports, etc, and is still gratis, that's the direction I'm looking to go. Any gotchas, or am I totally missing something obvious? Best, Aaron Bennett --- Aaron Bennett Manager of Systems Administration Clark University ITS

2 1

Re: log analysis tools
by Clément OUDOT 22 Feb '22

22 Feb '22

Le sam. 5 févr. 2022 à 20:57, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > > > --On Friday, February 4, 2022 10:12 PM -0500 Dave Macias <davama(a)gmail.com> > > wrote: > > > > > > > https://www.ltb-project.org/documentation/ldap-stats.html > > Is that the one I used to help maintain? I don't believe it's been updated > for 2.5 and later, unless it was forked and someone else has started > working on it. > Hello Quanah, this is indeed a fork done inside LTB project, there was no git repo for this script (or I did not found it). Of course if there are changes in 2.5 log format, we can update the script. Clément.

4 8

str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38)
by gpaz＠iter.es 21 Feb '22

21 Feb '22

````` [root@ldap ~]# slapcat The first database does not allow slapcat; using the first available one (2) dn: dc=ldap,dc=test objectClass: top objectClass: dcObject objectClass: organization dc: ldap o: ldap_test_iter description: ldap_test_iter structuralObjectClass: organization entryUUID: 4a04a984-1dfc-103c-8835-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209135948Z entryCSN: 20220209135948.842285Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209135948Z dn: ou=users,dc=ldap,dc=test objectClass: organizationalUnit ou: users structuralObjectClass: organizationalUnit entryUUID: 4a09e624-1dfc-103c-8836-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209135948Z entryCSN: 20220209135948.876561Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209135948Z dn: ou=groups,dc=ldap,dc=test objectClass: organizationalUnit ou: groups structuralObjectClass: organizationalUnit entryUUID: 4a0dc5fa-1dfc-103c-8837-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209135948Z entryCSN: 20220209135948.901999Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209135948Z dn: uid=pedro,ou=users,dc=ldap,dc=test uid: pedro cn: pedro sn: pedro objectClass: top objectClass: posixAccount objectClass: inetOrgPerson loginShell: /bin/bash uidNumber: 500 gidNumber: 500 mail: pedro(a)example.com gecos: pedro user homeDirectory: /home/pedro structuralObjectClass: inetOrgPerson entryUUID: 908089be-1dfc-103c-8838-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209140147Z userPassword:: e1NTSEF9eWdWaGZSMFhKY3N3blpLREdMbm9TU0VlanVWK01jL0s= entryCSN: 20220217123622.452494Z#000000#000#000000 modifiersName: uid=pedro,ou=users,dc=ldap,dc=test modifyTimestamp: 20220217123622Z dn: cn=pedro,ou=groups,dc=ldap,dc=test objectClass: posixGroup objectClass: top cn: pedro userPassword:: e2NyeXB0fXg= gidNumber: 500 memberUid: uid=pedro structuralObjectClass: posixGroup entryUUID: 9096c90e-1dfc-103c-8839-d781e468857b creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220209140147Z entryCSN: 20220209140147.240435Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220209140147Z dn: cn=module,dc=ldap,dc=test cn: module objectClass: top objectClass: olcModuleList olcModuleLoad: ppolicy.la olcModulePath: /usr/lib64/openldap structuralObjectClass: olcModuleList entryUUID: 8ffa80b4-243f-103c-809a-d143605cbb0e creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220217131629Z entryCSN: 20220217131629.473761Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220217131629Z dn: ou=ppolicy,dc=ldap,dc=test objectClass: organizationalUnit ou: ppolicy structuralObjectClass: organizationalUnit entryUUID: aeeed796-2443-103c-9d36-4f3e029afe7a creatorsName: cn=Manager,dc=ldap,dc=test createTimestamp: 20220217134559Z entryCSN: 20220217134559.393630Z#000000#000#000000 modifiersName: cn=Manager,dc=ldap,dc=test modifyTimestamp: 20220217134559Z ````` When I try enable the modulo I obtain the next error: ````` [root@ldap ldap]# slapadd -n2 -l 2.2_ppolicy-bdb-ldap.test.ldif str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=1) _#################### 100.00% eta none elapsed none fast! Closing DB... ````` File 2.2_ppolicy-bdb-ldap.test.ldif: ````` [root@ldap ldap]# cat 2.2_ppolicy-bdb-ldap.test.ldif dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=ppolicy,dc=ldap,dc=test olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE ````` Could anyone help me?

2 3

slapcat truncates slapd.log
by Jose Garcia 21 Feb '22

21 Feb '22

Hello, openldap.org community! This is my first thread here, in the hopes of finding a better understanding of a problem I'm having with OpenLDAP after several hours of unsuccessful troubleshooting. I'm in no way an expert on the matter so maybe someone more experienced here could help me get things a bit clearer. I recently found this issue in two Ubuntu 18.04 servers I'm running with OpenLDAP 2.4 and bdb backend for their databases. I want to export my LDAP database to an LDIF file by running: # slapcat -l database.ldif This works just fine. However, I realized every time I run such slapcat command, my slapd.log file gets truncated (i.e. all previous log entries are deleted). This happens on both servers, no matter if the slapd daemon is running or not. I don't know if this is normal or expected behavior, but it is weird to me that slapcat is wiping the log files. From what I understood slapd is in charge of the logging, so why is slapcat messing with that? Is this just normal/expected behavior, or am I experiencing some kind of weird issue here?

2 1

RE: Error when running make test or slapd after building on windows
by Joshua Dunbar 21 Feb '22

21 Feb '22

I see this issue here as well: https://www.mail-archive.com/openldap-bugs@openldap.org/msg08059.html But not sure I understand what the resolution is -----Original Message----- From: Joshua Dunbar Sent: Friday, February 18, 2022 11:19 AM To: Howard Chu <hyc(a)symas.com>; Dr. Ogg <ogg(a)sr375.com> Cc: Quanah Gibson-Mount <quanah(a)fast-mail.org>; openldap-technical(a)openldap.org Subject: RE: Error when running make test or slapd after building on windows I've attached the config.log -----Original Message----- From: Joshua Dunbar Sent: Friday, February 18, 2022 11:12 AM To: 'Howard Chu' <hyc(a)symas.com>; 'Dr. Ogg' <ogg(a)sr375.com> Cc: 'Quanah Gibson-Mount' <quanah(a)fast-mail.org>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> Subject: RE: Error when running make test or slapd after building on windows I installed Msys and ran the pacman commands via the instructions here: https://www.msys2.org/. I then opened a MSYS MinGW 64-bit command prompt and ran configure, make depend, and make. Make ends with the following error C:/msys64/mingw64/bin/../lib/gcc/x86_64-w64-mingw32/11.2.0/../../../../x86_64-w64-mingw32/bin/ld.exe: .libs/os-ip.o: in function `ldap_int_poll': C:/Users/USAF_Admin/Desktop/openldap-2.6.1/openldap-2.6.1/libraries/libldap/os-ip.c:391: undefined reference to `ber_pvt_wsa_err2string' collect2.exe: error: ld returned 1 exit status make[2]: *** [Makefile:437: libldap.la] Error 1 make[2]: Leaving directory '/home/USAF_Admin/libraries/libldap' make[1]: *** [Makefile:312: all-common] Error 1 make[1]: Leaving directory '/home/USAF_Admin/libraries' make: *** [Makefile:320: all-common] Error 1 Any ideas? -----Original Message----- From: Joshua Dunbar Sent: Thursday, February 17, 2022 6:17 PM To: Howard Chu <hyc(a)symas.com>; Dr. Ogg <ogg(a)sr375.com> Cc: Quanah Gibson-Mount <quanah(a)fast-mail.org>; openldap-technical(a)openldap.org Subject: RE: Error when running make test or slapd after building on windows Unfortunately this is for a government contract project and we are being mandated to use windows and not a containerized environment. Docker for windows was also booted. I have MSYS installed, as well as latest openldap source. -----Original Message----- From: Howard Chu <hyc(a)symas.com> Sent: Thursday, February 17, 2022 6:06 PM To: Dr. Ogg <ogg(a)sr375.com>; Joshua Dunbar <jdunbar(a)montereytechnologies.com> Cc: Quanah Gibson-Mount <quanah(a)fast-mail.org>; openldap-technical(a)openldap.org Subject: Re: Error when running make test or slapd after building on windows Dr. Ogg wrote: > Why not run in a Linux VM or a docker container? and avoid Cygwin? Or WSL2. I hear that works pretty well these days. > > >> On Feb 17, 2022, at 2:48 PM, Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >> >> Are there up to date instructions on how to build with Cygwin or Msys somewhere? I am trying to do this on a 64 bit Windows 10 computer. The way I am doing it with Cygwin with default configure options must be wrong. I am new to both Cygwin and OpenLDAP so apologies for my inexperience. >> >> -----Original Message----- >> From: Howard Chu <hyc(a)symas.com> >> Sent: Thursday, February 17, 2022 5:40 PM >> To: Quanah Gibson-Mount <quanah(a)fast-mail.org>; Joshua Dunbar >> <jdunbar(a)montereytechnologies.com>; openldap-technical(a)openldap.org >> Subject: Re: Error when running make test or slapd after building on >> windows >> >> Quanah Gibson-Mount wrote: >>> >>> >>> --On Thursday, February 17, 2022 8:00 PM +0000 Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >>> >>>> >>>> >>>> Hello, >>>> >>>> >>>> >>>> I am attempting to install openldap (latest version 2.6.1) on >>>> windows using Cygwin where I have installed dependencies of gcc >>>> core and make in order to get configure to run. I then run >>>> configure from a Cygwin terminal (without any arguments). Configure >>>> seems to run fine, and so does make depend, and make. Then when I >>>> attempt to run make test (or slapd with any other well formatted >>>> slapd.conf file) I get the following error message. I >>> >>> Hi Joshua, >>> >>> It's likely related to this discussion: >>> >>> <https://cygwin.com/pipermail/cygwin/2019-July/241961.html> >> >> More than just that. OpenLDAP code supports real POSIX environments and native WIN32 environments. >> It doesn't support Cygwin, which is a partially-working fake POSIX environment. >> >> You can use Cygwin or MSYS as the build platform, but the binaries will only work if built with the MinGW toolchain for native WIN32 output. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 5

Setup password policies: problem when adding OU
by Felix Natter 19 Feb '22

19 Feb '22

hello, I am trying to setup PPs using this guide: https://tylersguides.com/guides/openldap-password-policy-overlay/ Everything went fine up to adding the OU for the PP: policyou.ldif: dn: ou=policies,dc=company,dc=com objectClass: organizationalUnit ou: policies ldapadd -Y EXTERNAL -Q -H ldapi:/// -f policyou.ldif (1) which results in https://ldapwiki.com/wiki/LDAP_INSUFFICIENT_ACCESS (with "additional info: no write access to parent") Now I tried _several_ commands to fix this, then I did: ldapadd -H ldapi:/// -D cn=admin,cn=config -W -f policyou.ldif (2) which works. But I have to fix this on the production server now, and I don't know whether (2) fixed this or some other command. What could be the problem with (1)? Previously I used this guide to change the admin password twice: https://www.digitalocean.com/community/tutorials/how-to-change-account-pass… Do I have to set the password for cn=admin,cn=config separately? If yes, could you suggest a HOWTO? Many Thanks and Best Regards, Felix -- Felix Natter

3 4

Re: Error when running make test or slapd after building on windows
by Howard Chu 18 Feb '22

18 Feb '22

Dr. Ogg wrote: > Why not run in a Linux VM or a docker container? and avoid Cygwin? Or WSL2. I hear that works pretty well these days. > > >> On Feb 17, 2022, at 2:48 PM, Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >> >> Are there up to date instructions on how to build with Cygwin or Msys somewhere? I am trying to do this on a 64 bit Windows 10 computer. The way I am doing it with Cygwin with default configure options must be wrong. I am new to both Cygwin and OpenLDAP so apologies for my inexperience. >> >> -----Original Message----- >> From: Howard Chu <hyc(a)symas.com> >> Sent: Thursday, February 17, 2022 5:40 PM >> To: Quanah Gibson-Mount <quanah(a)fast-mail.org>; Joshua Dunbar <jdunbar(a)montereytechnologies.com>; openldap-technical(a)openldap.org >> Subject: Re: Error when running make test or slapd after building on windows >> >> Quanah Gibson-Mount wrote: >>> >>> >>> --On Thursday, February 17, 2022 8:00 PM +0000 Joshua Dunbar <jdunbar(a)montereytechnologies.com> wrote: >>> >>>> >>>> >>>> Hello, >>>> >>>> >>>> >>>> I am attempting to install openldap (latest version 2.6.1) on windows >>>> using Cygwin where I have installed dependencies of gcc core and make >>>> in order to get configure to run. I then run configure from a Cygwin >>>> terminal (without any arguments). Configure seems to run fine, and so >>>> does make depend, and make. Then when I attempt to run make test (or >>>> slapd with any other well formatted slapd.conf file) I get the >>>> following error message. I >>> >>> Hi Joshua, >>> >>> It's likely related to this discussion: >>> >>> <https://cygwin.com/pipermail/cygwin/2019-July/241961.html> >> >> More than just that. OpenLDAP code supports real POSIX environments and native WIN32 environments. >> It doesn't support Cygwin, which is a partially-working fake POSIX environment. >> >> You can use Cygwin or MSYS as the build platform, but the binaries will only work if built with the MinGW toolchain for native WIN32 output. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

DNS/ldap
by pascal.jakobi＠gmail.com 18 Feb '22

18 Feb '22

Just a question (quick). You probably saw the relatively new CAA record for DNS. This (great) record provides a means to get the address of a CA for a given DNS domain. Firstly, it is unclear to me why the old SRV records are not used as they essentially do the same. You may think of creating an SRV record for _pkica.<domain> that would provide a CA's IP address. Then my question is : why is this SRV not used on linux boxes ? This would provide a means to retrieve automatically a certificate/public key for a given user and avoid setting configs (i.e. ldap.conf) on the client side. In other tertms, don't we need a CAA equivalent for Directories ?

1 0

Error when running make test or slapd after building on windows
by Joshua Dunbar 18 Feb '22

18 Feb '22

Hello, I am attempting to install openldap (latest version 2.6.1) on windows using Cygwin where I have installed dependencies of gcc core and make in order to get configure to run. I then run configure from a Cygwin terminal (without any arguments). Configure seems to run fine, and so does make depend, and make. Then when I attempt to run make test (or slapd with any other well formatted slapd.conf file) I get the following error message. I have turned on the highest level of logging and don't get any additional useful information and have been going at this for a couple days now without any luck. I have tried manipulating permissions on the db folder as well as using different folder names and locations. I can see the lock.mdb file being generated in the /tests/testrun/db.1.a folder, but nothing else. Any insight or help would be very appreciated. 620dab00.2d2e09dc 0x800000010 config_build_entry: "olcDatabase={2}monitor" 620dab00.2d2e359c 0x800000010 slap_get_csn: conn=-1 op=0 generated new csn=20220217015512.758001Z#000000#000#000000 manage=0 620dab00.2d2ecdf4 0x800000010 backend_startup_one: starting "o=OpenLDAP Project,l=Internet" 620dab00.2d2edba0 0x800000010 mdb_db_open: "o=OpenLDAP Project,l=Internet" 620dab00.2d3072a8 0x800000010 mdb_db_open: database "o=OpenLDAP Project,l=Internet": dbenv_open(/tests/testrun/db.1.a). 620dab00.2d3a1894 0x800000010 mdb_db_open: database "o=OpenLDAP Project,l=Internet" cannot be opened: Invalid argument (22). Restore from backup! 620dab00.2d3a37d4 0x800000010 backend_startup_one (type=mdb, suffix="o=OpenLDAP Project,l=Internet"): bi_db_open failed! (22) 620dab00.2d3a42c4 0x800000010 slapd shutdown: initiated 620dab00.2d3c25f8 0x800000010 slapd destroy: freeing system resources. 620dab00.2d5278d0 0x800000010 slapd stopped. Thanks, Josh

3 4

Re: How to restrict access to pwdHistory attributes
by Chandeshwar Mishra 16 Feb '22

16 Feb '22

Hi Quanah, Thanks for your response. Our setup is a very old one and we are planning to migrate it to the latest stable version but Since this openldap is deployed in Production it is not possible for us to upgrade it suddenly. As you mentioned that ppolicy schema is missing in configuration, so is it possible that without having ppolicy schema, Openldap will remember the pwdHistory of the user ? In my case pwdHistory is visible to users, for which I want to apply ACL so that a user can only see his/her pwdHistory , not other users pwdHistory. Below are my configuration related to ppolicy configuration in config file:- include /etc/openldap/schema/ppolicy.schema --- more include directive related to schema ---- moduleload ppolicy.la moduleload memberof.la overlay memberof overlay syncprov overlay auditlog #overlay accesslog overlay ppolicy ppolicy_default "cn=passwordDefault,dc=example,dc=com" Thanks & Regards, Chandeshwar Kumar On Mon, Feb 14, 2022 at 11:24 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Saturday, February 12, 2022 5:22 AM +0000 > kumarchandeshwar99(a)gmail.com > wrote: > > > Hi, > > I am trying to restrict access to pwdHistory attributes provided by > > ppolicy overlay. I have applied the below ACL > > > > access to attrs=pwdHistory > > by * none > > but while doing slaptest, its throwing below error:- > > /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to > clause > > <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> > > ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] > > [attrs=<attrspec>] <attrspec> ::= <attrname> > > [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= > > <attr> [ , <attrlist> ] > > <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | > children > > <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] > > [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> > ] > > [dnattr=<attrname>] > > [realdnattr=<attrname>] > > [group[/<objectclass>[/<attrname>]][.<style>]=<group>] > > [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] > > [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] > > [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] > > > > Before posting here I searched archive and found one similar, issue , but > > it did not resolve my issue. I have running openldap-servers-2.4.23 on > > RHEL-6.5. > > You are missing the ppolicy schema in your configuration. > > However, I would note that both RHEL6 and OpenLDAP 2.4 are historic and no > longer in support. I'd strongly advise upgrading to both an OS that is > under support and a version of OpenLDAP that's under support. > > Regards, > Quanah > > > >

4 3

Re: OpenLDAP and NTLM
by Marc Boorshtein 15 Feb '22

15 Feb '22

> > > > NTLM has been obsoleted and shouldn't be used at all. SASL/GSSAPI or > SASL/GSS-SPNEGO should be fine. > I understand, but this is a legacy (really legacy) application that can't be changed. Is NTLM still working? >

2 1

OpenLDAP and NTLM
by Marc Boorshtein 15 Feb '22

15 Feb '22

I see that NTLM is supported as an authentication mechanism for supportedSASLMechanisms, but I'm not seeing any docs. Do I configure GSSAPI and NTLM is now available? Thanks Marc

3 2

slapo-memberof -> slapo-dynlist and value-based ACLs
by Michael Ströder 15 Feb '22

15 Feb '22

HI! I'm experimenting to replace slapo-memberof to slapo-dynlist in Æ-DIR's slapd.conf. Ok, basically it works but... Æ-DIR trys hard to follow need-to-know-principle. This means that memberOf values are only made visible to clients which they have defined to be visible on. Thus I have ACLs like this and which don't work for these clients (lines wrapped): access to dn.subtree="ou=ae-dir" filter="(objectClass=posixAccount)" attrs=memberOf val.regex="^.+$" [..] by set.expand="(user/-1 | user/aeSrvGroup | user/-1/aeProxyFor) & [ldap:///ou=ae-dir?entryDN?sub?(&(objectClass=aeSrvGroup)(aeStatus=0)(aeVisibleGroups=${v0}))]/entryDN" read [..] by * none I'm aware that this is quite special. But is there any chance that something like this will be ever supported? The alternative would be to implement an external update process for maintaining 'memberOf'. :-/ Ciao, Michael.

3 3

How to restrict access to pwdHistory attributes
by kumarchandeshwar99＠gmail.com 14 Feb '22

14 Feb '22

Hi, I am trying to restrict access to pwdHistory attributes provided by ppolicy overlay. I have applied the below ACL access to attrs=pwdHistory by * none but while doing slaptest, its throwing below error:- /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to clause <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] Before posting here I searched archive and found one similar, issue , but it did not resolve my issue. I have running openldap-servers-2.4.23 on RHEL-6.5. If any further details requires , Please let me know. Thanks.

2 1

issue with importing the samba3 schema
by Ulf Volmer 08 Feb '22

08 Feb '22

Hello, I'm trying to migrate an old openldap installation to a new one. OS of the new one is SLES15SP3, we are using the symas 2.5 packages. Sadly I got an error by importing the samba3 schema: # /opt/symas/bin/ldapadd -Y EXTERNAL -H ldapi:/// -f /opt/symas/etc/openldap/schema/samba3.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=samba3,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed I'm able to import other schemas in the same way, si I don't think that I hold the tool in the wrong way. Any pointers for me? Best regards Ulf

2 2

log analysis tools
by Paul B. Henson 07 Feb '22

07 Feb '22

Does anybody know of any good tools that can rip through an openldap log file and analyze it, creating a report of what queries are being made and how long they are taking to process? All of the information I'm interested in is included in the log: Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 fd=84 ACCEPT from IP=134.71.247.28:46592 (IP=0.0.0.0:636) Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 fd=84 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.2 tls_cipher=ECDHE-RSA-AES256-GCM-SHA384 Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=0 BIND dn="cn=it_boomi,ou=user,ou=service,dc=cpp,dc=edu" method=128 Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=0 BIND dn="cn=it_boomi,ou=user,ou=service,dc=cpp,dc=edu" mech=SIMPLE bind_ssf=0 ssf=256 Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=0 RESULT tag=97 err=0 qtime=0.000031 etime=0.000189 text= Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=1 SRCH base="ou=user,dc=cpp,dc=edu" scope=2 deref=3 filter="(&(objectClass=person)(calstateEduPersonEmplID=014532336))" Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=1 SRCH attr=memberOf Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=2 UNBIND Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000016 etime=0.192994 nentries=1 text= Feb 4 18:23:54 ldap-01 slapd[1207]: conn=46272 fd=84 closed but split up into a number of different lines which need to be correlated to summarize it. Before I try it myself I was hoping somebody else had already scratched that itch :). The only things I can find searching are either really old or commercial products. Thanks much…

8 14

intermittent memberOf performance issues
by Paul B. Henson 04 Feb '22

04 Feb '22

I've run into another problem with the memberOf implementation on my 2.5 servers. After I sorted out the proper configuration, queries requesting memberOf were very performant: Feb 4 13:26:44 ldap-01 slapd[1207]: conn=23393 op=1 SRCH base="ou=user,dc=cpp,dc=edu" scope=2 deref=3 filter="(&(objectClass=person)(calstateEduPersonEmplID=013522522))" Feb 4 13:26:44 ldap-01 slapd[1207]: conn=23393 op=1 SRCH attr=memberOf Feb 4 13:26:44 ldap-01 slapd[1207]: conn=23393 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000015 etime=0.191860 nentries=1 text= However, intermittently the server gets into a state where the exact same query takes over 30 seconds: Feb 4 08:05:11 ldap-01 slapd[1425456]: conn=40797 op=1 SRCH base="ou=user,dc=cpp,dc=edu" scope=2 deref=3 filter="(&(objectClass=person)(calstateEduPersonEmplID=015559557))" Feb 4 08:05:11 ldap-01 slapd[1425456]: conn=40797 op=1 SRCH attr=memberOf Feb 4 08:05:50 ldap-01 slapd[1425456]: conn=40797 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000019 etime=39.435523 nentries=1 text= When this occurs, the only way to resolve the issue that I have found is to reboot the server. Simply restarting slapd results in the same degraded performance on these queries. Normally there is very low read I/O load on the servers during operation, probably averaging less than 1M/s, peaking up to maybe 20-30M/s for just an instant occasionally. When the memberOf query performance is degraded, there is a very high read I/O load on the server, continuously about 200-300M/s. Any thoughts on this? It seems like for some reason the server gets into a state where it is not using the cache or memory map for doing the search required to construct the memberOf results? But instead is doing a full disk read of the entire database? It's also weird that restarting the service is not resolve this, but rebooting the server does. I'm not intimately familiar with the internals of lmdb, is there some state that persists with the environment or memory map in between service runs that is only cleared by a reboot? I initially thought I might have had a theory on it, relating to an unrelated bug in RHEL 8.5 that broke the "needs-rebooting" command resulting in servers not properly rebooting after kernel/library updates. The most recent occurrence of this issue started up after such an update without the required reboot, but upon reviewing historic occurrences it has occurred at times that don't meet that criteria, so I find myself clueless again as to what's going on. Any advice on how to fix or do further debugging on this issue much appreciated, thanks…

1 0

Fwd: [Issue 9795] New: Remove memberof overlay
by patrick+openldap.org＠laimbock.com 03 Feb '22

03 Feb '22

Hi Quanah, Has the memberof overlay been replaced with something else? I couldn't find anything in overlays/README and the roadmap. Best, Patrick -------- Forwarded Message -------- Subject: [Issue 9795] New: Remove memberof overlay Date: Wed, 02 Feb 2022 20:02:51 +0000 From: openldap-its(a)openldap.org To: openldap-bugs(a)openldap.org https://bugs.openldap.org/show_bug.cgi?id=9795 Issue ID: 9795 Summary: Remove memberof overlay Product: OpenLDAP Version: 2.6.1 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- The memberof overlay was deprecated with the release of OpenLDAP 2.5. It should be removed prior for the next minor release (i.e., 2.7) -- You are receiving this mail because: You are on the CC list for the issue.

2 2

2.6 MMR 4-way with one master different flavor of linux
by Dave Macias 02 Feb '22

02 Feb '22

Hello, Hope everyone is doing well. Our current environment: 3-way MMR (syncrepl) with centos 7 using v2.6 We want to add a 4th master but with Rocky Linux 8. Why rocky? because eventually we will migrate the 3 masters to rocky linux too. But that will take some time… Any concerns with mixing linux flavor but using same openldap version? Dont do it? Any input is appreciated. Thank you, Dave

3 6

[LMDB] mdb_env_set_mapsize and read transactions
by Ken Wenzel 01 Feb '22

01 Feb '22

Hello, I like to implement an autogrow functionality for LMDB. The documentation for mdb_env_set_mapsize says that no transactions should be active when using this function. When looking at the code I can see that the function only checks if there is an active WRITE transaction and in this case it returns an error. Is it possible to reuse existing READ transactions or even associated cursors after mdb_env_set_mapsize has been called? Thank you and best regards, Ken

3 4

Minor typo in slapo-ppolicy
by Ulrich Windl 01 Feb '22

01 Feb '22

Hi! I just discovered a minor typo in my version of the slapo-ppolicy manual page (possibly it's fixed alrerady): The manual page lists "pwdGraceAuthnLimit", but the attribute returned by slapcat is "pwdGraceAuthNLimit" (different case for 'N') The name from the schema also is "pwdGraceAuthNLimit". Regards, Ulrich

2 1

Question regarding password dictionary rule in OpenLDAP
by Alan Andrea 01 Feb '22

01 Feb '22

I have a question regarding password rules that are enforced when a user changes their password in OpenLDAP. We have a need to implement a dictionary rule whereby words and phrases in a dictionary are not allowed in a users password. I am not able to see currently where such functionality exists in OpenLDAP and am wondering if there are any extensions to OPenLDAP that were developed to support this or if it would be required to write code to support this feature? Thanks,Alan

3 3

Need to define behaviour when storing pwdChangedTime
by David Coutadeur 31 Jan '22

31 Jan '22

Hi, When doing a backup / restore on my OpenLDAP 2.5.9 instance, I faced a behaviour that I think must be defined explicitely, in draft-behera-ldap-password-policy, or at least in OpenLDAP documentation. My backup contains an entry like this: dn: uid=test,ou=people,ou=branch,dc=example,dc=com cn: test sn: test givenName: test uid: test userPassword: secret pwdChangedTime: 20220110153431Z mail: test(a)domain.com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person There is also a valid default password policy: (which must be defined before the users in the backup file) dn: cn=default,ou=ppolicies,dc=example,dc=com objectClass: pwdPolicy objectClass: pwdPolicyChecker objectClass: organizationalRole cn: default pwdMaxAge: 7776000 pwdAttribute: userPassword pwdCheckQuality: 2 pwdLockout: TRUE pwdMaxFailure: 5 pwdMinLength: 6 pwdMustChange: TRUE pwdCheckModule: /usr/local/openldap/lib64/ppm.so When restoring the backup with this command: ldapadd -x -h '127.0.0.1:389' -D 'cn=Manager,dc=example,dc=com' -w 'secret' -f backup.ldif -e relax I have an error showing that the attribute pwdChangedTime is duplicated and must not be defined twice. I assume that the password policy does not replace my pwdChangedTime value with the current date, but duplicates the attribute. Could you define this behaviour somewhere? 1/ Is it possible to update the pwdChangedTime attribute along with the userPassword ? 2/ If so, what value should be stored? (the given value or the current date?) 3/ Optionally, update OpenLDAP code according to the defined behaviour Thanks in advance for your answer. Regards, David

5 7

How to properly test whether an asynchronous ldap_connect() has fully connected?
by nickpelling＠nickpelling.com 27 Jan '22

27 Jan '22

I'm trying to run OpenLDAP on a Cortex-M7 processor, but to be a "good citizen" my LDAP client code needs to connect asynchronously. (The code connects synchronously fine.) Stripped down to the bare minimum (i.e. no error handling) for clarity here (the actual code has tons of error handling), my asynchronous connection code looks like this: ldap_set_option(pstContext->ld, LDAP_OPT_CONNECT_ASYNC, LDAP_OPT_ON); // Enable async connection ldap_connect(ld); // Do the LDAP connection As you'd expect, the next step is to test (asynchronously) whether the connection has completed, but it can't see any OpenLDAP functionality to do this directly. So here's what my test currently looks like: /** * Determine whether a connection has yet connected * * @param[in] LDAP connection instance to test * * @retval 0 if connection has connected * @retval -2 if connection is still waiting * @return ...otherwise an unexpected problem was encountered */ int ldap_connection_connected(LDAP * ld) { ber_socket_t sd; int iRetVal; iRetVal = -99; // Default to "an unexpected problem was encountered" if (ld->ld_defconn != NULL) { if (ld->ld_defconn->lconn_status == LDAP_CONNST_CONNECTED) { iRetVal = 0; // i.e. the connection has already connected, so exit early! } else { // Get the connection's sockbuffer ber_sockbuf_ctrl( ld->ld_defconn->lconn_sb, LBER_SB_OPT_GET_FD, &sd ); // Check to see if a result has yet been received via this sockbuffer iRetVal = ldap_int_check_async_open( ld, sd ); } } return iRetVal; } However, my bind code (i.e. that executes immediately after this) fails to connect to the server after an asynchronous ldap_connect(), even though it works fine after a synchronous ldap_connect(). Moreover, it looks to me (from the timings) as though my test for asynchronous connection is signalling completion earlier than I'm expecting, so I'm wondering if this is not waiting properly, e.g. if it's returning after the very first message response when it should be waiting for a whole series of message responses to arrive. Am I missing some clever OpenLDAP trick for correctly detecting when asynchronous ldap_connect() calls have fully connected? Thanks!

1 0

mdb_txn_begin() before mdb_dbi_open()
by Sam Dave 25 Jan '22

25 Jan '22

Hello, 1. I create a read-only transaction on an environment with mdb_txn_begin(). 2.Then I get a database handle on the same environment (using mdb_dbi_open() within a separate transaction). 3. Finally I try to create and use a cursor using the database in 2. and transaction in 1. but I get various runtime errors ("Segmentation fault" or "double free or corruption"). However, if I switch 1. and 2., everything works. Must a database really be created before a transaction? If so, curious to learn if this is mentioned anywhere in the docs (I didn't see it) Regards, Sam

2 1

mdb_cursor_close and mdb_txn_close/abort for read-only transactions
by Sam Dave 24 Jan '22

24 Jan '22

Hello, The mdb_cursor_close() documentation says: "Its transaction must still be live if it is a write-transaction." This leads me to my question: For *read-only* transactions, is it allowed to run mdb_cursor_close() *after* mdb_txn_close() or mdb_txn_abort()? Regards, Sam

2 2

Problem with connection on localhost for push replication
by frederic.goudal＠bordeaux-inp.fr 21 Jan '22

21 Jan '22

Hello, I have a strange problem : I have a push replication setup and delta-sync on a 2.6.0 instance. My replication is broken. What I find in the log is the following : slap_client_connect: URI=ldap://localhost DN="uid=ldapsync,ou=people,dc=ipb,dc=fr" ldap_sasl_bind_s failed (-5) than it retries 5 times, and in the log I just find : ldapa2021 slapd[265608]: do_syncrep1: rid=415 starting refresh (sending cookie=rid=415,csn=20130927152219.157851Z#000000#001#000000;20131127140429.597497Z#000000#002#00000\ 0;20141208130549.278599Z#000000#004#000000;20220120073003.212785Z#000000#00a#000000;20220119182551.334341Z#000000#018#000000) ldapa2021 slapd[265608]: conn=1008 op=1 syncprov_op_search: got a persistent search with a cookie=rid=415,csn=20130927152219.157851Z#000000#001#000000;20131127140429.59749\ 7Z#000000#002#000000;20141208130549.278599Z#000000#004#000000;20220120073003.212785Z#000000#00a#000000;20220119182551.334341Z#000000#018#000000 slapd[265608]: do_syncrep2: rid=415 LDAP_RES_SEARCH_RESULT slapd[265608]: do_syncrep2: rid=415 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform ldapa2021 slapd[265608]: do_syncrep2: rid=415 (53) Server is unwilling to perform ldapa2021 slapd[265608]: do_syncrepl: rid=415 rc -101 retrying every five minutes. The problem is that if I do an external ldapsearch with the same bind_dn and the password in the syncrepl definition, the bind is correct. my syncrelpl entry is {0}rid=415 provider=ldap://localhost binddn="uid=ldapsync,ou=people,dc=ipb,dc=fr" bindmethod=simple credentials=****** filter="(objectclass=*)" searchbase="dc=ipb,dc=fr" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 exattrs=hasSubordinates I'm a bit lost... -- Frédéric Goudal DSI Bordeaux-INP 05 56 84 23 11

1 0

2.6.1 with olcTLSVerifyClient=demand fails - TLS accept failure error, error=-1
by patrick+openldap.org＠laimbock.com 21 Jan '22

21 Jan '22

Hi, I'm having trouble getting OpenLDAP 2.6.1 on AlmaLinux 8.5 to work with olcTLSVerifyClient=demand which results in: connection_read(11): TLS accept failure error=-1 id=1001, closing ... conn=1001 fd=11 closed (TLS negotiation failure). With olcTLSVerifyClient=try I get: error unable to get TLS client DN, error 49. I tried various Google suggestions: check certificate permissions, SELinux AVCs (there are none), created CA, server and client certificates with EasyRSA and manually created the same certificates, ran slapd as root and tried with a python-ldap script. [root@ldap1 openldap]# ldapwhoami -d 1 -H ldaps://<FQDN> -x ... connect success TLS trace: SSL_connect:before SSL initialization TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS read server hello TLS trace: SSL_connect:TLSv1.3 read encrypted extensions TLS trace: SSL_connect:SSLv3/TLS read server certificate request TLS certificate verification: depth: 1, err: 0, subject: /C=NL/O=Example/OU=IT/CN=OpenLDAP-CA, issuer: /C=NL/O=Example/OU=IT/CN=OpenLDAP-CA TLS certificate verification: depth: 0, err: 0, subject: /C=NL/O=Example/OU=IT/CN=<FQDN>, issuer: /C=NL/O=Example/OU=IT/CN=OpenLDAP-CA TLS trace: SSL_connect:SSLv3/TLS read server certificate TLS trace: SSL_connect:TLSv1.3 read server certificate verify TLS trace: SSL_connect:SSLv3/TLS read finished TLS trace: SSL_connect:SSLv3/TLS write change cipher spec TLS trace: SSL_connect:SSLv3/TLS write client certificate TLS trace: SSL_connect:SSLv3/TLS write finished ... TLS trace: SSL3 alert read:fatal:unknown ldap_err2string ldap_result: Can't contact LDAP server (-1) There is only one ldap.conf and it's in /etc/openldap: BASE dc=example,dc=ldap URI ldaps://<FQDN> TLS_CACERT /etc/openldap/certs/openldap-CA.crt TLS_CERT /etc/openldap/certs/ldap-admin.crt TLS_KEY /etc/openldap/certs/ldap-admin.key TLS_REQCERT demand Certificates (slapd runs with -u ldap): [root@ldap1 certs]# ll /etc/openldap/certs total 20 -rw-r--r--. 1 root root 1980 21 jan 15:24 <FQDN>.crt -r--------. 1 ldap root 2484 21 jan 15:24 <FQDN>_nopass.key.crt -rw-r--r--. 1 root root 1984 21 jan 15:24 ldap-admin.crt -r--------. 1 patrick root 2484 21 jan 15:24 ldap-admin_nopass.key.crt -rw-r--r--. 1 root root 1952 21 jan 15:24 openldap-CA.crt dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcPidFile: /run/openldap/slapd.pid olcPasswordCryptSaltFormat: $6$%s olcLogLevel: -1 olcTLSCACertificateFile: /etc/openldap/certs/openldap-CA.crt olcTLSCertificateFile: /etc/openldap/certs/ldap-server.crt olcTLSCertificateKeyFile: /etc/openldap/certs/ldap-server.key olcTLSDHParamFile: /etc/pki/tls/certs/dhparam2048 olcTLSVerifyClient: demand The certificates are attached (the keys have no password) plus the output of 'openssl x509 -text -noout -in <cert> > <cert>.txt'. The python script test.py that I used is also attached. Thank you for any suggestions how to make this work or where to look. Best, Patrick

2 1

Reason behind "OPENLDAP_2.200" version number for openldap 2.6 version?
by thrivikram.rage＠gmail.com 21 Jan '22

21 Jan '22

Hi There , Is there any reason behind "OPENLDAP_2.200" version number for openldap 2.6 version ? , For earlier versions of "openldap 2.5.7 " the generated file was "OPENLDAP_2.5.7". Thanks, Vikram

2 1

OpenLDAP 2.6.1 testing call #1 (OpenLDAP 2.6.1)
by Quanah Gibson-Mount 20 Jan '22

20 Jan '22

This is the first testing call for OpenLDAP 2.6.1. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. We are aware of two issues with the regression suite tests failing (its4448 and its8752), so no need to report failures for those. Thanks! OpenLDAP 2.6.1 Engineering Fixed libldap to init client socket port (ITS#9743) Added slapd config keyword for logfile format (ITS#9745) Fixed slapd to allow objectClass edits with no net change (ITS#9772) Fixed slapd configtable population (ITS#9576) Fixed slapd to only set loglevel in server mode (ITS#9715) Fixed slapd logfile-rotate use of uninitialized variable (ITS#9730) Fixed slapd passwd scheme handling with slapd.conf (ITS#9750) Fixed slapd postread support for modrdn (ITS#7080) Fixed slapd syncrepl recreation of deleted entries (ITS#9282) Fixed slapd syncrepl replication with ODSEE (ITS#9707) Fixed slapd syncrepl to properly replicate glue entries (ITS#9647) Fixed slapd syncrepl to reject REFRESH for precise resync (ITS#9742) Fixed slapd syncrepl to avoid busy loop during refresh (ITS#9584) Fixed slapd syncrepl when X-ORDERED is specified (ITS#9761) Fixed slapd syncrepl to better handle out of order delete ops (ITS#9751) Fixed slapd syncrepl to correctly close connections when config is deleted (ITS#9776) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapd-wt to set correct flags (ITS#9760) Fixed slapo-accesslog to fix assertion due to deprecated code (ITS#9738) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapo-accesslog delete handling of multi-valued config attrs (ITS#9493) Fixed slapo-autogroup to maintain values in insertion order (ITS#9766) Fixed slapo-constraint to maintain values in insertion order (ITS#9770) Fixed slapo-dyngroup to maintain values in insertion order (ITS#9762) Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-dynlist static group filter with multiple members (ITS#9779) Fixed slapo-ppolicy when not built modularly (ITS#9733) Fixed slapo-refint to maintain values in insertion order (ITS#9763) Fixed slapo-retcode to honor requested insert position (ITS#9759) Fixed slapo-sock cn=config support (ITS#9758) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) Fixed slapo-syncprov to allow empty DB to host persistent syncrepl connections (ITS#9691) Fixed slapo-syncprov to consider all deletes for sycnInfo messages (ITS#5972) Fixed slapo-translucent to warn on invalid config (ITS#9768) Fixed slapo-unique to warn on invalid config (ITS#9767) Fixed slapo-valsort to maintain values in insertion order (ITS#9764) Build Environment Fix test022 to preserve DELAY search output (ITS#9718) Fix slapd-watcher to allow startup when servers are down (ITS#9727) Contrib Fixed slapo-lastbind to work with 2.6 lastbind-precision configuration (ITS#9725) Documentation Fixed slapd.conf(5)/slapd-config(5) documentation on lastbind-precision (ITS#9728) Fixed slapo-accesslog(5) to clarify logoldattr usage (ITS#9749) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 3

CRL refresh in OpenLDAP
by Xabier Berasategui Cano 19 Jan '22

19 Jan '22

Hi, We have an application that uses a client certificate to authenticate to OpenLDAP server 2.4.46 at SSL/TLS level. Among other things, olcTLSCRLCheck directive is configured to "peer" value to verify if the client certificate has not been revoked and the CRL is updated every day via script and expires after 15 days. Everything works well until the 15 days are exceeded and the authentication of the application fails since the server has not been restarted to refresh the CRL. Is there a way to refresh the CRL without restarting the server? Thanks in advance Regards P Please consider the environment before printing this e-mail.

2 1

RE25 testing call #1 (OpenLDAP 2.5.10)
by Quanah Gibson-Mount 19 Jan '22

19 Jan '22

This is the first testing call for OpenLDAP 2.5.10. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! We are aware of two issues with the regression suite tests failing (its4448 and its8752), so no need to report failures for those. OpenLDAP 2.5.10 Engineering Fixed libldap to init client socket port (ITS#9743) Fixed slapd to allow objectClass edits with no net change (ITS#9772) Fixed slapd syncrepl recreation of deleted entries (ITS#9282) Fixed slapd syncrepl replication with ODSEE (ITS#9707) Fixed slapd syncrepl to reject REFRESH for precise resync (ITS#9742) Fixed slapd syncrepl when X-ORDERED is specified (ITS#9761) Fixed slapd syncrepl to better handle out of order delete ops (ITS#9751) Fixed slapd syncrepl to correctly close connections when config is deleted (ITS#9776) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapd-wt to set correct flags (ITS#9760) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapo-autogroup to maintain values in insertion order (ITS#9766) Fixed slapo-constraint to maintain values in insertion order (ITS#9770) Fixed slapo-dyngroup to maintain values in insertion order (ITS#9762) Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-dynlist static group filter with multiple members (ITS#9779) slapo-refint to maintain values in insertion order (ITS#9763) Fixed slapo-retcode to honor requested insert position (ITS#9759) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) Fixed slapo-translucent to warn on invalid config (ITS#9768) Fixed slapo-unique to warn on invalid config (ITS#9767) Fixed slapo-valsort to maintain values in insertion order (ITS#9764) Documentation Fixed slapo-accesslog(5) to clarify logoldattr usage (ITS#9749) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Members of groups should be able to change user passwords. Can't find the error im mi Ldif file
by cupcake＠domayn.ch 18 Jan '22

18 Jan '22

Hi there, I can't seem to find my error in my Ldif file. I have an openLDAP server and I'd like to change the config, that every member of the group sys_allow_pw_change is able to change the password of every user. It's been a while since I've last used openLDAP. I got the current ACLs using ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \ > cn=config '(olcDatabase={1}mdb)' olcAccess dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read So I've created pwchange.ldif with the help of this serverfault post (https://serverfault.com/questions/1064914/q-what-is-the-correct-way-to-add-…): dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword by self write by dn="cn=admin,dc=ldap,dc=example,dc=com" manage by dn="[cn=sys_allow_pw_change,ou=Groups,dc=ldap,dc=example,dc=com]/memberUid & user/uid" write by anonymous auth by * none - add: olcAccess olcAccess: {1}to attrs=shadowLastChange by self write by * read - add olcAccess olcAccess: {2}to * by * read So I'm adding the group in question to olcAccess{0} and re adding all the current config. However: ldapmodify -a -x -D "cn=admin,dc=ldap,dc=example,dc=com" -w Passw0rd! -H ldap:// -f pwchange.ldif results in ldapmodify: invalid format (line 9) entry: "olcDatabase={1}mdb,cn=config" (Line 9 is by * none) Thanks for any pointers!

2 7

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CWE ID 90)
by chinnac412＠gmail.com 17 Jan '22

17 Jan '22

I am Using SearchControls constraints = new SearchControls(); NamingEnumeration answer = ctx.search("DC=YourDomain,DC=com", "sAMAccountName=" + username, constraints); when i Run the Varacode Dynamic scan i am getting the Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') when i debug i can see { constraints } is printing Special Characters like example ( specila@345678) so any solution or else any other alternate way to use instead of SearchControls

2 1

OPENLDAP_2.200 is this equivalent to openldap 2.6 version?
by thrivikram.rage＠gmail.com 13 Jan '22

13 Jan '22

Hi There , After building openldap 2.6 , i have noticed "OPENLDAP_2.200" when i grep for openldap version. is this correct version ?, can you please confirm.

2 1

mmr of cn=config with OpenLDAP 2.6
by Stefan Kania 11 Jan '22

11 Jan '22

Hi to all, is it now save to use mmr of cn=config with OpenLDAP 2.6? I got it running with 4 server. I'm installing all 4 server with Ansible so I created a basic configuration: ------------------ dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/symas/run/slapd.pid olcArgsFile: /var/symas/run/slapd.args olcToolThreads: 1 olcServerID: 4 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # Read all needed schema from variable in default/main.yml include: file:///opt/symas/etc/openldap/schema/core.ldif include: file:///opt/symas/etc/openldap/schema/cosine.ldif include: file:///opt/symas/etc/openldap/schema/nis.ldif include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif include: file:///opt/symas/etc/openldap/schema/dyngroup.ldif include: file:///opt/symas/etc/openldap/schema/kerberos.openldap.ldif # Read all modules from variable in default/main.yml dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: back_mdb olcModuleLoad: back_monitor olcModuleLoad: autoca.la olcModuleLoad: otp.la olcModuleLoad: argon2.la olcModuleLoad: syncprov olcModuleLoad: back_monitor olcModuleLoad: accesslog.la dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcSizeLimit: 500 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcPasswordHash: {ARGON2} dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by * break dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcmdbConfig olcDatabase: {2}mdb olcSuffix: dc=example,dc=net olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbCheckpoint: 512 30 olcDbDirectory: /var/symas/openldap-data olcDbIndex: default eq olcDbIndex: objectClass olcDbIndex: entryUUID olcDbIndex: entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: description pres,eq,sub olcDbIndex: title pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbMaxSize: 85899345920 olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimited size=unlimited olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlimited size=unlimited ------------------ The "ServerID" is different for every server, every thing else is identical. Then I created a file to change the serverID: ------------------ dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldap01.example.net olcServerID: 2 ldap://ldap02.example.net olcServerID: 3 ldap://ldap03.example.net olcServerID: 4 ldap://ldap04.example.net ------------------ and a file to configure the replication: ------------------ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=1 provider=ldap://ldap01.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes olcSyncRepl: rid=2 provider=ldap://ldap02.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes olcSyncRepl: rid=3 provider=ldap://ldap03.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes olcSyncRepl: rid=4 provider=ldap://ldap04.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes - add: olcMirrorMode olcMirrorMode: TRUE ------------------ When I configure the server via Ansible (everything in one playbook) the replication of cn=config is not working. When I only do the basic configuration via Ansible and then add the change of serverID and then the replication of cn=config step by step on every single server: ------------- ldapmodify -Y EXTERNAL -H ldapi:/// -f serverid.ldif ldapmodify -Y EXTERNAL -H ldapi:/// -f repl_config.ldif ------------- everything is fine. The two files "serverid.ldif" and "repl_config.ldif" are the files Ansible created, so the content of the file is the same. Can it be, that the problem is because Ansible first sets all the ServerIDs on all servers and then configure the replication of cn=config on all servers? For setting up the configuration I took: https://www.openldap.org/devel/admin/replication.html Starting at 18.3.3 What I don't understand: Do I realy have to put all Servers in the replication, even the server it self? So do I realy have to add on Server-01, the Server "server-01, server-02, server-03 ,server-04" to the replication? Dosn't it mean that server-01 is replicating to it self? If it's correct, can someone explain why? O did I understud something wrong on the webpage? Stefan

3 12

Help on building and configuring openLdap V2.6.0
by Stampfl, Burt 06 Jan '22

06 Jan '22

Hi, I'm new to OpenLDAP. Pulled down the current 2.6 release to a Debian target and am having trouble figuring out how to build the backend modules for dynamic use. What I did: 1. Downloaded openldap-2.6.0.tgz and extracted the source on my Debian target. 2. configured the 'build' via (output indicated it was successful) : ./configure --enable-sql=no --enable-wt=no --enable-spasswd=yes --enable-passwd=yes --enable-perl=yes --enable-crypt=yes --enable-ldap=yes --enable-slapd=yes --enable-ppolicy=yes --enable-otp=yes --enable-auditlog=yes --enable-modules=yes --with-cyrus-sasl=yes 3. ran 'make depend' (output indicated it was successful). 4. ran 'make' (output indicated it was successful). 5. ran the tests via 'env SLAPD_DEBUG=1 make test' (output indicated it was successful). 6. Installed it via 'su root -c 'make install' I was able to pretty easily get the slapd server running, create a database (mdb) add users, etc, and access via a remote client. Once I was able to do that I wanted to enable the ppolicy backend/overlay and have not been able to get this to work. Looking online it appears I need some 'backend' modules like back-mdb.la, ppolicy.la, etc and I cannot find them anywhere in my build tree. I had thought the --enable-xxx directives I used in the config step would have forced this to build them, but I guess not. How do I create these dynamic backend modules and is there any documentation on how to use them in the newer dynamic configuration schema ? I've attached a file with the output from the steps I performed above. Thank you Burt Burt Stampfl AMSC (NASDAQ: AMSC) W231 N2844 Roundy Circle Suite D, Pewaukee, WI 53072 USA Work: +1 262.901.6007 Mobile: +1 847.638.1792 burt.stampfl(a)amsc.com<mailto:burt.stampfl@amsc.com> amsc.com<http://www.amsc.com/> [Description: Description: cid:image001.jpg@01CC890F.E40B1CB0] "This e-mail message and any attachments are confidential and may be privileged. If you are not the intended recipient please notify AMSC immediately by replying to this message or by sending a message to postmaster(a)amsc.com and destroy all copies of this message and any attachments. Thank you."

2 1

Error with slapadd & syncrepl ldif file
by David White 06 Jan '22

06 Jan '22

At last, I'm trying to setup a consumer to replicate data off of a primary ldap server running the Symas-provided v2.6 packages on Ubuntu 20.04. The following links were very helpful to me: https://openldap-software.0penldap.narkive.com/VEt6vIEI/syncrepl-ldif-kicks… https://www.openldap.org/pub/hyc/LDAPcon2007s.pdf I have built an ldif file that I'm trying to slapadd. But when the binddn contains anything other than "cn" attributes, slapadd produces an error. My Question: Why can I not use a binddn that contains anything other than "cn" attributes, like "uid", "dc", or "ou"? Specific details with debug below: The following works perfectly fine: root@ldapconsumer:/opt/symas/etc/openldap# /opt/symas/sbin/slapadd -l /home/myself/ldap/consumer_sync.ldif -F /opt/symas/etc/openldap/slapd.d/ -w -n0 Closing DB.. root@ldapconsumer:/opt/symas/etc/openldap# cat /home/myself/ldap/consumer_sync.ldif dn: cn=config objectClass: olcGlobal cn: config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncRepl: rid=001 provider=ldap://172.16.2.5 binddn="cn=admin,cn=example,cn=com" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" Alternatively, this works as the binddn: cn=ldap.sync,cn=example,cn=com But the following values in the binddn do NOT work: - binddn=cn=ldap.sync,dc=example,dc=com - binddn=uid=sync,ou=People,dc=example,dc=com In either of the examples above that do NOT work, I'm getting an "invalid bind config value" error message. See below for full stdout with 1 example: root@ldapconsumer:/opt/symas/etc/openldap# /opt/symas/sbin/slapadd -l /home/myself/ldap/consumer_sync.ldif -F /opt/symas/etc/openldap/slapd.d/ -w -n0 invalid bind config value binddn=uid=ldap.sync,ou=People,dc=example,dc=com olcSyncrepl: value #0: Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" . failed to add syncinfo slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=5): Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" Closing DB... If I run this with debug enabled, below is what I see (not sure if this will be helpful or not, but am providing it just in case). Password has been redacted of course. root@ldapconsumer:/opt/symas/etc/openldap# /opt/symas/sbin/slapadd -l /home/myself/ldap/consumer_sync.ldif -F /opt/symas/etc/openldap/slapd.d/ -w -n0 -d -1 slapadd init: initiated tool. slap_sasl_init: initialized! backend_startup_one: starting "cn=config" ldif_read_file: no entry file "/opt/symas/etc/openldap/slapd.d//cn=config.ldif" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=32 matched="" text="" >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init {snip} slapadd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default => str2entry: "dn: cn=config objectClass: olcGlobal cn: config " >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> <= str2entry(cn=config) -> 0x5574eedc21b8 oc_check_required entry (cn=config), objectClass "olcGlobal" oc_check_allowed type "objectClass" oc_check_allowed type "cn" oc_check_allowed type "structuralObjectClass" ldif_write_entry: wrote entry "cn=config" => str2entry: "dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncRepl: rid=001 provider=ldap://172.16.2.5 binddn="uid=ldap.sync,ou=People,dc=example,dc=com" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5"" >>> dnPrettyNormal: <olcDatabase={0}config,cn=config> <<< dnPrettyNormal: <olcDatabase={0}config,cn=config>, <olcDatabase={0}config,cn=config> >>> dnNormalize: <cn=admin,cn=config> <<< dnNormalize: <cn=admin,cn=config> <= str2entry(olcDatabase={0}config,cn=config) -> 0x5574eedc2258 oc_check_required entry (olcDatabase={0}config,cn=config), objectClass "olcDatabaseConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcDatabase" oc_check_allowed type "olcRootDN" oc_check_allowed type "olcRootPW" oc_check_allowed type "olcSyncrepl" oc_check_allowed type "structuralObjectClass" config_build_entry: "olcDatabase={-1}frontend" slap_get_csn: conn=-1 op=0 generated new csn=20220106202401.439197Z#000000#000#000000 manage=0 ldif_read_file: read entry file: "/opt/symas/etc/openldap/slapd.d//cn=config.ldif" => str2entry: "# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 fd732ca0 dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobalentryUUID: 54643148-037a-103c-8b74-e78e18fa89a5 creatorsName: cn=config createTimestamp: 20220106202401Z entryCSN: 20220106202401.438467Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20220106202401Z " >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> >>> dnNormalize: <cn=config> <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> <<< dnNormalize: <cn=config> <= str2entry(cn=config) -> 0x5574eedc22f8 ldif_write_entry: wrote entry "olcDatabase={-1}frontend,cn=config" >>> dnPrettyNormal: <cn=admin,cn=config> <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> >>> dnPrettyNormal: <cn=admin,cn=config> <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> >>> dnNormalize: <uid=ldap.sync,ou=People,dc=example,dc=com> invalid bind config value binddn=uid=ldap.sync,ou=People,dc=example,dc=com olcSyncrepl: value #0: Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" . failed to add syncinfo syncinfo_free: rid=001 slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=5): Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" slapadd shutdown: initiatedslapadd destroy: freeing system resources. Sent with ProtonMail Secure Email.

1 0

OpenLDAP's UB minefield
by openldap-technical＠kolttonen.fi 06 Jan '22

06 Jan '22

Someone recently wrote on openldap-bugs: > The kernel recently got bitten using the same pattern of unaligned > short pointers through casts. GCC produced code which corrupted > initramfs during unpacking. > > See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D100363. > OpenLDAP should fix that code. Correct. That's what I said long time ago, too. I wonder if OpenLDAP projects' delusions about Undefined Behaviour "not being a bug" still persist, or are they perhaps going to fix their buggy code? What a minefield to walk on, it can blow up anytime. I am very happy to not have to administer this server code anymore, but I sure am scared for those who do. best regards, Unto Sten

2 1

slapcat & cn=config database
by David White 06 Jan '22

06 Jan '22

I'm starting a new thread on a different topic, as my current issue is veering way off topic from my original thread (c/f https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/… and c/f https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/…). Thanks to Ulrich's suggestion to run slapcat -n0 with debug (-d -1). That did indeed get me some more information, but I still cannot pinpoint why slapcat keeps telling me that it "could not open database". To recap: I'm currently running the Symas-provided openldap package v2.6, and my ultimate goal is to build a push-based proxy with syncrepl. But this thread is about the cn=config database. As part of my troubleshooting, I found this quite old thread about the different ways to start slapd: https://openldap-technical.openldap.narkive.com/Y1yq9Qd1/can-not-modify-cn-… I stopped slapd with: systemctl stop slapd I then manually started it like so, in order to force it to use the ldif directory instead of the slapd.conf file: /opt/symas/lib/slapd -F /var/symas/openldap-data/slapd.d/ This started right up, and I can confirm slapd is running. I'm able to run a ldapsearch against: -b "cn=config" like so, where we see all of the various databases, frontend, and Overlays configured. I have redacted the password, and changed the domain to "example" in the following stdout. Given this information, I'm still very confused why slapcat can't open the cn=config database for its own processing. Any help on this would be appreciated. root@ldap-provider:~# ldapsearch -x -LLL -D cn=config -W -s sub -b "cn=config" "(olcDatabase=*)" '*' '+' -v ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (olcDatabase=*) requesting: * + dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: FALSE olcLastMod: TRUE olcLastBind: TRUE olcLastBindPrecision: 0 olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 047a4d82-01dd-103c-8345-d3830b8ac76f creatorsName: cn=config createTimestamp: 20220104190525Z entryCSN: 20220104190525.214003Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20220104190525Z entryDN: olcDatabase={-1}frontend,cn=config subschemaSubentry: cn=Subschema dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcLastBind: TRUE olcLastBindPrecision: 0 olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcRootPW: secret olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 047a4fda-01dd-103c-8346-d3830b8ac76f creatorsName: cn=config createTimestamp: 20220104190525Z entryCSN: 20220104190525.214003Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20220104190525Z entryDN: olcDatabase={0}config,cn=config subschemaSubentry: cn=Subschema dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/symas/openldap-data olcSuffix: dc=example,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcLastBind: TRUE olcLastBindPrecision: 0 olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=example,dc=com olcRootPW: secret olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbNoSync: FALSE olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbMaxReaders: 0 olcDbMaxSize: 10485760 olcDbMode: 0600 olcDbSearchStack: 16 olcDbMaxEntrySize: 0 olcDbRtxnSize: 10000 structuralObjectClass: olcMdbConfig entryUUID: 047a52be-01dd-103c-8347-d3830b8ac76f creatorsName: cn=config createTimestamp: 20220104190525Z entryCSN: 20220104190525.214003Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20220104190525Z entryDN: olcDatabase={1}mdb,cn=config subschemaSubentry: cn=Subschema dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 structuralObjectClass: olcSyncProvConfig entryUUID: 047a54da-01dd-103c-8348-d3830b8ac76f creatorsName: cn=config createTimestamp: 20220104190525Z entryCSN: 20220104190525.214003Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20220104190525Z entryDN: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config subschemaSubentry: cn=Subschema Sent with ProtonMail Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Wednesday, January 5th, 2022 at 9:40 AM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > Hi! > > I meant: The debug output is useless when you leave out "-n0" (the case that > > doesn't work for you). > > > > > David White dmwhite823(a)protonmail.com schrieb am 05.01.2022 um 15:14 in > > Nachricht > > > > qn5VCvnElSb0fkpWltSUlY7hWAU=(a)protonmail.com>: > > > That's the thing. > > > > -n0 always returns "unknown database". > > > > Only -n1 returns data. > > > > Thanks for the suggestion, though. :) > > > > Sent with ProtonMail Secure Email. > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > > > > On Wednesday, January 5th, 2022 at 8:11 AM, Ulrich Windl > > > > Ulrich.Windl(a)rz.uni-regensburg.de wrote: > > > > > It seems you missed "-n0" for slapcat. > >

3 5

Guide to setup syncrepl with proxy-based push config
by David White 05 Jan '22

05 Jan '22

Hello, I have some basic experience interacting with & troubleshooting OpenLDAP as well as 389-ds, but I don't have a whole lot of experience setting them up or configuring an OpenLDAP server. My goal is to setup replication from a Primary inside a trusted network outwards to a Replica that is in an untrusted network, without allowing the replica any direct access to the primary, due to firewall flows and network requirements. This is true even for the initial connection, so a simple RefreshAndPersist configuration won't work. I have read that it is possible to setup a push-based replication using a proxy, such that: - The proxy gets installed as a "hidden" database onto the same server as the primary - The proxy sets up replication with the primary using RefreshAndPersist - The proxy is then able to push the data out of the replica I have skimmed over, and re-read, a lot of portions from this document: https://www.openldap.org/doc/admin24/replication.html I have also followed this basic guide to setup a Primary with replication capability: https://ubuntu.com/server/docs/service-ldap-replication What I'm having trouble with, is finding a useful guide that will walk me through the process to setup and configure the proxy as I've described above. Questions: - Based on my requirements above, will the proxy with syncrepl meet my needs? - If I put the proxy onto the same server as the primary, then due to firewall flows, the replica will not have any access to the primary. All communication will need to be initiated outbound - If I put the proxy into the same network as the replica, well.... that won't work either, for the same reason - The following URL from the OpenLDAP docs provides some example configs: https://www.openldap.org/doc/admin24/replication.html#Syncrepl%20Proxy - If I'm reading everything correctly, though, the "new" / "accepted" / "preferred" way to configure the ldap server is to use the `ldapadd`, `ldapmodify`, and related commands. My confusion and question here is.... should I try to configure all of this by editing the old slapd.conf file as the openldap.org docs provide examples, or is there a way to do this using the ldapmodify & related commands? - If I can / should do this from the command line... are there any guides or tutorials that will take me step-by-step through the process as I try to build this in a lab environment? Thanks in advance, David Sent with ProtonMail Secure Email.

4 15

Re: [EXT] Re: openldap ppolicy pwdAccountLockedTime
by kevin martin 03 Jan '22

03 Jan '22

Hmm, module loaded. I'm not doing a moduleload of anything ppolicy related, simply setting the overlay ppolicy, the ppolicy_default, and ppolicy_use_lockout. What's the module to load as I don't find a ppolicy la file after compiling? Can you point me to a doc that explains the proper way to use this now? On Mon, Jan 3, 2022, 10:41 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, January 3, 2022 9:39 AM -0600 kevin martin <ktmdms(a)gmail.com> > > wrote: > > > > > In 2.4 I was still pulling in the schema. In 2.5 ppolicy is compiled as > > part of the code. Assuming it just works, how does one go about setting > > pwdAccountLockedTime for a user then? I can't add it as an attribute of > > the user so I'm not sure how it can be set. > > If it has been moduleloaded into the slapd process, the ppolicy schema is > known to slapd and available for use. If you are finding the attribute to > not be defined it would suggest you've failed to load the module as > required. I would note that you want to ensure you're running 2.5.8 or > later (See ITS#9671). > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 8

dynamic groups seach for memberUID openldap 2.6
by Stefan Kania 03 Jan '22

03 Jan '22

Hi to all, two years ago I tried to use dynamic groups as Posix-groups see post: https://www.openldap.net/lists/openldap-technical/201911/msg00028.html Now I tried it again with OpenLDAP 2.6 and the attribute memberUID is still not showing up. Is it still not possible to search for memberUid? @Quanah You wrote: There's work to change this behavior (See ITS#9121) for OpenLDAP 2.5. Is the work on it still in progress? Stefan

3 6

A very simple olcAccess rule doesn't work
by Volodymyr Melnyk 03 Jan '22

03 Jan '22

Dear colleagues, There's a question I posted on ServerFault (https://serverfault.com/questions/1088252/a-very-simple-olcaccess-rule-does…), but it seems that asking my question in this mailing list would be a better idea/ So, long story short, I have a domain (let's call it `dc=example,dc=org`) . The domain has a branch (`ou=users,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org`). There's a simpleSecurityObject in this domain (`uid=admin,ou=managers,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org`). I need the uid=admin,*** user to have full (manage) access to the ou=users,*** branch, so I added the following olcAccess record: `to dn.subtree="ou=users,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org" by dn.exact="uid=admin,ou=managers,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org"`. It has added to the default set of rules: ``` dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by dn="cn=a dmin,dc=example,dc=org" write by anonymous auth by * none olcAccess: {2}to * by self read by dn="cn=admin,dc=example,dc=org" write by * none olcAccess: {3}to dn.subtree="ou=users,ou=ftp,ou=services,dc=k9999,dc=z9999,dc= infra,dc=example,dc=org" by dn.exact="uid=admin,ou=managers,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org" manage ``` But something seems to be wrong. When I run `ldapsearch -D uid=admin,ou=managers,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org -W -b ou=users,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org`, I get the following result: ``` # extended LDIF # # LDAPv3 # base <ou=users,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 command terminated with exit code 32 ``` The object is actually available and `cn=admin,dc=example,dc=org` can see it without any difficulties, so it seems that my access rule is wrong. But what exactly it is? It seems that the default rule #2 (`{2} to * by self read by dn="cn=admin,dc=example,dc=org" write by * none`) fires up earlier than the rule I added. Does that mean that I should always add my custom rules before it? And why does this rule has `by * none`? Doesn't it contradict the OpenLDAP documentation? "The default access control policy is allow read by all clients" (https://www.openldap.org/doc/admin24/access-control.html). Thank you in advance. With best regards, V.Melnyk

2 2

openldap ppolicy pwdAccountLockedTime
by kevin martin 03 Jan '22

03 Jan '22

it appears from looking at ppolicy.c that pwdAccountLockedTime is not supported in openlda. is there another way to lock a users account in openldap outside of simply changing the users password? --- Regards, Kevin Martin

5 9

symas openldap-packages and kerberos
by Stefan Kania 03 Jan '22

03 Jan '22

Hello to all, I'm trying to get GSSAPI authentication running with the symas-packages. I generated a ldap.keytab file and it's readable for the ldap-user running the slapd. With the Debian-packages I ad: --------- export KRB5_KTNAME="/path/to/ldap.keytab" --------- I don't want to use the system keytab /etc/krb5.keytab. How do I tell slapd from the symas-packages to use my service-keytab? I try to add to my /etc/default/symas-openldap: --------- KRB5_KTNAME="/path/to/ldap.keytab --------- but it's not working. Stefan

6 19

remove overlay from cn=config 2.6
by Stefan Kania 03 Jan '22

03 Jan '22

hi to all, with 2.4.x the only way to remove an overlay from cn=config was exort cn=config edit the export and reimport it. I found a thread where it said: --------- This will probably be supported in OpenLDAP 2.5. --------- So is it possible somehow or do I still have to go the way with slapcat and slapadd? If it's possible where can I read how? Stefan

2 1

Interpreting username@domainname
by Volodymyr Melnyk 03 Jan '22

03 Jan '22

Hello, Is that possible to tweak some settings that would make OpenLDAP always interpreting `uid=username@domainname` as `uid=username,ou=domainname` in authentication queries? Of course, making the clients to do its job would be preferred, but this would be less preferable option in my case. With thanks in advance, V.Melnyk

2 1

right order mmr-main-DB combined with mmr cn=config
by Stefan Kania 15 Dec '21

15 Dec '21

Hello, I'm still working on replication of cn=config. The replication of the main DB is working with delta-syncrepl but I still have problems getting mmr running for cn=config. As I use Ansible to configure it here my question: Is the order of setting up the replication relevant? What I do at the moment: Setting up a basic config for all 4 servers: ----------------------------------------- dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/symas/run/slapd.pid olcArgsFile: /var/symas/run/slapd.args olcToolThreads: 1 olcServerID: 1 ldap://ldap01.example.net olcServerID: 2 ldap://ldap02.example.net olcServerID: 3 ldap://ldap03.example.net olcServerID: 4 ldap://ldap04.example.net # create cn=config #dn: olcBackend={0}mdb,cn=config #objectClass: olcBackendConfig #olcBackend: {0}mdb dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: back_mdb olcModuleLoad: back_monitor olcModuleLoad: autoca.la olcModuleLoad: otp.la olcModuleLoad: argon2.la olcModuleLoad: syncprov olcModuleLoad: back_monitor olcModuleLoad: accesslog.la include: file:///opt/symas/etc/openldap/schema/core.ldif include: file:///opt/symas/etc/openldap/schema/cosine.ldif include: file:///opt/symas/etc/openldap/schema/nis.ldif include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif include: file:///opt/symas/etc/openldap/schema/dyngroup.ldif include: file:///opt/symas/etc/openldap/schema/kerberos.openldap.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcSizeLimit: 500 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcPasswordHash: {ARGON2} dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by * break dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcmdbConfig olcDatabase: {2}mdb olcSuffix: dc=example,dc=net olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbCheckpoint: 512 30 olcDbDirectory: /var/symas/openldap-data olcDbIndex: default eq olcDbIndex: objectClass olcDbIndex: entryUUID olcDbIndex: entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: description pres,eq,sub olcDbIndex: title pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbMaxSize: 85899345920 olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimited size=unlimited olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlimited size=unlimited ----------------------------------------- As you can see serverID is already set to URL-style for all servers ;-) But now I'm not sure, do I have to set up the replication for cn=config on all 4 servers and then set up replication of the main DB on just one of the servers and let it be replicated by the cn=config-replication? Or do I have to set up replication of the main DB on all servers first and then add the replication of cn=config to all servers and only replicate the changes made afterwards? Or do I have to set up the replication of main-DB and replication of cn=config on one server at a time? Or can I do it either way? The testsuit is showing using updateref on the replication of the main-DB do I really need it for mmr? If yes, do I need it for mmr of cn=config? I could not find any example that uses both, mmr for main-DB and mmr for cn=config. here is the order of my set up for cn=config replication: ------------------------ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=1 provider=ldap://ldap01.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes tls_reqcert=allow olcSyncRepl: rid=2 provider=ldap://ldap02.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes tls_reqcert=allow olcSyncRepl: rid=3 provider=ldap://ldap03.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes tls_reqcert=allow olcSyncRepl: rid=4 provider=ldap://ldap04.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes tls_reqcert=allow - add: olcMultiprovider olcMultiprovider: TRUE ------------------------ And last but not least the set up of the main-DB replication: ----------------------- dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcSyncrepl olcSyncrepl: rid=102 provider=ldap://ldap02.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes tls_reqcert=allow olcSyncrepl: rid=103 provider=ldap://ldap03.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes tls_reqcert=allow olcSyncrepl: rid=104 provider=ldap://ldap04.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes tls_reqcert=allow - add: olcMultiprovider olcMultiprovider: TRUE ----------------------- This is the ldif for the first server so olcSyncrepl for ldap01.example.net is not configured. On the other servers is the same the own URI has no olcSyncrepl entry. Here olcUpdatRef is not configured. Replication of the main-DB is running. BTW olcUpdateRef is also not configured in the howto of Quanah ;-) So it must be ok :-) Could you please take a look if I did something wrong. I don't know where to look anymore.

2 5

ldap_search_ext_s fails with "Operations error" when using root as base dn
by Alex Ditu 15 Dec '21

15 Dec '21

Hi, When I try to query the root of my AD with scope LDAP_SCOPE_SUBTREE ldap_search_ext_s() fails with "Operations error". It happens only when I set the ldap_search_options.base to the domain DN (eg. DC=example,DC=com). If I use a more specific base, such as CN=Computers,DC=example,DC=com the operation succeeds. Is there a limitation to the search function? pseudocode snippet: ``` ldap_search_options ldap_opts; ldap_opts.base = "DC=example,DC=com"; ldap_opts.scope = LDAP_SCOPE_SUBTREE; ```

2 1

Ldap sync has broken from time to time
by skeletor 15 Dec '21

15 Dec '21

Hi. We have a one master and 8 slaves. From time to time replication has broken and data has stopped to update on slaves. In logs i see next: syncrepl_null_callback : error code 0x50 syncrepl_entry: rid=000 be_modify cn=union,ou=roles,dc=staff,dc=com (80) syncrepl_entry: rid=000 be_modify failed (80) do_syncrepl: rid=000 rc 80 retrying do_syncrep1: rid=000 starting refresh (sending cookie=rid=000,csn=20211213150433.004754Z#000000#000#000000) do_syncrep2: rid=000 LDAP_RES_INTERMEDIATE - SYNC_ID_SET syncrepl_message_to_entry: rid=000 DN: cn=union,ou=roles,dc=staff,dc=com, UUID: 67c22522-0749-1039-933a-fdc6b5a9b3b7 syncrepl_entry: rid=000 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 4 "error code 0x50" means other ldap error. How to determine, what exactly wrong? There is no dependence with slaves or versions: - master has 2.4.50 - slaves have different versions: 2.4.50, 2.4.55, 2.4.57. All of slaves can breake. We use next configuration: syncrepl rid=000 provider=ldaps://ldap-master.domain.com type=refreshAndPersist retry="5 5 300 +" searchbase="dc=staff,dc=com" attrs="*,+" bindmethod=simple binddn="cn=slapd-slave,ou=services,dc=staff,dc=com" We can't try newer version, because use Oracle solaris and there are only 2.4.X versions. Should we create a bug or it was fixed in newer versions?

2 1

Symas OpenLDAP 2.6.0-5 released
by Quanah Gibson-Mount 14 Dec '21

14 Dec '21

Symas OpenLDAP 2.6.0 patch level 5 has been released for all supported platforms. It includes the following changes since the prior release: Fixed slapo-lastbind to work with 2.6 lastbind-precision configuration (ITS#9725) Added slapd config keyword for logfile format (ITS#9745) Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) New contrib module: slapo-allowed is now available. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Symas OpenLDAP 2.5.9-5 released
by Quanah Gibson-Mount 14 Dec '21

14 Dec '21

Symas OpenLDAP 2.5.9 patch level 5 has been released for all supported platforms. It includes the following changes since the prior release: Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: 2.6 slapadd bug? - SHA512 userPassword hash get 2 characters appended to the end at import
by Dave Macias 13 Dec '21

13 Dec '21

Thank you Quanah for the input. I will say that i always turn off line wrap “ldif-wrap=no” when i export. Dont like how it looks with the wrap. So each attribute is one line on import. I still have yet to try what Michael suggested about scping the mdb files over. I’ll report on that hopefully this week. Thank you, Dave On Dec 6, 2021, 12:46 PM -0500, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: > > > --On Saturday, December 4, 2021 2:58 AM -0500 Dave Macias > <davama(a)gmail.com> wrote: > > > > > > > Hello, > > > > Playing with 2.6 on rhel8 > > > > When imported my data.ldif I noticed i no longer could bind and my > > credentials would fail. Thought it was simply my account and tried with > > other test accounts and failed too. > > > > When i compare the userPassword attributes from the source to my 2.6 > > environment, i see there are two extra characters at the end. > > > > So original looks like: (and whats in data.ldif file) > > > > userPassword:: e2Nblablasuperdupper512hashthatendshere > > > > vs the one in 2.6 > > > > userPassword:: e2Nblablasuperdupper512hashthatendshereXX > > > > This happens on all the userPassword attributes that are SHA512. The XX > > characters seem random, no pattern to it. In other words each > > userPassword attribute has its own XX characters. > > I've generally seen issues like this when a script that munges data fails > to correctly delete multi-line attribute values and the leftover bits get > tacked onto the previous attribute. One way around this is to turn off > LDIF line wraps on export. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 1

OpenLDAP 2.6.0 testing call #3
by Quanah Gibson-Mount 13 Dec '21

13 Dec '21

This is the third testing call for OpenLDAP 2.6.0 Release. This is expected to be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. A list of items fixed and added in 2.6 can be found at: <https://bugs.openldap.org/buglist.cgi?bug_status=RESOLVED&bug_status=VERIFI…> A major change with 2.6 is the optional ability to bypass syslog for logging (ITS#6949). This significantly improves slapd and lloadd performance. Additionally, the following deprecated backends have been removed: back-ndb back-shell Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Re: Antw: [EXT] OpenLDAP Upgrade
by Ulrich Windl 13 Dec '21

13 Dec '21

>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 09.12.2021 um 17:54 in Nachricht <9E71A1C6CC6C9A43887B2B56(a)[192.168.1.3]>: > > ‑‑On Tuesday, December 7, 2021 8:39 AM ‑0800 Quanah Gibson‑Mount > <quanah(a)symas.com> wrote: > >> >> >> ‑‑On Tuesday, December 7, 2021 9:57 AM +0000 santoshk.sethi(a)tcs.com wrote: >> >>> Thanks Emmanuel, >>> Is it a stable version we can reply upon? Because the request is for a >>> production environment which are running critical business applications >>> >>> As part the OS upgrade (6.4 to 7.9), the default OpenLDAP comes in >>> RHEL7.9 is openldap‑servers‑2.4.44‑24.el7_9. >>> >>> This is a existing setup in production. We just want to upgrade it (rpm >>> ‑Uvh) :) on the exisitng RPMs. >> >> OpenLDAP 2.6 is the current release series. OpenLDAP 2.4 is no longer in >> support. As I noted previously, Symas provides pre‑built binaries via a >> repository as described at <https://repo.symas.com/soldap/>. Paid >> support is optionally available as well. > > Also, I'd note again that the vendor supplied builds are woefully out of > date and are generally unsuitable for a production environment, especially > one running business critical applications. Well, as long as those vendors offer support for their packages it's discussable whether those packages are suitable for production environments. At the moment I'm taking part in some online training, and I found out that the OS of the training environment had its last update in 2019, so probably the effective date of the software is even older. The company offering the training has _lots_ of money, however... Not all production environment needs bleeding edge software. Regards, Ulrich

2 3

OpenLDAP Upgrade
by santoshk.sethi＠tcs.com 13 Dec '21

13 Dec '21

HI, We have OpenLDAP 2.4.xx running in RHEL6.4. We are planning to upgrade the RHEL version to 7.9 and then upgrade the OpenLDAP to 2.6. The OpenLDAP installed are all RPMs #rpm -qa | grep -i openldap openldap-2.4.23-31.el6.x86_64 compat-openldap-2.3.43-2.el6.x86_64 openldap-devel-2.4.23-31.el6.x86_64 openldap-servers-2.4.23-31.el6.x86_64 openldap-clients-2.4.23-31.el6.x86_64 But the package for OpenLDAP available is binary packages. I need help how to upgrade considering the existing LDAP database, schema and configuration are required to be there after the upgrade. We have 2 Master server, 2 Consumer server and 2 loadbalancer running keepalived. Appreciate if anyone can help to upgrade the OS as well as the OpenLDAP package. Thanks Santosh

4 9

deltasync replication with 2.6 not working
by Stefan Kania 10 Dec '21

10 Dec '21

Hi to all, I still experimenting with openldap 2.6 and the deltasyncrepl with four hosts. I use debian 11 and the symas packages. I set up all four hosts with the following ldif-files. Starting with the basic settings: --------------------------------------- dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/symas/run/slapd.pid olcArgsFile: /var/symas/run/slapd.args olcToolThreads: 1 # create cn=config #dn: olcBackend={0}mdb,cn=config #objectClass: olcBackendConfig #olcBackend: {0}mdb dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: back_mdb olcModuleLoad: back_monitor olcModuleLoad: autoca.la olcModuleLoad: otp.la olcModuleLoad: argon2.la olcModuleLoad: syncprov olcModuleLoad: back_monitor olcModuleLoad: accesslog.la include: file:///opt/symas/etc/openldap/schema/core.ldif include: file:///opt/symas/etc/openldap/schema/cosine.ldif include: file:///opt/symas/etc/openldap/schema/nis.ldif include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif include: file:///opt/symas/etc/openldap/schema/dyngroup.ldif include: file:///opt/symas/etc/openldap/schema/kerberos.openldap.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcSizeLimit: 500 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcPasswordHash: {ARGON2} dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by * break dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcmdbConfig olcDatabase: {2}mdb olcSuffix: dc=example,dc=net olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbCheckpoint: 512 30 olcDbDirectory: /var/symas/openldap-data olcDbIndex: default eq olcDbIndex: objectClass olcDbIndex: entryUUID olcDbIndex: entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: description pres,eq,sub olcDbIndex: title pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbMaxSize: 85899345920 olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimited size=unlimited olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlimited size=unlimited --------------------------------------- After all four host have the same basic settings I change the "serverId" with the following LDIF-File. My problem is the same, even when I put the serverIds into the basic setup. The reason why I split the serverId from the basic settings is because I use Ansible to configure all hosts. ------------------------- dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldap01.example.net olcServerID: 2 ldap://ldap02.example.net olcServerID: 3 ldap://ldap03.example.net olcServerID: 4 ldap://ldap04.example.net ------------------------- The next step is setting up the deltasync replication with the following LDIf-file: ------------------------- dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 dn: olcDatabase={3}mdb,cn=config changetype: add objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {3}mdb olcDbDirectory: /var/symas/accesslog olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.exact="uid=repl-user,ou=users,dc={first_dc}},dc=net" read by dn.exact="cn=admin,dc=example,dc=net" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcLimits: dn.exact="cn=uid=repl-user,dc=example,dc=net" time=unlimited size=unlimited olcSizeLimit: unlimited olcTimeLimit: unlimited olcMonitoring: TRUE olcDbCheckpoint: 0 0 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbIndex: reqDN eq olcDbMode: 0600 olcDbSearchStack: 16 olcDbMaxsize: 85899345920 dn: olcOverlay=syncprov,olcDatabase={3}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE dn: olcOverlay={0}syncprov,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 200 dn: olcOverlay={1}accesslog,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcSyncrepl olcSyncrepl: rid=102 provider=ldap://ldap02.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes olcSyncrepl: rid=103 provider=ldap://ldap03.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes olcSyncrepl: rid=104 provider=ldap://ldap04.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes - replace: olcMirrorMode olcMirrorMode: TRUE ------------------------- The olcSyncrepl is different on each host this one is from ldap01.example.net so the host is not in the list. On each other host everything is setup the same. When in Start slapd I always getting this error messsages (on server ldap1: --------------------- ez 09 15:20:56 ldap01 slapd[2406]: conn=1035 fd=18 ACCEPT from IP=192.168.56.48:56760 (IP=0.0.0.0:389) Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=0 STARTTLS Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=0 RESULT oid= err=0 qtime=0.000024 etime=0.000299 text= Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 fd=18 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=1 BIND dn="uid=repl-user,ou=users,dc=example,dc=net" method=128 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=1 BIND dn="uid=repl-user,ou=users,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=1 RESULT tag=97 err=0 qtime=0.000033 etime=0.026849 text= Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior reqControls entryCSN Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 syncprov_op_search: got a persistent search with a cookie=rid=101,sid=004,csn=20211208190517.239632Z#000000#001#000000 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 syncprov_findbase: searching Dez 09 15:20:56 ldap01 slapd[2406]: findbase failed! 32 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 SEARCH RESULT tag=101 err=32 qtime=0.000019 etime=0.000166 nentries=0 text= Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=3 UNBIND Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 fd=18 closed --------------------- The rid 101 is NOT configured on this host, because it's ldap01 The same configuration is working on a Debian 10 with the openldpa-packages from debian. One more thing on debian 10 I see_ ---------------------- root@hm-01:~# ss -a | grep ldap | awk '{print$1 " " $2 " " $5 " " $6}' u_str LISTEN /var/run/slapd/ldapi 13381 tcp LISTEN 0.0.0.0:ldaps 0.0.0.0:* tcp LISTEN 0.0.0.0:ldap 0.0.0.0:* tcp ESTAB 192.168.56.41:ldap 192.168.56.44:35400 tcp ESTAB 192.168.56.41:ldap 192.168.56.42:57096 tcp ESTAB 192.168.56.41:ldap 192.168.56.43:54992 tcp ESTAB 192.168.56.41:33408 192.168.56.42:ldap tcp ESTAB 192.168.56.41:50268 192.168.56.43:ldap tcp LISTEN [::]:ldaps [::]:* tcp LISTEN [::]:ldap [::]:* ---------------------- What i expected because of "refreshAndPersist" on the Debian 11 host with the symas packages I see: --------------------- root@ldap01:~# ss -a | grep ldap | awk '{print$1 " " $2 " " $5 " " $6}' u_str LISTEN /var/symas/run/ldapi 14159 tcp LISTEN 0.0.0.0:ldaps 0.0.0.0:* tcp LISTEN 0.0.0.0:ldap 0.0.0.0:* tcp LISTEN [::]:ldaps [::]:* tcp LISTEN [::]:ldap [::]:* --------------------- So there is no permanent connection, that also shows the log. Error 32 means "no such object" but which object is missing. The accesslog DB files are there. The slapd is NOT running as rootI change all the permissions and settings to run slapd as unprivileged user. I'm lost :-) Stefan

2 2

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 09 Dec '21

09 Dec '21

--On Tuesday, December 7, 2021 10:00 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > HI Quanah/Geert, > > Hope this email finds you well !!! > > Continues to the below email with Gnutls I am facing an issue with sync > between master/slave with mirror mode on. As per the earlier suggestion, > I am trying to re-compile OpenLDAP with Openssl on the Redhat server. > It's failing to find OpenSSL libraries though I defined explicitly in the > user profile but still not helping. > > Any idea how I can point to the OpenSSL libraries? > > > ./configure --prefix=/opt/dirsvcs --with-tls=openssl > > configure: error: Could not locate TLS/SSL package Check the output in the config.log file as to why it had the error. Generally, I'd guess because you didn't set the CPPFLAGS and thus it couldn't find the header files. Alternatively, you could simply deploy the builds from Symas, which link to OpenSSL already and skip building OpenLDAP yourself. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Antw: [EXT] mmr of cn=config with OpenLDAP 2.6
by Stefan Kania 09 Dec '21

09 Dec '21

Am 09.12.21 um 08:12 schrieb Ulrich Windl: >>>> Stefan Kania <stefan(a)kania-online.de> schrieb am 07.12.2021 um 16:52 in > Nachricht <37d8d0c0-fd4a-885d-7a8c-3874412eaa06(a)kania-online.de>: > > ... >> What I don't understand: Do I realy have to put all Servers in the >> replication, even the server it self? So do I realy have to add on >> Server-01, the Server "server-01, server-02, server-03 ,server-04" to >> the replication? Dosn't it mean that server-01 is replicating to it >> self? If it's correct, can someone explain why? O did I understud >> something wrong on the webpage? > > Ebery change has a "change ID" (entryCSN): If a server receives an update having the same change ID that is already present, the update will be ignored, and maybe more importantly it won't propagate that update any further. That's how I understand it. So it does not harm. > Ok, that makes sense, but why only for the replication of cn=config. If you set up a mmr for the main DB you don't put only the other server into the Replication. If you have ldap1 ldap2 ldap3 lda4, on ldap1 you only have ldap2 ldap3 and ldap4 in the configuration. That's what I like to understand :-) >> >> Stefan > > > >

1 0

Re: Antw: [EXT] OpenLDAP Upgrade
by Ulrich Windl 09 Dec '21

09 Dec '21

>>> <santoshk.sethi(a)tcs.com> schrieb am 07.12.2021 um 10:57 in Nachricht <20211207095727.5262.37798(a)hypatia.openldap.org>: > Thanks Emmanuel, > Is it a stable version we can reply upon? Because the request is for a > production environment which are running critical business applications > > As part the OS upgrade (6.4 to 7.9), the default OpenLDAP comes in RHEL7.9 > is openldap-servers-2.4.44-24.el7_9. > > This is a existing setup in production. We just want to upgrade it (rpm > -Uvh) :) on the exisitng RPMs. Actually when you'd update you'd use "rpm -vF ..." I guess ;-) But I'm unsure whether that will work "cross-vendor"; maybe check the file lists (rpm -qvlp ...) and compare with existng paths, also. The best would probably be to have a snapshot-type backup (like for a VM shutting down, making a volume snapshot, then boot and trxy the update) > > #rpm -qa | grep -i openldap > openldap-2.4.23-31.el6.x86_64 > compat-openldap-2.3.43-2.el6.x86_64 > openldap-devel-2.4.23-31.el6.x86_64 > openldap-servers-2.4.23-31.el6.x86_64 > openldap-clients-2.4.23-31.el6.x86_64 > > > Thanks > Santosh

1 0

2.6 slapadd bug? - SHA512 userPassword hash get 2 characters appended to the end at import
by Dave Macias 06 Dec '21

06 Dec '21

Hello, Playing with 2.6 on rhel8 When imported my data.ldif I noticed i no longer could bind and my credentials would fail. Thought it was simply my account and tried with other test accounts and failed too. When i compare the userPassword attributes from the source to my 2.6 environment, i see there are two extra characters at the end. So original looks like: (and whats in data.ldif file) userPassword:: e2Nblablasuperdupper512hashthatendshere vs the one in 2.6 userPassword:: e2Nblablasuperdupper512hashthatendshereXX This happens on all the userPassword attributes that are SHA512. The XX characters seem random, no pattern to it. In other words each userPassword attribute has its own XX characters. Interesting, i dont see this issue with accounts that still have SHA1 hash. They are identical. I dont recall if i saw this on 2.5 but I’ll update on that. Thank you, Dave

3 6

2.6 rhel8 rpm pkg - lastbind module issue
by Dave Macias 03 Dec '21

03 Dec '21

Hello, Playing around with 2.6 Was attempting to add lastbind module but get error: cat <<EOF | ldapadd -D cn=config -w mysecret dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /opt/symas/lib/openldap/ olcModuleLoad: lastbind.la EOF adding new entry "cn=module,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 I have no issues doing the above with 2.5 rpm rhel8 pkg. Is there something im doing wrong? Any input is appreciated. Thank you, Dave

4 10

Q: Detect "user on grace logins" (ppolicy being used)?
by Ulrich Windl 02 Dec '21

02 Dec '21

Hi! I have a question: When using ppolicy, is tthere a simple way for a user to detect that he/she is "on grace logins", i.e. the poassword has to be changed soon? We had a situation where some monitoring tools uses periodic logins to sume user account. When that user should have changed the password, the periodic logins consumed all the grace logins, and the user was effectively locked out. While there are many ways to resolve this, I wonder whether it would be rather easy to avoid any further login attempts when the user is expected to change the password. Regards, Ulrich

2 1

Concurrent/simultaneous write access
by Jäckel, Carsten 02 Dec '21

02 Dec '21

Hello, during internal discussions, we came up with the question of how OpenLDAP deals with concurrent, competing write accesses to an LDAP object. The background to the question is that we use two applications that want to write attributes on the same user object in the DIT and maybe this could happen at the same time. Does anyone know how the OpenLDAP deals with such a situation? We would like to ask the following questions in detail: - Does the OpenLDAP lock the entire object for write access or only the attributes that are currently being changed? - Is there a kind of queue for write operations in which the competing write accesses are stored? If so, what criteria are used to determine which write operation has priority? - Are there scenarios caused by concurrent, simultaneous write access to objects / object attributes that lead to a crash of the openLDAP? - How can we best simulate simultaneous write access to an object in the DIT from different systems? - Are there different behaviors dealing with concurrent write-access when using different openLDAP versions? Kind regards, Carsten

2 1

force resync of slave
by Enrico Weigelt, metux IT consult 02 Dec '21

02 Dec '21

Hello friends, I've encountered my slaves (Zimbra cluster) aren't fully in sync with master. Some entries are missing attributes. Maybe it's a fallout from previous errors in my MMR setup (several minutes clocks difference, so one master couldn't sync to another). * modifying an affected entry doesn't fix it, just changes the actually changed attributes (delta-sync ?) * starting the slave w/ -c 'rid=100,csn=0' showed lots of corresponding log traffic (on first start), but still tells the entries were equal, doesn't fix the entries * problem: I don't know which entries are affect, just found a few of them Can anyone give me a hint on how to do a full resync ? thx --mtx -- --- Hinweis: unverschlüsselte E-Mails können leicht abgehört und manipuliert werden ! Für eine vertrauliche Kommunikation senden Sie bitte ihren GPG/PGP-Schlüssel zu. --- Enrico Weigelt, metux IT consult Free software and Linux embedded engineering info(a)metux.net -- +49-151-27565287

2 1

Move from memberof to dynlist
by Magnus Morén 02 Dec '21

02 Dec '21

I am trying to move from memberof(overlay) to dynlist but can't get it to work. I have static groups with uniqueMembers cn=somegroup,ou=group,dc=domain,dc=net uniqueMember: uid=user1,ou=people,dc=domain,dc=net uniqueMember: uid=user2,ou=people,dc=domain,dc=net ... I want to have: memberOf: cn=somegroup,ou=group,dc=domain,dc=net on all users who is member of any group. In my test i use cn=config style and OpenLDAP 2.6.0 from Symas In my old ldap server (slapd.conf based) i have overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true I have tried this from man slapo-dynlist but I must have done something wrong or not understand how it is supposed to work. This example extends the dynamic memberOf feature to add the memberOf attribute to all the members of both static and dynamic groups: include /path/to/dyngroup.schema # ... database <database> # ... overlay dynlist dynlist-attrset groupOfURLs memberURL member+memberOf@groupOfNames This dynamic memberOf feature can fully replace the functionality of the slapo-memberof(5) overlay.

3 6

Re: 2.6 rhel8 rpm pkg - lastbind module issue
by Dave Macias 01 Dec '21

01 Dec '21

> > Im looking at > > this: https://git.openldap.org/openldap/openldap/-/blob/6327f45d7de73f66 > > 9fa438d4f5823e139cf4e6b4/contrib/slapd-modules/lastbind/slapo-lastbind.5 > > > > slapadd -n 1 -F /opt/symas/etc/openldap/slapd.d -l data.ldif > > <= str2entry: str2ad(authTimestamp): attribute type undefined > > slapadd: could not parse entry (line=24) > > Closing DB... > > You need the fix for ITS#9725 to make use of authTimestamp. > I see. Thank you for the input! So then i guess i have to wait until the fix is applied to the OS pkgs. Best, Dave

2 1

ppolicy-question
by A. Schulze 01 Dec '21

01 Dec '21

Hello, using slapo-ppolicy I could configure slapd to hash a password if it's sent unhashed. moduleload ppolicy.la moduleload argon2.la password-hash {ARGON2} database mdb suffix dc=test ... overlay ppolicy ppolicy_default "cn=default,ou=ppolicies,dc=test" ppolicy_hash_cleartext That work and I could hash them using ARGON2. But clients could still hash a password them self and write '{MD5}...' as userPassword for example. Is it possible to reject any userPasswords prefixed with hash schema? Andreas

4 6

Multi-Master not syncing
by Enrico Weigelt, metux IT consult 30 Nov '21

30 Nov '21

Hello friends, I'm in huge trouble: my MMR setup (Zimbra) isn't syncing completely. * host A is the old master, host B a new one. * host B used to be a slave of A, but later was promoted to master (each has a syncrepl pointer to the other and mirrormode is TRUE) * sync from A to B seems to be fine, but the route back doesn't work * new objects (eg. new users) are synced up from B to A, but later changes don't get throught (eg. additional entries like mail aliases) On host B i get lots of repeated log messages like this: Nov 30 09:56:04 hz1-rz-mail-ldap-01 slapd[3999428]: conn=6002 op=1 syncprov_search_response: Entry uid=u37701,ou=people,dc=hs-harz,dc=de CSN 20211129215211.258933Z#000000#001#000000 older or equal to ctx 20211130085608.894386Z#000000#001#000000 On Host A I'm getting lots of log messages like this: Nov 30 10:12:38 inkataube slapd[17590]: dn_callback : new entry is older than ours uid=g50425,ou=people,dc=hs-harz,dc=de ours 20211130032044.897539Z#000000#001#000000, new 20211130032015.857165Z#000000#002#000000 It looks like both nodes can't agree on what's the most recent entries. Is there any way to force them taking either side's version ? thanks --mtx --- Hinweis: unverschlüsselte E-Mails können leicht abgehört und manipuliert werden ! Für eine vertrauliche Kommunikation senden Sie bitte ihren GPG/PGP-Schlüssel zu. --- Enrico Weigelt, metux IT consult Free software and Linux embedded engineering info(a)metux.net -- +49-151-27565287

2 1

symas gpg-key
by Stefan Kania 30 Nov '21

30 Nov '21

I installed the symas OpenLDAP 2.6. The first step was getting the gpg-key but the command on your web-page is : ---------------- root@ldap:~# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys DA26A148887DCBEB Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)). ---------------- is deprecated on debian 11. Do you provide a the key in .asc format so the key can be installed via: ---------------- wget -O- https://some-server.com/symas.gpg-key.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/symas.gpg > /dev/null ---------------- If you do, where can I find it? If not, could you provide it? :-) Stefan

2 2

delta-sync how to make sure
by frederic.goudal＠bordeaux-inp.fr 30 Nov '21

30 Nov '21

Hello, I have setup delta-sync replication on my servers, but how can I be sure it is used instead of just syncrepl ? What do I have to look at into the logs ? Thanks in advance -- Frédéric Goudal Administrateur Systèmes et Réseaux Bordeaux-INP

1 0

how to build dynacl now.c?
by Michael Ströder 29 Nov '21

29 Nov '21

HI! Hmm, I cannot see what I'm doing wrong here. Compiling other contrib modules works just fine. $ make -B -C contrib/slapd-modules/acl now make: Entering directory '/home/michael/src/openldap-git/re26/openldap/contrib/slapd-modules/acl' gcc now.c -o now now.c:28:10: fatal error: portable.h: No such file or directory 28 | #include <portable.h> | ^~~~~~~~~~~~ compilation terminated. make: *** [<builtin>: now] Error 1 make: Leaving directory '/home/michael/src/openldap-git/re26/openldap/contrib/slapd-modules/acl' Ciao, Michael.

2 2

Problem with attribute hasSubordinate
by frederic.goudal＠bordeaux-inp.fr 24 Nov '21

24 Nov '21

Hello, I'm upgrading an old ldap set of servers to a new one, going from 2.4.x to 2.6.0 What I'm currently doing is the following : old.2.4 <- multi-master syncrepl -> newMaster -> push-setup + delta-sync -> newSlave What I call push-setup is a hidden sufix on newMaster with newSlsave as ldap backend. The synchronisations occurs, but stop for now on the following error : Nov 23 14:47:47 ldap2021 slapd[57592]: conn=1000 op=662328 SRCH base="dc=ipb,dc=fr" scope=2 deref=0 filter="(entryUUID=d62c8932-e9aa-1034-9374-673a87a89e29)" Nov 23 14:47:47 ldap2021 slapd[57592]: conn=1000 op=662328 SRCH attr=* + Nov 23 14:47:47 ldap2021 slapd[57592]: conn=1000 op=662328 SEARCH RESULT tag=101 err=0 qtime=0.000046 etime=0.000808 nentries=1 text= Nov 23 14:47:47 ldap2021 slapd[57592]: conn=1000 op=662329 MOD dn="uid=xxxx,ou=people,dc=ipb,dc=fr" Nov 23 14:47:47 ldap2021 slapd[57592]: conn=1000 op=662329 MOD attr=entryCSN modifiersName modifyTimestamp hasSubordinates Nov 23 14:47:47 ldap2021 slapd[57592]: slap_queue_csn: queueing 0x7efedc155f70 20211123133002.586780Z#000000#00a#000000 Nov 23 14:47:47 ldap2021 slapd[57592]: conn=1000 op=662329 RESULT tag=103 err=16 qtime=0.000029 etime=0.000405 text=modify/delete: hasSubordinates: no such attribute Nov 23 14:47:47 ldap2021 slapd[57592]: slap_graduate_commit_csn: removing 0x7efedc155f70 20211123133002.586780Z#000000#00a#000000 I have donne slapcat on the old server, and on the the newMaster and there is no attribute hasSubordinates. I have dumped the schema ( ldapsearch -x -LLL -b cn=Subschema -s base '(objectClass=subschema)' +) and the attribute hasSubordinatess is defined both on newMaster and newSlave. I don't know what to do to fix this problem... Thanks in advance. -- Frédéric Goudal Administrateur Systèmes et Réseaux Bordeaux-INP

2 2

Failed LDAP Synchronization (openldap-servers-2.4.44)
by nabeel.tariq＠rapidcompute.com 24 Nov '21

24 Nov '21

Hi, I have configured LDAP successfully on Centos 7. I have integrated it with my Axigen email server. I can authenticate successfully with LDAP. I can search all the records using ldapsearch command. ldapsearch -H ldaps://cyberldap.cyber.net.pk:636 -b "o=intranet,dc=cyber,dc=net,dc=pk" -D "cn=manager,dc=cyber,dc=net,dc=pk" -W -x However, while synchronizing LDAP with my Axigen, I have faced below mentioned error. 2021-11-24 11:17:50 +0500 02 test USERDB:00000001: Failed OpenLdap search basedn(o=intranet,dc=cyber,dc=net,dc=pk), filter((&(objectClass=inetOrgPerson))), error(Other (e.g., implementation specific) error) on domain cyber.net.pk

1 0

Synchronisation ODSEE --> Openldap 2.5
by laurent.revillion＠ambre-systems.com 24 Nov '21

24 Nov '21

Hello, I want to synchronize the data in my ODSEE directory with the new Openldap directory. I have ODSEE [slapd 64-bit] Oracle Corporation. Sun-Directory-Server/11.1.1.7.3 B2015.0429.2115 64-bit ns-slapd : 11.1.1.7.3 B2015.0429.2115 ZIP Slapd Library : 11.1.1.7.3 B2015.0429.2115 Front-End Library : 11.1.1.7.3 B2015.0429.2115 end Openldap 2.5.X I did exactly what is indicated in the tests: openldap / tests / scripts / test072-dsee-sync openldap / tests / scripts / test075-dsee-persist The ODSEE directory starts correctly. When I start the Openldap instance with the indicated replication data / slapd-dsee-consumer1.conf data / slapd-dsee-consumer2.conf IN Openldap start i have (with -d -1 option) 61926439.1a909db2 0x7f7e26799880 slapd starting 61926439.1b711895 0x7f7e1e406700 daemon: added 4r listener=(nil) 61926439.1b718582 0x7f7e1e406700 daemon: added 7r listener=0x563d9bd87c10 61926439.1b71aee4 0x7f7e1e406700 daemon: added 8r listener=0x563d9bd87d00 61926439.1b728f00 0x7f7e1e406700 daemon: epoll: listen=7 active_threads=0 tvp=zero 61926439.1b729cbf 0x7f7e1e406700 daemon: epoll: listen=8 active_threads=0 tvp=zero 61926439.1b72aaf3 0x7f7e1e406700 daemon: activity on 1 descriptor 61926439.1b72b304 0x7f7e1e406700 daemon: activity on:61926439.1b72bbba 0x7f7e1e406700 61926439.1b72cd95 0x7f7e1e406700 daemon: epoll: listen=7 active_threads=0 tvp=zero 61926439.1b72d667 0x7f7e1e406700 daemon: epoll: listen=8 active_threads=0 tvp=zero 61926439.1c6896b8 0x7f7e1dc05700 >>> dnNormalize: <cn=Consumer 002> 61926439.1c691535 0x7f7e1dc05700 <<< dnNormalize: <cn=consumer 002> 61926439.1c69b3df 0x7f7e1dc05700 =>do_syncrepl rid=002 61926439.1c69eaae 0x7f7e1dc05700 ldap_create 61926439.1c6a1e25 0x7f7e1dc05700 ldap_url_parse_ext(ldap://127.0.0.1:3389) 61926439.1c6a3c1d 0x7f7e1dc05700 ldap_sasl_bind_s 61926439.1c6a4b7a 0x7f7e1dc05700 ldap_sasl_bind 61926439.1c6a8303 0x7f7e1dc05700 ldap_send_initial_request 61926439.1c6a9831 0x7f7e1dc05700 ldap_new_connection 1 1 0 61926439.1c6aa2a5 0x7f7e1dc05700 ldap_int_open_connection 61926439.1c6ab2ef 0x7f7e1dc05700 ldap_connect_to_host: TCP 127.0.0.1:3389 61926439.1c6aea76 0x7f7e1dc05700 ldap_new_socket: 12 61926439.1c6afeb6 0x7f7e1dc05700 ldap_prepare_socket: 12 61926439.1c6b1f47 0x7f7e1dc05700 ldap_connect_to_host: Trying 127.0.0.1:3389 61926439.1c6b2888 0x7f7e1dc05700 ldap_pvt_connect: fd: 12 tm: -1 async: 0 61926439.1c6b2fd3 0x7f7e1dc05700 attempting to connect: 61926439.1c6dd2fe 0x7f7e1dc05700 connect success 61926439.1c6e01eb 0x7f7e1dc05700 ldap_open_defconn: successful 61926439.1c6e0de0 0x7f7e1dc05700 ldap_send_server_request 61926439.1c6e1c57 0x7f7e1dc05700 ber_scanf fmt ({it) ber: 61926439.1c6e2774 0x7f7e1dc05700 ber_dump: buf=0x7f7e10001bb0 ptr=0x7f7e10001bb0 end=0x7f7e10001bda len=42 61926439.1c6e3112 0x7f7e1dc05700 0000: 30 28 02 01 01 60 23 02 01 03 04 14 63 6e 3d 64 0(...`#.....cn=d 61926439.1c6e3916 0x7f7e1dc05700 0010: 69 72 65 63 74 6f 72 79 20 6d 61 6e 61 67 65 72 irectory manager 61926439.1c6e40a5 0x7f7e1dc05700 0020: 80 08 70 61 73 73 77 6f 72 64 ..password 61926439.1c6e4fb6 0x7f7e1dc05700 ber_scanf fmt ({i) ber: 61926439.1c6e5814 0x7f7e1dc05700 ber_dump: buf=0x7f7e10001bb0 ptr=0x7f7e10001bb5 end=0x7f7e10001bda len=37 61926439.1c6e5fe9 0x7f7e1dc05700 0000: 60 23 02 01 03 04 14 63 6e 3d 64 69 72 65 63 74 `#.....cn=direct 61926439.1c6e6776 0x7f7e1dc05700 0010: 6f 72 79 20 6d 61 6e 61 67 65 72 80 08 70 61 73 ory manager..pas 61926439.1c6e6f8f 0x7f7e1dc05700 0020: 73 77 6f 72 64 sword 61926439.1c6e8145 0x7f7e1dc05700 ber_flush2: 42 bytes to sd 12 61926439.1c6e8afb 0x7f7e1dc05700 0000: 30 28 02 01 01 60 23 02 01 03 04 14 63 6e 3d 64 0(...`#.....cn=d 61926439.1c6e9274 0x7f7e1dc05700 0010: 69 72 65 63 74 6f 72 79 20 6d 61 6e 61 67 65 72 irectory manager 61926439.1c6e99ea 0x7f7e1dc05700 0020: 80 08 70 61 73 73 77 6f 72 64 ..password 61926439.1c6eec1c 0x7f7e1dc05700 ldap_write: want=42, written=42 61926439.1c6ef60f 0x7f7e1dc05700 0000: 30 28 02 01 01 60 23 02 01 03 04 14 63 6e 3d 64 0(...`#.....cn=d 61926439.1c6efd8d 0x7f7e1dc05700 0010: 69 72 65 63 74 6f 72 79 20 6d 61 6e 61 67 65 72 irectory manager 61926439.1c6f05c4 0x7f7e1dc05700 0020: 80 08 70 61 73 73 77 6f 72 64 ..password 61926439.1c6f2277 0x7f7e1dc05700 ldap_result ld 0x7f7e10000920 msgid 1 61926439.1c6f2c34 0x7f7e1dc05700 wait4msg ld 0x7f7e10000920 msgid 1 (infinite timeout) 61926439.1c6f34b0 0x7f7e1dc05700 wait4msg continue ld 0x7f7e10000920 msgid 1 all 1 61926439.1c6f3e6c 0x7f7e1dc05700 ** ld 0x7f7e10000920 Connections: 61926439.1c6f52a0 0x7f7e1dc05700 * host: 127.0.0.1 port: 3389 (default) 61926439.1c6f6877 0x7f7e1dc05700 * from: IP=127.0.0.1:56180 61926439.1c6f70a2 0x7f7e1dc05700 refcnt: 2 status: Connected 61926439.1c6f8693 0x7f7e1dc05700 last used: Mon Nov 15 14:44:25 2021 61926439.1c6f8f52 0x7f7e1dc05700 61926439.1c6f98a4 0x7f7e1dc05700 ** ld 0x7f7e10000920 Outstanding Requests: 61926439.1c6fa2a6 0x7f7e1dc05700 * msgid 1, origid 1, status InProgress 61926439.1c6fab71 0x7f7e1dc05700 outstanding referrals 0, parent count 0 61926439.1c6fb4ca 0x7f7e1dc05700 ld 0x7f7e10000920 request count 1 (abandoned 0) 61926439.1c6fbc72 0x7f7e1dc05700 ** ld 0x7f7e10000920 Response Queue: 61926439.1c6fc3fa 0x7f7e1dc05700 Empty 61926439.1c6fcb6c 0x7f7e1dc05700 ld 0x7f7e10000920 response count 0 61926439.1c6fd389 0x7f7e1dc05700 ldap_chkResponseList ld 0x7f7e10000920 msgid 1 all 1 61926439.1c6fdb88 0x7f7e1dc05700 ldap_chkResponseList returns ld 0x7f7e10000920 NULL 61926439.1c6fe4a8 0x7f7e1dc05700 ldap_int_select 61926439.1c728a2b 0x7f7e1dc05700 read1msg: ld 0x7f7e10000920 msgid 1 all 1 61926439.1c72a729 0x7f7e1dc05700 ber_get_next 61926439.1c72bcf8 0x7f7e1dc05700 ldap_read: want=8, got=8 61926439.1c72c592 0x7f7e1dc05700 0000: 30 0c 02 01 01 61 07 0a 0....a.. 61926439.1c72ddfd 0x7f7e1dc05700 ldap_read: want=6, got=6 61926439.1c72e594 0x7f7e1dc05700 0000: 01 00 04 00 04 00 ...... 61926439.1c72ef09 0x7f7e1dc05700 ber_get_next: tag 0x30 len 12 contents: 61926439.1c72f810 0x7f7e1dc05700 ber_dump: buf=0x7f7e100011c0 ptr=0x7f7e100011c0 end=0x7f7e100011cc len=12 61926439.1c73000c 0x7f7e1dc05700 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ 61926439.1c73242e 0x7f7e1dc05700 ldap_find_request_by_msgid: msgid 1, lr 0x7f7e100010a0 lr->lr_refcnt = 1 61926439.1c7331b9 0x7f7e1dc05700 read1msg: ld 0x7f7e10000920 msgid 1 message type bind 61926439.1c733b07 0x7f7e1dc05700 ber_scanf fmt ({eAA) ber: 61926439.1c73431c 0x7f7e1dc05700 ber_dump: buf=0x7f7e100011c0 ptr=0x7f7e100011c3 end=0x7f7e100011cc len=9 61926439.1c734ad7 0x7f7e1dc05700 0000: 61 07 0a 01 00 04 00 04 00 a........ 61926439.1c7357b8 0x7f7e1dc05700 read1msg: ld 0x7f7e10000920 0 new referrals 61926439.1c736002 0x7f7e1dc05700 read1msg: mark request completed, ld 0x7f7e10000920 msgid 1 61926439.1c736829 0x7f7e1dc05700 request done: ld 0x7f7e10000920 msgid 1 61926439.1c73709e 0x7f7e1dc05700 res_errno: 0, res_error: <>, res_matched: <> 61926439.1c737a4d 0x7f7e1dc05700 ldap_return_request: lrx 0x7f7e100010a0, lr 0x7f7e100010a0 61926439.1c738307 0x7f7e1dc05700 ldap_return_request: lrx->lr_msgid 1, lrx->lr_refcnt is now 0, lr is still present 61926439.1c738cab 0x7f7e1dc05700 ldap_free_request (origid 1, msgid 1) 61926439.1c739a8c 0x7f7e1dc05700 ldap_free_request_int: lr 0x7f7e100010a0 msgid 1 removed 61926439.1c73a4cd 0x7f7e1dc05700 ldap_do_free_request: asked to free lr 0x7f7e100010a0 msgid 1 refcnt 0 61926439.1c73bb4b 0x7f7e1dc05700 ldap_parse_result 61926439.1c73c76f 0x7f7e1dc05700 ber_scanf fmt ({iAA) ber: 61926439.1c73cf85 0x7f7e1dc05700 ber_dump: buf=0x7f7e100011c0 ptr=0x7f7e100011c3 end=0x7f7e100011cc len=9 61926439.1c73d701 0x7f7e1dc05700 0000: 61 07 0a 01 00 04 00 04 00 a........ 61926439.1c73e2d4 0x7f7e1dc05700 ber_scanf fmt (}) ber: 61926439.1c73eac1 0x7f7e1dc05700 ber_dump: buf=0x7f7e100011c0 ptr=0x7f7e100011cc end=0x7f7e100011cc len=0 61926439.1c73f201 0x7f7e1dc05700 61926439.1c73fad8 0x7f7e1dc05700 ldap_msgfree 61926439.1c746e58 0x7f7e1dc05700 => mdb_entry_get: ndn: "dc=ici,dc=fr" 61926439.1c74789d 0x7f7e1dc05700 => mdb_entry_get: oc: "(null)", at: "lastChangeNumber" 61926439.1c74ce52 0x7f7e1dc05700 mdb_dn2entry("dc=ici,dc=fr") 61926439.1c76894c 0x7f7e1dc05700 => mdb_dn2id("dc=ici,dc=fr") 61926439.1c76a201 0x7f7e1dc05700 <= mdb_dn2id: got id=0x1 61926439.1c76c985 0x7f7e1dc05700 => mdb_entry_decode: 61926439.1c76e088 0x7f7e1dc05700 <= mdb_entry_decode 61926439.1c76ec57 0x7f7e1dc05700 => mdb_entry_get: found entry: "dc=ici,dc=fr" 61926439.1c76f8d5 0x7f7e1dc05700 <= mdb_entry_get: failed to find attribute lastChangeNumber 61926439.1c770d36 0x7f7e1dc05700 mdb_entry_get: rc=16 61926439.1c7717f9 0x7f7e1dc05700 do_syncrep1: rid=002 starting refresh (sending cookie=(null)) slapd: memory.c:705: ber_bvreplace_x: Assertion `!((src)->bv_val == ((void *)0))' failed. ./start-consumer1.sh : ligne 4 : 15293 Abandon /opt/symas/lib/slapd -d -1 -u ldap -g ldap -h "ldap://:5389/" -f /opt/symas/config/static-test/slapd-dsee-consumer1.conf IN access log ODSEE i have : [15/Nov/2021:14:44:25 +0100] conn=18 op=0 msgId=1 - BIND dn="cn=directory manager" method=128 version=3 [15/Nov/2021:14:44:25 +0100] conn=18 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [15/Nov/2021:14:44:25 +0100] conn=18 op=1 msgId=0 - RESULT err=80 tag=120 nentries=0 etime=0 [15/Nov/2021:14:44:25 +0100] conn=18 op=-1 msgId=-1 - closing from 127.0.0.1:56180 - A1 - Client aborted connection - [15/Nov/2021:14:44:25 +0100] conn=18 op=-1 msgId=-1 - closed. I do not understand why ODSEE systematically gives an error 80 following the BIND of the consumer Openldap. Can you help me ? Thanks

2 2

OpenLDAP 2.6 installation on RHEL 7.9
by sumanbadra＠gmail.com 23 Nov '21

23 Nov '21

Hi, I have been trying to install OpenLDAP 2.6 in RHEL 7.9. At my first attempt it was failed as it requires openssl version 1.1.1 or greater. I had installed 1.1.1l as earlier version was openssl 1.0.2k. (installed with "./config --prefix=/usr --openssldir=/etc/ssl --libdir=lib shared" from the directory /usr/local/src/openssl-1.1.1l as root account and export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64 echo "export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64" >> ~/.bashrc) Verified openssl vesrion # openssl version OpenSSL 1.1.1l 24 Aug 2021 # which openssl /bin/openssl # openssl version -d OPENSSLDIR: "/usr/local/ssl" Now when I tried openldap 2.6 again I am getting below error ------ checking for sys/un.h... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package ------ I am trying to run below config vi /root/.ldap-env -------- export PATH=/opt/orsus/openldap-2.6/bin:/opt/orsus/openldap-2.6/sbin:/opt/orsus/openldap-2.6/libexec:$PATH export OWNER=ldap:ldap export CONFIG=/opt/orsus/openldap-2.6/etc/openldap/slapd.d -------- source /root/.ldap-env ./configure --with-cyrus-sasl --with-argon2 --with-systemd --with-tls=openssl --enable-overlays=mod --enable-backends=mod --disable-perl --disable-ndb --enable-crypt --enable-modules --enable-dynamic --enable-syslog --enable-debug --enable-local --enable-spasswd --disable-sql --disable-hdb --disable-bdb --prefix=/opt/orsus/openldap-2.6.0 I have tried below but still no luck. LDFLAGS="-L/usr/lib64/openssl -Wl,-rpath,/usr/include/openssl" CPPFLAGS="-I/usr/include/openssl" export CPPFLAGS export LDFLAGS Kindly help me. Thank you!!

1 0

contextCSN value
by bourguijl＠gmail.com 16 Nov '21

16 Nov '21

Dears, In context of a 4 MMR mirrored, if I do a ldapsearch for contextCSN of cn=config, I get following output : contextCSN: 20210720121843.555301Z#000000#000#000000 contextCSN: 20211001095511.729248Z#000000#001#000000 contextCSN: 20211021090559.554997Z#000000#002#000000 contextCSN: 20211025120556.001311Z#000000#003#000000 contextCSN: 20211021090202.909879Z#000000#004#000000 which is correct as I've 4 servers, but if I do same request for my own dn DB o=xxxx.be, I get following output : contextCSN: 20211116155042.534901Z#000000#001#000000 contextCSN: 20211116153150.449895Z#000000#002#000000 for me I should receive 003 & 004 ones too as they are in mirrored mode, no ? Can you advice ? Thx, Jean-Luc.

3 2

global vs. frontend config in slapd.conf
by Michael Ströder 16 Nov '21

16 Nov '21

HI! Since the fix for ITS#9575 there is this misleading message even when invoking slapcat: /opt/openldap-ms/etc/openldap/slapd.conf: line 126: setting password scheme in the global entry is deprecated. The server may refuse to start if it is provided by a loadable module, please move it to the frontend database instead As you can see I'm using static config (aka slapd.conf). Can I avoid this warning by rearraging something in slapd.conf? Ciao, Michael.

2 2

Re: Referrals on glued databases
by Nick Folino 16 Nov '21

16 Nov '21

nvm. I found the updatedn option. On Tue, Nov 16, 2021 at 9:24 AM Nick Folino <nick(a)folino.us> wrote: > > > ---------- Forwarded message --------- > From: Nick Folino <nick(a)folino.us> > Date: Tue, Nov 16, 2021 at 9:12 AM > Subject: Referrals on glued databases > To: OpenLDAP Technical Discussion List <openldap-technical(a)openldap.org> > > > Can anyone provide guidance on using referrals on consumers with glued > directories? > > For example if I have a root of dc=bar, with a separate database glued as > o=foo,dc=bar. Replication works fine in o=foo by configuring it on dc=bar. > > Configuring an updateref on dc=bar also works for updates to dc=bar, but > does not work for updates to o=foo. > > I can't add an updateref to o=foo as there is no replication defined on > that database. > > How can I configure this to provide referrals from all glued directories? > > Nick >

1 0

Referrals on glued databases
by Nick Folino 16 Nov '21

16 Nov '21

Can anyone provide guidance on using referrals on consumers with glued directories? For example if I have a root of dc=bar, with a separate database glued as o=foo,dc=bar. Replication works fine in o=foo by configuring it on dc=bar. Configuring an updateref on dc=bar also works for updates to dc=bar, but does not work for updates to o=foo. I can't add an updateref to o=foo as there is no replication defined on that database. How can I configure this to provide referrals from all glued directories? Nick

1 0

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 15 Nov '21

15 Nov '21

--On Sunday, November 14, 2021 9:36 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > I modified the file as per the base but no luck with that. > When I look TLS library which slapd program it's looks like it's using > gnutls . Do I need to configure in different way for GNUTLS for TLS > version in slapd. Yes. You will need to consult the GnuTLS documentation. The slapd man page clearly states that the TLSProtocolMin option is ignored when linked to GnuTLS. I generally advise linking to OpenSSL for a number of different reasons. I believe with GnuTLS you do this via the TLSCipherSuite option to slapd. See also <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/ht…>. One example from Exim sets the cipher suites to: NORMAL:!VERS-SSL3.0 so that may be of help. See also the slapd.conf(5) man page section on TLSCipherSuite for the GnuTLS command line to print out relevant information. This ticket may also be helpful: <https://mod.gnutls.org/ticket/29> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OpenLDAP client build/compilation steps on Windows platform
by c.venugopal521＠gmail.com 11 Nov '21

11 Nov '21

Hi Team, I am planning to migrate the NSLDAP C SDK to OpenLDAP (2.5/2.6) client SDK of the latest version. For this, I need to build OpenLDAP libraries/dlls to use them for our source code compilation and to run our application. Can someone please provide detailed steps to compile OpenLDAP on Windows platform with Microsoft Visual Studio 2019 as C compiler. - How to prepare a build environment (like any Cygwin installation required?) - What are the prerequisites for building OpenLDAP on Windows? - How to pass prerequisites while building OpenLDAP - What are the ENV variables that need to be set before building OpenLDAP code? - What are the options that we should pass to ./configure to generate .libs and .dlls (shared libs and static) along with TLS (say: OpenSSL as SSL provider) - What are the changes required in OpenLDAP source code to compile successfully on Windows with MSVC compiler if any? I am expecting .libs and .dll files (ex: libldap.lib, libldap.dll, liblber.lib, liblber.dll etc) from the compilation of OpenLDAP along with client utilities (.exe s) Once I successfully build, I will try to build OpenLDAP on the RHEL platform with gcc C compiler as my next step. Please help me here to build OpenLDAP successfully.

2 3

compare operation behaves differently under 2.5
by Paul B. Henson 11 Nov '21

11 Nov '21

I've run into another quirk during my 2.5 upgrade process. We use the Apache ldap authnz module with a configuration such as: AuthLDAPURL ldaps://ldap.cpp.edu:636/DC=cpp,DC=edu?uid Require ldap-group uid=unxadmin,ou=group,dc=cpp,dc=edu This stopped working when accessing a server updated to 2.5. On the 2.4 server, the Apache logs look like: [Wed Nov 10 15:07:52.056237 2021] [authnz_ldap:debug] [pid 29887] mod_authnz_ldap.c(926): [client 10.104.223.117:51050] AH01714: auth_ldap authorize: require group: testing for member: uid=henson,ou=user,dc=cpp,dc=edu (uid=unxadmin,ou=group,dc=cpp,dc=edu) [Wed Nov 10 15:07:52.056264 2021] [authnz_ldap:debug] [pid 29887] mod_authnz_ldap.c(935): [client 10.104.223.117:51050] AH01715: auth_ldap authorize: require group: authorization successful (attribute member) [Comparison true (cached)][6 - Compare True] and the slapd logs look like: Nov 10 15:07:52 ldap-01 slapd[1233]: conn=224154 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="member" Nov 10 15:07:52 ldap-01 slapd[1233]: conn=224154 op=4 RESULT tag=111 err=6 text= Nov 10 15:08:42 ldap-01 slapd[1233]: conn=224154 fd=138 closed (connection lost) whereas on the 2.5 server, the Apache logs look like: [Wed Nov 10 15:03:52.375004 2021] [authnz_ldap:debug] [pid 29088] mod_authnz_ldap.c(926): [client 10.104.223.117:51022] AH01714: auth_ldap authorize: require group: testing for member: uid=henson,ou=user,dc=cpp,dc=edu (uid=unxadmin,ou=group,dc=cpp,dc=edu) [Wed Nov 10 15:03:52.375887 2021] [authnz_ldap:debug] [pid 29088] mod_authnz_ldap.c(945): [client 10.104.223.117:51022] AH01719: auth_ldap authorize: require group "uid=unxadmin,ou=group,dc=cpp,dc=edu": didn't match with attr member [Comparison false (adding to cache)][5 - Compare False] and the slapd logs look like: Nov 10 15:03:52 ldap-03 slapd[1197]: conn=208924 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="member" Nov 10 15:03:52 ldap-03 slapd[1197]: conn=208924 op=4 RESULT tag=111 err=5 qtime=0.000011 etime=0.000139 text= If I understand correctly, Apache is making a compare call to check to see if my DN (uid=henson,ou=user,dc=cpp,dc=edu) exists as a value of the member attribute in the group uid=unxadmin,ou=group,dc=cpp,dc=edu. It certainly does, on both the server running 2.4 and 2.5: dn: uid=unxadmin,ou=group,dc=cpp,dc=edu objectClass: groupOfNames objectClass: cppGroup objectClass: posixGroup uid: unxadmin cn: Unix Administrators gidNumber: 17730 member: member: uid=gkuri,ou=user,dc=cpp,dc=edu member: uid=henson,ou=user,dc=cpp,dc=edu memberUid: gkuri memberUid: henson Any thoughts on why this is behaving differently? The configuration should be pretty much identical, modulo required path changes and updating the memberOf handling. I was able to work around it by sitting a couple of additional parameters: AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off This now compares just my uid (henson) to the group memberUid attribute: Nov 10 15:24:54 ldap-03 slapd[1197]: conn=210708 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="memberUid" Nov 10 15:24:54 ldap-03 slapd[1197]: conn=210708 op=4 RESULT tag=111 err=6 qtime=0.000016 etime=0.000108 text= Apparently "err=6" is good and "err=5" is not :)? I was able to replicate this difference in behavior using the CLI tools: # ldapcompare -x -H ldaps://ldap-01.ldap.cpp.edu/ uid=unxadmin,ou=group,dc=cpp,dc=edu member:uid=henson,ou=user,dc=cpp,dc=edu TRUE # ldapcompare -x -H ldaps://ldap-03.ldap.cpp.edu/ uid=unxadmin,ou=group,dc=cpp,dc=edu member:uid=henson,ou=user,dc=cpp,dc=edu FALSE ldapsearch confirms that attribute exists for that group in both locations: ldapsearch -x -H ldaps://ldap-01.ldap.cpp.edu/ member=uid=henson,ou=user,dc=cpp,dc=edu dn | grep unxadmin # unxadmin, group, cpp.edu dn: uid=unxadmin,ou=group,dc=cpp,dc=edu # ldapsearch -x -H ldaps://ldap-03.ldap.cpp.edu/ member=uid=henson,ou=user,dc=cpp,dc=edu dn | grep unxadmin # unxadmin, group, cpp.edu dn: uid=unxadmin,ou=group,dc=cpp,dc=edu Help :)? Thanks much…

2 4

DirSync support in OpenLDAP
by shekhar.shrinivasan＠gmail.com 10 Nov '21

10 Nov '21

Hi Team, We have a OpenLDAP Proxy in front of Active Directory servers and all client applications perform ldap operations via the Proxy. One of the applications seems to be not working as expected and when we checked the logs we see this error SEARCH RESULT tag=101 err=12 nentries=0 text=critical extension is not recognized After discussing with the app owner we understand that we need to enable support for dirsync. Can you please let us know if OpenLDAP supports DirSync and what exactly needs to be done on the OpenLDAP proxy. Thanks you for your help !

3 3

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 09 Nov '21

09 Nov '21

--On Tuesday, November 9, 2021 5:41 AM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Is this possible to give slapd.conf reference file . > I did updated config section and restart the slapd but that did not > helped. This would be an extremely basic slapd.conf file: include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel stats TLSCACertificateFile /path/to/ca/cert TLSCertificateFile /path/to/server/cert TLSCertificateKeyFile /path/to/server/private/key TLSProtocolMin 3.3 modulepath /usr/local/lib/openldap moduleload back_mdb.la database config rootpw secret database mdb maxsize 1073741824 suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq database monitor If you are still unable to set the minimum protocol, I would advise confirming what TLS library your slapd build is linked to. For example, the TLSProtocolMin parameter has no effect when slapd is linked to GnuTLS. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

TLS handshake callback
by Jérémie HUNEL 09 Nov '21

09 Nov '21

Hi, I would like to use a custom TLS handshake callback to verify the server's certificate, however it seems that there is not this option yet in openldap. I saw the LDAP_OPT_CONNECT_CB option but this is not exactly what I'm looking for. Is there a way to specify a custom callback? If not, is it a feature that you plan to develop? Regards, Jeremie Internal

1 0

OpenLDAP 2.6 Build Failure - undefined reference
by Simon Pichugin 04 Nov '21

04 Nov '21

Hi, I'm trying to build OpenLDAP 2.6 on Fedora Rawhide and I'm getting the error message: /usr/bin/ld: ./.libs/libldap.so: undefined reference to `ber_sockbuf_io_udp' I've checked commits from https://bugs.openldap.org/show_bug.cgi?id=9673 and found that 'ber_sockbuf_io_udp' was not added to https://git.openldap.org/openldap/openldap/-/blob/master/libraries/liblber/… Is it intentional? If I add 'ber_sockbuf_io_udp' there, my build passes the stage successfully. If 'ber_sockbuf_io_udp' absence is intentional, should I somehow account for it during './configure'? Thank you! Regards, Simon

2 1

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 03 Nov '21

03 Nov '21

--On Wednesday, November 3, 2021 11:13 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Yes it just adding few CN entries to DB for active directory sync up. Not > sure where is the issue then in disabling SSLv3. Do you think is 2.4.54 > might not support TLSprotocolMin? I think it supports. > > I did run slapd in debug mode while starting not seeing any issue TLS > version. > > @(#) $OpenLDAP: slapd 2.4.54 (Oct 27 2020 18:47:58) I testing with 2.4.59 on RHEL7 linked to the RHEL7 OpenSSL libraries and could not reproduce the issue. There are no fixes between 2.4.54 and 2.4.59 related to OpenSSL or TLS. I would note that your TLS configuration directives are inside the database backend definition which is invalid. They are global options and should appear before any database xxxx configuration section. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 03 Nov '21

03 Nov '21

--On Wednesday, November 3, 2021 10:51 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > We do have slapd.conf and as part of config we add a few entries to DB > using LDIF file which has OU/CN/Object class information. > > Do we need to update any config over there or do I need to update > anywhere w.r.t CN=config in slapd.conf ? > > /opt/dirsvcs/sbin/slapadd -f /opt/dirsvcs/etc/openldap/slapd.conf -l > /opt/dirsvcs/etc/openldap/base.ldif That means you're telling slapadd to use that slapd.conf file, it says nothing about what slapd itself is using at startup. > Do we have a tarball option for the 2.6 version? I can look to upgrade it. The OpenLDAP website has a tarball of the source available for download. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP SSLV3 disable
by Ballem, Narayanan 03 Nov '21

03 Nov '21

HI Team, Hope you can help with this issue. I am trying to disable SSLV3 on OpenLDAP servers we are using OpenLDAP as a proxy with upstream Active directory servers. we are using CA certs on this openssl we would like to disable SSLV3. Based on earlier update from OpenLdap Technical support team, I added "TLSProtocolMin 3.2" and able to restart slapd service as well without any issue. However when we tried to test SSLV3 connectivity it's still showing SSLv3 enabled . This OpenLDAP server built on RHEL server with locally compiled and openssl rpm/binaries are part of base RHEL OS image. cat /opt/dirsvcs/etc/openldap/slapd.conf|grep -i TLSProtocolMin TLSProtocolMin 3.2 openssl s_client -connect localhost:1636 -ssl3 -quiet depth=3 CN = XXX Root Certificate Authority verify return:1 SSLV3 is insecure as you know we are looking to disable this asap . Any help in addressing this much appreciated. Thanks Narayanan Linux Platform Engineering 500 Staples Drive, Framingham MA Office: 508-253-6909 | Mobile: 508-333-4395 [signature_1767107679]

3 6

memberof vs groupMembership
by Keith LeValley 01 Nov '21

01 Nov '21

Good afternoon, I am working to migrate my LDAP setup to openldap, however I have run into a problem around group membership. Specifically my old instance of ldap used the attribute "groupMembership" and I need to support this moving forward, so if you were to query the attribute "groupMembership" it needs to return the groups the user is part of. Currently in my test environment I have the memberof overlay working, and I found the option *memberof-memberof-ad* which should allow me to create a custom attribute named "groupMembership" and point the overlay at that attribute. I am really hoping to avoid this though and would much rather have a cleaner solution. Maybe some type of interface that just acts as a pointer to the memberof attribute when they query groupMembership? But I am not familiar enough with openldap to know whether this is even possible. So I guess my question is; is the custom attribute going to be the solution here or is there another tool that I am unaware of? -- Keith LeValley Identity Services Architect, Davenport University phone: (616) 732-1102 klevalley2(a)davenport.edu

3 2

OpenLDAP TLS ciphersuite and groups limit issue
by Ballem, Narayanan 30 Oct '21

30 Oct '21

HI Team, Hope you can help with this issue. 1)I am trying to disable SSLV3 on OpenLDAP servers we are using OpenLDAP as a proxy with upstream Active directory servers. we are using CA certs on this openssl we would like to disable SSLV3 I added the below entry slapd.conf but when I tried to start slapd it's failing to start TLSCipherSuite HIGH:MEDIUM:!SSLv2:!SSLV3 errors as below slapd[19899]: main: TLS init def ctx failed: -1 slapd[19899]: slapd stopped. slapd[19899]: connections_destroy: nothing to destroy. debug logs restart as below TLS: could not set cipher list HIGH:MEDIUM:!SSLv2:!SSLV3. 617c64c1 main: TLS init def ctx failed: -1 617c64c1 slapd stopped. 2) Also, did anybody notice this issue? I am facing the issue with a group display we have several users in group while looking for groups in getent group we are seeing a few users only not sure if there is any limit on group filed in Database. Thanks Narayanan Linux Platform Engineering 500 Staples Drive, Framingham MA Office: 508-253-6909 | Mobile: 508-333-4395 [signature_1767107679]

2 1

logfile-rotate directive fails in 2.6.0
by David Coutadeur 29 Oct '21

29 Oct '21

Hello, Not sure this is a configuration problem or a bug, but when setting the logfile-rotate, I get: 617bc9ae.1b73de17 0x7f44f87c9740 /usr/local/openldap/etc/openldap/slapd.conf: line 12 (logfile-rotate 10 100 24) 617bc9ae.1b759154 0x7f44f87c9740 /usr/local/openldap/etc/openldap/slapd.conf: line 12: <logfile-rotate> handler exited with 16384! My configuration file is below. I am using the 2.6.0 release. The strange part is that the same configuration converted into cn=config seems to work well. Regards, David # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/dyngroup.schema logfile-rotate 10 100 24 logfile /var/log/slapd-ltb/slapd.log logLevel 256 sasl-host ldap.my-domain.com pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args # Load dynamic backend modules: # moduleload back_ldap.la modulepath /usr/local/openldap/libexec/openldap moduleload argon2.la moduleload back_mdb.la moduleload dynlist.la moduleload memberof.la moduleload ppolicy.la moduleload syncprov.la moduleload unique.la access to dn.base="" by * read access to dn.base="cn=subschema" by * read ####################################################################### # config database definitions ####################################################################### database config rootdn cn=config rootpw secret access to attrs="userPassword" by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth =wdx by * auth access to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage ####################################################################### # MDB database definitions ####################################################################### database mdb maxsize 4294967296 suffix dc=my-domain,dc=com rootdn cn=Manager,dc=my-domain,dc=com rootpw secret directory /usr/local/openldap/var/openldap-data index objectClass eq index cn eq,sub index uid pres,eq index givenName pres,eq,sub index l pres,eq index employeeType pres,eq index mail pres,eq,sub index sn pres,eq,sub limits group="cn=admin,ou=groups,dc=my-domain,dc=com" size=unlimited time=unlimited access to attrs="userPassword" by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth =wdx by group.exact="cn=admin,ou=groups,dc=my-domain,dc=com" =wdx by self =wdx by * auth access to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by group.exact="cn=admin,ou=groups,dc=my-domain,dc=com" write by users read

2 1

Re: Antw: [EXT] Symas openldap 2.5 RPMs / openssl cert trust
by Paul B. Henson 29 Oct '21

29 Oct '21

On Thu, Oct 28, 2021 at 08:59:00AM +0200, Ulrich Windl wrote: > OK, thanks for explaining. I wasN#t aware that slapd uses ist own > versiomn of openssl. It doesn't necessarily in general, but specifically the Symas built RPMs do. If you use an OS packaged version it uses the os openssl, and if you build your own it does whatever you tell it to :).

1 0

contextCSN not updated
by bourguijl＠gmail.com 28 Oct '21

28 Oct '21

Dears, I'm using 2.5.7 in a context of 4 MMR with 4 Replica and I just noticed contextCSN is no more updated for cn=config DB or other DB when I do a modification which one is well applied. What could be the issue ? Thx, J-L.

4 4

Re: Antw: [EXT] Symas openldap 2.5 RPMs / openssl cert trust
by Paul B. Henson 26 Oct '21

26 Oct '21

On 10/24/2021 11:19 PM, Ulrich Windl wrote: > Some time ago the way to install root certificates had changed You mean on the server side? There's nothing wrong with the certificate chain on the server, everything trusts that properly including the ldapsearch included with the Symas openldap 2.4 rpms. The issue is that the 2.5 rpms include their own bundled version of openssl, which is not configured to trust the system certificate repository.

2 2

Compound indexing with
by thomaswilliampritchard＠gmail.com 25 Oct '21

25 Oct '21

Hi, If I issue an ldapsearch for groups with a filter of "(&(description=<description>)(|(member=<memberDN>)(memberUid=<memberName>)))" and have the following indexes olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: description eq Will openldap be able to use these indexes for this search, or do I have to add a composite index? What might that look like for specifically optimizing this query? Thanks for the consideration.

2 4

Problem with SSL/TLS on CentOS 7 after upgrading to 2.4.59
by Nick Milas 25 Oct '21

25 Oct '21

Hello, Our main OpenLDAP Server (running on CentOS 7) has been working fine with 2.4.58. Since yesterday, after a (minor, see at the end) OS upgrade which included an update to LTB Openldap 2.4.59, SSL clients see: # ldapwhoami -H ldaps://ldap.noa.gr:636 -x ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) In the log I see, for example: Oct 21 17:10:58 ldap slapd[18532]: conn=1170 fd=18 ACCEPT from IP=195.251.xxx.xxx:44016 (IP=0.0.0.0:389) Oct 21 17:10:58 ldap slapd[18532]: conn=1170 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 21 17:10:58 ldap slapd[18532]: conn=1170 op=0 STARTTLS Oct 21 17:10:58 ldap slapd[18532]: conn=1170 op=0 RESULT oid= err=0 text= Oct 21 17:10:58 ldap slapd[18532]: conn=1170 fd=18 closed (TLS negotiation failure) ... Oct 21 17:11:34 ldap slapd[18532]: conn=1172 fd=18 ACCEPT from IP=[2001:648:2011:xxxx::xxxx]:52018 (IP=[::]:636) Oct 21 17:11:34 ldap slapd[18532]: conn=1172 fd=18 TLS established tls_ssf=256 ssf=256 Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=0 BIND dn="uid=full,ou=sys,dc=noa,dc=gr" method=128 Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=0 BIND dn="uid=Full,ou=sys,dc=noa,dc=gr" mech=SIMPLE ssf=0 Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=0 RESULT tag=97 err=0 text= Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 SRCH base="dc=noa,dc=gr" scope=2 deref=0 filter="(objectClass=*)" Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 SRCH attr=* + Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_op_search: got a persistent search with a cookie=rid=601,csn=20200910151806.461875Z#000000#000#000000 Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_findbase: searching Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_op_search: registered persistent search Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_findcsn: mode=FIND_CSN csn=20200910151806.461875Z#000000#000#000000 Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_findcsn: csn==20200910151806.461875Z#000000#000#000000 not found Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_findcsn: csn<=20200910151806.461875Z#000000#000#000000 found Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_findcsn: mode=FIND_PRESENT csn= Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_sendinfo: present syncIdSet cookie= Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Oct 21 17:11:34 ldap slapd[18532]: conn=1172 op=1 syncprov_sendinfo: present syncIdSet cookie= ... Oct 21 17:11:34 ldap slapd[18532]: send_search_entry: conn 1172 ber write failed. Oct 21 17:11:34 ldap slapd[18532]: conn=1172 fd=18 closed (connection lost on write) Oct 21 17:11:34 ldap slapd[18532]: connection_read(18): no connection! Oct 21 17:11:34 ldap slapd[18532]: connection_read(18): no connection! Oct 21 17:11:34 ldap slapd[18532]: connection_read(18): no connection! Oct 21 17:11:34 ldap slapd[18532]: connection_read(18): no connection! <many more entries like this> ... Oct 21 17:11:34 ldap slapd[18532]: conn=1173 fd=18 ACCEPT from IP=[2001:648:2011:xxxx::xxxx]:33466 (IP=[::]:636) Oct 21 17:11:34 ldap slapd[18532]: conn=1173 fd=18 closed (TLS negotiation failure) Is there some settings change in 2.4.59 or something is getting wrong? My settings: olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/certs/priv.crt olcTLSCipherSuite: HIGH:MEDIUM:+SSLv2 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSCertificateFile: /usr/local/openldap/etc/openldap/certs/cert.crt olcTLSCACertificateFile: /usr/local/openldap/etc/openldap/certs/GeantCA.crt I also tried: olcTLSCipherSuite: ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW without success. Interestingly, I can see random successes like: Oct 21 17:28:55 ldap slapd[18532]: conn=1317 fd=19 ACCEPT from IP=[2001:648:2011:xxxx::xxxx]:47206 (IP=[::]:636) Oct 21 17:28:55 ldap slapd[18532]: conn=1317 fd=19 TLS established tls_ssf=256 ssf=256 Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=0 BIND dn="uid=auth,ou=sys,dc=noa,dc=gr" method=128 Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=0 BIND dn="uid=auth,ou=sys,dc=noa,dc=gr" mech=SIMPLE ssf=0 Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=0 RESULT tag=97 err=0 text= Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=1 SRCH base="ou=people,dc=noa,dc=gr" scope=2 deref=0 filter="(&(&(objectClass=inetOrgPerson)(!(schacUserStatus=internal)))(|(mail=jackie(a)noa.g r)))" Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=1 SRCH attr=cn sn givenname title mail telephonenumber o ou;lang-en-us objectClass Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=1 ENTRY dn="uid=jackie,ou=people,dc=noa,dc=gr" Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 21 17:28:55 ldap slapd[18532]: conn=1317 op=2 UNBIND Oct 21 17:28:55 ldap slapd[18532]: conn=1317 fd=19 close ... Oct 21 17:31:54 ldap slapd[18532]: conn=1347 fd=19 ACCEPT from IP=[2001:648:2011:xxxx::xxxx]:35456 (IP=[::]:389) Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=0 STARTTLS Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=0 RESULT oid= err=0 text= Oct 21 17:31:54 ldap slapd[18532]: conn=1347 fd=19 TLS established tls_ssf=256 ssf=256 Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=1 BIND dn="uid=auth,ou=sys,dc=noa,dc=gr" method=128 Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=1 BIND dn="uid=auth,ou=sys,dc=noa,dc=gr" mech=SIMPLE ssf=0 Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=1 RESULT tag=97 err=0 text= Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=2 SRCH base="ou=people,dc=noa,dc=gr" scope=2 deref=0 filter="(uid=gate)" Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=2 SRCH attr=uid uidNumber gidNumber homeDirectory loginShell Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=2 ENTRY dn="uid=gate,ou=webad,ou=people,dc=noa,dc=gr" Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 21 17:31:54 ldap slapd[18532]: conn=1347 op=3 UNBIND Oct 21 17:31:54 ldap slapd[18532]: conn=1347 fd=19 closed then failures start again, esp. when SYNCRPOV sessions take place (we have 4 SYNCRPOV consumers). Latest updates (from /var/log/yum.log): Oct 20 21:54:24 Updated: 1:grub2-common-2.02-0.87.el7.centos.7.noarch Oct 20 21:54:24 Updated: 32:bind-license-9.11.4-26.P2.el7_9.7.noarch Oct 20 21:54:24 Updated: 1:grub2-pc-modules-2.02-0.87.el7.centos.7.noarch Oct 20 21:54:25 Updated: libX11-common-1.6.7-4.el7_9.noarch Oct 20 21:54:26 Updated: kernel-headers-3.10.0-1160.45.1.el7.x86_64 Oct 20 21:54:28 Updated: ca-certificates-2021.2.50-72.el7_9.noarch Oct 20 21:54:29 Updated: tzdata-2021c-1.el7.noarch Oct 20 21:54:30 Updated: nss-softokn-freebl-3.67.0-3.el7_9.x86_64 Oct 20 21:54:36 Updated: glibc-common-2.17-325.el7_9.x86_64 Oct 20 21:54:38 Updated: glibc-2.17-325.el7_9.x86_64 Oct 20 21:54:39 Updated: nspr-4.32.0-1.el7_9.x86_64 Oct 20 21:54:39 Updated: nss-util-3.67.0-1.el7_9.x86_64 Oct 20 21:54:40 Updated: 1:openssl-libs-1.0.2k-22.el7_9.x86_64 Oct 20 21:54:41 Updated: 1:grub2-tools-minimal-2.02-0.87.el7.centos.7.x86_64 Oct 20 21:54:41 Updated: libX11-1.6.7-4.el7_9.x86_64 Oct 20 21:54:41 Updated: gd-last-2.3.3-2.el7.remi.x86_64 Oct 20 21:54:43 Updated: 32:bind-libs-lite-9.11.4-26.P2.el7_9.7.x86_64 Oct 20 21:54:43 Updated: nss-softokn-3.67.0-3.el7_9.x86_64 Oct 20 21:54:44 Updated: nss-sysinit-3.67.0-3.el7_9.x86_64 Oct 20 21:54:44 Updated: nss-3.67.0-3.el7_9.x86_64 Oct 20 21:54:45 Updated: rpm-4.11.3-46.el7_9.x86_64 Oct 20 21:54:45 Updated: rpm-libs-4.11.3-46.el7_9.x86_64 Oct 20 21:54:46 Updated: 1:grub2-tools-2.02-0.87.el7.centos.7.x86_64 Oct 20 21:54:47 Updated: 1:grub2-tools-extra-2.02-0.87.el7.centos.7.x86_64 Oct 20 21:54:47 Updated: 1:grub2-pc-2.02-0.87.el7.centos.7.x86_64 Oct 20 21:54:47 Updated: rpm-build-libs-4.11.3-46.el7_9.x86_64 Oct 20 21:54:47 Updated: nss-tools-3.67.0-3.el7_9.x86_64 Oct 20 21:54:48 Updated: openldap-2.4.44-24.el7_9.x86_64 Oct 20 21:54:48 Updated: 12:dhcp-libs-4.2.5-83.el7.centos.1.x86_64 Oct 20 21:54:48 Updated: 12:dhcp-common-4.2.5-83.el7.centos.1.x86_64 Oct 20 21:54:49 Updated: 32:bind-libs-9.11.4-26.P2.el7_9.7.x86_64 Oct 20 21:54:50 Updated: 32:bind-export-libs-9.11.4-26.P2.el7_9.7.x86_64 Oct 20 21:54:50 Updated: httpd-tools-2.4.6-97.el7.centos.1.x86_64 Oct 20 21:54:52 Updated: httpd-2.4.6-97.el7.centos.1.x86_64 Oct 20 21:54:54 Updated: 1:openssl-devel-1.0.2k-22.el7_9.x86_64 Oct 20 21:54:56 Updated: 1:openssl-1.0.2k-22.el7_9.x86_64 Oct 20 21:54:56 Updated: oniguruma5php-6.9.7.1-1.el7.remi.x86_64 Oct 20 21:54:56 Updated: gssproxy-0.7.0-30.el7_9.x86_64 Oct 20 21:54:57 Installed: libzstd-1.5.0-1.el7.x86_64 Oct 20 21:54:57 Updated: libzip5-1.8.0-2.el7.remi.x86_64 Oct 20 21:55:00 Updated: kernel-tools-libs-3.10.0-1160.45.1.el7.x86_64 Oct 20 21:55:01 Updated: glibc-headers-2.17-325.el7_9.x86_64 Oct 20 21:55:05 Installed: libicu69-69.1-2.el7.remi.x86_64 Oct 20 21:55:07 Updated: epel-release-7-14.noarch Oct 20 21:55:08 Updated: remi-release-7.9-2.el7.remi.noarch Oct 20 21:55:10 Updated: glibc-devel-2.17-325.el7_9.x86_64 Oct 20 21:55:12 Updated: kernel-tools-3.10.0-1160.45.1.el7.x86_64 Oct 20 21:55:25 Updated: 1:nfs-utils-1.3.0-0.68.el7.2.x86_64 Oct 20 21:55:26 Updated: 1:mod_ssl-2.4.6-97.el7.centos.1.x86_64 Oct 20 21:55:30 Updated: 12:dhclient-4.2.5-83.el7.centos.1.x86_64 Oct 20 21:55:33 Updated: 32:bind-utils-9.11.4-26.P2.el7_9.7.x86_64 Oct 20 21:55:36 Updated: openldap-ltb-2.4.59-1.el7.x86_64 Oct 20 21:55:37 Updated: sudo-1.8.23-10.el7_9.2.x86_64 Oct 20 21:55:38 Updated: rpm-python-4.11.3-46.el7_9.x86_64 Oct 20 21:55:39 Updated: 1:grub2-2.02-0.87.el7.centos.7.x86_64 Oct 20 21:55:40 Updated: rsyslog-8.24.0-57.el7_9.1.x86_64 Oct 20 21:55:40 Updated: kpartx-0.4.9-135.el7_9.x86_64 Oct 20 21:56:00 Updated: 2:microcode_ctl-2.1-73.11.el7_9.x86_64 Oct 20 21:56:01 Updated: kexec-tools-2.0.15-51.el7_9.3.x86_64 Oct 20 21:56:01 Updated: unzip-6.0-22.el7_9.x86_64 Oct 20 21:56:02 Updated: virt-what-1.18-4.el7_9.1.x86_64 Oct 20 21:56:04 Updated: glib2-2.56.1-9.el7_9.x86_64 Oct 20 21:56:05 Updated: python-perf-3.10.0-1160.45.1.el7.x86_64 Oct 20 21:56:30 Installed: kernel-3.10.0-1160.45.1.el7.x86_64 Oct 20 21:56:32 Updated: openldap-ltb-debuginfo-2.4.59-1.el7.x86_64 Please advise. Would you suggest an openldap downgrade to 2.4.58 and/or to openssl-1.0.2k-21? Any other ideas? Nick

5 7

Symas openldap 2.5 RPMs / openssl cert trust
by Paul B. Henson 23 Oct '21

23 Oct '21

The openssl binaries in the 2.5 RPMs use their own build of openssl, which doesn't appear to be configured to trust the system root certificate store: $ ldapsearch -H ldaps://ldap.cpp.edu/ ldap_sasl_interactive_bind: Can't contact LDAP server (-1) additional info: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain) It works fine if you explicitly tell it to: SSL_CERT_FILE=/etc/pki/tls/cert.pem ldapsearch -x -H ldaps://ldap.cpp.edu/ # extended LDIF [...] Is this intentional? It seems it would be useful for the openldap utilities, which are added to the default search path, to support the standard system root CA's. Thanks...

1 0

significant performance degradation in 2.5, broken indexes?
by Paul B. Henson 22 Oct '21

22 Oct '21

So I upgraded one of my test systems to 2.5, from 2.4. Doing a quick basic functionality check after the upgrade, I noticed that the performance on the upgraded system was significantly slower. When the system was running 2.4, searching for my entry after a cold start took a little more than a second: # time ldapsearch -x -b dc=cpp,dc=edu -H ldap://localhost/ uid=henson [...] dn: uid=henson,ou=user,dc=cpp,dc=edu [...] real 0m1.274s and then subsequent searches generally less than 1/10th of a second: real 0m0.010s real 0m0.009s real 0m0.007s real 0m0.006s real 0m0.010s real 0m0.008s After upgrading to 2.5, searches, both cold start and subsequent, all took between 1.5-2 seconds: real 0m1.513s real 0m1.523s real 0m1.308s real 0m1.874s real 0m2.150s real 0m1.406s These are test systems, so really have no load. I noticed on the upgraded box that the CPU kept spiking to 100% every few seconds, and tracked it down to the load balancer health checks, which basically run: # time /opt/symas/bin/ldapsearch -x -b dc=cpp,dc=edu '(objectClass=dcObject)' On the upgraded system, this again takes about 1.5 seconds on every search: real 0m1.483s whereas on the 2.4 system, less than 1/10th of a second: real 0m0.006s It feels like something weird is going on with indexing. I turned on debugging, and this is what the index activity looked like on the 2.4 system: Oct 21 15:27:06 ldap-dev-02 slapd[73033]: <= mdb_index_read: failed (-30798) Oct 21 15:27:06 ldap-dev-02 slapd[73033]: <= mdb_index_read: failed (-30798) Oct 21 15:27:12 ldap-dev-02 slapd[73033]: <= mdb_index_read: failed (-30798) Oct 21 15:27:12 ldap-dev-02 slapd[73033]: <= mdb_index_read 1 candidates Which makes sense, there's only one of me :). On the other hand, on the upgraded system: Oct 21 15:25:55 ldap-dev-03 slapd[42259]: <= mdb_index_read: failed (-30798) Oct 21 15:25:55 ldap-dev-03 slapd[42259]: <= mdb_index_read: failed (-30798) Oct 21 15:26:19 ldap-dev-03 slapd[42259]: <= mdb_index_read 132354 candidates It looks like it's doing a full directory search for my entry? My configuration on the two systems is exactly the same, other than the changed paths for the 2.5 directory layout, removing the password policy schema include, and removing a pres index on automountInformation for the upgrade advice. I have tested this both with using the existing binary mdb database files from the 2.4 system as well as dumping them out via slapcat, deleting the old ones, and creating new ones with the 2.5 version of slapadd, with the exact same behavior Any thoughts on what might be going on or how I can debug it to track down exactly what is causing it? There was obviously a lot more debug info in the logs that I didn't include, but none of it jumped out to me as "smoking gun". Thanks much…

2 5

Replication N-way
by bourguijl＠gmail.com 21 Oct '21

21 Oct '21

Dears, I've 4 masters in mirror mode and I try to sort out of replication issue for config DB. When I modify one parameter, sometimes it's replicated on all masters but for some other modification it's not. Here is extract from logs : Sep 21 18:14:57 obesulus prod-corp-M[3073666]: do_syncrep2: rid=003 cookie=rid=003,sid=003 Sep 21 18:14:57 obesulus prod-corp-M[3073666]: syncrepl_message_to_entry: rid=003 DN: olcDatabase={0}config,cn=config, UUID: 94f2e3c6-7209-102f-9dc5-7b3f1ec29d0e Sep 21 18:14:57 obesulus prod-corp-M[3073666]: syncrepl_entry: rid=003 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) csn=(none) tid 0x7f5f890fb700 Sep 21 18:14:57 obesulus prod-corp-M[3073666]: dn_callback : entries have identical CSN olcDatabase={0}config,cn=config 20210921161430.588403Z#000000#002#000000 Sep 21 18:14:57 obesulus prod-corp-M[3073666]: syncrepl_entry: rid=003 be_search (0) Sep 21 18:14:57 obesulus prod-corp-M[3073666]: syncrepl_entry: rid=003 olcDatabase={0}config,cn=config Sep 21 18:14:57 obesulus prod-corp-M[3073666]: syncrepl_entry: rid=003 entry unchanged, ignored (olcDatabase={0}config,cn=config) I don't know why I've this "entries have identical CSN" while entry has been modified on one master. I checked my syncrepl definition against URI and it's OK so I don't know what's the clue. Can you help me ? Thx, Jean-Luc.

3 9

Symas OpenLDAP 2.5 RPMs run slapd as root?
by Paul B. Henson 20 Oct '21

20 Oct '21

I'm testing openldap 2.5 in preparation for migration my production services, and I noticed that the 2.5 RPMs no longer create an ldap user and instead run slapd as root by default? Is this because they're no longer intended to replace the system bundled openldap packages? It seems undesirable from a security perspective to run slapd as root rather than a dedicated service account. I see there's a note about updating the startup options to run as a service account here: https://repo.symas.com/soldap/systemd/ but the ldap user/group used as an example won't exist unless the system RPMs or the 2.4 RPMs have been previously installed or the user is created manually.

5 8

Re: back-sql
by Udo Rader 20 Oct '21

20 Oct '21

Hi Mark, thanks for getting back. I've since dug out my +10y old configuration and managed to set things up pretty easily. There are some headaches and pitfalls, yes, but for a r/o address book it still works pretty well. After adding pcache, performance got a lot better, too. Not perfect of course, but it works well enough. Will probably only know in a couple of weeks how well it really works, performance and stability wise. BR Udo On 19.10.21 19:27, Mark Murawski wrote: > Hi Udo, > > After months of troubleshooting. I've determined that back-sql is > missing core functionality that prevents its use in terms of > implementing a full-service ldap system. > > I am a developer, but I don't have the time to deep-dive into this. What > I would up doing was storing my data in postgres and then exporting to a > read-only standard ldap backend. And re-exporting once a day to address > changes to the data in postgres. > > Hope this helps. > > Thanks. > > > > > > On 10/15/21 5:00 PM, Udo Rader wrote: >> Hi, >> I need to expose some data stored in a postgres database using >> OpenLDAP. In the past, I've used back-sql for that purpose and it has >> worked quite nicely, but that has been a very long time ago. >> Now, after digging through the archives a little bit, I read that the >> usage of the backend is discouraged, because it is unmaintained. >> What I basically need is an LDAP based address book, that users can >> connect to using their macOS based MUAs. >> So if we say, that the backend is only used for read-only access, is >> it still not recommended? And maybe, if the backend happens to be >> unusable, are there any viable alternatives that come to mind? >> Thanks >> Udo > -- Udo Rader, CEO BestSolution.at EDV Systemhaus GmbH Salurner Straße 15, A-6020 Innsbruck http://www.bestsolution.at/ Reg. Nr. FN 222302s am Firmenbuchgericht Innsbruck

2 2

Re: OpenLDAP 2.6.0 testing call #3
by Nick Folino 20 Oct '21

20 Oct '21

Works like a charm on my Fedora 34 systems. Nick On Mon, Oct 18, 2021 at 4:43 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the third testing call for OpenLDAP 2.6.0 Release. This is > expected to be the final testing call. > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > A list of items fixed and added in 2.6 can be found at: > > < > https://bugs.openldap.org/buglist.cgi?bug_status=RESOLVED&bug_status=VERIFI… > > > > A major change with 2.6 is the optional ability to bypass syslog for > logging (ITS#6949). This significantly improves slapd and lloadd > performance. > > Additionally, the following deprecated backends have been removed: > > back-ndb > back-shell > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Logfile timestamp in 2.6
by Nick Folino 17 Oct '21

17 Oct '21

Is there a way to change the timestamp format in the logs? Something a bit more readable than time from epoch in hex would be nice. Nick

4 6

back-sql
by Udo Rader 16 Oct '21

16 Oct '21

Hi, I need to expose some data stored in a postgres database using OpenLDAP. In the past, I've used back-sql for that purpose and it has worked quite nicely, but that has been a very long time ago. Now, after digging through the archives a little bit, I read that the usage of the backend is discouraged, because it is unmaintained. What I basically need is an LDAP based address book, that users can connect to using their macOS based MUAs. So if we say, that the backend is only used for read-only access, is it still not recommended? And maybe, if the backend happens to be unusable, are there any viable alternatives that come to mind? Thanks Udo

2 1

accesslog moving from 2.4. to 2.5 SIGSEGV on startup
by David Hawes 14 Oct '21

14 Oct '21

When slapcat-ing a 2.4 accesslog database and slapadd-ing it to a 2.5 instance, slapd will segfault on startup (specifically logpurge) due to a missing minCSN, which was added in 2.5 [1]. Though I haven't done too much analysis on the correct fix, 2 options are: 1. Add the minCSN to your accesslog LDIF. I simply used the entryCSN of the accesslog suffix. 2. Check that li->li_mincsn is not null in log_old_lookup(). Simple patch attached. I attached a minimal slapd conf and accesslog.ldif to duplicate the issue. [1] https://git.openldap.org/openldap/openldap/-/commit/66a743f119c85ee83f2efcd…

2 1

delta-sync out of sync..
by frederic.goudal＠bordeaux-inp.fr 14 Oct '21

14 Oct '21

Hello, I have a strange problem, but maybe I have missed something. I have two ldap servers openldap 2.5.7 in Multimaster delta-sync replication (copying the config from Quanah blog). Recencly one of the two servers ran out of disk space, the one that recieve modifications. This server had an entry that had not been replicated on the second server. After cleaning the disk, I restarted the server. I noticed in the log a lot of syncing activity. When the logs stopped to show activity : the contextCSN of both server are exactly the same (both context csn), but the entry has not been created on the second server. What to do ? Thanks in advance -- Frédéric Goudal Administrateur Systèmes et Réseaux Bordeaux-INP

2 1

Symas OpenLDAP 2.5.8 now available
by Quanah Gibson-Mount 12 Oct '21

12 Oct '21

Symas OpenLDAP 2.5.8 is now available. Installation instructions available at <https://repo.symas.com/soldap/>. Builds are provided for free of use with no support. Optional paid support is available, further details at <https://www.symas.com/> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP 2.6.0 testing call #2
by Quanah Gibson-Mount 11 Oct '21

11 Oct '21

This is the second testing call for OpenLDAP 2.6.0 Release. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. A list of items fixed and added in 2.6 can be found at: <https://bugs.openldap.org/buglist.cgi?bug_status=RESOLVED&bug_status=VERIFI…> A major change with 2.6 is the ability to bypass syslog for logging (ITS#6949). This significantly improves slapd performance. Currently this is being adjusted so that lloadd also supports this new feature, but it can be tested with slapd at this time. Additionally, the following deprecated backends have been removed: back-ndb back-shell Known issues: *) The standalone form of lloadd does not honor olcLogLevel when combined with the new logging parameters. It will honor debug level settings passed via the -d option. *) The standalone form of lloadd can deadlock if the monitor backend is enabled. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

5 8

2.5.7 - bind err=49 after a userPassword and pwdChangedTime update
by Dave Macias 11 Oct '21

11 Oct '21

Hello, Happy Friday! I have a script that defaults the password to the user's username and then it sets the pwdChangedTime so far back that pwdMaxAge: 62208000 triggers. In 2.5.7 before I change the pwdChangedTime i MUST do a simple bind with dn/password before I can apply the new pwdChangedTime. I say in 2.5.7 bc in 2.4.59 i dont see this behavior. So my flow goes as follows: ldappasswd <newpass> ldapmodify <newPwdChangedTime> (pwdChangedTime: 20191008133434Z) ssh with new <newpass> Oct 8 09:17:06 localhost slapd[1380194]: conn=1199 op=2 BIND dn="uid=davetest,ou=People,dc=domain,dc=net" method=128 Oct 8 09:17:06 localhost slapd[1380194]: conn=1199 op=2 RESULT tag=97 err=49 qtime=0.000026 etime=0.000262 text= Flow i have to do so that bind works: ldappasswd <newpass> ldapsearch -D userdn -w <newpass> &/dev/null ldapmodify <newPwdChangedTime> (pwdChangedTime: 20191008133434Z) ssh with new <newpass> Oct 8 09:29:11 localhost slapd[1380194]: conn=1264 op=2 BIND dn="uid=davetest,ou=People,dc=domain,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Oct 8 09:29:11 localhost slapd[1380194]: fe_op_lastbind: old pwdLastSuccess value=20211008132909Z 2s ago Oct 8 09:29:11 localhost slapd[1380194]: ppolicy_bind: Entry uid=davetest,ou=People,dc=domain,dc=net has an expired password: 0 grace logins Oct 8 09:29:11 localhost slapd[1380194]: conn=1264 op=2 RESULT tag=97 err=49 qtime=0.000016 etime=0.002915 text= Oct 8 09:29:11 localhost slapd[1380194]: conn=1264 op=3 UNBIND Oct 8 09:29:11 localhost slapd[1380194]: conn=1264 fd=15 closed Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 fd=15 ACCEPT from IP= 127.0.0.1:34044 (IP=0.0.0.0:389) Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=0 STARTTLS Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=0 RESULT oid= err=0 qtime=0.000029 etime=0.000113 text= Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 fd=15 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=1 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality defaultNamingContext lastUSN highestCommittedUSN Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000016 etime=0.000228 nentries=1 text= Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=2 BIND dn="uid=davetest,ou=People,dc=domain,dc=net" method=128 Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=2 BIND dn="uid=davetest,ou=People,dc=domain,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Oct 8 09:29:14 localhost slapd[1380194]: fe_op_lastbind: old pwdLastSuccess value=20211008132911Z 3s ago Oct 8 09:29:14 localhost slapd[1380194]: ppolicy_bind: Entry uid=davetest,ou=People,dc=domain,dc=net has an expired password: 0 grace logins Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=2 RESULT tag=97 err=49 qtime=0.000016 etime=0.002904 text= Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.1 Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=3 PASSMOD id="uid=davetest,ou=People,dc=domain,dc=net" old new Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=3 RESULT oid= err=0 qtime=0.000016 etime=0.002618 text= Oct 8 09:29:14 localhost slapd[1380194]: conn=1265 op=4 UNBIND Is this expected behavior? Thank you, Dave

2 1

[LMDB] Performance on AWS/Windows
by Jürgen Baier 08 Oct '21

08 Oct '21

Hi, I'm using LMDB for mapping MD5 hash codes to some data. I noticed that a virtualized environment (Xen/Windows on our own servers and AWS/Windows) slows down LMDB significantly (e.g. a certain workload is executed in 30 minutes on a local machine vs. 15 hours on AWS). My application also has an implementation in SQLite which is slower than LMDB on a local machine. But its performance is similar on AWS. The rough numbers are something like Local: - LMDB: 30 minutes - SQLite: 45 minutes AWS: - LMDB: 15 hours - SQLite: 50 minutes I wanted to ask if there is something I can do to speed up LMDB on AWS? Maybe I'm missing something obvious. Thanks, Jürgen -- Juergen Baier

4 3

Sudoers LDAP Backend and wildcards
by Dario García Díaz-Miguel 07 Oct '21

07 Oct '21

Hello Everyone, We are facing an issue related with the Sudoers LDAP Backend. We have a LDAP group that should be able to vi, tail and less all the files contained inside /var/log/ We are thinking about using wildcards but it seems that the wildcards that works for suders file does not works when the backend is the LDAP. Eg. dn: cn=%GroupEX,ou=SUDOers,dc=examples,dc=example,dc=com objectClass: top objectClass: sudoRole cn: %Sec_Analysts description: Security Administrators group sudo rules sudoCommand: /usr/bin/less /var/log/* sudoCommand: /usr/bin/tail /var/log/* sudoCommand: /usr/bin/head /var/log/* sudoCommand: /usr/bin/vi /var/log/* sudoCommand: /usr/bin/vim /var/log/* sudoOption: !authenticate sudoOrder: 115 sudoRunAsUser: root sudoUser: %GroupEX This only works when the user that belongs to GroupEX run the commands as shown: /usr/bin/less /var/log/* /usr/bin/tail /var/log/* ... But this does not work when the command is performed as: /usr/bin/less /var/log/warn /usr/bin/tail /var/log/warn Any ideas? Using ACLs and File permissions are not an option here. Thank you so much. Regards. [cid:image001.gif@01D7BB82.7B9FECE0] Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com <http://www.gmv.com/> [cid:image002.png@01D7BB82.7B9FECE0]<http://www.facebook.com/infoGMV> [cid:image003.png@01D7BB82.7B9FECE0]<http://www.twitter.com/infoGMV_es> [cid:image004.png@01D7BB82.7B9FECE0]<http://www.youtube.com/infoGMV> [cid:image005.png@01D7BB82.7B9FECE0]<https://www.linkedin.com/company/gmv> [cid:image006.png@01D7BB82.7B9FECE0]<http://www.gmv.com/en/RSS> [cid:image007.png@01D7BB82.7B9FECE0]<http://www.gmv.com/blog_gmv/language/en/> P Please consider the environment before printing this e-mail.

3 2

2.5.7 - help understanding syslog local4
by Dave Macias 04 Oct '21

04 Oct '21

Hello, On 2.4.X i didnt have any issues using rsyslog with "local4.* /var/log/slapd/slapd.log" and I would get all the connection and searches done on the db. Which was great!! I am having a hard time doing the same thing with 2.5.7. Without any changes to the service file, just running slapd on rocky linux 8 i get these logs on /var/log/slapd/slapd.log only Sep 23 10:10:18 localhost slapd[3992243]: @(#) $OpenLDAP: slapd 2.5.7 (Aug 19 2021 17:48:53) $#012#011mockbuild@3b6af787015541c89363999d4338d587 :/builddir/build/BUILD/openldap-2.5.7/servers/slapd If i change the service file with (-d 256): ExecStart=/opt/symas/lib/slapd -d 256 -h ${SLAPD_URLS} $SLAPD_OPTIONS I get at least these msgs: 614c8ac4.0dc359b2 0x7fdf0f91f700 conn=1000 fd=17 ACCEPT from IP=[xxxx]:55556 (IP=[xxxx]:389) 614c8ac4.0dc5b882 0x7fdf0f91f700 conn=1000 op=0 BIND dn="" method=128 614c8ac4.0dc709f0 0x7fdf0f91f700 conn=1000 op=0 RESULT tag=97 err=0 qtime=0.000016 etime=0.000135 text= 614c8ac4.17c7146d 0x7fdf0f91f700 conn=1000 op=1 SRCH base="dc=domain,dc=net" scope=2 deref=0 filter="(objectClass=*)" 614c8ac4.36abd8fd 0x7fdf0f91f700 conn=1000 op=1 SEARCH RESULT tag=101 err=4 qtime=0.000028 etime=0.518395 nentries=500 text= 614c8ac5.06b07c4b 0x7fdf0f91f700 conn=1000 op=2 UNBIND 614c8ac5.06b1d67d 0x7fdf0f91f700 conn=1000 fd=17 closed But unfortunately I do not get them to log into my slapd.log file. I even added -l local4 but no change. Is (-d 256) even correct? /opt/symas/lib/slapd -d ? Installed log subsystems: Any (-1, 0xffffffff) Trace (1, 0x1) Packets (2, 0x2) Args (4, 0x4) Conns (8, 0x8) BER (16, 0x10) Filter (32, 0x20) Config (64, 0x40) ACL (128, 0x80) Stats (256, 0x100) Stats2 (512, 0x200) Shell (1024, 0x400) Parse (2048, 0x800) Sync (16384, 0x4000) None (32768, 0x8000) Any input as to what I may be doing wrong is much appreciated! Thank you, Dave

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical