- openldap-technical - openldap.org

Re: Q: status of component matching?
by Lehnert, Hartmut 31 May '10

31 May '10

Hi all! To avoid the slapd's core dump when using component match filters (see ITS # 6556) I removed line 556 of file "servers/slapd/filter.c": case LDAP_FILTER_EXT: //mra_free( op, f->f_mra, 1 ); break; Now component match filter search requests are answered by slapd but don't work correctly. In fact nothing is found! For example the request /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s sub "(userCertificate:componentFilterMatch:=item:{ component \"toBeSigned.serialNumber\", rule allComponentsMatch, value 449 })" sncertnr Is answered with # extended LDIF # # LDAPv3 # base <o=CustomerCA,c=de> with scope subtree # filter: (userCertificate:componentFilterMatch:=item:{ component "toBeSigned.serialNumber", rule allComponentsMatch, value 449 }) # requesting: sncertnr # # search result search: 2 result: 0 Success # numResponses: 1 But in the database of slapd there are several certificates with serialNumber 449: lehnert.hartmut@sn-ocspr4:/opt/lehnert/Openldap-Support$ ./dumpasn1 449.cer 0 30 702: SEQUENCE { 4 30 551: SEQUENCE { 8 A0 3: [0] { 10 02 1: INTEGER 2 : } 13 02 2: INTEGER 449 17 30 13: SEQUENCE { 19 06 9: OBJECT IDENTIFIER : sha256WithRSAEncryption (1 2 840 113549 1 1 11) 30 05 0: NULL : } 32 30 111: SEQUENCE { 34 31 11: SET { 36 30 9: SEQUENCE { 38 06 3: OBJECT IDENTIFIER countryName (2 5 4 6) 43 13 2: PrintableString 'DE' : } : } 47 31 12: SET { On slapd's side the debug message bdb_search: <integer> does not match filter is written out for every record. What's going wrong here? Regards, Hartmut

1 0

multiple instances
by mj romero 31 May '10

31 May '10

Hello, I installed a server (RHEL5 x86_64) with three instances of OpenLDAP 2.3.43. ldap 6572 1 0 May24 ? 00:49:12 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.104:389 -f /etc/openldap/slapd.conf -l LOCAL4ldap 6612 1 0 May24 ? 00:49:09 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.105:389 -f /etc/openldap/slapd_i3.conf -l LOCAL6ldap 8031 1 0 01:01 ? 00:01:26 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.104:389 -f /etc/openldap/slapd_i2.conf -l LOCAL5 At first everything worked perfect but after several days working properly one instance stopped.I started the instance again but after several days one instance stopped (not the same).I don't understand what happens. Any help is very useful to me. Thank you very much. _________________________________________________________________ Disfruta de Messenger y Hotmail en tu BlackBerry ¡Hazlo ya! http://serviciosmoviles.es.msn.com/messenger/blackberry.aspx

1 0

memberOf attributes not working through slapd-ldap backend
by Liam Gretton 29 May '10

29 May '10

Hi, Main LDAP server is 2.4 on openSUSE. The memberof overlay is in use. On any openSUSE clients (also OpenLDAP 2.4), ldapsearch on a uid with a '+' for the attribute arguments correctly returns the memberOf attributes as created by the overlay. On Scientific Linux 5.4 I have a build of OpenLDAP 2.4 (not mine, supplied by our vendor which repackages some components). I've setup a proxy server there which uses slapd-ldap to proxy connections back to the openSUSE LDAP server. On the SL system, ldapsearch talking directly to the openSUSE server correctly returns the memberOf attributes when using '+'. But when going through the local proxy server, they don't appear. The server log says "PROXIED attributeDescription "MEMBEROF" inserted"; if I specify the attribute explicitly (e.g. ldapsearch uid=liam memberof) the memberOf attributes are displayed, but all in capitals, as if there's a schema missing. One possibly important point: we're using the rfc2307bis schema on our main server, and this isn't supplied with the SL distribution of OpenLDAP, so I've just copied it over to the SL system. I think this suggests a broken build of OpenLDAP 2.4 supplied by our vendor, but is there anything I might be doing wrong? The proxy server's slapd.conf file is as so: include /cm/local/apps/openldap/etc/schema/core.schema include /cm/local/apps/openldap/etc/schema/cosine.schema include /cm/local/apps/openldap/etc/schema/inetorgperson.schema include /cm/local/apps/openldap/etc/schema/rfc2307bis.schema include /cm/local/apps/openldap/etc/schema/rcsperson.schema argsfile /var/run/openldap/slapd.args pidfile /var/run/openldap/slapd.pid database ldap monitoring off uri ldap://opensuse.ldapserver.example.com tls start tls_cacertdir=/etc/openldap/certs suffix dc=example,dc=com rootdn "cn=admin,dc=example,dc=com" -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

3 4

ldapsearch issue
by Derek Yarnell 29 May '10

29 May '10

Hi, So I was trying to do the following search, (&(automountMapName=auto*)(objectClass=automountMap)) It logs the following though, slapd[5205]: conn=258105 op=9 SRCH base="ou=automount,ou=system,dc=XXX,dc=XXX,dc=XXX" scope=2 deref=2 filter="(&(?automountMapName=auto*)(objectClass=automountMap))" If you do this search (&(automountMapName=*)(objectClass=automountMap)) slapd[5205]: conn=258174 op=1 SRCH base="ou=automount,ou=system,dc=XXX,dc=XXX,dc=XXX" scope=2 deref=0 filter="(&(automountMapName=*)(objectClass=automountMap))" This is the schema definition on the server (rfc2307bis), attributeType ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) My feeling is that caseExactIA5SubstringsMatch is doing something very wrong here. Shouldn't slapd be returning a error not injecting a ? in my search. Thanks, derek Derek Yarnell UNIX Systems Administrator University of Maryland Institute for Advanced Computer Studies

2 1

Replication problem - segfault
by Marcio Merlone 28 May '10

28 May '10

Hi all, I am upgrading my servers from Ubuntu 8.04 to 10.04 one by one. I took the opportunity to test and migrate slapd.conf to cn=config. I got the first new server running 10.04 (slapd 2.4.21-0ubuntu5), which is called 'haumea', and set everything up, smooth run. Then, I got to test replication with another server running Ubuntu 8.04 (slapd 2.4.9-0ubuntu0.8.04.3) - this one is 'venus'. So, in short, I am testing a multi-master replication with slapd 2.4.21-0ubuntu5 and slapd 2.4.9-0ubuntu0.8.04.3. At first, it successfully replicated one attr (olcLogLevel) from haumea to venus, but later on, when I try to modify 'olcMonitoring' of 'dn: olcDatabase={0}config,cn=config' same way, slapd process dies on the older server (venus): 'May 28 11:41:47 venus kernel: [511798.502592] slapd[3966]: segfault at 00000140 eip b7fa5634 esp b67658a0 error 4' Are there any issues regarding slapd 2.4.21-0ubuntu5 or replication between different versions? Does anyone know where can I get pre-compiled binary packages to upgrade Ubuntu 8.04 to slapd 2.4.21? Please let me know if you need further information. Thanks and best regards. -- Marcio Merlone

1 0

Slapd service does not start - Gentoo Linux ...
by Christopher Kurtis Koeber 28 May '10

28 May '10

Hello, I recently installed OpenLDAP 2.4.19 on a Gentoo Linux system. The installation completed without issue but the service slapd will not start. I loaded the initial entry and ran slaptest, which came back clean. Below is the output for "slaptest -d 25" and attached is my config file. Also attached is the output of the following command: /usr/lib/openldap/slapd -F /etc/openldap/ -d 65535 Any ideas as to why the service will not start while the system is starting up? Thank you for your time. ----Begin Output---- slaptest -d 25 slaptest init: initiated tool. bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.7.25: (2010-05-20) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.7.25: (2010-05-20) >>> dnNormalize: <> <<< dnNormalize: <> >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> hdb_db_init: Initializing HDB database >>> dnPrettyNormal: <dc=wesleyseminary,dc=edu> <<< dnPrettyNormal: <dc=wesleyseminary,dc=edu>, <dc=wesleyseminary,dc=edu> >>> dnPrettyNormal: <cn=Manager,dc=wesleyseminary,dc=edu> <<< dnPrettyNormal: <cn=Manager,dc=wesleyseminary,dc=edu>, <cn=manager,dc=wesleyseminary,dc=edu> >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 2.5.13.39 (certificateListMatch): 2.5.13.38 (certificateListExactMatch): matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) 2.5.13.35 (certificateMatch): 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcDbChecksum $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcSpNoPresent $ olcSpReloadHint $ olcChainCacheURI $ olcChainReturnError $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbNoRefs $ olcDbNoUndefFilter ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcSpCheckpoint $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcSpCheckpoint $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) slaptest startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=module{0}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}inetorgperson" config_build_entry: "cn={3}nis" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}hdb" backend_startup_one: starting "dc=wesleyseminary,dc=edu" hdb_db_open: database "dc=wesleyseminary,dc=edu": dbenv_open(/var/lib/openldap-data). config file testing succeeded slaptest shutdown: initiated ====> bdb_cache_release_all slaptest destroy: freeing system resources. ---End Output--- Regards, Christopher Kurtis Koeber (W): (202) 885-8654 (C): (301) 467-8417 http://www.chriskoeber.com <http://www.chriskoeber.com/>

2 2

Re: ppolicy master/slave issue (currently "forward ppolicy updates" OR "authenticate")
by Chris Jacobs 28 May '10

28 May '10

Whew! And I thought I was really off my rocker for a bit there - it made no sense to me (still doesn't, really). One of the reasons for our LDAP upgrade was the pwdpolicy (and less out-of-sync slaves; an issue with our 2.3 boxes) - going to have to re-think our implementation - I really preferred the 'slave servers in remote locations' model, but if the ppolicy overlay works best in a multi master model (replicating pwdfailures and authenticate - for real), I'll have to convince mgmt of the new model. Thanks for checking Sidhartha! - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org To: openldap-technical(a)openldap.org Sent: Tue May 25 17:16:00 2010 Subject: RE: ppolicy master/slave issue (currently "forward ppolicy updates" OR "authenticate") I replicated the setup and issues with slapd.d configuration. Running OpenLDAP 2.4.21 on CentOS x64. 1. Master and slave setup with ppolicy overlay. 2. When client points to master, pwdFailures are duly recorded and respected. Password auth works as expected. 3. When clients points to slave with chaining disabled, password auth and changes work fine but obviously pwdFailures are not recorded anywhere - neither on slave or master. 4. When client points to slave with chaining enabled, password auth breaks meaning user can type any string and still get a successful auth. Interestingly, in this case, pwdFailures get recorded on slave and master. Why or how a bind succeeds with a wrong password is weird. With slapd.d type config, the chain directives go under "frontendconfig" so I suspect the solution must lie there. As a sidenote, I am thinking of doing without slaves and just creating more primaries in multi-mode replication. Seems less complicated in terms of configuration and maintenance. Thanks, - Siddhartha > -----Original Message----- > From: openldap-technical-bounces+sjain=silverspringnet.com(a)openldap.org > [mailto:openldap-technical- > bounces+sjain=silverspringnet.com(a)openldap.org] On Behalf Of Chris > Jacobs > Sent: Tuesday, May 25, 2010 9:16 AM > To: openldap-technical(a)openldap.org > Subject: RE: ppolicy master/slave issue (currently "forward ppolicy > updates" OR "authenticate") > > Haven't heard anything on this yet... > > If someone could point me to some documentation, or better, graphic > illustration, of how OpenLDAP 'works', perhaps I can figure this out on > my own. > > Thanks, > - chris > > -----Original Message----- > From: openldap-technical- > bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org [mailto:openldap- > technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org] On Behalf Of > Chris Jacobs > Sent: Thursday, May 06, 2010 11:45 AM > To: openldap-technical(a)openldap.org > Subject: RE: ppolicy master/slave issue (currently "forward ppolicy > updates" OR "authenticate") > > Anyone? > > I can't be the only person trying to implement ppolicy_forward_updates > and have user's actually authenticate... > > I've been poring over the documentation: > > http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies > http://www.symas.com/blog/?page_id=66 > http://www.openldap.org/software/man.cgi?query=slapo- > ppolicy&sektion=5&apropos=0&manpath=OpenLDAP+2.4-Release > Which indicates: "This setting is only useful on a replication > consumer, and also requires the updateref setting and chain overlay to > be appropriately configured." > > I tried "chain-rebind-as-user" and that didn't seem to help (you can > see it in the configs below) - at least, how I tried it. Perhaps I > misunderstand something (I'm hoping at least) > > I'm totally at a loss here... > > - chris > > -----Original Message----- > From: openldap-technical- > bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org [mailto:openldap- > technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org] On Behalf Of > Chris Jacobs > Sent: Monday, May 03, 2010 9:07 AM > To: openldap-technical(a)openldap.org > Subject: RE: ppolicy master/slave issue > > Really, I think this comes down to how to: > * ppolicy_forward_updates requiring priviledges > * authentication NOT requiring priviledges > > How do I split the two? Let ppolicy forward updates, which requires > priviledges, and NOT specify any authentication while user's are > authenticating? > > Thanks, > - chris > > -----Original Message----- > From: openldap-technical- > bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org [mailto:openldap- > technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org] On Behalf Of > Chris Jacobs > Sent: Thursday, April 29, 2010 2:55 PM > To: openldap-technical(a)openldap.org > Subject: ppolicy master/slave issue > > Hello again, > > I'm having an odd issue with ppolicy and my master/slave config. > > First, my goals > General use: > Slave handles all reads locally. > Writes get forwarded to the master by the slave. > > Password policy: > When password failures happen on clients using slave ldap servers, > the failures, etc, get passed to the master to get replicated to the > slaves. > I understand this would be done using the ppolicy option: > ppolicy_forward_updates > > Authentication: > Actually authenticate (more later). > > To the problem: > --------------- > When I leave the section in the chain bit of SLAVE slapd.conf below > marked by lines intact (which bind as root): > * ppolicy_forward_updates seems to work great - the master shows > matching "pwdFailureTime" attributes. > * Regardless of password entered, you get a shell. User/bad password = > get a shell! This being a problem should be obvious. > I suspect that's due to the chain overlay section... > > If I comment out the lines in the SLAVE slapd.conf: > * authentication actually requires authentication (bad password = no > authentication) > * ppolicy_forward_updates don't work (no updates to master) > > It's possible that from my description some may already know my issue - > however, just to be sure, I've pasted below 'bare' versions of the: > * a master slapd.conf (sans schema includes) > * a slave slapd.conf (sans schema includes) > * /etc/ldap.conf (using slave) > * /etc/openldap/ldap.conf (same on all ldap servers) (thanks Howard - > they are NOT the same) > * /etc/pam.d/system-auth-ac (CentOS 5.4; ssh refers to system-auth-ac > for all types). > > Thanks for any help (and, likely, pointing out any 'stupids' below), > - chris > > PS: Feel free to critique - you won't hurt my feelings. > > MASTER slapd.conf: (one of a pair, mirrored, active/passive fail over) > ---------------------------------------------------------------------- > serverID 1 > loglevel 0 > pidfile /usr/local/var/openldap-data/run/slapd.pid > argsfile /usr/local/var/openldap-data/run/slapd.args > TLSCipherSuite HIGH:MEDIUM:+SSLv2 > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/cacerts/servercrt.pem > TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem > TLSVerifyClient never > password-hash {MD5} > sizelimit size.soft=500 size.hard=unlimited > timelimit time.soft=3600 time.soft=unlimited > database bdb > suffix "dc=example,dc=net" > rootdn "cn=root,dc=example,dc=net" > rootpw "secret" > directory "/usr/local/var/openldap-data" > include /etc/openldap/slapd.access.conf > index uid,cn,gidNumber,uidNumber,memberUid eq > index objectClass pres,eq > index operatingSystem pres,eq > index host pres,eq > index rack eq > index entryUUID eq > index uniqueMember eq > index entryCSN eq > index site eq > overlay ppolicy > ppolicy_hash_cleartext > ppolicy_use_lockout > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 10 > syncrepl rid=2 > provider=ldaps://ldapmaster2.corp.example.net > type=refreshAndPersist > interval=00:00:10:00 > searchbase="dc=example,dc=net" > bindmethod=simple > binddn="cn=root,dc=example,dc=net" > credentials="secret" > retry="15 20 60 +" > mirrormode on > database monitor > > SLAVE slapd.conf: > ----------------- > serverID 13 > loglevel 0 > pidfile /usr/local/var/openldap-data/run/slapd.pid > argsfile /usr/local/var/openldap-data/run/slapd.args > TLSCipherSuite HIGH:MEDIUM:+SSLv2 > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/cacerts/servercrt.pem > TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem > TLSVerifyClient never > password-hash {MD5} > sizelimit size.soft=500 size.hard=unlimited > timelimit time.soft=3600 time.soft=unlimited > overlay chain > chain-uri ldaps://ldap-vip.corp.example.net/ > chain-rebind-as-user TRUE > vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv > vvvvvv > chain-idassert-bind bindmethod="simple" > binddn="cn=root,dc=example,dc=net" > credentials="secret" > mode="self" > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > ^^^^^^ > chain-tls ldaps > chain-return-error TRUE > database bdb > suffix "dc=example,dc=net" > rootdn "cn=root,dc=example,dc=net" > rootpw "secret" > directory "/usr/local/var/openldap-data" > include /etc/openldap/slapd.access.conf > index uid,cn,gidNumber,uidNumber,memberUid eq > index objectClass pres,eq > index operatingSystem pres,eq > index host pres,eq > index rack eq > index entryUUID eq > index uniqueMember eq > index entryCSN eq > index site eq > overlay ppolicy > ppolicy_hash_cleartext > ppolicy_use_lockout > ppolicy_forward_updates > syncrepl rid=1 > provider=ldaps://ldap-vip.corp.example.net > type=refreshAndPersist > interval=00:00:10:00 > searchbase="dc=example,dc=net" > bindmethod=simple > binddn="cn=root,dc=example,dc=net" > credentials="secret" > retry="15 20 60 +" > updateref "ldaps://ldap-vip.corp.example.net" > database monitor > > /etc/openldap/ldap.conf: (same on all LDAP servers) > --------------------------------------------------- > uri ldaps://localhost > base dc=example,dc=net > network_timeout 0 > sizelimit 0 > timelimit 0 > tls_cacert /etc/openldap/cacerts/cacert.pem > tls_reqcert demand > > /etc/ldap.conf: (on client using slave) > --------------------------------------- > uri ldaps://ldap-vip.dc1.example.net > timelimit 10 > bind_timelimit 10 > bind_policy soft > base dc=example,dc=net > scope sub > ssl on > tls_checkpeer no > tls_cacertfile /etc/openldap/cacert.pem (contents same as > /etc/openldap/cacerts/cacert.pem) > pam_login_attribute uid > pam_lookup_policy yes > pam_password exop > > /etc/pam.d/system-auth-ac: > -------------------------- > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 500 quiet > auth sufficient pam_ldap.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_localuser.so > account sufficient pam_succeed_if.so uid < 500 quiet > account [default=bad success=ok user_unknown=ignore] pam_ldap.so > account required pam_permit.so > > password requisite pam_cracklib.so try_first_pass retry=3 > password sufficient pam_unix.so sha256 shadow nullok > try_first_pass use_authtok > password sufficient pam_ldap.so use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > session optional pam_mkhomedir.so > session [success=1 default=ignore] pam_succeed_if.so service in > crond quiet use_uid > session required pam_unix.so > session optional pam_ldap.so > > > > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > > > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > > > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 3

ppolicy + user notification
by Allgood, John 27 May '10

27 May '10

Hello All I have finally got ppolicy working correctly except for some interesting behavior. When I set the pwdMaxAge to say 3 days just for testing and when I log into the system shortly after changing my password. The systems notifies me that my password will expire in 2 days. On the 3rd day I don't get any notifications from the system. I have also defined in my policy a grace period for logins which does work but I don't get any notifications of that either. Also I am trying to build check_password.c to provide additional checking but when I try to compile the program I get missing headers files portable.h and slap.h. I have searched the entire system and can't locate them. I thought they would be part of the development RPMS which I installed. Any ideas on any of this.? Thanks John Allgood Senior Systems Administrator OHL Transportation Services 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

1 0

ldap search hangs forever
by Jeremiah Martell 27 May '10

27 May '10

I'm using openldap-2.4.18 as a client to bind and asynchronously search an active directory server. I have a domain, example.com, that has two domain controllers: one.example.com, and two.example.com. The ip of one.example.com is 12.34.56.1 The ip of two.example.com is 12.34.56.2 The reverse mapping of 12.34.56.1 is one.example.com The reverse mapping of 12.34.56.2 doesn't exist ----- / nslookup one.example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: one.example.com Address 1: 12.34.56.1 one.example.com / nslookup two.example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: two.example.com Address 1: 12.34.56.2 / nslookup example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: example.com Address 1: 12.34.56.2 Address 2: 12.34.56.1 one.example.com / nslookup 12.34.56.2 Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: 12.34.56.2 Address 1: 12.34.56.2 / nslookup 12.34.56.1 Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: 12.34.56.1 Address 1: 12.34.56.1 one.example.com / ----- I have given openldap a "rebind proc" to use when chasing the referrals. I do a sasl gssapi bind to one.example.com, which succeeds. I do a search, which returns three referrals: DomainDnsZones.example.com ForestDnsZones.example.com example.com openldap looks up these three names and gets 12.34.56.2, which doesn't reverse map to anything. Then I get error messages for each referral: May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) Then openldap hangs forever; I never get a LDAP_RES_SEARCH_RESULT. ----- If I modify my DNS server to return 12.34.56.1 first instead of 12.34.56.2, then everything works perfectly. If I don't chase referrals, then everything works perfectly minus chasing referrals of course. If I use "normal" binding instead of sasl gssapi, then everything works perfectly. If I use openldap's syncronous search instead of asyncronously polling with ldap_result, then the call times out and returns. I half-expected openldap to not be able to bind to the referrals, but still fail quickly and return. I don't understand why the ldap search never finishes. (I never get a LDAP_RES_SEARCH_RESULT) I did get a LDAP_RES_SEARCH_REFERENCE and a LDAP_NO_RESULTS_RETURNED, but those dont signify the search has finished, right? I've attached the ldap debugging. You'll see at the end the repeated calls to ldap_result with timeouts of 10 seconds. I don't know how to read them exactly, but the status seems to be "RequestCompleted" ? ----- 17:20:50.530 ldap_result ld 0x10097060 msgid 5 17:20:50.530 wait4msg ld 0x10097060 msgid 5 (timeout 10000000 usec) 17:20:50.530 wait4msg continue ld 0x10097060 msgid 5 all 2 17:20:50.530 ** ld 0x10097060 Connections: 17:20:50.530 * host: one.example.com port: 389 (default) 17:20:50.530 refcnt: 1 status: Connected 17:20:50.530 last used: Wed May 26 17:19:59 2010 17:20:50.530 17:20:50.530 ** ld 0x10097060 Outstanding Requests: 17:20:50.530 * msgid 5, origid 5, status RequestCompleted 17:20:50.530 outstanding referrals 0, parent count 0 17:20:50.530 ld 0x10097060 request count 1 (abandoned 0) 17:20:50.530 ** ld 0x10097060 Response Queue: 17:20:50.530 Empty 17:20:50.530 ld 0x10097060 response count 0 17:20:50.530 ldap_chkResponseList ld 0x10097060 msgid 5 all 2 17:20:50.530 ldap_chkResponseList returns ld 0x10097060 NULL 17:20:50.530 ldap_int_select ----- I got the latest 2.4.22 release and grabbed the majority of the changes, but the hang remains. You can see the full debugging information in the attached txt file. I'm asking if the forever hang could be a bug in openldap, or perhaps I'm doing something wrong? Thanks, - Jeremiah

1 0

Replication via cn=config
by Marcio Merlone 27 May '10

27 May '10

Hi all, I am setting a pair of multi-master replicated servers (venus and haumea) using Ubuntu 10.04 and OpenLDAP 2.4.21-0ubuntu5. I am following the docs at http://www.openldap.org/doc/admin24/replication.html and when I get to the part for this ldif: dn: olcDatabase={1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {1}frontend olcSuffix: dc=tld olcDbDirectory: ./db olcRootDN: cn=admin,dc=tld olcRootPW: secret olcLimits: dn.exact="cn=admin,dc=tld" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=003 provider=ldap://haumea.tld binddn="cn=admin,dc=tld" bindmethod=simple credentials=secret searchbase="dc=tld" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=004 provider=ldap://venus.tld binddn="cn=admin,dc=tld" bindmethod=simple credentials=secret searchbase="dc=tld" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov I get htis error: root@haumea:/etc/ldap# ldapadd -x -H ldap://localhost/ -D "cn=admin,cn=config" -W -f replica.ldif Enter LDAP Password: adding new entry "olcDatabase={1}frontend,cn=config" ldap_add: Object class violation (65) additional info: attribute 'olcDbDirectory' not allowed root@haumea:/etc/ldap# I googled for this but got very few useless results. Can someone point me the right direction? Thanks and best regards. -- Marcio Merlone

2 3

Re: Q: status of component matching?
by Lehnert, Hartmut 27 May '10

27 May '10

Hi Dieter! Thank you very much! I used CFLAGS=-DLDAP_COMP_MATCH when configuring the slapd and now it's able to load our component match module. But some problems are still left: When running the following LDAP search command using component matching filter /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children "(userCertificate:componentFilterMatch:=item:{ component \"toBeSigned.serialNumber\", rule integerMatch, value 449 })" against slapd it terminates: /home/openldap/openldap-2.4.21-install/libexec/slapd: symbol lookup error: /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0: undefined symbol: GenBufFreeBuf In the source code of both snacc and component match module no definition for function "GenBufFreeBuf" can be found. Where can I get it? Regards, Hartmut

3 6

WG: Q: status of component matching?
by Lehnert, Hartmut 27 May '10

27 May '10

Hello Dieter! Nevertheless I generated a core dump in the mean time - but this was only possible by adding the GenBufFreeBuf function as a dummy to init.c file of the comp match module: void GenBufFreeBuf (void *p) { } The back trace of the core: (gdb) bt #0 0x080e17d4 in slap_sl_free (ptr=0xb6f981d2, ctx=0x82d01a8) at sl_malloc.c:487 #1 0x0809ecf1 in ch_free (ptr=0xb6f981d2) at ch_malloc.c:137 #2 0x080dedae in mra_free (op=0x82cfde8, mra=0xb6f98288, freeit=1) at mra.c:43 #3 0x0808273f in filter_free_x (op=0x82cfde8, f=0xb6f982c8, freeme=1) at filter.c:556 #4 0x08080834 in do_search (op=0x82cfde8, rs=0xb7499134) at search.c:230 #5 0x0807da51 in connection_operation (ctx=0xb7499220, arg_v=0x82cfde8) at connection.c:1109 #6 0x0807df99 in connection_read_thread (ctx=0xb7499220, argv=0xb) at connection.c:1245 #7 0x08162082 in ldap_int_thread_pool_wrapper () #8 0xb7cc11b5 in start_thread () from /lib/libpthread.so.0 #9 0xb7da738e in clone () from /lib/libc.so.6 (gdb) Does this cover any new information? Thank you. Regards, Hartmut -----Ursprüngliche Nachricht----- Von: Lehnert, Hartmut Gesendet: Mittwoch, 26. Mai 2010 10:10 An: openldap-technical(a)openldap.org Betreff: AW: Q: status of component matching? Hi Dieter! I built slapd and the comp match module with CFLAGS=-g option but a core dump isn't generated. I don't think that a core dump analysis is necessary to solve the problem because the slapd output /home/openldap/openldap-2.4.21-install/libexec/slapd: symbol lookup error: /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0: undefined symbol: GenBufFreeBuf is clear enough: the symbol GenBufFreeBuf is simply missing in the source code and binary of the comp match module. So once again: do you know where I can get the missing source code? Thank you for looking at this problem. Regards, Hartmut -----Ursprüngliche Nachricht----- Von: openldap-technical-bounces+hartmut.lehnert=secunet.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+hartmut.lehnert=secunet.com@OpenLDAP.org] Im Auftrag von Dieter Kluenter Gesendet: Dienstag, 25. Mai 2010 17:38 An: openldap-technical(a)openldap.org Betreff: Re: Q: status of component matching? Am Tue, 25 May 2010 15:51:40 +0200 schrieb "Lehnert, Hartmut" <Hartmut.Lehnert(a)secunet.com>: > Hi Dieter! > > > > Thank you very much! I used CFLAGS=-DLDAP_COMP_MATCH when configuring > the slapd and now it's able to load our component match module. > > But some problems are still left: When running the following LDAP > search command using component matching filter > > > > /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p > 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children > "(userCertificate:componentFilterMatch:=item:{ component > \"toBeSigned.serialNumber\", rule integerMatch, value 449 })" > > > > against slapd it terminates: > > > > /home/openldap/openldap-2.4.21-install/libexec/slapd: symbol lookup > error: > /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0: > undefined symbol: GenBufFreeBuf > > > > In the source code of both snacc and component match module no > definition for function "GenBufFreeBuf" can be found. Where can I get > it? The function is called in comp_match/init.c, could you please build slapd with debugging symbols enabled (-g) and when installing don't strip, that is 'make install STRIP=" "', If possible create a core dump and run core and slapd in gdb in order to create a backtrace? -Dieter -- Dieter Klünter | Systemberatung sip: +49.40.20932173 http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

2 2

Re: use of server-side sorting and virtual list view controls blocks slapd
by Lehnert, Hartmut 27 May '10

27 May '10

Hi Dieter! We tried Sizelimit unlimited In slapd.conf, but the effect is the same, slapd answers "size limit exceeded". The search request command is /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children -E!sss="sncertnr:2.5.13.3" -E!vlv="0/9/0/1:objectclass=SN-ISIS-MTT-MainCert" "objectclass=*" sncertnr Besides this effect we only have 10 records stored in the LDAP database ;-) For the supported features see the following list: openldap@ocsp-openldap24:~/openldap-snacc-2.3.6/c-lib> /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b "" -s base + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: + # # dn: structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 supportedControl: 2.16.840.1.113730.3.4.9 supportedControl: 1.2.840.113556.1.4.473 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 entryDN: subschemaSubentry: cn=Subschema # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The OID 1.3.6.1.4.1.4203.666.8.1 is missing here but this OID is marked as kind of experimental. Why do I need this feature and how can I enable this? Regards, Hartmut

2 5

More on dynamic group searches
by Ian Collins 26 May '10

26 May '10

Hello, This is my first post here, so if I'm going over old ground, please let me know (I have searched). I have looked through the archives and reached the conclusion that there isn't a convenient means of searching for groups based on a dynamic entry. For example, if I have a dynlist entry containing olcDlAttrSet: {0}groupOfURLs memberURL uniqueMember uniqueMember is dynamically added to search results, but can't be part of the search. Is this conclusion correct? I am migrating a client over from Sun's directory manager (which does allow searching on dynamic attributes) to OpenLDAP, so I have to support all the client applications that currently authenticate against and use LDAP. For example: filter="(&(objectClass=posixGroup)(uniqueMember=cn=Admins,ou=groups,o=staff,dc=company))" attrs="gidNumber" -- Ian.

4 9

Re: choosing replication strategies
by Chris Jacobs 26 May '10

26 May '10

The admin guide really does a pretty good job of covering the different replication methods, I'd check it out a bit more. :) - chris PS: I'm no guru, and have recently identified an issue with mirror-mode and ppolicy. I'll be reviewing them again myself. Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Wed May 26 06:35:50 2010 Subject: Re: choosing replication strategies On Wed, May 26, 2010 at 09:03:03AM +0200, Nikola Radovanovic wrote: > Is the N-way multimaster replication best bet, or is it possible to > use some other strategy, like mirroring? See MirrorMode replication in OpenLDAP admin guide. Regards, Luka This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Openldap with back-sql (Oracle)
by honey bajaj 26 May '10

26 May '10

Hi All, I have configured Openldap 2.3.32 with back-sql, have followed the readme and http://www.easysoft.com/applications/openldap/back-sql-odbc.html to create test and metadata. But while performing search i am receiving following errors ldapsearch -x -b dc=example,dc=com name=Mitya # extended LDIF # # LDAPv3 # base with scope subtree # filter: name=Mitya # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 May 25 10:23:12 ldap1p slapd[7211]: backsql_load_schema_map("inetOrgPerson"): autoadding 'objectClass' and 'ref' mappings May 25 10:23:12 ldap1p slapd[7211]: backsql_close_db_conn(4294967295) May 25 10:23:12 ldap1p slapd[7211]: slap_listener(ldap:///) May 25 10:23:29 ldap1p slapd[7211]: daemon: listen=8, new connection on 9 May 25 10:23:29 ldap1p slapd[7211]: daemon: added 9r (active) listener=(nil) May 25 10:23:29 ldap1p slapd[7211]: conn=0 fd=9 ACCEPT from IP=127.0.0.1:32793 (IP=0.0.0.0:389) May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=7 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=8 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: daemon: activity on 1 descriptor May 25 10:23:29 ldap1p slapd[7211]: daemon: activity on: May 25 10:23:29 ldap1p slapd[7211]: 9r May 25 10:23:29 ldap1p slapd[7211]: May 25 10:23:29 ldap1p slapd[7211]: daemon: read active on 9 May 25 10:23:29 ldap1p slapd[7211]: connection_get(9) May 25 10:23:29 ldap1p slapd[7211]: connection_get(9): got connid=0 May 25 10:23:29 ldap1p slapd[7211]: connection_read(9): checking for input on id=0 May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=7 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=8 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: do_bind May 25 10:23:29 ldap1p slapd[7211]: >>> dnPrettyNormal: May 25 10:23:29 ldap1p slapd[7211]: > dnPrettyNormal: May 25 10:23:29 ldap1p slapd[7211]: backsql_search(): base="dc=example,dc=com", filter="(name=mitya)", scope=2, May 25 10:23:29 ldap1p slapd[7211]: deref=0, attrsonly=0, attributes to load: all May 25 10:23:29 ldap1p slapd[7211]: ==>backsql_get_db_conn() May 25 10:23:29 ldap1p slapd[7211]: ==>backsql_open_db_conn(0) May 25 10:23:29 ldap1p slapd[7211]: conn=0 op=0 RESULT tag=97 err=0 text= May 25 10:23:29 ldap1p slapd[7211]: do_bind: v3 anonymous bind May 25 10:23:29 ldap1p slapd[7211]: backsql_open_db_conn(0): connected, adding to tree. May 25 10:23:29 ldap1p slapd[7211]:

2 1

openldap & outlook 2007 browsing
by Mark Bojara 26 May '10

26 May '10

Hey OpenLDAP Gurus! Im sure the above mentioned topic has been discussed a million times but with my hours of googling I have not been able to find anything conclusive.. I know this isnt directly related to OpenLDAP and you dont really support 3rd party software but Im running out of places to ask this question & time. I have gotten Openldap running with MS Outlook 2007 as a client, I am able to search for entries found on my openldap server however when I open the main addressbook window it does not display all the entries at once (aka Browsing). I have started Openldap with debug 256 mode and I can see connections made before clicking the Find button (proving that the "Enable Browsing" option in Outlook does do something) however still doesnt display anything. Does anyone know where I can go from here or atleast point me to the right place I can ask this question? Thanks alot Mark

2 1

choosing replication strategies
by Nikola Radovanovic 26 May '10

26 May '10

hi, i am new to the OpenLDAP and this is my first post here, so if i missed out the listing - please, tell me. i read admin guide, and also got LDAP system administration book (unfortunately, it is outdated for the replication part) i am in search of the best replication strategy for the following scenario: we have 2 geographically distant 'sites' (between two of them is WAN), and each of these needs to have 2 (or sometimes more) OpenLDAP servers. if some data is to be changed, it is done only on one 'site' (our software will redirect client calls to the specific one, based on our business logic). 'sites' must replicate data between them, and that should be done via exactly one dedicated OpenLDAP server in each 'site' (or at least it seems right :) ) Is the N-way multimaster replication best bet, or is it possible to use some other strategy, like mirroring? Naturally, servers will contain mostly some personal data which is rarely changed (but often read)... regards nikola

2 1

Summary of dynamic groups
by Ian Collins 26 May '10

26 May '10

Hello again, My earlier thread appears to have been hijacked, so I'm starting a new one for the summary of my investigations. My current understanding is as follows: There are three overlays that can use yes to manage groups dynamically: dynlist, autogroup and memberof. - dynlist works well for including members specified in a URL to the result of a search on a group. The dynamic members can not be included in a search filter. - autogroup works well for including members specified in a URL to the result of a search on a group. The dynamic members can be included in a search filter, but the only supported list attribute is 'member', which limits its use. - memberof works well for reverse group management, including group dn in the entries for group members. It only works with DN-values attributes, so it can't be used with clients that expect POSIX group members to be listed by 'memberUid' rather than 'member'. From the above, I don't see a way to use OpenLDAP in an existing environment where dynamic groups are searched for by members and don't list their members with the 'member' attribute. Please tell me I'm wrong (and how)! Thanks, -- Ian.

2 4

RE: ppolicy master/slave issue (currently "forward ppolicy updates" OR "authenticate")
by Siddhartha Jain 26 May '10

26 May '10

One more observation: 1. When changing password on the client, with client pointing at slave (with chaining enabled), the password change only goes through when the right password is supplied. 2. But, entering a wrong password won't give you a password fail message. Look at this transaction, where I enter a wrong password for password change: $ passwd Changing password for user joe. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Strong(er) authentication required only authenticated users may change passwords passwd: Permission denied From: Siddhartha Jain Sent: Tuesday, May 25, 2010 5:16 PM To: openldap-technical(a)openldap.org Subject: RE: ppolicy master/slave issue (currently "forward ppolicy updates" OR "authenticate") I replicated the setup and issues with slapd.d configuration. Running OpenLDAP 2.4.21 on CentOS x64. 1. Master and slave setup with ppolicy overlay. 2. When client points to master, pwdFailures are duly recorded and respected. Password auth works as expected. 3. When clients points to slave with chaining disabled, password auth and changes work fine but obviously pwdFailures are not recorded anywhere - neither on slave or master. 4. When client points to slave with chaining enabled, password auth breaks meaning user can type any string and still get a successful auth. Interestingly, in this case, pwdFailures get recorded on slave and master. Why or how a bind succeeds with a wrong password is weird. With slapd.d type config, the chain directives go under "frontendconfig" so I suspect the solution must lie there. As a sidenote, I am thinking of doing without slaves and just creating more primaries in multi-mode replication. Seems less complicated in terms of configuration and maintenance. Thanks, - Siddhartha > -----Original Message----- > From: openldap-technical-bounces+sjain=silverspringnet.com(a)openldap.org > [mailto:openldap-technical- > bounces+sjain=silverspringnet.com(a)openldap.org] On Behalf Of Chris > Jacobs > Sent: Tuesday, May 25, 2010 9:16 AM > To: openldap-technical(a)openldap.org > Subject: RE: ppolicy master/slave issue (currently "forward ppolicy > updates" OR "authenticate") > > Haven't heard anything on this yet... > > If someone could point me to some documentation, or better, graphic > illustration, of how OpenLDAP 'works', perhaps I can figure this out on > my own. > > Thanks, > - chris > > -----Original Message----- > From: openldap-technical- > bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org [mailto:openldap- > technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org] On Behalf Of > Chris Jacobs > Sent: Thursday, May 06, 2010 11:45 AM > To: openldap-technical(a)openldap.org > Subject: RE: ppolicy master/slave issue (currently "forward ppolicy > updates" OR "authenticate") > > Anyone? > > I can't be the only person trying to implement ppolicy_forward_updates > and have user's actually authenticate... > > I've been poring over the documentation: > > http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies > http://www.symas.com/blog/?page_id=66 > http://www.openldap.org/software/man.cgi?query=slapo- > ppolicy&sektion=5&apropos=0&manpath=OpenLDAP+2.4-Release > Which indicates: "This setting is only useful on a replication > consumer, and also requires the updateref setting and chain overlay to > be appropriately configured." > > I tried "chain-rebind-as-user" and that didn't seem to help (you can > see it in the configs below) - at least, how I tried it. Perhaps I > misunderstand something (I'm hoping at least) > > I'm totally at a loss here... > > - chris > > -----Original Message----- > From: openldap-technical- > bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org [mailto:openldap- > technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org] On Behalf Of > Chris Jacobs > Sent: Monday, May 03, 2010 9:07 AM > To: openldap-technical(a)openldap.org > Subject: RE: ppolicy master/slave issue > > Really, I think this comes down to how to: > * ppolicy_forward_updates requiring priviledges > * authentication NOT requiring priviledges > > How do I split the two? Let ppolicy forward updates, which requires > priviledges, and NOT specify any authentication while user's are > authenticating? > > Thanks, > - chris > > -----Original Message----- > From: openldap-technical- > bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org [mailto:openldap- > technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org] On Behalf Of > Chris Jacobs > Sent: Thursday, April 29, 2010 2:55 PM > To: openldap-technical(a)openldap.org > Subject: ppolicy master/slave issue > > Hello again, > > I'm having an odd issue with ppolicy and my master/slave config. > > First, my goals > General use: > Slave handles all reads locally. > Writes get forwarded to the master by the slave. > > Password policy: > When password failures happen on clients using slave ldap servers, > the failures, etc, get passed to the master to get replicated to the > slaves. > I understand this would be done using the ppolicy option: > ppolicy_forward_updates > > Authentication: > Actually authenticate (more later). > > To the problem: > --------------- > When I leave the section in the chain bit of SLAVE slapd.conf below > marked by lines intact (which bind as root): > * ppolicy_forward_updates seems to work great - the master shows > matching "pwdFailureTime" attributes. > * Regardless of password entered, you get a shell. User/bad password = > get a shell! This being a problem should be obvious. > I suspect that's due to the chain overlay section... > > If I comment out the lines in the SLAVE slapd.conf: > * authentication actually requires authentication (bad password = no > authentication) > * ppolicy_forward_updates don't work (no updates to master) > > It's possible that from my description some may already know my issue - > however, just to be sure, I've pasted below 'bare' versions of the: > * a master slapd.conf (sans schema includes) > * a slave slapd.conf (sans schema includes) > * /etc/ldap.conf (using slave) > * /etc/openldap/ldap.conf (same on all ldap servers) (thanks Howard - > they are NOT the same) > * /etc/pam.d/system-auth-ac (CentOS 5.4; ssh refers to system-auth-ac > for all types). > > Thanks for any help (and, likely, pointing out any 'stupids' below), > - chris > > PS: Feel free to critique - you won't hurt my feelings. > > MASTER slapd.conf: (one of a pair, mirrored, active/passive fail over) > ---------------------------------------------------------------------- > serverID 1 > loglevel 0 > pidfile /usr/local/var/openldap-data/run/slapd.pid > argsfile /usr/local/var/openldap-data/run/slapd.args > TLSCipherSuite HIGH:MEDIUM:+SSLv2 > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/cacerts/servercrt.pem > TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem > TLSVerifyClient never > password-hash {MD5} > sizelimit size.soft=500 size.hard=unlimited > timelimit time.soft=3600 time.soft=unlimited > database bdb > suffix "dc=example,dc=net" > rootdn "cn=root,dc=example,dc=net" > rootpw "secret" > directory "/usr/local/var/openldap-data" > include /etc/openldap/slapd.access.conf > index uid,cn,gidNumber,uidNumber,memberUid eq > index objectClass pres,eq > index operatingSystem pres,eq > index host pres,eq > index rack eq > index entryUUID eq > index uniqueMember eq > index entryCSN eq > index site eq > overlay ppolicy > ppolicy_hash_cleartext > ppolicy_use_lockout > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 10 > syncrepl rid=2 > provider=ldaps://ldapmaster2.corp.example.net > type=refreshAndPersist > interval=00:00:10:00 > searchbase="dc=example,dc=net" > bindmethod=simple > binddn="cn=root,dc=example,dc=net" > credentials="secret" > retry="15 20 60 +" > mirrormode on > database monitor > > SLAVE slapd.conf: > ----------------- > serverID 13 > loglevel 0 > pidfile /usr/local/var/openldap-data/run/slapd.pid > argsfile /usr/local/var/openldap-data/run/slapd.args > TLSCipherSuite HIGH:MEDIUM:+SSLv2 > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/cacerts/servercrt.pem > TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem > TLSVerifyClient never > password-hash {MD5} > sizelimit size.soft=500 size.hard=unlimited > timelimit time.soft=3600 time.soft=unlimited > overlay chain > chain-uri ldaps://ldap-vip.corp.example.net/ > chain-rebind-as-user TRUE > vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv > vvvvvv > chain-idassert-bind bindmethod="simple" > binddn="cn=root,dc=example,dc=net" > credentials="secret" > mode="self" > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > ^^^^^^ > chain-tls ldaps > chain-return-error TRUE > database bdb > suffix "dc=example,dc=net" > rootdn "cn=root,dc=example,dc=net" > rootpw "secret" > directory "/usr/local/var/openldap-data" > include /etc/openldap/slapd.access.conf > index uid,cn,gidNumber,uidNumber,memberUid eq > index objectClass pres,eq > index operatingSystem pres,eq > index host pres,eq > index rack eq > index entryUUID eq > index uniqueMember eq > index entryCSN eq > index site eq > overlay ppolicy > ppolicy_hash_cleartext > ppolicy_use_lockout > ppolicy_forward_updates > syncrepl rid=1 > provider=ldaps://ldap-vip.corp.example.net > type=refreshAndPersist > interval=00:00:10:00 > searchbase="dc=example,dc=net" > bindmethod=simple > binddn="cn=root,dc=example,dc=net" > credentials="secret" > retry="15 20 60 +" > updateref "ldaps://ldap-vip.corp.example.net" > database monitor > > /etc/openldap/ldap.conf: (same on all LDAP servers) > --------------------------------------------------- > uri ldaps://localhost > base dc=example,dc=net > network_timeout 0 > sizelimit 0 > timelimit 0 > tls_cacert /etc/openldap/cacerts/cacert.pem > tls_reqcert demand > > /etc/ldap.conf: (on client using slave) > --------------------------------------- > uri ldaps://ldap-vip.dc1.example.net > timelimit 10 > bind_timelimit 10 > bind_policy soft > base dc=example,dc=net > scope sub > ssl on > tls_checkpeer no > tls_cacertfile /etc/openldap/cacert.pem (contents same as > /etc/openldap/cacerts/cacert.pem) > pam_login_attribute uid > pam_lookup_policy yes > pam_password exop > > /etc/pam.d/system-auth-ac: > -------------------------- > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 500 quiet > auth sufficient pam_ldap.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_localuser.so > account sufficient pam_succeed_if.so uid < 500 quiet > account [default=bad success=ok user_unknown=ignore] pam_ldap.so > account required pam_permit.so > > password requisite pam_cracklib.so try_first_pass retry=3 > password sufficient pam_unix.so sha256 shadow nullok > try_first_pass use_authtok > password sufficient pam_ldap.so use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > session optional pam_mkhomedir.so > session [success=1 default=ignore] pam_succeed_if.so service in > crond quiet use_uid > session required pam_unix.so > session optional pam_ldap.so > > > > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > > > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > > > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. >

1 0

ppolicy master/slave issue
by Chris Jacobs 26 May '10

26 May '10

Hello again, I'm having an odd issue with ppolicy and my master/slave config. First, my goals General use: Slave handles all reads locally. Writes get forwarded to the master by the slave. Password policy: When password failures happen on clients using slave ldap servers, the failures, etc, get passed to the master to get replicated to the slaves. I understand this would be done using the ppolicy option: ppolicy_forward_updates Authentication: Actually authenticate (more later). To the problem: --------------- When I leave the section in the chain bit of SLAVE slapd.conf below marked by lines intact (which bind as root): * ppolicy_forward_updates seems to work great - the master shows matching "pwdFailureTime" attributes. * Regardless of password entered, you get a shell. User/bad password = get a shell! This being a problem should be obvious. I suspect that's due to the chain overlay section... If I comment out the lines in the SLAVE slapd.conf: * authentication actually requires authentication (bad password = no authentication) * ppolicy_forward_updates don't work (no updates to master) It's possible that from my description some may already know my issue - however, just to be sure, I've pasted below 'bare' versions of the: * a master slapd.conf (sans schema includes) * a slave slapd.conf (sans schema includes) * /etc/ldap.conf (using slave) * /etc/openldap/ldap.conf (same on all ldap servers) (thanks Howard - they are NOT the same) * /etc/pam.d/system-auth-ac (CentOS 5.4; ssh refers to system-auth-ac for all types). Thanks for any help (and, likely, pointing out any 'stupids' below), - chris PS: Feel free to critique - you won't hurt my feelings. MASTER slapd.conf: (one of a pair, mirrored, active/passive fail over) ---------------------------------------------------------------------- serverID 1 loglevel 0 pidfile /usr/local/var/openldap-data/run/slapd.pid argsfile /usr/local/var/openldap-data/run/slapd.args TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/servercrt.pem TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem TLSVerifyClient never password-hash {MD5} sizelimit size.soft=500 size.hard=unlimited timelimit time.soft=3600 time.soft=unlimited database bdb suffix "dc=unix,dc=aptimus,dc=net" rootdn "uid=root,ou=people,dc=unix,dc=aptimus,dc=net" rootpw "secret" directory "/usr/local/var/openldap-data/aptimus" include /etc/openldap/slapd.access.conf index uid,cn,gidNumber,uidNumber,memberUid eq index objectClass pres,eq index operatingSystem pres,eq index host pres,eq index rack eq index entryUUID eq index uniqueMember eq index entryCSN eq index site eq overlay ppolicy ppolicy_hash_cleartext ppolicy_use_lockout overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 10 syncrepl rid=2 provider=ldaps://ldapmaster2.corp.aptimus.net type=refreshAndPersist interval=00:00:10:00 searchbase="dc=unix,dc=aptimus,dc=net" bindmethod=simple binddn="uid=root,ou=people,dc=unix,dc=aptimus,dc=net" credentials="secret" retry="15 20 60 +" mirrormode on database monitor SLAVE slapd.conf: ----------------- serverID 13 loglevel 0 pidfile /usr/local/var/openldap-data/run/slapd.pid argsfile /usr/local/var/openldap-data/run/slapd.args TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/servercrt.pem TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem TLSVerifyClient never password-hash {MD5} sizelimit size.soft=500 size.hard=unlimited timelimit time.soft=3600 time.soft=unlimited overlay chain chain-uri ldaps://ldap-vip.corp.aptimus.net/ chain-rebind-as-user TRUE vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv chain-idassert-bind bindmethod="simple" binddn="uid=root,ou=people,dc=unix,dc=aptimus,dc=net" credentials="Ten%20two" mode="self" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ chain-tls ldaps chain-return-error TRUE database bdb suffix "dc=unix,dc=aptimus,dc=net" rootdn "uid=root,ou=people,dc=unix,dc=aptimus,dc=net" rootpw "secret" directory "/usr/local/var/openldap-data/aptimus" include /etc/openldap/slapd.access.conf index uid,cn,gidNumber,uidNumber,memberUid eq index objectClass pres,eq index operatingSystem pres,eq index host pres,eq index rack eq index entryUUID eq index uniqueMember eq index entryCSN eq index site eq overlay ppolicy ppolicy_hash_cleartext ppolicy_use_lockout ppolicy_forward_updates syncrepl rid=1 provider=ldaps://ldap-vip.corp.aptimus.net type=refreshAndPersist interval=00:00:10:00 searchbase="dc=unix,dc=aptimus,dc=net" bindmethod=simple binddn="uid=root,ou=people,dc=unix,dc=aptimus,dc=net" credentials="secret" retry="15 20 60 +" updateref "ldaps://ldap-vip.corp.aptimus.net" database monitor /etc/openldap/ldap.conf: (same on all LDAP servers) --------------------------------------------------- uri ldaps://localhost base dc=unix,dc=aptimus,dc=net network_timeout 0 sizelimit 0 timelimit 0 tls_cacert /etc/openldap/cacerts/cacert.pem tls_reqcert demand /etc/ldap.conf: (on client using slave) --------------------------------------- uri ldaps://ldap-vip.dc1.aptimus.net timelimit 10 bind_timelimit 10 bind_policy soft base dc=unix,dc=aptimus,dc=net scope sub ssl on tls_checkpeer no tls_cacertfile /etc/openldap/cacert.pem (contents same as /etc/openldap/cacerts/cacert.pem) pam_login_attribute uid pam_lookup_policy yes pam_password exop /etc/pam.d/system-auth-ac: -------------------------- auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so sha256 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 5

How to obtain a 'version number' of an attributes
by Andrew Bartlett 25 May '10

25 May '10

I've got a little challenge... there is an attribute in AD call msDS-KeyVersionNumber. In AD this operational attribute increments each time the unicodePwd attribute is updated. It is typically a small integer, being the number of times that the password has ever been changed. In Samba4, we maintain this by looking into our replication metadata (replPropertyMetaData), and returning a counter that is maintained there. I could maintain this manually from Samba's side (this is what we did in the past), but I wanted to first check if there was something already stored that I could convert. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc.

5 8

cURL, libcurl, and LDAP
by Howard Chu 25 May '10

25 May '10

For those of you who use libcurl in your own applications, you may be interested to know that I've written a new LDAP implementation for libcurl. http://article.gmane.org/gmane.comp.web.curl.cvs/13393 The old code had a number of problems, mainly due to exclusively using the synchronous LDAPv2 APIs, which prevented it from playing nicely in the otherwise fully-asynchronous libcurl framework. It also has a bug such that it always opens two connections to the LDAP server for every curl request. The old code is still there, for deployments stuck with older LDAP libraries (OpenLDAP 2.3, or non-OpenLDAP code). The new code is fully asynchronous and non-blocking, written for OpenLDAP 2.4. It's also (surprise, surprise) far more efficient in parsing results. To cut down on duplication of config code, this module uses libcurl's existing socket and SSL infrastructure, instead of OpenLDAP's built in SSL/TLS support. Thus it automatically supports all of the libraries and features libcurl already supports, without needing any ongoing maintenance for when new libcurl features are added. If you've got other tools already built around curl, you'll get improved LDAP support without making any other changes. If you're looking for ways to tightly integrate libldap support directly into your own applications, the libcurl OpenLDAP code can show you how. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Proxy authorization fail with cyrus-sasl and postfix
by Julien Vehent 24 May '10

24 May '10

Hello list, I am trying to authenticate my mail users against my ldap directory (slapd 2.4.17, debian squeeze). I have setup proxy authorization for user postfix as follow: in slapd.conf ---- # SASL proxy authorization rewrite rule authz-regexp "^uid=([^,]+).*,cn=[^,]*,cn=auth$" "ldap:///dc=linuxwall,dc=info??sub?(uid=$1)" authz-policy to ---- ldif of user postfix ---- dn: cn=Postfix Administrator,ou=infrastructure,dc=linuxwall,dc=info authzto: ldap:///dc=linuxwall,dc=info??sub?(objectClass=inetOrgPerson) cn: Postfix Administrator [...] ---- I have a similar user with cyrus for cyrus-imapd. My user postfix seem to have the authorization to act on behalf of other user. ---- # ldapwhoami -Y DIGEST-MD5 -U postfix -H ldap://localhost -R linuxwall.info -X u:julien SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: u:julien SASL SSF: 128 SASL data security layer installed. dn:cn=julien vehent,ou=people,dc=linuxwall,dc=info ---- Thus, I set up the ldapdb driver from the sasl library in the chroot of postfix. I see connections from postfix to slapd, postfix user is properly authenticated, but then I have the following message (see trace below): ---- May 23 12:57:04 samchiel slapd[1431]: conn=109 fd=17 ACCEPT from IP=127.0.0.1:58349 (IP=127.0.0.1:389) May 23 12:57:04 samchiel slapd[1431]: conn=109 op=0 BIND dn="" method=163 May 23 12:57:04 samchiel slapd[1431]: conn=109 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: May 23 12:57:04 samchiel slapd[1431]: conn=109 op=1 BIND dn="" method=163 May 23 12:57:04 samchiel slapd[1431]: conn=109 op=1 BIND authcid="postfix" authzid="postfix" May 23 12:57:04 samchiel slapd[1431]: conn=109 op=1 BIND dn="cn=postfix administrator,ou=infrastructure,dc=linuxwall,dc=info" mech=DIGEST-MD5 sasl_ssf=128 ssf=128 May 23 12:57:04 samchiel slapd[1431]: conn=109 op=1 RESULT tag=97 err=0 text= May 23 12:57:04 samchiel slapd[1431]: conn=109 op=2 RESULT tag=120 err=123 text=not authorized to assume identity May 23 12:57:04 samchiel slapd[1431]: conn=109 op=2 do_extended: get_ctrls failed May 23 12:57:04 samchiel slapd[1431]: conn=109 op=3 UNBIND May 23 12:57:04 samchiel slapd[1431]: conn=109 fd=17 closed May 23 12:57:04 samchiel slapd[1431]: connection_read(17): no connection! ---- I don't understand this error 'not authorized to assume identity'... Since proxy authorization works fine when I test it with ldapwhoami. Also, on the same machine, I have a cyrus-imapd server that authenticates on the same slapd using the same ldapdriver. Thus, I don't think either slapd or cyrus-sasl are the problem, but since I don't understand the error..... Can you guys give me a hand here ? Thanks, Julien

3 6

dynlist and group membership (libnss-ldap, posixGroup, samba)
by Felipe Augusto van de Wiel 23 May '10

23 May '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I'm afraid I'm missing something very simple here and it is likely that the issue is on libnss-ldap and not on OpenLDAP dynlist overlay, I just want to make sure everything is fine regarding OpenLDAP configuration. I'm using Debian 5.0 (Lenny) and OpenLDAP 2.4.11 (Debian packaged version). I'm also using rfc2307bis and I would like to have a dynamic group with all non-disabled Samba users. Not sure if it is recommended to send the full slapd.conf, so I'm just sending the parts I added in order to have the dynlist/"dynamic group". /etc/ldap/slapd.conf: include /etc/ldap/schema/dyngroup.schema ... overlay dynlist dynlist-attrset posixGroup labeledURI member $ ldapsearch -x cn=active-samba-users dn: cn=active-samba-users,ou=Groups,dc=ahpi,dc=org objectClass: top objectClass: groupOfNames objectClass: posixGroup objectClass: sambaGroupMapping objectClass: labeledURIObject cn: active-samba-users gidNumber: 999 sambaSID: S-1-5-21-1234567899-1234567899-123456789-2999 sambaGroupType: 2 displayName: active samba users labeledURI: ldap:///ou=People,?uid?sub?(&(objectClass=posixAccount)(objectClass=sambaSAMAccount)(!(sambaAcctFlags=*D*))) When I run the search above I do get the expected results, several 'member' fields are added to the response: member: uid=userA,ou=People,dc=ahpi,dc=org member: uid=userB,ou=People,dc=ahpi,dc=org The problem, is that I would expect and 'id userA' to include group 'active-samba-users' but it doesn't. But 'getent group active-samba-users' includes all the users: active-samba-users:*:999:userA,userB Am I doing something wrong or missing something obvious? Below are the complete version of libnss-ldap.conf and pam_ldap.conf /etc/libnss-ldap.conf: ldap_version 3 base dc=ahpi,dc=org host 127.0.0.1 uri ldap://localhost rootbinddn cn=manager,dc=ahpi,dc=org scope sub pam_password ssha nss_schema rfc2307bis nss_map_attribute uniqueMember member /etc/pam_ldap.conf ldap_version 3 base dc=ahpi,dc=org uri ldap://localhost rootbinddn cn=manager,dc=ahpi,dc=org pam_password ssha nss_schema rfc2307bis nss_map_attribute uniqueMember member I also tried to use a different attrset: dynlist-attrset posixGroup labeledURI memberUid:uid From some maillist archives I had the impression that the approach above could solve it, I then removed the nss_schema and nss_map_attribute from libnss-ldap and pam_ldap but it didn't seem to work (the query was OK). It seems to me that something is wrong with my libnss/pam configuration, but it would be great if somebody else could confirm it. Thanks in advance. :-) Kind regards, - -- Felipe Augusto van de Wiel <felipe.wiel(a)hpp.org.br> Tecnologia da Informação (TI) - Complexo Pequeno Príncipe http://www.pequenoprincipe.org.br/ T: +55 41 3310 1747 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCgAGBQJL9JYHAAoJECCPPxLgxLxPv3gP/ip9seR1fhhLvrTwQ9OlfdjL iRk3nU9iPj5JtzwDHiOl872CTdZuI7Hbh4bCAe61Ix7Ai8Sz0nZsaBJRu2L+4K9W 4qY2lLAChn1k/R//9pnWxSi3zRInL6aMIXWWPqxLI5cmN9zht6Z0YQp/Uf5tkoez q16nXSklJTJFJEAaEbhR5oxVo0vAGAl8zMdU8aZ1OicsdaVG4e0gzTtaCet6Yyvf lCt7M1S3TNW4emebysKML+lbC6MdCAdUiRn0TzN3RL7v/42YZQX7k/nL2ZWKhIEn jTkB5AzH4G1SjMTjq2yl3x7JGjFEmgPIDVTHcXfZj8mho6VaHmfR2QLGY6Mmt6/E 7ATQsYe57qNhTW5XhrUadd/5M+jCHkFe6mfKALbYhmj4Yjj1cXUxLTh4g4AYtWbL qKd+haYf8cFDoDDBvf/bQQBe8tlM0ZRLkbqliy6I0+VZGoWkGButwM0TVjSPnin5 h7by/m3cgRFuRf2qZEafCoCzsVExN8wLKkzo9VHDx9ZxvA0KJ6QEQl52s5w+DkmF CxyjTkRWPYi6mpzj9+nK0l8wbTeq+GLV2qvldPt+QIPyWDVOrnzJofkJK36Huhzs 7siOd8SI2uSSZwrRESaNWl/Wjyf0DAUhXOHUYqpGBIg9yiWHCKWr/A0EhOVOEWwb CyPGFEw88YJq8dD89pdb =Icjy -----END PGP SIGNATURE-----

2 3

Q: status of component matching?
by Nardmann, Heiko 23 May '10

23 May '10

Hi all, we are trying to set up an openldap 2.4.21 slapd server that is able to handle component-filter search requests. The problem we get is that the slapd fails to load the compmatch module. With full debug output the error message is: "lt_dlopenext failed: (compmatch.la) file not found" Does anybody already have entered this problem? What we did/tried is now described in detail: We use Suse 11.1 as the Linux distribution. Compiler info: openldap@ocsp-openldap24:~/openldap-2.4.21/tests> gcc -v Using built-in specs. Target: i586-suse-linux Configured with: ../configure --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --libdir=/usr/lib --libexecdir=/usr/lib --enable-languages=c,c++,objc,fortran,obj-c++,java,ada --enable-checking=release --with-gxx-include-dir=/usr/include/c++/4.3 --enable-ssp --disable-libssp --with-bugurl=http://bugs.opensuse.org/ --with-pkgversion='SUSE Linux' --disable-libgcj --disable-libmudflap --with-slibdir=/lib --with-system-zlib --enable-__cxa_atexit --enable-libstdcxx-allocator=new --disable-libstdcxx-pch --enable-version-specific-runtime-libs --program-suffix=-4.3 --enable-linux-futex --without-system-libunwind --with-cpu=generic --build=i586-suse-linux Thread model: posix gcc version 4.3.2 [gcc-4_3-branch revision 141291] (SUSE Linux) The openldap software is configured with the following command: ./configure LDFLAGS="-L/usr/local/BerkeleyDB.5.0/lib -ldb" --prefix /home/openldap/openldap-2.4.21-install --enable-modules --enable-sssvlv --enable-syncprov --enable-valsort --enable-bdb=mod To supply the ASN.1 object parsing we downloaded http://www.openldap.org/software/download/OpenLDAP/openldap-release/openlda… to create the asn.1 library libcasn1.a. While running make for the component match module itself we encounter problems when calling the libtool for linking: ../../../libtool --mode=link gcc -g -O2 -DLDAP_COMPONENT -DLDAP_COMP_MATCH \ /home/openldap/openldap-snacc-2.3.6/c-lib/libcasn1.a -L/usr/lib -lcrypto -version-info 0:0:0 \ -rpath /home/openldap/openldap-2.4.21-install/libexec/openldap -module -o compmatch.la componentlib.lo \ init.lo certificate.lo asn_to_syn_mr.lo authorityKeyIdentifier.lo crl.lo \ /home/openldap/openldap-snacc-2.3.6/c-lib/libcasn1.a -L/usr/lib -lcrypto *** Warning: Linking the shared library compmatch.la against the *** static library /home/openldap/openldap-snacc-2.3.6/c-lib/libcasn1.a is not portable! In the resulting compmatch.a library the asn.1 lib is included four times: openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> ar tv .libs/compmatch.a rw-r--r-- 1000/1000 152162 May 18 14:37 2010 libcasn1.a rw-r--r-- 1000/1000 152162 May 18 14:37 2010 lt1-libcasn1.a rw-r--r-- 1000/1000 131488 May 19 14:04 2010 componentlib.o rw-r--r-- 1000/1000 70900 May 19 14:04 2010 init.o rw-r--r-- 1000/1000 144908 May 19 14:04 2010 certificate.o rw-r--r-- 1000/1000 55372 May 19 14:04 2010 asn_to_syn_mr.o rw-r--r-- 1000/1000 110584 May 19 14:04 2010 authorityKeyIdentifier.o rw-r--r-- 1000/1000 84920 May 19 14:04 2010 crl.o rw-r--r-- 1000/1000 152162 May 18 14:37 2010 libcasn1.a rw-r--r-- 1000/1000 152162 May 18 14:37 2010 libcasn1.a The component filter test fails: >>>>> Starting test031-component-filter for bdb... running defines.sh Running slapadd to build slapd database... slapadd: bad configuration file! slapadd failed (1)! Be sure to have a certificate module in tests/data/comp_libs The module is in openldap/contrib/slapd-modules/comp_match Test skipped. >>>>> ./scripts/test031-component-filter completed OK for bdb. Now we try to load the module via slapd. In the slapd.conf we specify the following: # Load dynamic backend modules: modulepath /home/openldap/openldap-2.4.21-install/libexec/openldap moduleload back_bdb.la moduleload compmatch.la Check that all module files do exist: openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> ls -al /home/openldap/openldap-2.4.21-install/libexec/openldap total 736 drwxr-xr-x 2 openldap openldap 4096 2010-05-19 14:10 . drwxr-xr-x 3 openldap openldap 4096 2010-05-19 09:32 .. lrwxrwxrwx 1 openldap openldap 21 2010-05-19 09:31 back_bdb-2.4.so.2 -> back_bdb-2.4.so.2.5.4 -rwxr-xr-x 1 openldap openldap 221074 2010-05-19 09:31 back_bdb-2.4.so.2.5.4 -rwxr-xr-x 1 openldap openldap 889 2010-05-19 09:31 back_bdb.la lrwxrwxrwx 1 openldap openldap 21 2010-05-19 09:31 back_bdb.so -> back_bdb-2.4.so.2.5.4 -rwxr-xr-x 1 openldap openldap 889 2010-05-19 10:02 compmatch.la lrwxrwxrwx 1 openldap openldap 18 2010-05-19 09:56 compmatch.so -> compmatch.so.0.0.0 -rwxr-xr-x 1 openldap openldap 507076 2010-05-19 09:55 compmatch.so.0.0.0 Starting slapd by openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> strace -vall -s1024 -oasi /home/openldap/openldap-2.4.21-install/libexec/slapd -h ldap://localhost:9389/ -d -1 results in the following: line 15 (pidfile /home/openldap/openldap-2.4.21-install/var/run/slapd.pid) line 16 (argsfile /home/openldap/openldap-2.4.21-install/var/run/slapd.args) line 19 (modulepath /home/openldap/openldap-2.4.21-install/libexec/openldap) line 21 (moduleload back_bdb.la) loaded module back_bdb.la bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 5.0.21: (March 30, 2010) module back_bdb.la: null module registered line 26 (moduleload compmatch.la) lt_dlopenext failed: (compmatch.la) file not found /home/openldap/openldap-2.4.21-install/etc/openldap/slapd.conf: line 26: <moduleload> handler exited with 1! slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. The content of compmatch.la: openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> cat /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.la # back_bdb.la - a libtool library file # Generated by ltmain.sh - GNU libtool 1.5.22-OpenLDAP (1.1220.2.365 2005/12/18 22:14:06) # # Please DO NOT delete this file! # It is necessary for linking the library. # The name that we can dlopen(3). dlname='compmatch.so.0.0.0' # Names of this library. library_names='compmatch.so.0.0.0 compmatch.so' # The name of the static archive. old_library='' # Libraries that this one depends upon. dependency_libs='' # Version information for back_bdb. current=0 age=0 revision=0 # Is this an already installed library? installed=yes # Should we warn about portability when linking against -modules? shouldnotlink=yes # Files to dlopen/dlpreopen dlopen='' dlpreopen='' # Directory that this library needs to be installed in: libdir='/home/openldap/openldap-2.4.21-install/libexec/openldap' An excerpt from the strace file shows that the module itself can be accessed: open("/home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0.0.0", O_RDONLY) = 10 read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20\241\0\0004\0\0\0\224V\7\0\0\0\0\0004\0 \0\6\0(\0'\0$\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\267\2\0\20\267\2\0\5\0\0\0\0\20\0\0\1\0\0\0\364\273\2\0\364\313\2\0\364\313\2\0\4(\0\0<>\0\0\6\0\0\0\0\20\0\0\2\0\0\0`\274\2\0`\314\2\0`\314\2\0\330\0\0\0\330\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0\364\0\0\0\364\0\0\0\364\0\0\0$\0\0\0$\0\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345td\364\273\2\0\364\313\2\0\364\313\2\0\f\4\0\0\f\4\0\0\4\0\0\0\1\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\"\261\223\260l\363\226\251\276\214p&\265\373\240\242l\3254\310\t\2\0\0006\2\0\0\230\0\0\0\n\1\0\0;\0\0\0\0\0\0\0\235\0\0\0\0\0\0\0\0\0\0\0\350\1\0\0(\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\7\2\0\0\0\0\0\0\205\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\0\0\0\0\16\1\0\0\322\1\0\0\0\0\0\0\224\1\0\0#\0\0\0\275\0\0\0\0\0\0\0\263\0\0\0\0\0\0\0D\0\0\0$\1\0\0\314\0\0\0\312\1\0\0c\1\0\0\0\0\0\0\0\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\274\1\0\0\375\0\0\0\362\1\0\0\237\1\0\0\0\0\0\0\0\0\0\0\210\1\0\0\0\0\0\0\0\0\0\0\225\0\0\0\0\0\0\0t\1\0\0\21\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 512) = 512 fstat64(10, {st_dev=makedev(8, 2), st_ino=357002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=1000, st_gid=1000, st_blksize=4096, st_blocks=1000, st_size=507076, st_atime=2010/05/19-14:13:32, st_mtime=2010/05/19-09:55:40, st_ctime=2010/05/19-09:55:40}) = 0 mmap2(NULL, 199216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb7c42000 fadvise64(10, 0, 199216, POSIX_FADV_WILLNEED) = 0 mmap2(0xb7c6e000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x2b) = 0xb7c6e000 mmap2(0xb7c72000, 2608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7c72000 close(10) = 0 open("/usr/local/BerkeleyDB.5.0/lib/libcrypto.so.0.9.8", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 10 fstat64(10, {st_dev=makedev(8, 2), st_ino=567539, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=64, st_size=31447, st_atime=2010/05/19-14:13:32, st_mtime=2010/05/18-10:45:00, st_ctime=2010/05/18-10:45:00}) = 0 mmap2(NULL, 31447, PROT_READ, MAP_PRIVATE, 10, 0) = 0xb7c3a000 close(10) = 0 open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 10 read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\320\3\0004\0\0\0\2641\26\0\0\0\0\0004\0 \0\7\0(\0\35\0\34\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\333\24\0\220\333\24\0\5\0\0\0\0\20\0\0\1\0\0\0\300\351\24\0\300\351\24\0\300\351\24\0\304F\1\0Xz\1\0\6\0\0\0\0\20\0\0\2\0\0\0\310Z\25\0\310Z\25\0\310Z\25\0\360\0\0\0\360\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0\24\1\0\0\24\1\0\0\24\1\0\0$\0\0\0$\0\0\0\4\0\0\0\4\0\0\0P\345td\310\242\22\0\310\242\22\0\310\242\22\0\34u\0\0\34u\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0R\345td\300\351\24\0\300\351\24\0\300\351\24\0@v\0\0@v\0\0\4\0\0\0\1\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\265\352E\24\365\314\1771\372m\0\247U\306\336\241\222C->\5\10\0\0r\r\0\0\0\0\0\0-\6\0\0\0\0\0\0\336\n\0\0\0\0\0\0\0\0\0\0f\7\0\0\363\3\0\0\0\0\0\0\0\0\0\0\215\f\0\0l\v\0\0\214\v\0\0/\v\0\0\311\4\0\0\257\7\0\0\32\f\0\0u\3\0\0\203\3\0\0\30\6\0\0\327\n\0\0\260\4\0\0\303\2\0\0H\6\0\0&\r\0\0\342\v\0\0m\t\0\0\202\3\0\0O\6\0\0\267\v\0\0\373\n\0\0\0\0\0\0\331\0\0\0\233\7\0\0-\0\0\0/\10\0\0\0\0\0\0\t\6\0\0\0\0\0\0E\1\0\0.\0\0\0U\4\0\0\21\0\0\0\0\0\0\0\345\t\0\0!\2\0\0\0\0\0\0\0\0\0\0", 512) = 512 fstat64(10, {st_dev=makedev(8, 2), st_ino=523294, st_mode=S_IFREG|0555, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2856, st_size=1455676, st_atime=2010/05/19-14:13:32, st_mtime=2008/12/03-07:36:55, st_ctime=2009/07/27-12:44:06}) = 0 mmap2(NULL, 1467416, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb7ad3000 fadvise64(10, 0, 1467416, POSIX_FADV_WILLNEED) = 0 mmap2(0xb7c21000, 90112, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x14e) = 0xb7c21000 mmap2(0xb7c37000, 9240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7c37000 close(10) = 0 open("/usr/local/BerkeleyDB.5.0/lib/libz.so.1", O_RDONLY) = 10 read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\31\0\0004\0\0\0(2\1\0\0\0\0\0004\0 \0\7\0(\0\35\0\34\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254)\1\0\254)\1\0\5\0\0\0\0\20\0\0\1\0\0\0(.\1\0(>\1\0(>\1\0\344\2\0\0\354\2\0\0\6\0\0\0\0\20\0\0\2\0\0\0\350.\1\0\350>\1\0\350>\1\0\320\0\0\0\320\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0\24\1\0\0\24\1\0\0\24\1\0\0$\0\0\0$\0\0\0\4\0\0\0\4\0\0\0P\345td\0\34\1\0\0\34\1\0\0\34\1\0\304\2\0\0\304\2\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345td(.\1\0(>\1\0(>\1\0\330\1\0\0\330\1\0\0\4\0\0\0\1\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\17\363*\0274\316\273\2402`\300d\237a\241\201\356h\327Sa\0\0\0i\0\0\0;\0\0\0\0\0\0\0\f\0\0\0\32\0\0\0,\0\0\0\35\0\0\0\0\0\0\0b\0\0\0\0\0\0\0\0\0\0\0g\0\0\0\0\0\0\0P\0\0\0\0\0\0\0\\\0\0\0\0\0\0\0003\0\0\0_\0\0\0A\0\0\0\37\0\0\0W\0\0\0000\0\0\0[\0\0\0'\0\0\0%\0\0\0\0\0\0\0F\0\0\0]\0\0\0\23\0\0\0006\0\0\0\0\0\0\0a\0\0\0h\0\0\0\6\0\0\0-\0\0\0H\0\0\0\34\0\0\0008\0\0\0\27\0\0\0\0\0\0\0\20\0\0\0`\0\0\0005\0\0\0K\0\0\0\0\0\0\0)\0\0\0J\0\0\0\26\0\0\0", 512) = 512 fstat64(10, {st_dev=makedev(8, 2), st_ino=579040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=168, st_size=79536, st_atime=2010/05/19-14:13:32, st_mtime=2010/05/19-08:48:55, st_ctime=2010/05/19-08:48:55}) = 0 mmap2(NULL, 82196, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb7abe000 fadvise64(10, 0, 82196, POSIX_FADV_WILLNEED) = 0 mmap2(0xb7ad1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x12) = 0xb7ad1000 close(10) = 0 mprotect(0xb7ad1000, 4096, PROT_READ) = 0 mprotect(0xb7c21000, 32768, PROT_READ) = 0 munmap(0xb7c3a000, 31447) = 0 munmap(0xb7c42000, 199216) = 0 munmap(0xb7ad3000, 1467416) = 0 munmap(0xb7abe000, 82196) = 0 write(2, "lt_dlopenext failed: (compmatch.la) file not found\n", 51) = 51 time(NULL) = 1274271212 send(3, "<167>May 19 14:13:32 slapd[24620]: lt_dlopenext failed: (compmatch.la) file not found\n", 86, MSG_NOSIGNAL) = 86 write(2, "/home/openldap/openldap-2.4.21-install/etc/openldap/slapd.conf: line 26: <moduleload> handler exited with 1!\n", 109) = 109 close(9) = 0 munmap(0xb7e62000, 4096) = 0 write(2, "slapd destroy: freeing system resources.\n", 41) = 41 munmap(0xb7c73000, 252728) = 0 write(2, "slapd stopped.\n", 15) = 15 So does anybody have an idea? Regards, Heiko -- Dipl.-Ing. Heiko Nardmann Berater Business Security secunet Security Networks AG Weidenauer Str. 223-225 D-57076 Siegen Telefon +49 201 5454-2017 Telefax +49 201 5454-1329 Heiko.Nardmann(a)secunet.com www.secunet.com secunet Security Networks AG Kronprinzenstr. 30 45128 Essen Amtsgericht Essen HRB 13615 Vorstand: Dr. Rainer Baumgart Thomas Koelzer Thomas Pleines Aufsichtsratsvorsitzender: Dr. Karsten Ottenberg Diese E-mail kann vertrauliche Informationen enthalten. Falls Sie diese E-Mail irrtÃ¼mlich erhalten haben, informieren Sie bitte unverzÃ¼glich den Absender und lÃ¶schen Sie diese E-Mail von jedem Rechner, auch von den Mailservern. Jede Verbreitung des Inhalts, auch die teilweise Verbreitung, ist in diesem Fall untersagt. AuÃŸer bei Vorsatz oder grober FahrlÃ¤ssigkeit schlieÃŸen wir jegliche Haftung fÃ¼r Verluste oder SchÃ¤den aus, die durch Viren befallene Software oder E-Mails verursacht werden. This e-mail may contain confidential information. If you received this e-mail in error, please contact the sender and delete this e-mail from your computer, including your mailservers. Any dissemination, even partly, is prohibited. Except in case of gross negligence or wilful misconduct we accept no liability for any loss or damage caused by software or e-mail viruses.

2 1

setup for OpenLDAP for windows platform
by mani chandel 22 May '10

22 May '10

Hello, Can anyone please provide me the latest setup of OpenLDAP for windows platform. Thanks in advance. Regards, Mani

1 0

use of server-side sorting and virtual list view controls blocks slapd
by Lehnert, Hartmut 22 May '10

22 May '10

Hi all, We encounter a problem using server-side sort and virtual list view controls in our search requests. After sending one search requests the slapd remains busy until it is restarted: Executing the command /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children -E!sss=sncertnr -E!vlv="0/0/1/0" "objectclass=*" Generates the following output: # extended LDIF # # LDAPv3 # base <o=CustomerCA,c=de> with scope children # filter: objectclass=* # requesting: sncertnr # with server side sorting critical control # with virtual list view critical control: 0/0/1/0 # # R\C3\BCger OttoSER:9000, testsuite, CustomerCA, de dn:: Y249UsO8Z2VyIE90dG9TRVI6OTAwMCxvdT10ZXN0c3VpdGUsbz1DdXN0b21lckNBLGM9ZGU= SNcertNr: 9000 # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success control: 2.16.840.1.113730.3.4.10 false MA8CAQECAQsCAQAEBJB4LAg= vlvResult: pos=1 count=11 context=kHgsCA== (0) Success # numResponses: 2 # numEntries: 1 Press [before/after(/offset/count|:value)] Enter for the next window. # extended LDIF # # LDAPv3 # base <o=CustomerCA,c=de> with scope children # filter: objectclass=* # requesting: sncertnr # with server side sorting critical control # with virtual list view critical control: 0/0/1/11 # # search result search: 3 result: 4 Size limit exceeded # numResponses: 1 Why is the size limit exceeded here? Executing the same command once more produces the following output: # extended LDIF # # LDAPv3 # base <o=CustomerCA,c=de> with scope children # filter: objectclass=* # requesting: sncertnr # with server side sorting critical control # with virtual list view critical control: 0/0/1/0 # # search result search: 2 result: 51 Server is busy text: Other sort requests already in progress # numResponses: 1 Now slapd doesn't accept sssvlv requests anymore, it has to be restarted. Here is the content of slapd.conf: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /home/openldap/openldap-2.4.21-install/etc/openldap/schema/core.schema include /home/openldap/openldap-2.4.21-install/etc/openldap/schema/isis_mtt_exte nsions.schema include /home/openldap/openldap-2.4.21-install/etc/openldap/schema/secunet_isis_ mtt_extensions.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /home/openldap/openldap-2.4.21-install/var/run/slapd.pid argsfile /home/openldap/openldap-2.4.21-install/var/run/slapd.args # Load dynamic backend modules: modulepath /home/openldap/openldap-2.4.21-install/libexec/openldap # modulepath /usr/local/libexec/openldap moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # moduleload /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch # moduleload /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.la # moduleload compmatch.la # overlay server-side-sorting + virtual list view: overlay sssvlv # Sets the maximum number of concurrent sort requests allowed # across all connections; the default is one half of the number of # server threads: sssvlv-max 8 # Sets the maximum number of keys allowed in a sort request; the # default is 5: sssvlv-maxkeys 5 # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=openldapadmin" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw welcome # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /home/openldap/openldap-2.4.21-install/var/openldap-data # Indices to maintain index objectClass eq index c eq index o eq index ou eq index sncertnr eq index sncerthash eq index snissuerkeyhash eq index snissuernamehash eq Does anybody have an idea? Executing this command against a Sun DS 6 server doesn't generate this problem. Regards, Hartmut

2 1

shadowLastChange not updating
by Allgood, John 21 May '10

21 May '10

Hey All I am troubleshooting openldap on a Centos box and having an issue. When the users set their passwords using the passwd program shadowLastChange is not getting updated in ldap. Using openldap 2.3.43.12.el5. Here is a listing of my ACL's. Any ideas? access to attrs=userPassword,shadowLastChange by dn.base="cn=Manager,dc=turbocorp,dc=com" write by anonymous auth by self write by * none access to attrs=SambaLMPassword,SambaNTPassword by dn.base="cn=Manager,dc=turbocorp,dc=com" write by anonymous auth by self write by * none access to * by dn.base="cn=Manager,dc=turbocorp,dc=com" write by self write by * read John Allgood Senior Systems Administrator OHL Transportation Services 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 3

Group based ACLS
by Indexer 20 May '10

20 May '10

I have been reading http://www.openldap.org/doc/admin24/access-control.html and am evry interested in how sets can be applied to controlling ACLs. In the examples shown, all the relationships are tied to the user having an attribute such as a manager etc, but i would like to do this in reverse so that an account, lets say Admin, can only modify users that have an entry in a group such as cn=Group,dc=example memberUid: testuser uid=testuser,dc=example uid=someuser,dc=example In this case Admin would be able to modify testuser, but not someuser. Is this possible, or do i need to enforce membership on the user as well such that uid=testuser,dc=example memberOf: group William

1 0

olcAccess
by Indexer 20 May '10

20 May '10

Im having a look at using the new olcAccess system rather than using slapd.conf for ACLs, and while the documentation of olcAccess is fantastic, how to implement it is not so easily found. Any help and pointers on how to get started with olcAccess would be greatly appreciated, as i just want to add a set of ACLs to my LDAP with this. William

3 4

RE: Segmentation Fault appearing while doing the sync.-OpenLDAP 2.4.22
by masarati＠aero.polimi.it 19 May '10

19 May '10

> Thanks for the suggestion. > > No I didn't run the core with gdb. Please see <http://www.openldap.org/faq/data/cache/56.html>. In any case, you don't need sync_use_subentry, unless your database's suffix is "". > The owner of the files is root and I am running the slapd process with > root only. > > Have rearranged the directives in the config. Please check the attached. > But it is still throwing the same error. > > Can you please suggest on this? > > Rahul Manchanda > > GS Selfcare > Platform Build Team > > Tel: +91 02066018100 Extn: 6178 > SMTP: rahul.manchanda(a)bt.com > > Office: Sharda Center ,6th Floor Annex > Off Karve Road, Erandwana ,Pune-04 > > -----Original Message----- > From: Dieter Kluenter [mailto:dieter@dkluenter.de] > Sent: Wednesday, May 19, 2010 10:09 AM > To: Manchanda,RK,Rahul,DKE C > Cc: openldap-technical(a)openldap.org > Subject: Re: Segmentation Fault appearing while doing the sync.-OpenLDAP > 2.4.22 > > <rahul.manchanda(a)bt.com> writes: > >> Hi , >> >> I have added sync_use_subentry in the ldap configuration and it started >> throwing the core dump while performing the sync from other running >> server and >> stops the LDAP process. > > Did you run the core within gdb? >> >> Here is the error seen the in the debug logs. >> >> <= index_entry_add( 114, "ou=New NetIQ StAlbans / >> Glasgow,ou=ChartReports,ou= >> services,o=BT" ) success >> >> => entry_encode(0x00000072): ou=New NetIQ StAlbans / Glasgow,ou= >> ChartReports,ou=services,o=BT >> >> <= entry_encode(0x00000072): ou=New NetIQ StAlbans / Glasgow,ou= >> ChartReports,ou=services,o=BT >> >> bdb_add: added id=00000072 dn="ou=New NetIQ StAlbans / Glasgow,ou= >> ChartReports,ou=services,o=BT" >> >> send_ldap_result: conn=-1 op=0 p=0 >> >> send_ldap_result: err=0 matched="" text="" >> >> bdb_modify: cn=ldapsync,o=bt >> >> bdb_dn2entry("cn=ldapsync,o=bt") >> >> => bdb_dn2id("cn=ldapsync,o=bt") >> >> <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found >> (-30988) >> >> bdb_modify: dn2entry failed (-30988) > > who is running slapd and who is the owner of dn2id.bdb and dn2entry.bdb? > >> send_ldap_result: conn=-1 op=0 p=0 >> >> send_ldap_result: err=10 matched="o=BT" text="" > > error 10 indicates that the referral is not available. Error 10 is there because the internal modification can't find the entry it's looking for, thus tries to send a referral according to updateref. p. >> ./start_ldap.sh: line 3: 14900 Segmentation Fault (core dumped) >> /software >> /openldap2.4.22/libexec/slapd -f /software/openldap2.4.22/etc/openldap/ >> slapd.conf -h ldap://tardis02.nat.bt.com:489/ -d -1 >> >> Have attached the slapd.conf file. >> >> Could you please suggest? > > Your slapd.conf is completely bogus, don't mix global configuration > parameters with database specific parameters, and vice versa. Overlay > declarations have to follow all database configuration parameters. > > >> >> overlay syncprov >> syncprov-checkpoint 100 5 >> syncprov-sessionlog 100 >> >> sync_use_subentry TRUE > ^^^^^^^^^^^^^^^^^^^^^^^^ > > this is a database specific parameter > > >> # Index Definition > [...] > > Indices are database specific > >> ############################# >> ###### ACL definitions ###### >> ############################# > > ACL's are partly global and database specific > > -Dieter > > -- > Dieter KlÃŒnter | Systemberatung > sip: +49.40.20932173 > http://www.dpunkt.de/buecher/2104.html > GPG Key ID:8EF7B6C6 >

1 0

Segmentation Fault appearing while doing the sync.-OpenLDAP 2.4.22
by rahul.manchanda＠bt.com 19 May '10

19 May '10

Hi , I have added sync_use_subentry in the ldap configuration and it started throwing the core dump while performing the sync from other running server and stops the LDAP process. Here is the error seen the in the debug logs. <= index_entry_add( 114, "ou=New NetIQ StAlbans / Glasgow,ou=ChartReports,ou=services,o=BT" ) success => entry_encode(0x00000072): ou=New NetIQ StAlbans / Glasgow,ou=ChartReports,ou=services,o=BT <= entry_encode(0x00000072): ou=New NetIQ StAlbans / Glasgow,ou=ChartReports,ou=services,o=BT bdb_add: added id=00000072 dn="ou=New NetIQ StAlbans / Glasgow,ou=ChartReports,ou=services,o=BT" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" bdb_modify: cn=ldapsync,o=bt bdb_dn2entry("cn=ldapsync,o=bt") => bdb_dn2id("cn=ldapsync,o=bt") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) bdb_modify: dn2entry failed (-30988) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=10 matched="o=BT" text="" ./start_ldap.sh: line 3: 14900 Segmentation Fault (core dumped) /software/openldap2.4.22/libexec/slapd -f /software/openldap2.4.22/etc/openldap/slapd.conf -h ldap://tardis02.nat.bt.com:489/ -d -1 Have attached the slapd.conf file. Could you please suggest? Many Thanks in advance. Rahul Manchanda GS Selfcare Platform Build Team Tel: +91 02066018100 Extn: 6178 SMTP: rahul.manchanda(a)bt.com Office: Sharda Center ,6th Floor Annex Off Karve Road, Erandwana ,Pune-04

2 2

Problem with syncrepl and deletion on openldap 2.4.21
by Mark Cave-Ayland 19 May '10

19 May '10

Hi folks, We've been running the latest openldap stable on one of our client sites and have hit an issue earlier in the day with syncrepl changes not being propagated to all consumers. The live system is configured with one master and 4 slaves connected across various LAN/WAN links with all servers running 2.4.21, db-4.7 on RHEL4. Earlier in the day, we renamed a corrupted ou (that was accidentally created with hidden control characters) to ou=salvage. Since the slapd.conf backend on the master was set to "database bdb", this was done by cloning the data into a new ou=salvage and deleting the old version. This data was cleaned up by the client by copying from ou=salvage into its correct location, and then finally they attempted to delete the complete ou=salvage part of the tree. However, after the deletion phase we found that 2 of our slaves were inconsistent with the master. As an example, on one slave we noticed that one DN with cn=001901717 had not been deleted from ou=salvage. The relevant parts of the log on the master and slave look like this: master: May 17 12:35:08 master slapd[3692]: conn=222514 op=3089 SRCH attr=objectclass May 17 12:35:08 master slapd[3692]: conn=222514 op=3089 SEARCH RESULT tag=101 err=0 nentries=0 text= May 17 12:35:08 master slapd[3692]: conn=222514 op=3090 DEL dn="cn=001801489,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" May 17 12:35:08 master slapd[3692]: slap_queue_csn: queing 0x824fee10 20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=149,csn=20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3090 RESULT tag=107 err=0 text= May 17 12:35:08 master slapd[3692]: slap_graduate_commit_csn: removing 0x82f2e250 20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=107,csn=20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=136,csn=20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=103,csn=20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=154,csn=20100517113508.089178Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3091 SRCH base="cn=001800462,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" scope=1 deref=2 filter="(objectClass=*)" May 17 12:35:08 master slapd[3692]: conn=222514 op=3091 SRCH attr=objectclass May 17 12:35:08 master slapd[3692]: conn=222514 op=3091 SEARCH RESULT tag=101 err=0 nentries=0 text= May 17 12:35:08 master slapd[3692]: conn=222514 op=3092 DEL dn="cn=001800462,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" May 17 12:35:08 master slapd[3692]: slap_queue_csn: queing 0x8e151e10 20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=149,csn=20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3092 RESULT tag=107 err=0 text= May 17 12:35:08 master slapd[3692]: slap_graduate_commit_csn: removing 0x7d00cc58 20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=107,csn=20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=136,csn=20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=103,csn=20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=154,csn=20100517113508.144277Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3093 SRCH base="cn=001801399,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" scope=1 deref=2 filter="(objectClass=*)" May 17 12:35:08 master slapd[3692]: conn=222514 op=3093 SRCH attr=objectclass May 17 12:35:08 master slapd[3692]: conn=222514 op=3093 SEARCH RESULT tag=101 err=0 nentries=0 text= May 17 12:35:08 master slapd[3692]: conn=222514 op=3094 DEL dn="cn=001801399,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" May 17 12:35:08 master slapd[3692]: slap_queue_csn: queing 0x8c6f6e10 20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=149,csn=20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3094 RESULT tag=107 err=0 text= May 17 12:35:08 master slapd[3692]: slap_graduate_commit_csn: removing 0x82588ca0 20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=107,csn=20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=136,csn=20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=103,csn=20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=154,csn=20100517113508.192643Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3095 SRCH base="cn=001800467,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" scope=1 deref=2 filter="(objectClass=*)" May 17 12:35:08 master slapd[3692]: conn=222514 op=3095 SRCH attr=objectclass May 17 12:35:08 master slapd[3692]: conn=222514 op=3095 SEARCH RESULT tag=101 err=0 nentries=0 text= May 17 12:35:08 master slapd[3692]: conn=222514 op=3096 DEL dn="cn=001800467,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" May 17 12:35:08 master slapd[3692]: slap_queue_csn: queing 0x8cffae10 20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=107,csn=20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=136,csn=20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=103,csn=20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=154,csn=20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=149,csn=20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3096 RESULT tag=107 err=0 text= May 17 12:35:08 master slapd[3692]: slap_graduate_commit_csn: removing 0x7d802e90 20100517113508.234887Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3097 SRCH base="cn=001901714,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" scope=1 deref=2 filter="(objectClass=*)" May 17 12:35:08 master slapd[3692]: conn=222514 op=3097 SRCH attr=objectclass May 17 12:35:08 master slapd[3692]: conn=222514 op=3097 SEARCH RESULT tag=101 err=0 nentries=0 text= May 17 12:35:08 master slapd[3692]: conn=222514 op=3098 DEL dn="cn=001901714,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" May 17 12:35:08 master slapd[3692]: slap_queue_csn: queing 0x87ef3e10 20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=149,csn=20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3098 RESULT tag=107 err=0 text= May 17 12:35:08 master slapd[3692]: slap_graduate_commit_csn: removing 0x7e95abe8 20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=107,csn=20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=136,csn=20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=103,csn=20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: syncprov_sendresp: cookie=rid=154,csn=20100517113508.277430Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3099 SRCH base="cn=001901717,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" scope=1 deref=2 filter="(objectClass=*)" May 17 12:35:08 master slapd[3692]: conn=222514 op=3099 SRCH attr=objectclass May 17 12:35:08 master slapd[3692]: conn=222514 op=3099 SEARCH RESULT tag=101 err=0 nentries=0 text= May 17 12:35:08 master slapd[3692]: conn=222514 op=3100 DEL dn="cn=001901717,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com" May 17 12:35:08 master slapd[3692]: slap_queue_csn: queing 0x81cfce10 20100517113508.331930Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 op=3101 ABANDON msg=3101 May 17 12:35:08 master slapd[3692]: conn=222514 op=3102 UNBIND May 17 12:35:08 master slapd[3692]: slap_graduate_commit_csn: removing 0x7e550d68 20100517113508.331930Z#000000#000#000000 May 17 12:35:08 master slapd[3692]: conn=222514 fd=411 closed slave: May 17 12:35:32 slave slapd[2393]: slap_graduate_commit_csn: removing 0x8b867e0 20100517113508.192643Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 be_delete cn=001801399,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com (0) May 17 12:35:32 slave slapd[2393]: slap_queue_csn: queing 0x89bfb70 20100517113508.192643Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: slap_graduate_commit_csn: removing 0x8b69c68 20100517113508.192643Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: do_syncrep2: rid=149 cookie=rid=149,csn=20100517113508.234887Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 be_search (0) May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 cn=001800467,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com May 17 12:35:32 slave slapd[2393]: slap_queue_csn: queing 0x8af8bf0 20100517113508.234887Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: slap_graduate_commit_csn: removing 0x86d0a60 20100517113508.234887Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 be_delete cn=001800467,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com (0) May 17 12:35:32 slave slapd[2393]: slap_queue_csn: queing 0x8af8bf0 20100517113508.234887Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: slap_graduate_commit_csn: removing 0x86893e8 20100517113508.234887Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: do_syncrep2: rid=149 cookie=rid=149,csn=20100517113508.277430Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 be_search (0) May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 cn=001901714,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com May 17 12:35:32 slave slapd[2393]: slap_queue_csn: queing 0x86c0a38 20100517113508.277430Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: slap_graduate_commit_csn: removing 0x8abc018 20100517113508.277430Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: syncrepl_entry: rid=149 be_delete cn=001901714,ou=People,ou=salvage,ou=Access Groups,dc=client,dc=com (0) May 17 12:35:32 slave slapd[2393]: slap_queue_csn: queing 0x86c0a38 20100517113508.277430Z#000000#000#000000 May 17 12:35:32 slave slapd[2393]: slap_graduate_commit_csn: removing 0x8aedb68 20100517113508.277430Z#000000#000#000000 (logging stops for about 3s before another connection is made) AFAICT it seems that something happened between the master and slave that caused an ABANDON to be issued and the connection dropped to that slave. The deletion was successful on the master, but the cn=001901717 entry still remains on the slave. My questions would therefore be: 1) Are there any known issues with syncrepl and deletion in 2.4.21 that may be fixed in 2.4.22? 2) What does an ABANDON actually mean? Did the client or server terminate the connection and can we find out why? When slave reconnected back to the master, why was the incomplete transaction from the master not pushed back to the slave? 3) Would a simple restart of slapd on the slave cause it to resynchronise correctly with the master? 4) Is there any more information that we can provide from the logs on the 2 inconsistent slaves? Note I'm not sure whether to open an ITS on this since it is a live system and hence the scope for testing/debugging is much more limited. But I can try my best to obtain extra information if asked. Many thanks, Mark. -- Mark Cave-Ayland - Senior Technical Architect PostgreSQL - PostGIS Sirius Corporation plc - control through freedom http://www.siriusit.co.uk t: +44 870 608 0063 Sirius Labs: http://www.siriusit.co.uk/labs

2 2

multiple structural object class issue while migrating from sun one to openldap
by mani chandel 17 May '10

17 May '10

Hello, I am trying to do a migration from Sun one directory server 5.2 to openldap 2.2.29 (installed on windows). I did an export of data from sun one and now doing the import of data into openldap. But while importing I am running into the following errors. LDAP: error code 65 - invalid structural object class chain (st-person/inetOrgPerson) LDAP: error code 65 - invalid structural object class chain (st-person/fw1person) LDAP: error code 65 - invalid structural object class chain (st-person/st-extranetuser) LDAP: error code 65 - invalid structural object class chain (st-person/mailrecipient) Since all the above classes are structural so I tried making st-person auxiliary but then it threw error in other entries that no structural class provided which included only st-person as their object class. Object class mailrecipient was also conflicting with some other object classes so I tried making it auxiliary but it gave this error "LDAP: error code 80 - structuralObjectClass 'mailRecipient' is not STRUCTURAL" Is there any way so that I could allow multiple allow multiple structural object classes in openldap ? If not could anyone please suggest a solution to this problem. I would be really thankful if somebody could help me over this as I need to do this migration as soon as possible. Thanks a lot in advance, Mani

1 0

FW: OpenLDAP: contextCSN check across mirrors
by rahul.manchanda＠bt.com 17 May '10

17 May '10

Hi, Thanks for the reply. Can you please help me in understanding the two updates that has come in the two new LDAP releases "slapd-bdb contextCSN updates from updatedn" & " slapd syncrepl contextCSN storing in subentry". Can you please suggest what configurations are required to frequently change the contextCSN in slapd.conf so that my script can pick the latest one? I am also attaching the python script which I am using to check the sync status across mirrors? Could you please assist? Many Thanks. Rahul Manchanda GS Selfcare Platform Build Team Tel: +91 02066018100 Extn: 6178 SMTP: rahul.manchanda(a)bt.com Office: Sharda Center ,6th Floor Annex Off Karve Road, Erandwana ,Pune-04 -----Original Message----- From: Howard Chu [mailto:hyc@symas.com] Sent: Monday, May 10, 2010 6:32 PM To: Manchanda,RK,Rahul,DKE C Cc: quanah(a)zimbra.com; openldap-technical(a)openldap.org Subject: Re: OpenLDAP: contextCSN check across mirrors rahul.manchanda(a)bt.com wrote: > Thanks for the reply. > > "Added slapd syncrepl contextCSN storing in subentry (ITS#6373)". In > this point what I can understand is that contextCSN will also get > stored in suffix entries as well as to sub entries as well. Please > correct if wrong. That's wrong. Read the manpage and/or the ITS for the actual behavior. > I have some doubts if you can please help in making it more clear: > > 1) Can the contextCSN entry differ at the sub entry level if compared > with suffix(root) entry level? It will only be in one place or the other, not both. > 2) If this is the case then a check will be required to each and every > entry if the sync is there at the dn level across mirrors and scripts > need to be modified so as to put a loop till all the entries has been > checked in that particular LDAP tree. Please correct if wrong. No. > 3) how will the contextCSN entries will get changed. Does checkpoint > plays a role in changing the contextCSN value or not? No. > 4) provider will not change the contextCSN until the whole data get > synched False. but will consumer will still be able to do so. Is this still the > scenario in the new version? I don't understand the question. > > Many Thanks in advance!! > > Rahul Manchanda > > GS Selfcare > Platform Build Team > > Tel: +91 02066018100 Extn: 6178 > SMTP: rahul.manchanda(a)bt.com > > Office: Sharda Center ,6th Floor Annex Off Karve Road, Erandwana > ,Pune-04 > > > -----Original Message----- > From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] > Sent: Friday, May 07, 2010 4:48 PM > To: Manchanda,RK,Rahul,DKE C; openldap-technical(a)openldap.org > Subject: RE: OpenLDAP: contextCSN check across mirrors > > --On Friday, May 07, 2010 7:50 AM +0100 rahul.manchanda(a)bt.com wrote: > >> Hi, >> >> It is 2.4.19. > > Please update your servers to 2.4.22 and see if it still occurs. > Numerous > fixes have occurred since the 2.4.19 release. I've noted some > specific ones below that are likely of interest. > > OpenLDAP 2.4.20 Release (2009/11/27) > Added slapd syncrepl contextCSN storing in subentry (ITS#6373) > Fixed slapd syncrepl deletes in MirrorMode (ITS#6368) > Fixed slapd syncrepl to use correct SID (ITS#6367) > Fixed slapo-syncprov checkpoint conversion (ITS#6370) > Fixed slapo-syncprov deadlock (ITS#6335) > Fixed slapo-syncprov memory leak (ITS#6376) > Fixed slapo-syncprov out of order changes (ITS#6346) > Fixed slapo-syncprov psearch with stale cookie (ITS#6397) > > OpenLDAP 2.4.21 Release (2009/12/20) > Fixed slapd syncrepl freeing tasks from queue (ITS#6413) > Fixed slapd syncrepl parsing of tls defaults (ITS#6419) > Fixed slapd syncrepl uninitialized variables (ITS#6425) > > OpenLDAP 2.4.22 Release (2010/04/24) > Fixed slapd-bdb contextCSN updates from updatedn (ITS#6469) > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 3

PAM Authentication
by Miha Krajnc 15 May '10

15 May '10

I have set up 2 servers, a web server and a database server. The database server has mysql and OpenLDAP (configured, with 1 Posix user). The web server has apache, php, etc. I want to connect with the web server to the database server with PAM (libpam-ldap) and use creditentials from the database server for user logins. I have set up libpam-ldap, but the authentecation doesnt work. Further investegation (/var/log/auth.log ) shows that the teh web server cant contact the database server. However, i also ha ve phpLDAPadmin installed aon the web server, and i can connect to the database server from there. Anyone know what could be wrong? Here is the auth.log: May 11 10:57:33 web sudo: nss_ldap: could not connect to any LDAP server as cn=admin,dc=stef,dc=si - Can't contact LDAP server May 11 10:57:33 web sudo: nss_ldap: failed to bind to LDAP server ldap:/// 192.168.1.107:389/: Can't contact LDAP server May 11 10:57:33 web sudo: nss_ldap: reconnecting to LDAP server... May 11 10:57:33 web sudo: nss_ldap: could not connect to any LDAP server as cn=admin,dc=stef,dc=si - Can't contact LDAP server May 11 10:57:33 web sudo: nss_ldap: failed to bind to LDAP server ldap:/// 192.168.1.107:389/: Can't contact LDAP server -- Lep pozdrav, Miha Krajnc.

5 7

Custom Logging
by Marco Pizzoli 11 May '10

11 May '10

Hi list, Is there a way to log some specific client (choosen by IP or by binddn) to log to some specific log-file? I would like to have both the "general" log file written by syslogd, and a special log file to write only some specific clients . Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

rewriting (invalid) bindDN ?
by g-openldap-technical-list＠lachenal.net 11 May '10

11 May '10

Hi list, I've just set up a ldap proxy on witch I wish users may bind with their cn instead of dn. Some reading let me say it's possible - slapo-rwm (5) - http://blogs.turmzimmer.net/2008/06/26#ldap-3 - http://www.openldap.org/lists/openldap-software/201004/msg00065.html and some more I run slapd 2.4.11 from Debian Lenny. Here is slapd.conf : slapd.conf> ################################################################## slapd.conf> # Global Directives: slapd.conf> disallow bind_anon slapd.conf> require authc slapd.conf> include /etc/ldap/schema/core.schema slapd.conf> include /etc/ldap/schema/cosine.schema slapd.conf> include /etc/ldap/schema/nis.schema slapd.conf> include /etc/ldap/schema/inetorgperson.schema slapd.conf> pidfile /var/run/slapd/slapd.pid slapd.conf> argsfile /var/run/slapd/slapd.args slapd.conf> loglevel -1 slapd.conf> modulepath /usr/lib/ldap slapd.conf> moduleload back_ldap slapd.conf> moduleload rwm slapd.conf> sizelimit 500 slapd.conf> tool-threads 1 slapd.conf> ################################################################## slapd.conf> # Specific Directives for database #1 slapd.conf> slapd.conf> database ldap slapd.conf> suffix "o=MyO" slapd.conf> uri "ldap://MyLDAP" slapd.conf> readonly on slapd.conf> overlay rwm slapd.conf> rwm-rewriteEngine on slapd.conf> rwm-rewriteContext bindDN slapd.conf> rwm-rewriteRule "(.*)" "cn=$1,ou=SubOU,ou=OU,o=MyO" ":" When trying to bind from Thunderbird as client with just "MyCN", connection fail with "invalid dn". I expected some info about rwm rewriting syslog> slapd[11027]: conn=5 op=0 do_bind syslog> slapd[11027]: >>> dnPrettyNormal: <MyCN> syslog> slapd[11027]: conn=5 op=0 do_bind: invalid dn (glachenal) syslog> slapd[11027]: send_ldap_result: conn=5 op=0 p=3 syslog> slapd[11027]: send_ldap_result: err=34 matched="" text="invalid DN" syslog> slapd[11027]: send_ldap_response: msgid=1 tag=97 err=34 syslog> slapd[11027]: conn=5 op=0 RESULT tag=97 err=34 text=invalid DN When trying to bind with a valid DN, rwm works as expected. (And of course bind failed because of unexistent rewritten DN) syslog> slapd[11135]: >>> dnPrettyNormal: <cn=MyCN,ou=SubOU,ou=OU,o=MyO> syslog> slapd[11135]: <<< dnPrettyNormal: <cn=MyCN,ou=SubOU,ou=OU,o=MyO>, <cn=MyCN,ou=SubOU,ou=OU,o=MyO> syslog> slapd[11135]: conn=1 op=0 BIND dn="cn=MyCN,ou=SubOU,ou=OU,o=MyO" method=128 syslog> slapd[11135]: do_bind: version=3 dn="cn=MyCN,ou=SubOU,ou=OU,o=MyO" method=128 syslog> slapd[11135]: [rw] bindDN: "cn=MyCN,ou=SubOU,ou=OU,o=MyO" -> "cn=cn=MyCN,ou=SubOU,ou=OU,o=MyO,ou=SubOU,ou=OU,o=MyO" syslog> slapd[11135]: >>> dnPrettyNormal: <cn=cn=MyCN,ou=SubOU,ou=OU,o=MyO,ou=SubOU,ou=OU,o=MyO> syslog> slapd[11135]: <<< dnPrettyNormal: <cn=cn\3DMyCN,ou=SubOU,ou=OU,o=MyO,ou=SubOU,ou=OU,o=MyO>, <cn=cn\3DMyCN,ou=SubOU,ou=OU,o=MyO,ou=SubOU,ou=OU,o=MyO> So, why isn't rwm not used when supplying an invalid dn ? Regards, -G.-

3 2

OpenLDAP: contextCSN check across mirrors
by rahul.manchanda＠bt.com 10 May '10

10 May '10

Hello, I have configured three mirrors and am using a python script (ldapSynchCheck.py) which check the sync status on retrieving the contextCSN from both Provider and consumer I tried deleting a tree from directory and checked what is the output of the script and can still see "All of them are in sync". I believe this is happening because contextCSN is not getting updated on the respective directories and hence it will showing all in sync. However sometimes I am getting below error and it seems one of the consumer changed its contextCSN while provider was synching the data and it also confirms that provider will not change the contextCSN until it completes the sync to the consumer. 2010-05-06 15:15:51,459 - ldapSynchCheck.py - INFO - Provider is: tardis03.nat.bt.com:389 2010-05-06 15:15:51,462 - ldapSynchCheck.py - DEBUG - Connecting to ldap://tardis03.nat.bt.com:389 2010-05-06 15:15:51,464 - ldapSynchCheck.py - DEBUG - LDAP protocol version 3 2010-05-06 15:15:51,465 - ldapSynchCheck.py - DEBUG - Binding with o=BT 2010-05-06 15:15:51,469 - ldapSynchCheck.py - INFO - Checking if consumer tardis02.nat.bt.com:9011 is in SYNCH with provider 2010-05-06 15:15:51,470 - ldapSynchCheck.py - DEBUG - Connecting to ldap://tardis02.nat.bt.com:9011 2010-05-06 15:15:51,471 - ldapSynchCheck.py - DEBUG - LDAP protocol version 3 2010-05-06 15:15:51,472 - ldapSynchCheck.py - DEBUG - Binding with o=BT 2010-05-06 15:15:51,475 - ldapSynchCheck.py - DEBUG - Retrieving Provider contextCSN 2010-05-06 15:15:51,482 - ldapSynchCheck.py - DEBUG - contextCSN = 20100506141551.044268Z#000000#003#000000 2010-05-06 15:15:51,483 - ldapSynchCheck.py - DEBUG - Retrieving Consumer contextCSN 2010-05-06 15:15:51,513 - ldapSynchCheck.py - DEBUG - contextCSN = 20100506141551.044268Z#000000#003#000000 2010-05-06 15:15:51,515 - ldapSynchCheck.py - INFO - Provider and consumer exactly in SYNCH 2010-05-06 15:15:51,516 - ldapSynchCheck.py - INFO - Checking if consumer tardis01.nat.bt.com:9022 is in SYNCH with provider 2010-05-06 15:15:51,517 - ldapSynchCheck.py - DEBUG - Connecting to ldap://tardis01.nat.bt.com:9022 2010-05-06 15:15:51,519 - ldapSynchCheck.py - DEBUG - LDAP protocol version 3 2010-05-06 15:15:51,520 - ldapSynchCheck.py - DEBUG - Binding with o=BT 2010-05-06 15:15:51,523 - ldapSynchCheck.py - DEBUG - Retrieving Provider contextCSN 2010-05-06 15:15:51,525 - ldapSynchCheck.py - DEBUG - contextCSN = 20100506141551.044268Z#000000#003#000000 2010-05-06 15:15:51,526 - ldapSynchCheck.py - DEBUG - Retrieving Consumer contextCSN 2010-05-06 15:15:51,573 - ldapSynchCheck.py - DEBUG - contextCSN = 20100506141549.755004Z#000000#003#000000 <here it goes different> Traceback (most recent call last): File "./ldapSynchCheck.py", line 258, in <module> main() File "./ldapSynchCheck.py", line 253, in main is_insynch(ldapprov, ldapcons, options.basedn, options.threshold, logger) File "./ldapSynchCheck.py", line 188, in is_insynch delta = contextCSN_to_datetime(provcontextCSN) - contextCSN_to_datetime(conscontextCSN) File "./ldapSynchCheck.py", line 155, in contextCSN_to_datetime return datetime.datetime.fromtimestamp(time.mktime(time.strptime(gentime,"%Y%m% d%H%M%S"))) File "/software/python/lib/python2.6/_strptime.py", line 454, in _strptime_time return _strptime(data_string, format)[0] File "/software/python/lib/python2.6/_strptime.py", line 328, in _strptime data_string[found.end():]) ValueError: unconverted data remains: .044268 As I know putting a frequent checkpoint will generate a large amount of checkpoint log file and will cause issues while database recovery during crash/corrupt situations. Can someone please suggest how make this more precise? Is there any other way contextCSN keeps on changing frequently? Please suggest. Many Thanks in advance!! Rahul Manchanda GS Selfcare Platform Build Team Tel: +91 02066018100 Extn: 6178 SMTP: rahul.manchanda(a)bt.com Office: Sharda Center ,6th Floor Annex Off Karve Road, Erandwana ,Pune-04

4 6

Re: LDAP/PAM First time
by zoolook 10 May '10

10 May '10

2010/5/4 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, May 04, 2010 11:01 AM +0100 Rus Foster <vaserv(a)gmail.com> >> What have I missed? > > Use the correct -b option to ldapsearch. and/or configure /etc/ldap/ldap.conf or whatever your distro uses

1 0

Encrypting passwords
by Miha Krajnc 09 May '10

09 May '10

Greetings, some time ago i saw a command (i'm guessing from the ldap-utils package) that would encrypt text into one of the encryptions supported by openldap (md5, crypt etc...) anyone know what that command is? Thanks! -- Lep pozdrav, Miha Krajnc.

3 5

ldapmodify chando password
by Márcio Luciano Donada 07 May '10

07 May '10

Hi list, I'm using ldapmodify to change the user password, but I am not able to use the MD5 it. My question is, you can use the encryption method with the ldapmodify? thanks -- Márcio Luciano Donada <mdonada -at- auroraalimentos -dot- com -dot- br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

1 0

Re: bdb_index_read: failed
by Chris Jacobs 07 May '10

07 May '10

Ah, hah. I admit, I hadn't read that far back and made some ass/umptions. Doh. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: Howard Chu <hyc(a)symas.com> To: Chris Jacobs Cc: 'arwin(a)infopact.nl' <arwin(a)infopact.nl>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> Sent: Fri May 07 01:06:15 2010 Subject: Re: bdb_index_read: failed Chris Jacobs wrote: > This was all assuming that this was an established service - and if you've > simply taken over an admin role, this could have been going on for a while > and the final 'culprit' may simply be missing indexes. There is no missing index. The index is working correctly, it was simply asked to find a value that does not exist. There's nothing abnormal about that, there's nothing to fix. This whole thread is much ado about nothing. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Re: bdb_index_read: failed
by Chris Jacobs 07 May '10

07 May '10

I'd totally forgotten to reply-to-all: Arwin, You'd have to turn log levels up, and/or restrict usage to narrow that down (classic trouble shooting, to the rescue). Personally, I'd ask your staff to start with (devs and IT) and ask what's being done different, or if there are new users of LDAP. I can understand something being done that's 'new' or 'different' could very well be some snoop, but more likely the 'culprit' is going to be something 'ok'. Moving on... See when the events occur and (and perhaps who is authenticating)turn the log levels up during that time - that'll require a restart of slapd if your config is static files (now I really see the beauty of olconfig). Start with just logging auth, whether you find a link there or not, and if you need more detail, log the queries (shudder). Oh, and you'll need some 'spare' disk and cpu if this is a modestly used service. If you get to the latter part, you'll likely crush your box. And back again... Seriously, ask around. It'll likely be easier. This was all assuming that this was an established service - and if you've simply taken over an admin role, this could have been going on for a while and the final 'culprit' may simply be missing indexes. Good luck, - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: Howard Chu <hyc(a)symas.com> Cc: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Wed May 05 22:33:27 2010 Subject: Re: bdb_index_read: failed Thanks Howard, thats good news. However, I would like to know what or who is causing this. I've tried different loglevels but matchting the error with the query/filter that's causing it is rather challenging to say the least... Any hints on how to find the query responsible? Thanks! Arwin. Howard Chu schreef: > Arwin wrote: >> Hi all, >> >> We are running 1 master server and a couple of slaves, all >> openldap-2.4 on Ubuntu 8.04 lts, syncrepl >> and cn=config configuration. >> The last couple of days we are getting a few of the following errors >> in the slapd logs: >> >> Apr 29 11:03:41 ldapsrvr-1 slapd[6112]: bdb_idl_fetch_key: [b49d1940] >> Apr 29 11:03:41 ldapsrvr-1 slapd[6112]:<= bdb_index_read: failed (-30990) >> Apr 29 11:03:41 ldapsrvr-1 slapd[6112]:<= bdb_equality_candidates: >> id=0, first=0, last=0 >> Apr 29 11:03:41 ldapsrvr-1 slapd[6112]: => bdb_equality_candidates >> (objectClass) >> >> Tried solving it by re-adding the index and running slapindex but the >> errors still remain. >> >> Everything seems to work ok though, replication works, we can add/edit >> entries and user >> authentication of accounts in the dit work just fine. >> >> Can anybody tell me if this (bdb_index_read: failed (-30990)) is >> something that needs to be fixed >> and if so, how? > > No. It's normal, it just means it was looking for the index of a value > that doesn't exist in your DB. > This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Re: LDAP_SERVER_DOWN in win32?
by Chris Jacobs 07 May '10

07 May '10

Ummm... I suspect your machine's firewall (likely built in one from Windows) might be blocking it. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org To: openldap-technical(a)openldap.org Sent: Fri May 07 00:30:26 2010 Subject: LDAP_SERVER_DOWN in win32? I try to use openldap in windows xp. there is some implentations of openldap-win32-2.4.x. I have used every one of them, and openldap for linux in debian. the same problem is i can't connect them except the server is in localhost if my client run at win32, even i try to build my client in openldap, novel cldap and winldap. init is ok, bind is ok( i'm sure bind result should be >0 ,not LDAP_SUCCESS), but it report LDAP_SERVER_DOWN when i try to do some operations like search, add ... and the problem do not exist if I run my client(build with openldap or novell cldap) in linux(debian testing ), all server is ok. I try PHPLDAPAdmin and config it use openldap running at some window host, the problem is the same , LDAP_SERVER_DOWN. thanks for help gtalk:freeespeech@gmail.com<mailto:gtalk%3Afreeespeech@gmail.com> ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

LDAP_SERVER_DOWN in win32?
by owen nirvana 07 May '10

07 May '10

I try to use openldap in windows xp. there is some implentations of openldap-win32-2.4.x. I have used every one of them, and openldap for linux in debian. the same problem is i can't connect them except the server is in localhost if my client run at win32, even i try to build my client in openldap, novel cldap and winldap. init is ok, bind is ok( i'm sure bind result should be >0 ,not LDAP_SUCCESS), but it report LDAP_SERVER_DOWN when i try to do some operations like search, add ... and the problem do not exist if I run my client(build with openldap or novell cldap) in linux(debian testing ), all server is ok. I try PHPLDAPAdmin and config it use openldap running at some window host, the problem is the same , LDAP_SERVER_DOWN. thanks for help gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

1 0

testing bind result in slapi pluging
by Gianluigi Nigro 06 May '10

06 May '10

Hi, i'm writing a plugin for SLAPI_PLUGIN_POST_BIND_FN operation: int mia_init(Slapi_PBlock *pb) { ... ... If( slapi_pblock_set(pb, SLAPI_PLUGIN_POST_BIND_FN, (void *)mia_get) != 0) { slapi_log_error(SLAPI_LOG_PLUGIN, "mia_init", "error" ); return -1; } ... return 0; } int mia_get(Slapi_PBlock *pb) { ... int oprc = -1; ... if( slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &oprc) != 0 ) { If ( oprc == 0 ) Do something else Do something else } ... } The slapi_pblock_get for SLAPI_PLUGIN_OPRETURN always return 0 even if the bind operation is failed (for example following an error 49 Invalid Credentials ). Is there a way to test if the bind operation is successful or failed ? Tanks Gianluigi Nigro gianluigi.nigro(a)passepartout.sm <mailto:gianluigi.nigro@passepartout.sm> ------------------------------ Passepartout s.a. World Trade Center - Edificio A Via Consiglio dei Sessanta, 99 - 47891 Dogana - RSM tel. 0549 978011 fax 0549 978005 www.passepartout.net <http://www.passepartout.net> -------------------------------------------------------------------- Il contenuto di questo messaggio di posta elettronica e ogni eventuale documento a quest'ultimo allegato puo contenere informazioni la cui riservatezza e' tutelata ed e' rivolto unicamente agli effettivi destinatari i quali prendono atto del carattere non strettamente personale dei messaggi di risposta, che potranno essere noti all'organizzazione aziendale. Sono vietati la riproduzione e l'uso di questo messaggio in mancanza di autorizzazione del destinatario. Se avete ricevuto questo messaggio per errore, vogliate cortesemente chiamarci immediatamente per telefono o fax e distruggere quanto ricevuto (compresi i file allegati) senza farne copia. Qualsivoglia utilizzo non autorizzato del contenuto di questo messaggio costituisce violazione dell'obbligo di non prendere cognizione della corrispondenza tra altri soggetti.

1 0

bdb_index_read: failed
by Arwin 06 May '10

06 May '10

Hi all, We are running 1 master server and a couple of slaves, all openldap-2.4 on Ubuntu 8.04 lts, syncrepl and cn=config configuration. The last couple of days we are getting a few of the following errors in the slapd logs: Apr 29 11:03:41 ldapsrvr-1 slapd[6112]: bdb_idl_fetch_key: [b49d1940] Apr 29 11:03:41 ldapsrvr-1 slapd[6112]: <= bdb_index_read: failed (-30990) Apr 29 11:03:41 ldapsrvr-1 slapd[6112]: <= bdb_equality_candidates: id=0, first=0, last=0 Apr 29 11:03:41 ldapsrvr-1 slapd[6112]: => bdb_equality_candidates (objectClass) Tried solving it by re-adding the index and running slapindex but the errors still remain. Everything seems to work ok though, replication works, we can add/edit entries and user authentication of accounts in the dit work just fine. Can anybody tell me if this (bdb_index_read: failed (-30990)) is something that needs to be fixed and if so, how? T.i.a. Arwin.

2 2

cn=monitor attributes (monitorOpInitiated for example) missing in cn=Subschema
by mike 05 May '10

05 May '10

Hi Everyone, I am having an issue accessing attributes that are not in "cn=Subschema" I'm using openldap-stable-20100219.tgz build. When I look at cn=Monitor with browsing tools (like Softerra LDAP browser) I do see entries for monitorOpInitiated and monitorOpCompleted in DN cn=Operations,cn=Monitor. For example from a ldapsearch result: # Modify, Operations, Monitor dn: cn=Modify,cn=Operations,cn=Monitor structuralObjectClass: monitorOperation creatorsName: modifiersName: createTimestamp: 20100421205801Z modifyTimestamp: 20100421205801Z monitorOpInitiated: 39 monitorOpCompleted: 39 entryDN: cn=Modify,cn=Operations,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE When I look at cn=Subschema, I do not see any definitions of these two attributes. Shouldn't they be there? Using (unfortunately) Microsoft's VBScript, ADODB, and ADsDSOOBJECT to access to access cn=Monitor, I can access everything that is defined in the subschema (entryDN, modifyTimestamp, etc); however, I cannot access MonitorOpInitiated and such. Looking at the logs, It looks like the query never gets to the ldap server because MS checks it against the cn=subschema. I saw ITS#4947 and ITS#5576 which sounds like what my problem is (attributes not published). Is there a fix for this and what would that fix be? My OS for the ldap server is Redhat Enterprise 5.4. At the end of this email is my redacted slapd.conf file. I had sent this to the bugs mail-list, but they said to post it here. ---Thanks Mike Cannady [root@vmLDAPdev2 openldap]# cat slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/HTC/iaaa-radius.schema include /usr/local/etc/openldap/HTC/radius.schema include /usr/local/etc/openldap/HTC/users.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 loglevel 0x100 #loglevel any sizelimit unlimited # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org ServerID 002 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args access to * by dn.one="ou=replicants,ou=admin,dc=htc,dc=com" read by * break access to dn.subtree="dc=htc,dc=com" by dn.one="ou=admin,dc=htc,dc=com" manage by self write by anonymous auth access to * by self write by users read by anonymous auth ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=htc,dc=com" rootdn "cn=Manager,dc=htc,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {xxxxxxx}xxxxxxxxxxxxxxxxxxxxxxxxxx # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data cachesize 50000 dncachesize 50000 idlcachesize 150000 checkpoint 1024 5 # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq # Replicas of this database syncrepl rid=001 provider=ldap://vmldapdev1.htc.external:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=htc,dc=com" attrs="*,+" bindmethod=simple binddn="uid=vmldapdev2,ou=replicants,ou=admin,dc=htc,dc=com" credentials=atest2 mirrormode TRUE overlay syncprov syncprov-checkpoint 1000 1 database monitor [root@vmLDAPdev2 openldap]

2 1

slapo-memberof Usage
by Stuart Cherrington 05 May '10

05 May '10

Hello again, Having successfully upgraded my LDAP install to 2.4.22 on Redhat 5.3 I've been looking at use of the 'slapo-memberof' schema as provided by openldap2.4-server package. The man page for slapo-memberof2.4 indicates I can use the 'memberof-dn' directive. So, I've updated my slapd.conf file to allow the 'moduleload memberof.la' to be used and restarted ldap2.4 services. On the client I have configured my ldap.conf without the memberof directive and it works fine, but when I use memberof I can no longer login. nss_base_passwd ou=people,dc=ldn,dc=sw,dc=com Works fine nss_base_passwd ou=people,dc=ldn,dc=sw,dc=com?sub?memberof-dn=cn=access,ou=auth,dc=ldn,dc=sw,dc=com Fails to log me in. I can see the people and auth OU's from the client using ldapsearch. Questions: What is the correct syntax for using the memberof-dn directive? If the client does NOT have the openldap2.4-server package installed, does it pass the 'memberof-dn' directive to my LDAP server to be parsed? TIA, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/195013117/direct/01/ We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now

2 1

cross-compiling for different hardware
by Michael Pitcher 05 May '10

05 May '10

Is it possible to use OpenLDAP to cross-compile on a build(host) machine (e.g., little-endian) for a different target (big-endian)? If so, how? I have tried several ways to setup configure but no success. It looks like, for example, liblber generates the same objects (.lo) for the target and also (.o) for the build(host). Is this correct? Pointers, hints would be welcome. Thanks. -- Mike

1 0

OpenLDAP bespoke schema to use 'ismemberof' to restrict user access to hosts
by Stuart Cherrington 05 May '10

05 May '10

Hi, I sent this from my work email but its not appeared in the mailing list, am trying it from my hotmail acct to see if it's mroe successful. Newbie post, let me know if you need any other info, inside leg measurement, blood type etc. I wanted to restrict users to logging onto specific hosts, I.e. to keep developers away from Production hosts etc. I managed to do this on thread http://www.linuxquestions.org/questi...-users-789466/ using Sun's SDSCC. We're now migrating to OpenLDAP and I need the same functionality. I found the 'ismemberof' attribute does not appear to be part of the default schemas that come with Redhat 5.3 RPM's, Openldap is V 2.3.43. I found an interesting article at http://forums.devshed.com/ldap-progr...te-191444.html on how to create your own schema's. So I created a file called /etc/openldap/schema/memberof.schema and put in the following text: # The isMemberOf attribute associated with an entity is a # collection of values each of which identifies a group to # which that entity belongs. attributetype ( 1.3.6.1.4.1.5923.1.5.1.1 NAME 'isMemberOf' DESC 'identifiers for groups to which containing entity belongs' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) Then I added this schema to the slapd.conf and restarted ldap. In the client, I've used the same 'ismemberof' line from my previous thread, so it says: nss_base_passwd ou=people,dc=ldn,dc=sw,dc=com?sub?isMemberOf=cn=access,ou=auth,dc=ldn,dc=sw,dc=com Having tried MANY combination's of ?, ( and ) it won't work. So, can anyone comment on my schema, it right? is it complete sh!te? Does the nss_apsswd line need changing now I've moved to Openldap? Comments on a postcard please. BTW - I've been looking at LDAP books to cure my insomnia, and found http://www.amazon.co.uk/LDAP-Directo...2282151&sr=1-1. The books.google.com site had some useful pages from this book but the review on amazon is not great. TIA Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

4 6

LDAP/PAM First time
by Rus Foster 04 May '10

04 May '10

HI I'm taking my first steps into setting up an OpenLDAP/PAM setup and I've managed to get the server + client speaking but I think I might of screwed up my schemas or got myself very confused with some googling. Current setup Centos 5.x latest Server [root@host-95-154-194-53 tmp]# rpm -qa | grep -i openldap openldap-2.3.43-3.el5 openldap-clients-2.3.43-3.el5 openldap-servers-2.3.43-3.el5 [root@host-95-154-194-53 tmp]# cat /etc/openldap/slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema logfile /var/log/openldap allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by anonymous auth by self write by * read database bdb suffix "dc=damnvps,dc=com" rootdn "cn=Manager,dc=damnvps,dc=com" rootpw {SSHA}EcUcIEBYYT1VfVsHmbRsbLuGfctcZhUD directory /var/lib/ldap index objectClass eq Imported ldif's (***** designates next file break) File base.ldif dn: dc=damnvps,dc=com dc: damnvps objectClass: top objectClass: domain dn: ou=Hosts,dc=damnvps,dc=com ou: Hosts objectClass: top objectClass: organizationalUnit dn: ou=Rpc,dc=damnvps,dc=com ou: Rpc objectClass: top objectClass: organizationalUnit dn: ou=Services,dc=damnvps,dc=com ou: Services objectClass: top objectClass: organizationalUnit dn: nisMapName=netgroup.byuser,dc=damnvps,dc=com nismapname: netgroup.byuser objectClass: top objectClass: nisMap dn: ou=Mounts,dc=damnvps,dc=com ou: Mounts objectClass: top objectClass: organizationalUnit dn: ou=Networks,dc=damnvps,dc=com ou: Networks objectClass: top objectClass: organizationalUnit dn: ou=People,dc=damnvps,dc=com ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=damnvps,dc=com ou: Group objectClass: top objectClass: organizationalUnit dn: ou=Netgroup,dc=damnvps,dc=com ou: Netgroup objectClass: top objectClass: organizationalUnit dn: ou=Protocols,dc=damnvps,dc=com ou: Protocols objectClass: top objectClass: organizationalUnit dn: ou=Aliases,dc=damnvps,dc=com ou: Aliases objectClass: top objectClass: organizationalUnit dn: nisMapName=netgroup.byhost,dc=damnvps,dc=com nismapname: netgroup.byhost objectClass: top objectClass: nisMap ***** File group.ldif ***** dn: cn=rghf,ou=Group,dc=damnvps,dc=com objectClass: posixGroup objectClass: top cn: rghf userPassword: {crypt}x gidNumber: 500 ***** File passwd.ldif **** dn: uid=rghf,ou=People,dc=damnvps,dc=com uid: rghf cn: rghf objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$I6nmZtvf$tbQl9rwZ0qK01i.im9c5l0 shadowLastChange: 14733 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 500 homeDirectory: /home/rghf I imported them with ldapadd -D "cn=Manager,dc=damnvps,dc=com" -W -f /tmp/passwd.ldif-x ldapadd -D "cn=Manager,dc=damnvps,dc=com" -W -f /tmp/passwd.ldif -x ldapadd -D "cn=Manager,dc=damnvps,dc=com" -W -f /tmp/hosts.ldif -x However trying to pull out anything via ldapsearch gives root@host-95-154-194-53 tmp]# ldapsearch -x # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 What have I missed? thanks Rus

2 1

RE: RPM spec file
by Joe Friedeggs 04 May '10

04 May '10

> On 15/04/2010 16:38, Joe Friedeggs wrote: >> >> I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. > > The folks at LTB-project maintain RPMs for recent OpenLDAP releases. You > could either use their pre-built RPMs or grab their spec file from the > repository: > > http://ltb-project.org/wiki/documentation/openldap-rpm > > Jonathan I googled the HECK out of that rpm.......how did I miss the LBT :-( Thanks, Jonathan, that is just what I was looking for. And thanks to all others that provided input. Joe _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. http://clk.atdmt.com/GBL/go/196390706/direct/01/

3 3

Ldap authentication issue with PAM
by Indexer 03 May '10

03 May '10

I am currently trying to make a ldap server which i can use to authenticate users. Sadly a large number of how to's are incomplete and don't work, so after reading alot of how to's and manuals I have got 99.9% of the way. On attempting to authenticate a user it denies the user access with a error from auth.log May 4 02:21:08 nemo sshd[1271]: error: PAM: authentication error for william from 172.20.0.1 I can succesfully search the ldap with this user binding to the ldap ldapsearch -x -D "uid=william,ou=Admin,dc=chocolate,dc=lan" -W '(uid=william)' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=chocolate,dc=lan> (default) with scope subtree # filter: (uid=william) # requesting: ALL # # william, Admin, chocolate.lan dn: uid=william,ou=Admin,dc=chocolate,dc=lan uid: william cn: william objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: top loginShell: /bin/bash uidNumber: 10000 gidNumber: 10000 homeDirectory: /home/william userPassword:: e1NTSEF9Z3BQd05Lc3JUMWwxSVNhOVQvN1dPb3ZOcnVBSXJwVTE= gecos: William Brown,,,, description: William Brown shadowLastChange: 1 shadowMax: 0 shadowExpire: 0 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Slapd when trying to authenticate shows this. /usr/local/libexec/slapd -4 -d 256 slapd starting conn=0 fd=10 ACCEPT from IP=127.0.0.1:28629 (IP=0.0.0.0:389) conn=0 op=0 BIND dn="" method=128 conn=0 op=0 RESULT tag=97 err=0 text= connection_input: conn=0 deferring operation: binding conn=0 op=1 SRCH base="ou=Nemo,ou=Group,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixGroup))" conn=0 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=0 op=2 SRCH base="ou=Marvin,ou=Group,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixGroup))" conn=0 op=2 SRCH attr=cn userPassword memberUid uniqueMember gidNumber conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=0 fd=10 closed (connection lost) conn=1 fd=10 ACCEPT from IP=127.0.0.1:43475 (IP=0.0.0.0:389) conn=1 op=0 BIND dn="" method=128 conn=1 op=0 RESULT tag=97 err=0 text= connection_input: conn=1 deferring operation: binding conn=1 op=1 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" conn=1 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire <= bdb_equality_candidates: (uid) not indexed conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=2 fd=12 ACCEPT from IP=127.0.0.1:15318 (IP=0.0.0.0:389) conn=2 op=0 BIND dn="" method=128 conn=2 op=0 RESULT tag=97 err=0 text= connection_input: conn=2 deferring operation: binding conn=2 op=1 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire <= bdb_equality_candidates: (uid) not indexed conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=2 op=2 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" conn=2 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire <= bdb_equality_candidates: (uid) not indexed conn=2 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=2 fd=12 closed (connection lost) conn=3 fd=12 ACCEPT from IP=127.0.0.1:63485 (IP=0.0.0.0:389) conn=3 op=0 BIND dn="" method=128 conn=3 op=0 RESULT tag=97 err=0 text= connection_input: conn=3 deferring operation: binding conn=3 op=1 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" conn=3 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire <= bdb_equality_candidates: (uid) not indexed conn=3 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=3 op=2 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" conn=3 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire <= bdb_equality_candidates: (uid) not indexed conn=3 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=3 fd=12 closed (connection lost) conn=1 fd=10 closed (connection lost) Here is my /etc/ldap.conf base dc=chocolate,dc=lan suffix dc=chocolate,dc=lan uri ldap://ldap.srv.chocolate.lan ldap_version 3 rootbinddn cn=Manager,dc=chocolate,dc=lan scope one timelimit 3 bind_timelimit 3 bind_policy soft pam_filter objectclass=posixAccount pam_login_attribute uid pam_check_host_attr no pam_member_attribute memberuid pam_password exop nss_reconnect_tries 4 # number of times to double the sleep time nss_reconnect_sleeptime 1 # initial sleep value nss_reconnect_maxsleeptime 16 # max sleep value to cap at nss_reconnect_maxconntries 2 # how many tries before sleeping nss_base_passwd ou=Admin,dc=chocolate,dc=lan?one nss_base_passwd ou=People,dc=chocolate,dc=lan?one nss_base_shadow ou=Admin,dc=chocolate,dc=lan?one nss_base_shadow ou=People,dc=chocolate,dc=lan?one nss_base_group ou=Nemo,ou=Group,dc=chocolate,dc=lan?one nss_base_group ou=Marvin,ou=Group,dc=chocolate,dc=lan?one ssl off Here is /etc/openldap/slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/local/libexec/openldap moduleload back_bdb access to attrs=userPassword by dn="uid=william,ou=Admin,dc=chocolate,dc=lan" write by anonymous auth by self write by * none access to * by self write by users read database bdb suffix "dc=chocolate,dc=lan" rootdn "cn=Manager,dc=chocolate,dc=lan" rootpw {SSHA}pG0QHakwiNmJHXcyTB5H4RQtoDAGbEsm directory /var/db/openldap-data index objectClass eq index uid eq password-hash {SSHA} Here is the /etc/openldap/ldap.conf from both the client and server BASE dc=chocolate,dc=lan URI ldap://ldap.srv.chocolate.lan Any help with this would be greatly appreciated William

2 1

Re: RPM spec file
by Chris Jacobs 03 May '10

03 May '10

Side question: is there any difference between statically compiled in vs dynamic modules? I'm most concerned about performance vs flexibility of replacing modules. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: Joe Friedeggs <friedeggs44(a)hotmail.com> Cc: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Mon May 03 11:49:47 2010 Subject: Re: RPM spec file Le 03/05/2010 19:17, Joe Friedeggs a écrit : > > > >>> On 15/04/2010 16:38, Joe Friedeggs wrote: >>>> >>>> I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. >>> >>> The folks at LTB-project maintain RPMs for recent OpenLDAP releases. You >>> could either use their pre-built RPMs or grab their spec file from the >>> repository: >>> >>> http://ltb-project.org/wiki/documentation/openldap-rpm >>> >>> Jonathan >> > > I pulled down the openldap RPM from that site. It seems there are no modules included in the package (syncprov, rwm, ppolicy, etc.). Where would one obtain the modules that coincide with this package? According to the SPEC file, all overlays are compiled in : > ./configure --enable-ldap --enable-debug --prefix=%{ldapserverdir} --libdir=%{ldapserverdir}/%{_lib} --with-tls --with-cyrus-sasl --enable-spasswd --enable-overlays --enable-modules However, they are statically compiled in, not as dynamic modules in separate files, which is maybe what you're expecting? Jonathan -- -------------------------------------------------------------- Jonathan Clarke - jonathan(a)phillipoux.net -------------------------------------------------------------- Ldap Synchronization Connector (LSC) - http://lsc-project.org -------------------------------------------------------------- This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Group based automounting.
by Todd Smith 03 May '10

03 May '10

Hey all, We are attempting to provision our assets out based on group membership and I am trying to figure out a way to use openldap/automount (via the rfc2307 based schema) to do so. An example would be userX is part of groupY and groupY can automount nfsExport_1. In this scenario only members of groupY can see nfsExport1 when they login. I'm sure this is possible *somehow* I just haven't come across any information on the net that has given me the final key to solving this one. I am prominently interested in doing this with the rfc2307 schema however if it is only possible with the autofs schema I could use that as well. Many thanks for any input, Todd Smith Head of Information Technology soho vfx | T.O. 99 atlantic ave. suite 303 toronto ontario m6k 3j8 tel: 416.516.7863

1 0

openldap library and LDAP_OPT_X_KEEPALIVE_IDLE
by Fred MAISON 30 Apr '10

30 Apr '10

Hello, Could someone tell which openldap library version first included keepalive paches giving acces to following options : LDAP_OPT_X_KEEPALIVE_IDLE LDAP_OPT_X_KEEPALIVE_PROBES LDAP_OPT_X_KEEPALIVE_INTERVAL I have submitted a patch on freeradius for the rlm_ldap module for using those options to solve firewall/load-balancers LDAP session timeout by generation regular tcp keepalive packets ont LDAP sockets, and I see my current linux distros does not seems to have fresh-enough openldap library version to support this. debian squeeze libldap2-dev 2.4.17 CentOS 5.4 openldap-devel-2.3.43-3.el5 2.3.43 Best regards Fred MAISON

2 1

_ldap.so: undefined symbol: gnutls_alert_send
by Jean-Sébastien Mansart 29 Apr '10

29 Apr '10

Hi. I've got this error with a Zope/Plone site : Traceback (most recent call last): File "/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/Zope2/Startup/run.py", line 56, in ? run() File "/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/Zope2/Startup/run.py", line 21, in run starter.prepare() File "/home/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/Zope2/Startup/__init__.py", line 102, in prepare self.startZope() File "/home/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/Zope2/Startup/__init__.py", line 278, in startZope Zope2.startup() File "/home/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/Zope2/__init__.py", line 47, in startup _startup() File "/home/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/Zope2/App/startup.py", line 45, in startup OFS.Application.import_products() File "/home/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/OFS/Application.py", line 686, in import_products import_product(product_dir, product_name, raise_exc=debug_mode) File "/home/zope/z_sgec/Zope-2.10.11-final-py2.4/lib/python/OFS/Application.py", line 709, in import_product product=__import__(pname, global_dict, global_dict, silly) File "/home/zope/z_sgec/buildout-cache/eggs/Products.LDAPMultiPlugins-1.9-py2.4.egg/Products/LDAPMultiPlugins/__init__.py", line 22, in ? from Products.LDAPMultiPlugins.LDAPMultiPlugin import addLDAPMultiPluginForm File "/home/zope/z_sgec/buildout-cache/eggs/Products.LDAPMultiPlugins-1.9-py2.4.egg/Products/LDAPMultiPlugins/LDAPMultiPlugin.py", line 29, in ? from Products.LDAPUserFolder import manage_addLDAPUserFolder File "/home/zope/z_sgec/buildout-cache/eggs/Products.LDAPUserFolder-2.16-py2.4.egg/Products/LDAPUserFolder/__init__.py", line 20, in ? from Products.LDAPUserFolder.LDAPUserFolder import LDAPUserFolder File "/home/zope/z_sgec/buildout-cache/eggs/Products.LDAPUserFolder-2.16-py2.4.egg/Products/LDAPUserFolder/LDAPUserFolder.py", line 47, in ? from Products.LDAPUserFolder.LDAPDelegate import filter_format File "/home/zope/z_sgec/buildout-cache/eggs/Products.LDAPUserFolder-2.16-py2.4.egg/Products/LDAPUserFolder/LDAPDelegate.py", line 19, in ? import ldap File "/home/zope/z_sgec/buildout-cache/eggs/python_ldap-2.3.11-py2.4-linux-i686.egg/ldap/__init__.py", line 22, in ? from _ldap import * ImportError: /home/zope/z_sgec/buildout-cache/eggs/python_ldap-2.3.11-py2.4-linux-i686.egg/_ldap.so: undefined symbol: gnutls_alert_send I have install gnutls1.3, recompiled openldap, python-ldap, and so on, but nothing works. Anyone could help me ? Thanks. -- *Jean-Sébastien Mansart *- Développeur Web Email : jean-sebastien.mansart(a)bayard-service.com <mailto:jean-sebastien.mansart@bayard-service.com> Tel : 04 79 26 28 29 *Bayard Service Edition * Savoie Technolac - House Boat BP308 - 73377 Le Bourget du Lac Cedex www.bayardserviceweb.com <http://www.bayardserviceweb.com>

3 2

Slow problem after some time
by Marco Pizzoli 28 Apr '10

28 Apr '10

Hi list, I have a problem with my openldap 2.4.22 deployment. Today I upgraded my architecture from 2-way openldap2.4.20 to 3-way openldap.2.4.22, but I continue to have the same problem of slowlyness after some time my systems came up. One of them in particular but I'm aware of our balancing system heavily prefer this one. The symptom is that every search, even the same simple search executed repeteadly, cause a cpu-burst and will be served in a enormous time, sometimes 1m30s even after a cold start the same query is served in less than a second. My user database is accessed for linux, AIX, DB2 and Oracle authentication. I have repeatedly the same searches fired against my openldap instancies. I suspect to have a problem in the way I configured the memory to be allocated My data on the user_db are quite static, but I have an accesslog writing very much. Retaining 3 days of history, my db dir grow to about 11/12GB. I'm using 4 different disk (and scsi controller) for userdb, logdb, transactionlog and OS. Following information about my environment. I can send others if necessary. My user database is quite little: 1.5MB slapcat ldif database hdb suffix "dc=lancse,dc=csebo.it" rootdn "cn=Manager,dc=lancse,dc=csebo.it" rootpw {SSHA}mySecret directory /srv/ldap/db_utenti index cn eq index ou eq index objectClass eq index uid eq index gidNumber eq index uidNumber eq #index member pres,eq index memberUid eq index entryCSN eq index entryUUID eq index userPassword pres index uniqueMember eq limits dn="cn=Manager,dc=lancse,dc=csebo.it" size=unlimited # cachesize: numero di entry del db da tenere in cache. # Ad oggi (2010-04-20) nel database degli utenti ne abbiamo cachesize 2000000 # dncachesize: indica il numero di dn da tenere in memoria. # Il valore di 0 indica nessun limite #dncachesize 2000000 dncachesize 0 # idlcachesize: index-data-lookup cache. Indica il numero di slot dell'indice tenuti in memoria idlcachesize 2000000 # cachefree: indica quante entry alla volta liberare quando viene saturata cachefree 10 # checkpoint ogni 1MB di scritte eseguite e/o 30 minuti di tempo checkpoint 1024 30 [root@ldap01 db_utenti]# ls -lhtr *.bdb -rw------- 1 ldap ldap 44K Apr 26 18:09 uid.bdb -rw------- 1 ldap ldap 40K Apr 26 18:09 gidNumber.bdb -rw------- 1 ldap ldap 8.0K Apr 27 09:07 uniqueMember.bdb -rw------- 1 ldap ldap 28K Apr 27 12:32 uidNumber.bdb -rw------- 1 ldap ldap 40K Apr 27 12:32 ou.bdb -rw------- 1 ldap ldap 32K Apr 28 11:04 memberUid.bdb -rw------- 1 ldap ldap 36K Apr 28 16:14 userPassword.bdb -rw------- 1 ldap ldap 164K Apr 28 16:14 objectClass.bdb -rw------- 1 ldap ldap 72K Apr 28 16:14 entryUUID.bdb -rw------- 1 ldap ldap 260K Apr 28 16:14 dn2id.bdb -rw------- 1 ldap ldap 32K Apr 28 16:14 cn.bdb -rw------- 1 ldap ldap 64K Apr 28 17:34 entryCSN.bdb -rw------- 1 ldap ldap 2.0M Apr 28 17:39 id2entry.bdb The DB_CONFIG is this: # Uso 256MB di cache splittato in 2 file set_cachesize 0 268435456 2 # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 # IMPOSTO LA DIR DEI TLOGS IN UN FileSystem DEDICATO set_lg_dir logs # PARAMETRI DI TUNING DEI LOCK set_lk_max_objects 3000 set_lk_max_locks 3000 set_lk_max_lockers 3000 # IMPOSTO LA RIMOZIONE AUTOMATICA DEI LOG set_flags DB_LOG_AUTOREMOVE ------------------------------------------------------------------------------------- This is the accesslog db dir database hdb suffix "cn=log01,dc=csebo.it" rootdn "cn=Manager,cn=log01,dc=csebo.it" rootpw mySecret directory /srv/ldap/db_log index entryUUID eq index reqStart eq index reqEnd eq index objectClass eq index reqType eq index reqDN eq index reqAuthzID eq index reqEntries eq index reqAttr eq index reqResult eq index reqFilter pres,eq #index reqEntries eq #index reqSession eq #index reqResult eq #index reqScope eq #index reqDerefAliases eq #index reqAttrsOnly eq #index reqFilter eq,approx #index reqTimeLimit eq,approx #index reqSizeLimit eq,approx limits dn="cn=Manager,cn=log01,dc=csebo.it" size=unlimited # cachesize: numero di entry del db da tenere in cache. cachesize 150000 # dncachesize: indica il numero di dn da tenere in memoria. # Il valore di 0 indica nessun limite dncachesize 300000 # idlcachesize: index-data-lookup cache. Indica il numero di slot dell'indice tenuti in memoria # Per i backend bdb e' suggerito essere uguale a "cachesize" # Per i backend hdb e' suggerito essere uguale ad almeno 3 volte "cachesize" idlcachesize 450000 # cachefree: indica quante entry alla volta liberare quando viene saturata cachefree 10 # checkpoint ogni 4MB di scritte eseguite e/o 30 minuti di tempo checkpoint 4096 30 [root@ldap01 db_log]# ls -lhtr total 7.8G drwx------ 2 ldap ldap 16K Feb 26 11:54 lost+found lrwxrwxrwx 1 ldap ldap 26 Feb 26 12:11 logs -> ../transactionlogs/db_logs -rw-r--r-- 1 ldap ldap 1.3K Apr 28 17:40 DB_CONFIG -rw------- 1 ldap ldap 2.3M Apr 28 17:40 __db.004 -rw------- 1 ldap ldap 321M Apr 28 17:40 __db.003 -rw------- 1 ldap ldap 16M Apr 28 17:40 __db.002 -rw------- 1 ldap ldap 24K Apr 28 17:40 __db.001 -rw-r--r-- 1 ldap ldap 2.0K Apr 28 17:40 alock -rw------- 1 ldap ldap 32K Apr 28 17:40 __db.006 -rw------- 1 ldap ldap 2.5M Apr 28 17:40 __db.005 -rw------- 1 ldap ldap 1.3M Apr 28 18:27 reqEntries.bdb -rw------- 1 ldap ldap 21M Apr 28 18:27 reqFilter.bdb -rw------- 1 ldap ldap 12M Apr 28 18:27 reqAttr.bdb -rw------- 1 ldap ldap 1.7M Apr 28 18:27 reqType.bdb -rw------- 1 ldap ldap 106M Apr 28 18:27 reqStart.bdb -rw------- 1 ldap ldap 1.2M Apr 28 18:27 reqResult.bdb -rw------- 1 ldap ldap 105M Apr 28 18:27 reqEnd.bdb -rw------- 1 ldap ldap 6.3M Apr 28 18:27 reqDN.bdb -rw------- 1 ldap ldap 5.7M Apr 28 18:27 reqAuthzID.bdb -rw------- 1 ldap ldap 4.6M Apr 28 18:27 objectClass.bdb -rw------- 1 ldap ldap 6.0G Apr 28 18:27 id2entry.bdb -rw------- 1 ldap ldap 163M Apr 28 18:27 entryUUID.bdb -rw------- 1 ldap ldap 1.1G Apr 28 18:27 dn2id.bdb This is the DB_CONFIG file # one 0.25 GB cache set_cachesize 0 268435456 1 # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 # IMPOSTO LA DIR DEI TLOGS IN UN FileSystem DEDICATO set_lg_dir logs # Dimensione dei log --> 60MB set_lg_max 62914560 #set_lg_max 41943040 # PARAMETRI DI TUNING DEI LOCK set_lk_max_objects 3000 set_lk_max_locks 3000 set_lk_max_lockers 3000 My system has 15 GB of RAM. This is an example of my RAM situation when the problem arises [root@ldap01 db_log]# free -m total used free shared buffers cached Mem: 14799 8009 6790 0 924 3160 -/+ buffers/cache: 3924 10875 Swap: 6143 8 6135 top -H PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ SWAP DATA COMMAND 9008 ldap 25 0 4806m 3.8g 346m S 0.0 26.5 0:10.69 880m 4.0g slapd2.4 9151 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 0:11.23 880m 4.0g slapd2.4 9152 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:37.42 880m 4.0g slapd2.4 9153 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 3:20.29 880m 4.0g slapd2.4 9154 ldap 15 0 4806m 3.8g 346m S 0.3 26.5 3:02.49 880m 4.0g slapd2.4 9155 ldap 16 0 4806m 3.8g 346m S 0.0 26.5 2:23.49 880m 4.0g slapd2.4 9156 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:14.86 880m 4.0g slapd2.4 9157 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:44.86 880m 4.0g slapd2.4 9158 ldap 16 0 4806m 3.8g 346m S 0.0 26.5 2:03.71 880m 4.0g slapd2.4 9163 ldap 16 0 4806m 3.8g 346m S 0.0 26.5 2:06.05 880m 4.0g slapd2.4 9164 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:46.38 880m 4.0g slapd2.4 9165 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:25.31 880m 4.0g slapd2.4 9170 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:12.04 880m 4.0g slapd2.4 9171 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:17.15 880m 4.0g slapd2.4 9172 ldap 18 0 4806m 3.8g 346m R 98.1 26.5 2:06.54 880m 4.0g slapd2.4 9173 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:39.32 880m 4.0g slapd2.4 9174 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:25.64 880m 4.0g slapd2.4 9175 ldap 15 0 4806m 3.8g 346m S 0.0 26.5 2:33.29 880m 4.0g slapd2.4 With dstat I can see that I *don't* have disk reading, only writings due to the accesslog ---procs--- ------memory-usage----- ---paging-- -dsk/total- ---system-- ----total-cpu-usage---- ------memory-usage----- run blk new| used buff cach free| in out | read writ| int csw |usr sys idl wai hiq siq| used buff cach free 2 0 2|3932M 926M 3178M 6764M| 0 0 | 0 559k| 246 445 | 24 0 75 0 0 0|3932M 926M 3178M 6764M 1 0 0|3932M 926M 3178M 6764M| 0 0 | 0 464k| 200 333 | 24 0 76 0 0 0|3932M 926M 3178M 6764M 1 0 2|3933M 926M 3178M 6764M| 0 0 | 0 408k| 213 309 | 24 1 75 0 0 0|3933M 926M 3178M 6764M 3 0 0|3932M 926M 3178M 6764M| 0 0 | 0 420k| 205 280 | 23 0 75 1 0 0|3932M 926M 3178M 6764M 3 0 0|3932M 926M 3178M 6764M| 0 0 | 0 376k| 210 349 | 23 0 77 0 0 0|3932M 926M 3178M 6764M 1 0 0|3932M 926M 3178M 6764M| 0 0 | 0 900k| 233 373 | 24 0 75 0 0 0|3932M 926M 3178M 6764M 1 0 0|3932M 926M 3178M 6764M| 0 0 | 0 356k| 208 446 | 22 1 77 0 0 0|3932M 926M 3178M 6764M 1 0 0|3932M 926M 3178M 6764M| 0 0 | 0 440k| 213 389 | 22 0 76 1 0 0|3932M 926M 3178M 6764M 1 0 0|3932M 926M 3178M 6764M| 0 0 | 0 403k| 200 306 | 23 1 75 1 0 0|3932M 926M 3178M 6764M 3 0 4|3932M 926M 3178M 6764M| 0 0 | 0 648k| 196 365 | 24 1 74 1 0 0|3932M 926M 3178M 6764M 2 0 0|3932M 926M 3178M 6764M| 0 0 | 0 572k| 246 287 | 22 2 75 0 0 0|3932M 926M 3178M 6764M 1 0 2|3932M 926M 3179M 6763M| 0 0 | 0 552k| 197 256 | 25 1 73 1 0 0|3932M 926M 3179M 6763M 2 0 0|3932M 926M 3179M 6763M| 0 0 | 0 368k| 210 259 | 23 1 75 0 0 0|3932M 926M 3179M 6763M 2 0 0|3932M 926M 3179M 6763M| 0 0 | 0 4228k| 203 272 | 24 1 73 2 0 0|3932M 926M 3179M 6763M 2 0 0|3932M 926M 3179M 6763M| 0 0 | 0 440k| 218 346 | 23 1 76 0 0 0|3932M 926M 3179M 6763M 4 0 0|3932M 926M 3179M 6763M| 0 0 | 0 499k| 215 359 | 24 0 75 1 0 0|3932M 926M 3179M 6763M 2 0 0|3932M 926M 3179M 6763M| 0 0 | 0 348k| 215 313 | 25 0 74 1 0 0|3932M 926M 3179M 6763M 1 0 0|3932M 926M 3179M 6763M| 0 0 | 0 360k| 166 245 | 24 0 75 1 0 0|3932M 926M 3179M 6763M 2 0 7|3933M 926M 3179M 6762M| 0 0 | 0 432k| 225 393 | 25 3 71 0 0 0|3933M 926M 3179M 6762M 2 0 0|3933M 926M 3179M 6762M| 0 0 | 0 508k| 206 353 | 24 1 75 0 0 0|3933M 926M 3179M 6762M 1 0 2|3933M 926M 3179M 6762M| 0 0 | 0 716k| 254 342 | 25 1 75 0 0 0|3933M 926M 3179M 6762M 2 0 0|3933M 926M 3179M 6762M| 0 0 | 0 436k| 252 361 | 24 0 75 0 0 0|3933M 926M 3179M 6762M 1 0 0|3933M 926M 3179M 6762M| 0 0 | 0 456k| 226 359 | 24 0 75 1 0 0|3933M 926M 3179M 6762M I have also password_policy with forwarding of operational attributes and auditlog overlay. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

How to correctly escape search filters
by Jeremiah Martell 27 Apr '10

27 Apr '10

I've been trying to research how to correctly escape search filters, and I can't find any single reliable source that makes sense. I look at RFC 2253 (http://www.ietf.org/rfc/rfc2253.txt) section 2.4, and this IBM webpage ( http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/rzah… ), and they both seem to suggest that you need to escape (for example) the '+' sign. But when I escape a search filter like this: (&(objectclass=person)(facsimileTelephoneNumber=+1234)) to this: (&(objectclass=person)(facsimileTelephoneNumber=\+1234)) it results in a bad filter. My hunch is that perhaps DNs, attribute names, and attribute values are all escaped different. Is there a simple explanation online on how to escape search filters? Thanks, - Jeremiah

2 1

Re: openldap 2.4.21 - back-ldap + pcache ... backend binding
by repudi8or repu 27 Apr '10

27 Apr '10

On Tue, Apr 27, 2010 at 3:43 PM, repudi8or repu <repudi8or(a)gmail.com> wrote: > Thanks for the response Masarati, > > I have setup with mode=self, but still the same error. > > Maybe im having a conceptual issue here. What i am trying to do is ensure > the backend functions prior to looking at the configuring the frontend > correctly. I am configuring the solaris openldap slapd with back-ldap and > pcache and am expecting to be able to simulate a fronted authentication > process using ldapsearch to the solaris openldap proxy. The backend ldap > service is AD @ backendldap.core.dir.mycompany.com. the proxy box i will > refer to as openldapproxy (openldapproxy.core.dir.mycompany.com)" > > my database ldap section now looks like this :- > backendldap.core.dir.mycompany.com" > > database ldap > uri "ldap://backendldap.core.dir.mycompany.com" > suffix "ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com" > rootdn "dc=core,dc=dir,dc=mycompany,dc=com" > idassert-bind > bindmethod=simple binddn="cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" credentials="password" > mode=self > > i am testing by running ldapsearch on the openldapproxy host itself in the > following manner :- > # /usr/local/bin/ldapsearch -x -h localhost -b > ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com employeeID=12345678 > > the proxied bind goes out to the backend AD as i have shown in the below > discussion. The response returned is :- > # filter: employeeID=12345678 > # requesting: ALL > # > # search result > search: 2 > result: 48 Inappropriate authentication > # numResponses: 1 > > Running slapd in diag mode i see the following in the debug output :- > do_bind: v3 anonymous bind > connection_get(11) > connection_get(11): got connid=1014 > connection_read(11): checking for input on id=1014 > ber_get_next > ber_get_next: tag 0x30 len 105 contents: > op tag 0x63, time 1272346583 > ber_get_next > conn=1014 op=1 do_search > ber_scanf fmt ({miiiib) ber: > >>> dnPrettyNormal: > <ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com> > => ldap_bv2dn(ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com,0) > <= ldap_bv2dn(ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(ou=people,ou=eprofile,dc=core,dc=dir,dc=mycompany,dc=com)=0 > <<< dnPrettyNormal: > <ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com>, > <ou=people,ou=eprofile,dc=core,dc=dir,dc=mycompany,dc=com> > SRCH "ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com" 2 0 0 0 > 0 > ber_scanf fmt ({mm}) ber: > filter: (?=undefined) > ber_scanf fmt ({M}}) ber: > attrs: > ==> limits_get: conn=1014 op=1 self="[anonymous]" > this="ou=people,ou=eprofile,dc=core,dc=dir,dc=telstra,dc=com" > send_ldap_result: conn=1014 op=1 p=3 > send_ldap_result: err=48 matched="" text="" > send_ldap_response: msgid=2 tag=101 err=48 > Note the anonymous bind, I need this to be a simply authenticated bind > using the idassert binddn and credentials > Note the "self="[anonymous]"............... I was expecting that it should > have been self=[USERID_THAT_RAN_THE_LDAPSEARCH] > > Regards Rep > On Tue, Apr 27, 2010 at 1:55 PM, <masarati(a)aero.polimi.it> wrote: > >> > Hi Folks, >> > >> > I am having troubles configuring openladp to my requirements. >> > >> > I am setting up an openldap server running on solaris 10 x86 to use as >> > a ldap proxy authentication server. >> > >> > My issue is that i cant get it to send authenticated simple binds to the >> > backend ldap system. I am running wireshark and when i ldapsearch direct >> > to >> > the backend ldap i see a bind which looks like this :- >> > Lightweight-Directory-Access-Protocol >> > LDAPMessage bindRequest(1) >> > "cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" simple >> > messageID: 1 >> > protocolOp: bindRequest (0) >> > bindRequest >> > version: 3 >> > name: >> > cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com >> > authentication: simple (0) >> > simple: 384174656C73747261316732 >> > >> > However when i initiate an ldapsearch to my local solaris slapd and >> > capture >> > the proxied backldap bind to the backend ldap system it looks like this >> :- >> > Lightweight-Directory-Access-Protocol >> > LDAPMessage bindRequest(1) "<ROOT>" simple >> > messageID: 1 >> > protocolOp: bindRequest (0) >> > bindRequest >> > version: 3 >> > name: >> > authentication: simple (0) >> > simple: <MISSING> >> > >> > I am having trouble working out from the documentation if it should be >> > acl-bind or idassert-bind or some other option which influences the >> > backend >> > bind. I have tried both those to no avail. >> > Here is the "database ldap" section from my slapd.conf >> > >> > ####################################################################### >> > # ldap database definitions >> > ####################################################################### >> > database ldap >> > uri "ldap://backendldap.core.dir.mycompany.com" >> > suffix "ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com" >> > rootdn "dc=core,dc=dir,dc=mycompany,dc=com" >> > acl-bind bindmethod=simple >> > binddn="cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" >> > credentials="password" >> > idassert-bind bindmethod=simple >> > binddn="cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" >> > credentials="password" >> >> The relevant directive is "idassert-bind", since you appear to be looking >> for an identity assertion. I hope what you posted was screwed up by the >> mailer: continuation lines must start with whitespace. What is missing >> above is the "mode=self" parameter to "idassert-bind". Try something like >> >> idassert-bind bindmethod=simple >> binddn="cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" >> credentials="password" >> mode=self >> >> p. >> >> > overlay pcache >> > proxycache bdb 400 1 50 1200 >> > directory /var/openldap-data >> > cachesize 10000 >> > index cn,sn,uid pres,eq,sub >> > index objectclass eq >> > >> > proxycachequeries 400 >> > proxyattrset 0 uid mail cn sn givenName >> > proxytemplate (uid=) 0 600 >> > proxytemplate (mail=) 0 600 >> > proxytemplate (&(uid=)(mail=)) 0 600 >> > >> > Any help would be greatly appreciated >> > >> > Regards Rep >> > >> >> >> >

2 1

openldap 2.4.21 - back-ldap + pcache ... backend binding
by repudi8or repu 27 Apr '10

27 Apr '10

Hi Folks, I am having troubles configuring openladp to my requirements. I am setting up an openldap server running on solaris 10 x86 to use as a ldap proxy authentication server. My issue is that i cant get it to send authenticated simple binds to the backend ldap system. I am running wireshark and when i ldapsearch direct to the backend ldap i see a bind which looks like this :- Lightweight-Directory-Access-Protocol LDAPMessage bindRequest(1) "cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com authentication: simple (0) simple: 384174656C73747261316732 However when i initiate an ldapsearch to my local solaris slapd and capture the proxied backldap bind to the backend ldap system it looks like this :- Lightweight-Directory-Access-Protocol LDAPMessage bindRequest(1) "<ROOT>" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: authentication: simple (0) simple: <MISSING> I am having trouble working out from the documentation if it should be acl-bind or idassert-bind or some other option which influences the backend bind. I have tried both those to no avail. Here is the "database ldap" section from my slapd.conf ####################################################################### # ldap database definitions ####################################################################### database ldap uri "ldap://backendldap.core.dir.mycompany.com" suffix "ou=People,ou=eProfile,dc=core,dc=dir,dc=mycompany,dc=com" rootdn "dc=core,dc=dir,dc=mycompany,dc=com" acl-bind bindmethod=simple binddn="cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" credentials="password" idassert-bind bindmethod=simple binddn="cn=mybindid,cn=users,dc=core,dc=dir,dc=mycompany,dc=com" credentials="password" overlay pcache proxycache bdb 400 1 50 1200 directory /var/openldap-data cachesize 10000 index cn,sn,uid pres,eq,sub index objectclass eq proxycachequeries 400 proxyattrset 0 uid mail cn sn givenName proxytemplate (uid=) 0 600 proxytemplate (mail=) 0 600 proxytemplate (&(uid=)(mail=)) 0 600 Any help would be greatly appreciated Regards Rep

2 1

Schema-aware and OBSOLETE (was: (ITS#6151) Update cosine.schema to RFC 4524)
by Michael Ströder 26 Apr '10

26 Apr '10

Kurt, following-up on openldap-technical since this is off-topic in ITS#6151. Kurt Zeilenga wrote: > > On Apr 22, 2010, at 2:58 PM, Michael Ströder wrote: > >> Kurt Zeilenga wrote: >>> One additional note, I generally would advise that a schema-aware client >>> not alter it's update behavior of elements based upon whether said elements >>> are active or inactive (OBSOLETE) in the schema. >> >> I disagree especially for cases when new data is added. > > I think you're trying to make the client far smarter than it really ought > to be. This general statement is pretty blurry without speaking about certain use-cases. > If the clients configured to place say place element of data in attribute > x, it shouldn't try to put it elsewhere. It should fail. > While certainly one could design a client such as it could be configured > with fallbacks for attributes, and fallback for fallbacks, etc., this is an > unnecessarily complication IMO. Who said that my or any other client is doing anything like this in case of OBSOLETE schema elements? It would certainly be non-sense. The only thing I'm trying to achieve is to guide the user in the UI not to get frustrated by trial-and-error. > Also, note that were a client to attempt the above, it could still fail due > to an element being marked inactive between the time it read the schema and > the time it tried the DIT update. A client always have to implement proper error control even if the UI is guiding the user along the subschema information. >>> Instead, they should just >>> try the update and, if it fails, report it as they normally would. >> >> Modifying existing data I first have to think about... >> >>> Handling the inactive condition locally hides the error from the directory >>> administrator, who is likely relying on directory server logs to find >>> applications which using inactive schema. >> >> Hmm, that's not the case with a schema-aware client anyway which guides the >> user *not* to use OBSOLETE schema elements. > > I generally assume the user is not selecting which attribute to store some > piece of information into. I assume the client been programmed to collect > a piece of information and configured (or programmed) where to store it. With web2ldap it's a mix of both: One can pre-configure HTML templates per object class for input forms with which the web2ldap admin specifies the descriptive labels around an input field. With this you can hide which LDAP attribute the data is stored into. But the user can also switch to table and LDIF input fields (and back to tempating) when editing the data. In the template and table input forms I'd like to grey out input fields where the user's input would lead to a schema violation (OBSOLETE). E.g. it does not make sense to present OBSOLETE object classes in the object class select form when adding/modifying entries. It's similar to use slapo-allowed to only display editable input fields of attributes a user is allowed to write to. On the other hand web2ldap always trys to respect what's already present in the entries. The paradigm is to be minimal invasive: Don't change anything while modifying existing entries if the user did not explicitly change it. > The client you refer to is what I would call an application-neutral LDAP > directory administration tool. For such a tool, it might be reasonable to > warn the user (whose generally an "administrator" of some sort as opposed > to a "normal" user). Even such a tool can have customization. The categories are not that sharp... ;-) >> You're likely talking about >> detecting pre-configured applications with hard-coded use of OBSOLETE object >> classes and attribute types. >> Most times these are not schema-aware at all. > > Well, pre-configured applications may be schema-aware but maybe not as > fully as an LDAP directory administration tool might be. They might check > that the element they were configured to use is appropriate for that use by > examining its specification in the subschema. Yes, there are things like this in web2ldap too for certain use-cases (e.g. determining whether it works with MS AD while setting password attribute etc.). But I was especially interested in discussing what's appropriate in case of OBSOLETE schema descriptions. Ciao, Michael.

1 0

[Fwd: Support for ordering matching rules in extensible match filters?]
by deepee＠gmx.net 25 Apr '10

25 Apr '10

Hi, first of all, please excuse me if I've hit the wrong openldap mailinglist. My question below is related to section 4.1 of RFC4517 which says: Servers that implement the extensibleMatch filter SHOULD allow the matching rules listed in Section 4.2 to be used in the extensibleMatch filter and SHOULD allow matching rules to be used with all attribute types known to the server, where the assertion syntax of the matching rule is the same as the value syntax of the attribute. Could someone please explain to me why openldap currently doesn't support for example 'caseIgnoreOrderingMatch' (which is listed in section 4.2 of RFC4517) in extensible match filters? Of course I've seen the two SHOULDs above - I just don't understand the openldap related technical/design decision regarding the missing support and would be very happy if someone could please explain this to me. Another more common question but also related to my previous mail (below): could someone please also tell me the RFC(s) in which the evaluation of ordering matching rules (especially when used in extensible match filters) is specified? Thanks again! Betreff: Support for ordering matching rules in extensible match filters? Datum: Thu, 22 Apr 2010 11:18:35 +0200 Von: Daniel <deepee(a)gmx.net> An: openldap-technical(a)openldap.org Hi, why doesn't slapd support ordering matching rules in extensible match filters? Does the small code enhancement for slapd's generalizedTimeOrderingMatch() would make sense into the direction to support ordering matching in extensible filters (in this particular case)? Thanks a lot! static int generalizedTimeOrderingMatch( int *matchp, slap_mask_t flags, Syntax *syntax, MatchingRule *mr, struct berval *value, void *assertedValue ) { struct berval *asserted = (struct berval *) assertedValue; ber_len_t v_len = value->bv_len; ber_len_t av_len = asserted->bv_len; /* ignore trailing 'Z' when comparing */ int match = memcmp( value->bv_val, asserted->bv_val, (v_len < av_len ? v_len : av_len) - 1 ); Debug( LDAP_DEBUG_TRACE, "gTOM1: %s %s %d\n", value->bv_val, asserted->bv_val, match); if ( flags & SLAP_MR_EXT ) { Debug( LDAP_DEBUG_TRACE, "gTOM: MR => SLAP_MR_EXT (%ld) [%d %d]\n", flags, 0, 0); if ( match == -1 ) match = 0; else if ( match == 0 ) match = 1; } else { Debug( LDAP_DEBUG_TRACE, "gTOM: MR => ? (%ld) [%d %d]\n", flags, 0, 0); if ( match == 0 ) match = v_len - av_len; } Debug( LDAP_DEBUG_TRACE, "gTOM2: %s %s %d\n", value->bv_val, asserted->bv_val, match); *matchp = match; return LDAP_SUCCESS; }

2 2

N-Way Replication noob questions
by Siddhartha Jain 25 Apr '10

25 Apr '10

Hi, First, kudos to OpenLDAP team for the progress they have made with 2.4. I am returning to use OpenLDAP after nearly a decade and it is heartening to see all the new features even when going from 2.3 to 2.4 (As a side rant, it is painful to see Redhat/CentOS still ship 2.3.x. RedHat might do it to push their own DS over OpenLDAP but why CentOS)? 1. From the OpenLDAP guide, I see that replication is setup to replicate both - config and information trees. a. With each master having a unique "ServerID", does it mean that config replication won't overwrite certain attributes like ServerID? b. How are multiple "ServerID" values handled when the replication config is introduced? c. What about credentials used for rootDN of various databases? Do they get sync-ed too? 2. What is the best way to setup a new master with empty databases? Slapcat from an existing one and Slapdadd to the new one? Or, let replication take care of it? Network traffic issues aside, my point is how does timestamp matching work for non-existant objects (in the new master vs existing). Or, put differently, how is deletion vs new/empty database differentiated? Why wouldn't replication consider the non-existence of databases in the new master as all databases having been deleted? 3. From 18.2.2.3 of the Guide "Arguments against Multi-Master replication". 4. " If connectivity with a provider is lost because of a network partition, then "automatic failover" can just compound the problem" Care to expand on this, please? 5. " If a network is partitioned and multiple clients start writing to each of the "masters" then reconciliation will be a pain; it may be best to simply deny writes to the clients that are partitioned from the single provider" How so? If all masters are sync-ed with NTP tighly, then shouldn't this issue take care of itself when a partitioned master(s) comes back online and reconnect. Thanks, - Siddhartha

2 1

ppolicy in back_ldap?
by Tyler Gates 23 Apr '10

23 Apr '10

Hey guys, I currently have a multi-master system setup with a back_ldap proxying frontend. We are using ppolicy and it is loaded fine and works on the two masters but I'm experiencing a little weirdness on the proxy side. It works fine but when I implemented password expirations the other day I keep seeing messages on the proxy like: ppolicy_bind: Setting warning for password expiry for .... = 0 seconds These entries should not be receiving any warning messages and I know my settings are correct because if I redirect to one of the masters the log output is what I expect. Also, if I run a perl script that uses password policy controls and look for time_before_expiration, the value is always 0 on the proxy while it is not even set if pwdExpireWarning is not met or a sane value if it is on the masters. After reading slapo-ppolicy it looks like maybe I should be setting olcPPolicyForwardUpdates to TRUE (?) and set a olcupdateRef in olcDatabase={1}ldap,cn=config to both masters but it spits at me every time I try it. It also says a chain overlay should be set as well but when I read slapo-chain its says: "It is useless in conjunction with the slapd-ldap and slapd-meta backends because they already exploit the libldap specific referral chase feature." If I remove ppolicy overlay I don't see any of the values. I need the proxy to be able to see these attributes (as in those making queries to it) and not hammer my logs with incorrect messages. Is it possible to make this work, am I doing some wrong? Thanks for any help, Tyler -- Tyler Gates Systems Administrator Castle Branch Inc. 910-815-3880 ext 7230 tjgates(a)castlebranch.com This e-mail message, including any attachments, may contain private, confidential, and privileged information for the restricted use of the intended recipient(s). If you are not the intended recipient(s), you may NOT use, disclose, copy, or disseminate this information. Please notify the sender by return e-mail of this misdirected correspondence and destroy all copies of the original message including all attachments. Your cooperation is appreciated.

2 8

Syncrepl TLS certificate verification - configurable
by Siddhartha Jain 22 Apr '10

22 Apr '10

Hi, I have setup replication between two primary servers to use TLS. The config says: {0}rid=101 provider=ldap://pldap01.xyz.net binddn="cn=Manager,dc=xyz,dc=net" bindmethod=simple credentials=secret searchbase="dc=xyz,dc=net" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cert=/etc/openldap/cacerts/newcert.pem tls_cacert=/etc/openldap/cacerts/cacert.pem tls_key=/etc/openldap/cacerts/newreq.pem {1}rid=102 provider=ldap://pldap02.xyz.net binddn="cn=Manager,dc=xyz,dc=net" bindmethod=simple credentials=secret searchbase="dc=xyz,dc=net" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cert=/etc/openldap/cacerts/newcert.pem tls_cacert=/etc/openldap/cacerts/cacert.pem tls_key=/etc/openldap/cacerts/newreq.pem Replication works alright but logs show these lines on pldap01: Apr 22 03:47:20 pldap01 slapd[3451]: conn=1089 fd=22 TLS established tls_ssf=256 ssf=256 Apr 22 03:47:20 pldap01 slapd[3451]: slap_client_connect: URI=ldap://pldap02.xyz.net Warning, ldap_start_tls failed (-11) And, this on pldap02: Apr 22 03:47:40 pldap02 slapd[2564]: conn=1096 fd=26 TLS established tls_ssf=256 ssf=256 Apr 22 03:47:51 pldap02 slapd[2564]: slap_client_connect: URI=ldap://pldap01.xyz.net Warning, ldap_start_tls failed (-11) To be fair, the certificates are self-signed and don't match the DN but I am assuming that "starttls=yes" forces TLS and the consumers cannot default to plaintext. Right? If yes, does this mean that in syncrepl, tls use is hardcoded to verify certificates and fall back to non-verified TLS session if verification fails? Or, is this configurable meaning can I enforce verification (preferable in production)? Thanks, - Siddhartha

2 1

RE: Implementing LDAP logging
by rahul.manchanda＠bt.com 22 Apr '10

22 Apr '10

Adding to the below I didn't compiled the LDAP with --enable-debug during configuration time. Is that the reason it is not logging to the logfile I mentioned in the ldap configuration? This is the way I am specifying the logging info in the slapd.conf: loglevel sync stats logfile /opt/software/openldap2.4.19/etc/openldap/logs/ldaplog-primary.log Please suggest. Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4 From: Manchanda,RK,Rahul,DKE C Sent: Wednesday, April 21, 2010 3:03 PM To: openldap-technical(a)openldap.org Cc: Manchanda,RK,Rahul,DKE C Subject: Implementing LDAP logging Hi All, Even on specifying the loglevel and logfile directives in the slapd.conf ldap related logs are not being written to the file. However separate auditlog file is getting created successfully and all the update/delete/modify/insert operations are getting recorded successfully over there. I need to get the ldap related log file created as well but that is something not happening. Also tried specifying the LOCAL4 feature in the syslog.conf and restarted the system logging service but no luck with that as well. I don't want to put the logging options in the ldap start up command line argument but want the log file created from configuration itself. Can someone please suggest on this and also is there a way to implement log rotation for the ldap log file through configuration itself then that will be really helpful. Many Thanks in advance. Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4

2 4

Support for ordering matching rules in extensible match filters?
by Daniel 22 Apr '10

22 Apr '10

Hi, why doesn't slapd support ordering matching rules in extensible match filters? Does the small code enhancement for slapd's generalizedTimeOrderingMatch() would make sense into the direction to support ordering matching in extensible filters (in this particular case)? Thanks a lot! Cheers Daniel static int generalizedTimeOrderingMatch( int *matchp, slap_mask_t flags, Syntax *syntax, MatchingRule *mr, struct berval *value, void *assertedValue ) { struct berval *asserted = (struct berval *) assertedValue; ber_len_t v_len = value->bv_len; ber_len_t av_len = asserted->bv_len; /* ignore trailing 'Z' when comparing */ int match = memcmp( value->bv_val, asserted->bv_val, (v_len < av_len ? v_len : av_len) - 1 ); Debug( LDAP_DEBUG_TRACE, "gTOM1: %s %s %d\n", value->bv_val, asserted->bv_val, match); if ( flags & SLAP_MR_EXT ) { Debug( LDAP_DEBUG_TRACE, "gTOM: MR => SLAP_MR_EXT (%ld) [%d %d]\n", flags, 0, 0); if ( match == -1 ) match = 0; else if ( match == 0 ) match = 1; } else { Debug( LDAP_DEBUG_TRACE, "gTOM: MR => ? (%ld) [%d %d]\n", flags, 0, 0); if ( match == 0 ) match = v_len - av_len; } Debug( LDAP_DEBUG_TRACE, "gTOM2: %s %s %d\n", value->bv_val, asserted->bv_val, match); *matchp = match; return LDAP_SUCCESS; }

1 0

RE: Implementing LDAP logging
by rahul.manchanda＠bt.com 22 Apr '10

22 Apr '10

Hi All, Can someone please suggest on the below query? Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4 From: Manchanda,RK,Rahul,DKE C Sent: Wednesday, April 21, 2010 4:28 PM To: Manchanda,RK,Rahul,DKE C; 'openldap-technical(a)openldap.org' Subject: RE: Implementing LDAP logging Adding to the below I didn't compiled the LDAP with --enable-debug during configuration time. Is that the reason it is not logging to the logfile I mentioned in the ldap configuration? This is the way I am specifying the logging info in the slapd.conf: loglevel sync stats logfile /opt/software/openldap2.4.19/etc/openldap/logs/ldaplog-primary.log Please suggest. Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4 From: Manchanda,RK,Rahul,DKE C Sent: Wednesday, April 21, 2010 3:03 PM To: openldap-technical(a)openldap.org Cc: Manchanda,RK,Rahul,DKE C Subject: Implementing LDAP logging Hi All, Even on specifying the loglevel and logfile directives in the slapd.conf ldap related logs are not being written to the file. However separate auditlog file is getting created successfully and all the update/delete/modify/insert operations are getting recorded successfully over there. I need to get the ldap related log file created as well but that is something not happening. Also tried specifying the LOCAL4 feature in the syslog.conf and restarted the system logging service but no luck with that as well. I don't want to put the logging options in the ldap start up command line argument but want the log file created from configuration itself. Can someone please suggest on this and also is there a way to implement log rotation for the ldap log file through configuration itself then that will be really helpful. Many Thanks in advance. Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4

3 2

Help with objectClass and attribute definition.
by Techie 22 Apr '10

22 Apr '10

Hello, I am looking to add attributes containing server names to my ldap accounts. Does anyone know of an existing LDAP objectClass that will allow multiple attribute definitions that can be used for server names. For example.. objectClass: Servers sharebox: homeserver.example.com sharebox: dataserver.example.com I would really like to avoid creating my own objectClass and attribute definitions as I am sure some already exist. Thank you

2 3

Re: Re: OpenLDAP and SSH authentification
by Michel Dubois 22 Apr '10

22 Apr '10

It works since my last answer Thank you guys 2010/4/22 Michel Dubois <dubois.michel(a)gmail.com> > It works since my last answer > > Thank you guys > > 2010/4/22 Siddhartha Jain <sjain(a)silverspringnet.com> > > Michel, >> >> You did not specify what linux distro. That info will help. For example, >> on CentOS/RH, all you have to do to enable pam_ldap auth is " >> /usr/bin/authconfig --enableldapauth --update" >> >> Again, on RH/CentOS, this command changes /etc/pam.d/system-auth (linked >> to system-auth-ac). >> >> ------------ >> cat /etc/pam.d/system-auth >> #%PAM-1.0 >> # This file is auto-generated. >> # User changes will be destroyed the next time authconfig is run. >> auth required pam_env.so >> auth sufficient pam_unix.so nullok try_first_pass >> auth requisite pam_succeed_if.so uid >= 500 quiet >> auth sufficient pam_ldap.so use_first_pass >> auth required pam_deny.so >> >> account required pam_unix.so broken_shadow >> account sufficient pam_succeed_if.so uid < 500 quiet >> account [default=bad success=ok user_unknown=ignore] pam_ldap.so >> account required pam_permit.so >> >> password requisite pam_cracklib.so try_first_pass retry=3 >> password sufficient pam_unix.so md5 shadow nullok try_first_pass >> use_authtok >> password sufficient pam_ldap.so use_authtok >> password required pam_deny.so >> >> session optional pam_keyinit.so revoke >> session required pam_limits.so >> session optional pam_mkhomedir.so skel=/etc/skel/ umask=0022 >> session [success=1 default=ignore] pam_succeed_if.so service in crond >> quiet use_uid >> session required pam_unix.so >> session optional pam_ldap.so >> --------------- >> >> >> For local users (root and several others), you want to disable LDAP >> lookups. Otherwise, nss_ldap tries to look up these users in LDAP. Add this >> to your /etc/ldap.conf: >> "nss_initgroups_ignoreusers >> root,bin,daemon,adm,mail,ftp,nscd,vcsa,sshd,dbus,avahi,haldaemon,ntp,ldap,named,apache" >> >> Hope this helps. >> >> >> - Siddhartha >> >> >> >> >> From: openldap-technical-bounces+sjain=silverspringnet.com(a)openldap.org[mailto: >> openldap-technical-bounces+sjain <openldap-technical-bounces%2Bsjain>= >> silverspringnet.com(a)openldap.org] On Behalf Of Mackey, Theral >> Sent: Wednesday, April 21, 2010 10:05 AM >> To: openldap-technical(a)openldap.org >> Subject: RE: Re: OpenLDAP and SSH authentification >> >> You probably also want a line in the account section for pam_ldap.so. >> Im not as familiar with opie (know what it is, just havent used it much), >> but since it is set as requisite and before the ldap module, its possibly >> failing your auth stack if you don't have it setup properly. Test with it >> commented out using your ldap user, and again with ldap commented out using >> a local user. Make sure ldap is working by itself (and the same for opie) >> before laying other stuff on top of it. Consult the various pam-opie-ldap >> integration guides on the best way to get that working together. >> >> Since you have pam.d/common-*, those are likely the files you will want to >> edit rather than sshd. The sshd pam config file probably has a line that >> includes the common stack files, which should already have the basic stack >> in them, duplicating it in sshd will cause problems. >> >> (I assume this is a debian style system) Also check that your >> pam_ldap.conf is setup the same as libnss-ldap.conf, you can probably >> replace it with a symlink to libnss-ldap.conf. >> >> Don't use rootbinddn, use binddn or just comment them all out. rootbinddn >> gets its password from a file and expects to be the root/cn=Manager user of >> your directory. Its generally not needed for auth. The bindpw is the pw for >> binddn, which should be a user that can read user/group entries, and auth to >> userPassword. If your directory allows anonymous reads, you can comment both >> out and pam will work with anonymous binds. >> >> You can generally leave the nss_base_* mappings all commented out unless >> your directory is setup strangely, and you probably want pam_password set to >> exop so that ldap handles passwords internally rather than forcing a method >> (unless you have a reason for it (opie req?)). >> >> >> -T >> >> From: openldap-technical-bounces+tmackey=zetta.net(a)OpenLDAP.org [mailto: >> openldap-technical-bounces+tmackey <openldap-technical-bounces%2Btmackey> >> =zetta.net(a)OpenLDAP.org] On Behalf Of dubois.michel(a)gmail.com >> Sent: Wednesday, April 21, 2010 1:57 AM >> To: openldap-technical(a)openldap.org >> Subject: Re: Re: OpenLDAP and SSH authentification >> >> Thanks to all ......... >> >> I add this following in the /etc/libnss-ldap.conf on the server side : >> rootbinddn cn=proxyuser,dc=exemple,dc=org >> bindpw proxy >> pam_password MD5 >> nss_base_passwd ou=people,dc=exemple,dc=org?one >> nss_base_shadow ou=people,dc=exemple,dc=org?one >> nss_base_group ou=groups,dc=exemple,dc=org?one >> >> and I add this line in the /etc/pam.d/common-session file : >> session required pam_mkhomedir.so skel=/etc/skel/ >> >> for creating the home dir when the user is connecting for the first >> time... >> >> Thanks for your help anyway........... >> >> >> >> Le , Ariel <ariel(a)bidcactus.com> a écrit : >> > In your /etc/nsswitch.conf >> > >> > >> > Try changing to these lines: >> > >> > >> > passwd: files ldap >> > group: files ldap >> > shadow: files ldap >> > >> > >> > Also in pam.d/sshd password section try adding: >> > >> > >> > password sufficient pam_ldap.so >> > >> > >> > >> > >> > To make much of this easier you might want to install packages something >> like this for your distro: >> > libpam-ldap >> > libnss-ldap >> > ldap-auth-client >> > ldap-auth-config >> > >> > >> > Good luck. >> > -a >> > >> > >> > >> > >> > On Apr 20, 2010, at 3:15 AM, Michel Dubois wrote: >> > >> > Hello Everyone, >> > >> > I'm newbie on OpenLDAP. I build a LDAP server with one user. I can see >> this user when I did a "getent passwd" on my client. This is meaning that >> my LDAP server is working and my client is connecting on the LDAP server. >> > >> > I already modify my /etc/pam.d/sshd file on t my client machine like >> this : >> > >> > >> > # auth >> > auth required pam_nologin.so no_warn >> > auth sufficient pam_opie.so no_warn no_fake_prompts >> > auth requisite pam_opieaccess.so no_warn allow_local >> > auth sufficient /usr/local/lib/pam_ldap.so no_warn >> > auth required pam_unix.so no_warn try_first_pass >> > >> > # account >> > account required pam_login_access.so >> > account required pam_unix.so >> > >> > # session >> > session required pam_permit.so >> > >> > # password >> > password required pam_unix.so no_warn try_first_pass >> > >> > >> > >> > >> > >> > >> > >> > But I can't be connected in shh mode on my client machine with the user >> login ? And this modification disable my ssh root connection. >> > >> > What do I have to check? >> > Regards, >> > >> > -- >> > ----------------------------------------------------------- >> > Michel Dubois >> > >> > >> > >> > >> > >> > >> > >> > >> > > > > -- > ----------------------------------------------------------- > Michel Dubois > > -- ----------------------------------------------------------- Michel Dubois

1 0

Monitoring OpenLDAP Performance
by rahul.manchanda＠bt.com 22 Apr '10

22 Apr '10

Good Morning All, I need to capture the following stats for a serving LDAP. total_connections bytes_sent completed_operations initiated_operations referrals_sent entries_sent bind_operations unbind_operations add_operations delete_operations modify_operations compare_operations search_operations write_waiters read_waiters I have switched on the monitor mode on LDAP but not sure how can I get these statistics from that. Is there a way that I can capture these stats? Many Thanks in advance!! Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com

6 7

OpenLDAP and SSH authentification
by Michel Dubois 22 Apr '10

22 Apr '10

Hello Everyone, I'm newbie on OpenLDAP. I build a LDAP server with one user. I can see this user when I did a "getent passwd" on my client. This is meaning that my LDAP server is working and my client is connecting on the LDAP server. I already modify my */etc/pam.d/sshd file on t my client machine like this : * * # auth auth required pam_nologin.so no_warn auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth sufficient /usr/local/lib/pam_ldap.so no_warn auth required pam_unix.so no_warn try_first_pass # account account required pam_login_access.so account required pam_unix.so # session session required pam_permit.so # password password required pam_unix.so no_warn try_first_pass * But I can't be connected in shh mode on my client machine with the user login ? And this modification disable my ssh root connection. What do I have to check? Regards, -- ----------------------------------------------------------- Michel Dubois

5 4

Re: Using Replication Slave For Authentication
by Ariel 22 Apr '10

22 Apr '10

On Apr 20, 2010, at 1:50 PM, Sergiy Stepanenko wrote: > On 04/20/2010 10:49 AM, Ariel wrote: >> On Apr 20, 2010, at 12:20 PM, Sergiy Stepanenko wrote: >> >>> On 04/20/2010 06:12 AM, Ariel wrote: >>>> I have inherited an openldap server (2.4.9) and have set about to making it a bit more fault tolerant. So I have added a syncrepl slave and everything seems to work fine. It pulls down the whole ldap tree and stays in sync in real time with type=refreshAndPersist. I can use command line tools to very that it has all the information from the original master server using a command like this: >>>> >>>> ldapsearch -xLL -H ldaps://ldap2.domain.com/ -b "dc=domain,dc=com" -D "cn=admin,dc=domain,dc=com" -W >>>> >>>> My problem however is that when I try to authenticate users against the slave server, it does not work. All attempts fail. Also when I use ApacheDS (graphical LDAP browser) to view its contents, it only shows the Root DSE and none of the child objects like cn=config or any of the users or any of that. I can use ApacheDS fine to view and modify everything on the master server though. >>>> >>>> The slapd.conf config files between the two are exactly the same (except one is declared as sync master and one as slave), the password hashes are successfully replicated to the slave as I can see with ldapsearch, but I have no idea how to debug why it won't authenticate users. For reference, here is my syncrepl config section (in slapd.conf) on the slave: >>>> >>>> syncrepl rid=123 >>>> provider=ldaps://ldap1.domain.com:636 >>>> type=refreshAndPersist >>>> searchbase="dc=domain,dc=com" >>>> filter="(objectClass=*)" >>>> scope=sub >>>> schemachecking=off >>>> bindmethod=simple >>>> binddn="uid=syncuser,ou=People,dc=domain,dc=com" >>>> credentials=syncpassword >>>> >>>> and on the master server: >>>> >>>> moduleload syncprov.la >>>> overlay syncprov >>>> syncprov-checkpoint 100 10 >>>> syncprov-sessionlog 100 >>>> >>>> As a failover/backup server seems extremely prudent especially on the ancient hardware we have running these things, I really want to get this to work properly. Perhaps even later doing a round-robin style load balancing between the two or what have you. >>>> >>>> I have no idea how to debug this, any help would be greatly appreciated! >>>> >>>> -a >>>> >>> >>> Hi >>> >>> If you can show ACL on master and slave it will help to understand why you cannot auth users against slave. From what you described, it looks like slave has either access restriction to userPassword and base DN for users or access fails. I also never noticed any TLS certificates configuration mentioned. >>> >>> -- >>> Sergiy Stepanenko >>> Systems Administrator >>> Information Technology Services >>> University of Saskatchewan >>> ----------------------------------- >>> phone: (306) 966-2762 >>> email:sergiy.stepanenko@usask.ca >> >> >> Hey, thanks for the reply! I can only see the ACL on the slave using ldapsearch from CLI (every user I have tested has seen exactly only the information they are allowed), and all privileges seem to be in working order. >> >> When I use ApacheDS (or any other graphical client) using the same users, I only get the Root DSE which describes what Schema are loaded. Also, we do not use TLS, just ldaps protocol with simple authentication. All clients have `TLS_REQCERT allow` in their /etc/ldap/ldap.conf so a self signed ssl certificate on the server will work. >> > Make sure to use port 663 for SSL connection in ApacheDS, also check what bas DN is set up in Apache (Browser Options) >> Connecting and authenticating from ldapsearch works, but no other mechanisms will work. >> >> I'm probably missing something so simple it would make me cry. Perhaps I should set the loglevel to something ridiculously high and see what it says? > Try loglevel acl conns for starters and look at Apache search log. If it has been an error it would be there. >> >> -a > > Read log ldap or syslog where ever you point slapd output. I suspect that ldap appliances connect->bind->authenticate->access as self, but GUI clients fail to authenticate and resort in anonymous access level which normally looks like access to DSE entry only. > > -- > Sergiy Stepanenko > Systems Administrator > Information Technology Services > University of Saskatchewan > ----------------------------------- > phone: (306) 966-2762 > email:sergiy.stepanenko@usask.ca Putting loglevel to -1 (everything) and logging in with ApacheDS as cn=admin,dc=domain,dc=com (which is supposed to supersede any ACL rules and have read/write to everything I believe) I find a whole lot of "access granted" lines and then towards the end": => access_allowed: search access to "cn=config" "entry" requested => slap_access_allowed: backend default search access denied to "cn=admin,dc=domain,dc=com" => access_allowed: no more rules send_ldap_result: conn=0 op=8 p=3 send_ldap_result: err=32 matched="" text="" Error 32 means object doesn't exist (I think). Which would be true, our LDAP tree has no cn=config. We get the same error on the primary server, so I suppose it is ApacheDS trying to look for what would be in the Apache LDAP implementation. But that's the only error I can find, everything else is miles and miles of "search access granted". I tried to get it to list DN="dc=domain,dc=com" by hand from ApacheDS, and it would not return anything (it says "No base DN returned from server.") although in the logs it shows: conn=6 op=3 SRCH base="dc=domain,dc=com" scope=0 deref=3 filter="(objectClass=*)" conn=6 op=3 SRCH attr=hasSubordinates objectClass => hdb_search bdb_dn2entry("dc=domain,dc=com") => access_allowed: search access to "dc=domain,dc=com" "entry" requested <= root access granted access_allowed: search access granted by manage(=mwrscxd) base_candidates: base: "dc=domains,dc=com" (0x00000001) send_ldap_result: conn=6 op=3 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=4 tag=101 err=0 But when I run the ldapsearch command (as any user) from other computers on the network it returns the DN's information... So I am thoroughly confused... I am pretty sure it is not logging in as anonymous, but I have no idea why only the ldapsearch command is the only thing that can authenticate and retrieve information. It is the same version of openldap as the primary server, it has the same exact config, it has all the same schema loaded, it has the exact full ldap tree. I'm going to explode!@$#@ -a

2 5

RPM spec file
by Joe Friedeggs 21 Apr '10

21 Apr '10

I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. Thanks in advance, Joe _________________________________________________________________ The New Busy is not the too busy. Combine all your e-mail accounts with Hotmail. http://www.windowslive.com/campaign/thenewbusy?tile=multiaccount&ocid=PID28…

4 6

Outlook and Thunderbird Browsing Openldap
by Kalpin Erlangga Silaen 21 Apr '10

21 Apr '10

Hello all, I have install openldap on CentOS 5.4 (via yum). I want use this openldap for shared address book. I tested on thunderbird and outlook 2007 with results below: on thunderbird: 1. Compose new email, while I type some letter in field To: ; thunderbird can lookup into openldap content 2. In Addressbook menu, I can lookup the content after put some letter in search field and click search 3. in addressbook menu, while I click openldap addressbook, thunderbird can not browse or display all contents (my openldap content only 3 address book for test) basicly I do not have problem with thunderbird integration openldap on outlook 2007 1. Compose new email, while I type some letter in field To: ; outlook can not lookup into openldap content 2. In Addressbook menu, I can lookup the content after put some letter in search filend and click search. 3. In address book menu, while I click Openldap addressbook, outlook 2007 can not browse or display all contents (my openldap content only 3 address book for test). Is it possible to make outlook 2007 for below missions: 1. While compose new email, if I type some letter in field To: ; outlook 2007 supposed to lookup to openldap 2. In addressbook menu, if I click Openldap addressbook, suppose outlook 2007 display all content (limited in configuration) Any idea? Thank you notes: sorry for my english -- Regards, Kalpin Erlangga Silaen "Come now, and let us reason together," Says the LORD, "Though your sins are like scarlet, They shall be as white as snow; Though they are red like crimson, They shall be as wool. --- URL: http://www.kalpin.us YM: kalpinus(a)yahoo.com MSN: kalpinus(a)hotmail.com

3 3

Implementing LDAP logging
by rahul.manchanda＠bt.com 21 Apr '10

21 Apr '10

Hi All, Even on specifying the loglevel and logfile directives in the slapd.conf ldap related logs are not being written to the file. However separate auditlog file is getting created successfully and all the update/delete/modify/insert operations are getting recorded successfully over there. I need to get the ldap related log file created as well but that is something not happening. Also tried specifying the LOCAL4 feature in the syslog.conf and restarted the system logging service but no luck with that as well. I don't want to put the logging options in the ldap start up command line argument but want the log file created from configuration itself. Can someone please suggest on this and also is there a way to implement log rotation for the ldap log file through configuration itself then that will be really helpful. Many Thanks in advance. Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4

1 0

how to constructure ldap entry when user status is changed
by owen nirvana 21 Apr '10

21 Apr '10

I have some user information ( with certificate ) ,like cn = bob, dc= one, dc = two ,dc = org sn: .. userCertificate;binary::... .. : ... someday , if he would be revoked, should i move it to another entry ( replace a new dn ), like cn = bob, dc = crl ,dc = two ,dc = org or maybe I use the same entry , like cn = bob, dc= one, dc = two ,dc = org sn: .. userCertificate;binary::... .. : ... revoked : true/false revokeTime : ... gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

1 0

Using Replication Slave For Authentication
by Ariel 20 Apr '10

20 Apr '10

I have inherited an openldap server (2.4.9) and have set about to making it a bit more fault tolerant. So I have added a syncrepl slave and everything seems to work fine. It pulls down the whole ldap tree and stays in sync in real time with type=refreshAndPersist. I can use command line tools to very that it has all the information from the original master server using a command like this: ldapsearch -xLL -H ldaps://ldap2.domain.com/ -b "dc=domain,dc=com" -D "cn=admin,dc=domain,dc=com" -W My problem however is that when I try to authenticate users against the slave server, it does not work. All attempts fail. Also when I use ApacheDS (graphical LDAP browser) to view its contents, it only shows the Root DSE and none of the child objects like cn=config or any of the users or any of that. I can use ApacheDS fine to view and modify everything on the master server though. The slapd.conf config files between the two are exactly the same (except one is declared as sync master and one as slave), the password hashes are successfully replicated to the slave as I can see with ldapsearch, but I have no idea how to debug why it won't authenticate users. For reference, here is my syncrepl config section (in slapd.conf) on the slave: syncrepl rid=123 provider=ldaps://ldap1.domain.com:636 type=refreshAndPersist searchbase="dc=domain,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=syncuser,ou=People,dc=domain,dc=com" credentials=syncpassword and on the master server: moduleload syncprov.la overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 As a failover/backup server seems extremely prudent especially on the ancient hardware we have running these things, I really want to get this to work properly. Perhaps even later doing a round-robin style load balancing between the two or what have you. I have no idea how to debug this, any help would be greatly appreciated! -a

2 1

openLDAP architecture - centralized repository and authentication
by Marot Laurent 20 Apr '10

20 Apr '10

Hi all, I'm far from being openLDAP and more generally Linux advanced user but I'd love to be if I could find some architecture guidance for the following use case. (I've only been playing from time to time with openLDAP on Windows boxes - shame on me :)) I'm currently using 30 Linux server in my business unit. Almost 10 different sysadmin have to administer those servers. I'd like to have a centralized directory gartering all those 30 x 10 accounts so that I could have one single place du manage my identities. All my servers could then authenticate agains this directory. Could openLDAP and some adding tools provide me the right architecture to reach this goal ? Any pointer on this issue will please me ( Google only lead me to basical information about configuring openLDAP on standalone linux boxes) Thanks a lot LM

2 1

Samba and ldap failover - RH / Centos problem?
by Götz Reinicke - IT Koordinator 20 Apr '10

20 Apr '10

Hi folks, I recently got my ldap master slave samba test environment up and runing. samba-3.0.33-3.15.el5_4.1 openldap-2.3.43-3.el5 The ldap systems sync fine, samba users are authenticated by each server seperatly if I set tham in the samba conf. E.g. passdb backend = ldapsam:"ldap://ldap2.filmakademie.de" and passdb backend = ldapsam:"ldap://ldap1.filmakademie.de" work. passdb backend = ldapsam:"ldap://ldap1.filmakademie.de ldap://ldap2.filmakademie.de" works as long, as ldap1 is up. If ldap1 is down, no authentication / switchover to ldap2 is done. I've googled, looked up the samba wiki and finaly I found a posting Fedora 4 related to probems with an ldap_initialize() function ... So my question, are ther any known problems or what may I check/debug? Thanks and best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

Re: openLDAP architecture - centralized repository and authentication
by Francis, Steve (IHG) 20 Apr '10

20 Apr '10

OpenLdap will definitly provide that, as I'm using it for all my new linux instances Steve Francis IHG - z/OS- zLinux Technical Advisor Sent from my BlackBerry ________________________________ From: openldap-technical-bounces+steve.francis=ihg.com(a)OpenLDAP.org <openldap-technical-bounces+steve.francis=ihg.com(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Mon Apr 19 09:10:17 2010 Subject: openLDAP architecture - centralized repository and authentication Hi all, I’m far from being openLDAP and more generally Linux advanced user but I’d love to be if I could find some architecture guidance for the following use case. (I’ve only been playing from time to time with openLDAP on Windows boxes – shame on me J) I’m currently using 30 Linux server in my business unit. Almost 10 different sysadmin have to administer those servers. I’d like to have a centralized directory gartering all those 30 x 10 accounts so that I could have one single place du manage my identities. All my servers could then authenticate agains this directory. Could openLDAP and some adding tools provide me the right architecture to reach this goal ? Any pointer on this issue will please me ( Google only lead me to basical information about configuring openLDAP on standalone linux boxes) Thanks a lot LM

1 0

Restricting acces using host attribute
by Francis, Steve (IHG) 19 Apr '10

19 Apr '10

Greetings, I have a Ldap server up and running, all is well. However, I would like to start restricing access to hosts using the host attribute, which if I'm correct is part of the account objectClass. This is a SLES 10.3 system. The id that I migrated from /etc/passwd had the host attribute, but all other id's created later via the YAST gui interface, do not. I believe this is because they are using inetOrgPerson, instead of account. Is there some way of adding the host attribute to newly added users? Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

1 2

Basic ACL question...I think.
by Ken Kleiner 18 Apr '10

18 Apr '10

Hi, I'm new to ACL creation. We have a fully functional ldap server implementation that is working quite well for user auth. What I'm trying to do is set up my ldap server so that when a specific host binds using a particular DN, that host only sees specific entries in the ou=People tree, so that getent, id, nss, pam, etc only recognizes those users. Is this possible? I'm stumped. Thanks. Ken Kleiner System Manager University of Massachusetts Lowell Computer Science Department 978 934 3645

2 3

Adding Objectclass account gives object class violation
by Shamika Joshi 16 Apr '10

16 Apr '10

I'm using samba-openldap on Ubuntu 9.10 Server. I have created following user:rick using smbldap-tools which use default samba.schema.eg shown below. Now I also want to use "Host based authentication" using pam_filter where I need to mention host entry which has to be present in that user record. pam_filter |(host=cms2)(host=cms3) However "host" attribute appears only if I add "objectclass:account". If I go ahead to add that here for user:rick it gives me objectclass violation. What could be the way out of it? Any inputs would be highly appreciated cn: rick objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount sn: rick givenName: rick uid: rick uidNumber: 30003 gidNumber: 513 homeDirectory: /home/rick loginShell: /bin/bash gecos: System User sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 displayName: rick sambaAcctFlags: [UX] sambaSID: S-1-5-21-1045966857-3925637060-4258372004-61006 sambaPrimaryGroupSID: S-1-5-21-1045966857-3925637060-4258372004-513 sambaLogonScript: logon.bat sambaProfilePath: \\x6\profiles\rick sambaHomePath: \\x6\rick sambaHomeDrive: H: sambaLMPassword: 01FC5A6BE7BC6929AAD3B435B51404EE sambaNTPassword: 0CB6948805F797BF2A82807973B89537 sambaPwdLastSet: 1271227877 userPassword: test Thanks Shamika

6 17

Re: RPM spec file
by Chris Jacobs 16 Apr '10

16 Apr '10

Be careful - it didn't do what I wanted (like 64 bit). And on top of that, none of the tools were in the default paths. - chris PS: I only found that after tons of googling too. Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: jonathan(a)openldap.org <jonathan(a)openldap.org> Cc: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Thu Apr 15 19:20:16 2010 Subject: RE: RPM spec file > On 15/04/2010 16:38, Joe Friedeggs wrote: >> >> I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. > > The folks at LTB-project maintain RPMs for recent OpenLDAP releases. You > could either use their pre-built RPMs or grab their spec file from the > repository: > > http://ltb-project.org/wiki/documentation/openldap-rpm > > Jonathan I googled the HECK out of that rpm.......how did I miss the LBT :-( Thanks, Jonathan, that is just what I was looking for. And thanks to all others that provided input. Joe _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. http://clk.atdmt.com/GBL/go/196390706/direct/01/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Re: Slapd-ldap proxy between replica and mirror
by masarati＠aero.polimi.it 15 Apr '10

15 Apr '10

>> Hi, >> >> We have a similar scenario that the one explained in the post of Javier >> Manteiga: >> http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/200907/msg… >> >> We have deployed two servers: a master and a replica (delta-syncrepl). >> We >> added the chaining configuration that appears in openldap 2.4 >> administrator's guide (12.3.2) to handle the modifications originated >> from >> the replica. >> >> Replica slapd.conf: >> >> ##################### >> # Chaining configuration # >> ##################### >> overlay chain >> chain-uri "ldap://192.168.1.10:389" >> chain-idassert-bind bindmethod="simple" >> binddn="cn=replicator,dc=example,dc=com" >> credentials="secret" >> mode="self" >> chain-return-error TRUE >> >> ########## >> # Replica # >> ########## >> database bdb >> suffix "dc=example,dc=com" >> rootdn "cn=Administrator,dc=example,dc=com" >> rootpw "secret" >> .... >> ################## >> # Syncrepl directives # >> ################## >> syncrepl rid=001 >> provider=ldap://192.168.1.10:389 >> type=refreshAndPersist >> retry="60 +" >> searchbase="dc=example,dc=com" >> filter="(objectclass=*)" >> scope=sub >> attrs="*" >> schemachecking=on >> binddn="cn=replicator,dc=example,dc=com" >> bindmethod=simple >> credentials=secret >> sizelimit=unlimited >> logbase="cn=accesslog" >> logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" >> syncdata=accesslog >> >> # Refer updates to the master >> updateref ldap://192.168.1.10:389 >> >> The problem appears when we change the single master for a mirrormode >> configuration (administrator guide 18.3.4.1). In addition, we set up a >> back-ldap proxy between mirror and replica. >> >> back-ldap proxy slapd.conf: >> >> ######## >> # Proxy # >> ######## >> database ldap >> suffix "dc=example,dc=com" >> rootdn "cn=slapd-ldap" >> >> uri "ldap://192.168.1.20:389 ldap://192.168.1.30:389" >> >> >> The IP addresses are: >> 192.168.1.10 -> Back-ldap proxy >> 192.168.1.20 -> Mirror mode server 1 >> 192.168.1.30 -> Mirror mode server 2 >> >> >> When we try to modify the password through the replica, we get the >> following >> messages in the server where is located the proxy: >> >> ldap-proxy[13175]: daemon: activity on 1 descriptor >> ldap-proxy[13175]: daemon: activity on: >> ldap-proxy[13175]: 12r >> ldap-proxy[13175]: >> ldap-proxy[13175]: daemon: read active on 12 >> ldap-proxy[13175]: daemon: epoll: listen=7 active_threads=0 tvp=NULL >> ldap-proxy[13175]: connection_get(12) >> ldap-proxy[13175]: connection_get(12): got connid=1002 >> ldap-proxy[13175]: connection_read(12): checking for input on id=1002 >> ldap-proxy[13175]: op tag 0x66, time 1270632398 >> ldap-proxy[13175]: conn=1002 op=2 do_modify >> ldap-proxy[13175]: conn=1002 op=2 do_modify: dn >> (uid=user,ou=people,dc=example,dc=com) >> ldap-proxy[13175]: => get_ctrls >> ldap-proxy[13175]: => get_ctrls: oid="2.16.840.1.113730.3.4.18" >> (noncritical) >> ldap-proxy[13175]: parseProxyAuthz: conn 1002 >> authzid="dn:uid=user,ou=people,dc=example,dc=com" >> ldap-proxy[13175]: slap_sasl_getdn: conn 1002 >> id=dn:uid=user,ou=people,dc=example,dc=com [len=38] >> ldap-proxy[13175]: >>> dnNormalize: >> <uid=user,ou=people,dc=example,dc=com> >> ldap-proxy[13175]: <<< dnNormalize: >> <uid=user,ou=people,dc=example,dc=com> >> ldap-proxy[13175]: ==>slap_sasl2dn: converting SASL name >> uid=user,ou=people,dc=example,dc=com to a DN >> ldap-proxy[13175]: <==slap_sasl2dn: Converted SASL name to <nothing> >> ldap-proxy[13175]: parseProxyAuthz: conn=1002 >> "uid=user,ou=people,dc=example,dc=com" >> ldap-proxy[13175]: ==>slap_sasl_authorized: can >> cn=replicator,dc=example,dc=com become >> uid=user,ou=people,dc=example,dc=com? >> ldap-proxy[13175]: <== slap_sasl_authorized: return 48 >> ldap-proxy[13175]: <= get_ctrls: n=1 rc=123 err="not authorized to >> assume >> identity" >> ldap-proxy[13175]: send_ldap_result: conn=1002 op=2 p=3 >> ldap-proxy[13175]: send_ldap_result: err=123 matched="" text="not >> authorized >> to assume identity" >> ldap-proxy[13175]: send_ldap_response: msgid=3 tag=103 err=123 >> ldap-proxy[13175]: conn=1002 op=2 RESULT tag=103 err=123 text=not >> authorized >> to assume identity >> ldap-proxy[13175]: conn=1002 op=2 do_modify: get_ctrls failed >> ldap-proxy[13175]: daemon: activity on 1 descriptor >> ldap-proxy[13175]: daemon: activity on: >> >> The authorization is denied for cn=replicator,dc=example,dc=com. > > The error looks self-explanatory: the identity > "cn=replicator,dc=example,dc=com" is not authorized to assume the identity > of the client that attempted the write. The failure appears to happen in > slap_sasl2dn(), where the user's DN is converted to <nothing> (the > "mapping" fails). It is not clear why it fails. Sorry, I take the last sentence back: mapping a DN to nothing means there was nothing to map. The failure is just later, where (pretty self-explanatory): ldap-proxy[13175]: ==>slap_sasl_authorized: can cn=replicator,dc=example,dc=com become uid=user,ou=people,dc=example,dc=com? ldap-proxy[13175]: <== slap_sasl_authorized: return 48 ldap-proxy[13175]: <= get_ctrls: n=1 rc=123 err="not authorized to assume identity" the entry "cn=replicator,dc=example,dc=com" does not have the right to assume the identity of "uid=user,ou=people,dc=example,dc=com". > You probably do not show > enough of your master and replica slapd.conf. This is correct. Also, the error may depend on the value of the authzTo/authzFrom attributes of the identities involved in the mapping. As clearly stated in slapd-ldap man page about idassert: [snip] Other identity assertion modes are anonymous and self, which respectively mean that the empty or the client’s identity will be asserted; [snip] For all modes that require the use of the proxyAuthz control, on the remote server the proxy identity must have appropriate authzTo permissions, or the asserted identities must have appropriate authzFrom permissions. p.

2 3

serviceSearchDescriptor problem.
by Miha Krajnc 15 Apr '10

15 Apr '10

Hey, I'm having a problem setting up an openLDAP database. I've installed it, configured it (that took a while, OpenLDAP should realy supply a script to do it manualy) and set my server to use it for authentication (as well as the /etc/passwd file). But now i want to configure the server to work with the sudoers file so users can use the "sudo" command. Here is where i'm having problems. I folowed this guide: http://georgia.ubuntuforums.org/showthread.php?p=9121830 <http://georgia.ubuntuforums.org/showthread.php?p=9121830#post9121830>And i came to the part where i need to insert this code into the database with ldapadd: dn: ou=SUDOers,dc=prvi-dijak,dc=si objectClass: top objectClass: organizationalUnit ou: SUDOers serviceSearchDescriptor: sudoers: ou=sudoers,dc=example,dc=com But here is where i run into a problem. The server always gives out an error, like this: ldapadd -f sudoWork/sudoMaster.ldif -h 127.0.0.1 -D cn=admin,dc=prvi-dijak,dc=si -W -x Enter LDAP Password: adding new entry "ou=SUDOers,dc=prvi-dijak,dc=si" ldap_add: Undefined attribute type (17) additional info: serviceSearchDescriptor: attribute type undefined And i have no idea why. I also tried to do it manualy. I added the organizationalUnit with "phpLDAPadmin" but i can not find the serviceSearchDescriptor attribute anywhere. Could you advise me on how to fix this problem? -- Good day, Miha Krajnc.

2 2

Facing ldap_sasl_bind_s failed (-1) error for N-way Multimaster ldap replication
by Shamika Joshi 15 Apr '10

15 Apr '10

I'm seeing following erros in syslog after I was done with N-way Multimaster ldap replication. I following these links exactly to configure my master & slave servers http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master https://help.ubuntu.com/9.10/serverguide/C/openldap-server.html Apr 15 00:28:08 x6 slapd[5783]: slap_client_connect: URI=ldap:// x6.testlab.com DN="cn=admin,cn=config" ldap_sasl_bind_s failed (49) Apr 15 00:28:08 x6 slapd[5783]: do_syncrepl: rid=001 rc 49 retrying (1 retries left) Apr 15 00:28:08 x6 slapd[5783]: slap_client_connect: URI=ldap:// x6slave.testlab.com DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) Apr 15 00:28:08 x6 slapd[5783]: do_syncrepl: rid=002 rc -1 retrying (1 retries left) While troubleshooting ldap_sasl_bind_s failed (-1) error in my syslog for ldap replication, I have also ended adding wrong olcSyncrepl entries as shown in snapshot below. How should I go about removing these entries from my cn=config? Could anyone give me an example? Thanks Shamika dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {CRYPT}7hzU8RaZxaGi2 olcSyncrepl: {0}rid=001 provider=ldap://x6.testlab.combinddn="cn=admin,cn=con fig" bindmethod=simple credentials=1234 searchbase="cn=config" type=refreshAn dPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://x6slave.testlab.combinddn="cn=admin,c n=config" bindmethod=simple credentials=1234 searchbase="cn=config" type=refr eshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {2}rid=001 provider=ldap://x6.testlab.combinddn="cn=admin,dc=tes <==== tlab,dc=com" bindmethod=simple credentials=secret searchbase="cn=config" type =refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {3}rid=002 provider=ldap://ldap02.example.combinddn="cn=admin,dc <==== =testlab,dc=com" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {4}rid=001 provider=ldap://x6.testlab.combinddn="cn=admin,cn=con <==== fig" bindmethod=simple credentials=secret searchbase="cn=config" type=refresh AndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {5}rid=002 provider=ldap://x6slave.testlab.combinddn="cn=admin,c <==== n=config" bindmethod=simple credentials=secret searchbase="cn=config" type=re freshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config <==== objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov dn: olcOverlay={2}syncprov,olcDatabase={0}config,cn=config <==== objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {2}syncprov dn: olcOverlay={3}syncprov,olcDatabase={0}config,cn=config<==== objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {3}syncprov dn: olcOverlay={4}syncprov,olcDatabase={0}config,cn=config<==== objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {4}syncprov dn: olcOverlay={5}syncprov,olcDatabase={0}config,cn=config<==== objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {5}syncprov

1 0

OpenLDAP Data Directory issue
by rahul.manchanda＠bt.com 14 Apr '10

14 Apr '10

Hello, For a running LDAP if I delete the data directory still the LDAP is responding to reads and writes without giving any error. All logins in related to application are working fine. Is this picking the data from cache or actual data itself is getting stored somewhere. Can someone please provide his/her technical expertise on this behavior? Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4

3 3

Sincronizing two different structred trees
by Rodrigo Renie Braga 14 Apr '10

14 Apr '10

Hello list. I was wondering if it's possible to sincronize, using chaining or syncrepl, two different structured OpenLDAP servers, actually, both servers are equal on a specific sub-tree and it's that specific subtree that I'd like to sincronize. Something like: Server A dc=example,dc=com | | - ou=users | | - ou=company Server B dc=other,dc=org | | - ou=people | | - ou=company It's both "company" subtrees that i'd like to sinc... Is it possible? Thanks in advance...

2 2

SASL EXTERNAL, sasldb2 and authz-regexp
by Götz Reinicke - IT-Koordinator 14 Apr '10

14 Apr '10

Hi folks, first of all thanks to all comments about my previous posts! Finaly I'm faced with hopefully the last authentication problem and may be somewone could tell me an answere or point me once more into the right direction. My consumer server should bind to the provider using sasl with the saslmech external. (Red Hat 5.x, cyrus-sasl-2.1.22, openldap-2.3.43-3 ) I'v changed the slapd.conf files on both servers: consumer: syncrepl ... bindmethod=sasl saslmech=EXTERNAL starttls=yes provider: authz-regexp "dn=email=webmaster(a)filmakademie.de,cn=ldap2.filmakademie.de,ou=it officenet,o=filmakademie baden-wuerttemberg gmbh,l=ludwigbsburg,st=baden-wuerttemberg,c=de" "cn=replicator,dc=filmakademie,dc=de" after restarting both servers I do get the error: <==slap_sasl2dn: Converted SASL name to <nothing> SASL [conn=0] Error: unable to open Berkeley db /etc/sasldb2: No such file or directory I've searched my docs, online howtoos and found postings about "know sasl before using openldap" but the sasl docs didn't help too. Thanks for any help and best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

3 4

Re: Problem with SSL/TLS
by Chris Jacobs 13 Apr '10

13 Apr '10

/etc/ldap.conf is used by nss tools and the ilk. /etc/openldap/ldap.conf would be used by openldap tools - like ldapsearch. I have the same setting there for tls_checkpeer - but in the latter ldap.conf (under openldap). FWIW: there's apparently no real different format for the two files; while one would only be setup on ldap servers, mine are identical and things work with a mirror master, both setup behind a VIP (fail over, not load balanced) and a plethora of slaves in different subdomains. - chris PS: I'd forgotten to 'reply-to-all' earlier. :) Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: Lynn York To: Chris Jacobs Sent: Mon Apr 12 10:29:19 2010 Subject: RE: Problem with SSL/TLS Here is my /etc/ldap.conf: #host 127.0.0.1 base cn=users,dc=testing,dc=com uri ldap://localhost:636 binddn cn=manager,dc=testing,dc=com bindpw password scope sub timelimit 120 bind_policy soft bind_timelimit 120 idle_timelimit 3600 ssl on tls_cacert /etc/openldap/cacerts/servercrt.pem tls_cacertdir /etc/openldap/cacerts tls_checkpeer no nss_base_group cn=groups,dc=testing,dc=com?sub pam_password md5 I have tried it with and without “tls_checkpeer”…. I am sort of at a loss as to what it can be. I also tested it using openssl client.. and here is the output: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> verify return:1 depth=0 /C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> i:/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> -----BEGIN CERTIFICATE----- MIIDPzCCAqigAwIBAgIBATANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMx FTATBgNVBAgTDFBlbm5zeWx2YW5pYTEXMBUGA1UEChMOTWF2ZW5XaXJlLCBMTEMx EDAOBgNVBAsTB1N1cHBvcnQxFjAUBgNVBAMTDW1hdmVud2lyZS5jb20xMDAuBgkq hkiG9w0BCQEWIW13LWhvc3Rpbmctc3lzYWRtaW5AbWF2ZW53aXJlLmNvbTAeFw0x MDA0MDkyMDUwNDlaFw0xMTA0MDkyMDUwNDlaMIGzMQswCQYDVQQGEwJVUzEVMBMG A1UECBMMUGVubnN5bHZhbmlhMRgwFgYDVQQHEw9LaW5nIG9mIFBydXNzaWExFzAV BgNVBAoTDk1hdmVuV2lyZSwgTExDMRAwDgYDVQQLEwdTdXBwb3J0MRYwFAYDVQQD Ew1tYXZlbndpcmUuY29tMTAwLgYJKoZIhvcNAQkBFiFtdy1ob3N0aW5nLXN5c2Fk bWluQG1hdmVud2lyZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMGp U5HS8A2DRokU5TQz1Dyycx/VA2uhrRwatTPq8xtoQigWM2feiXUwtoiQ/gP3IjB5 AJLf8aC8y72Io2IME4aqh1s7bdscV2b0QMs1MfXiL9h2XQWZVCkgDLjjb1XzHhlw 3I6vkrh/uGH2PQyXbuG/6dIguzCHfnGgGXgy1o45AgMBAAGjezB5MAkGA1UdEwQC MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl MB0GA1UdDgQWBBR0mZkOwZZjYFiWlloEvgSpoPxOuzAfBgNVHSMEGDAWgBS7Iqbt j25p56k4BdHpXYG3xjhdijANBgkqhkiG9w0BAQUFAAOBgQARO7OcDgNOZ3WuP9IM mUeQWuGVBAh7MQ3Uv2HrSOAfTHxg/QxjCZZlwULq1EZZDHNgyPMM+5ElWSID5El/ fdxHcizNOjPPuVPwtJIrs8RhTIehn0aKryqtkvpcAnxFuc+VxwcCBhV58wtbSuXL PXRTvoTDXWkiXwdR4m1bubOF5A== -----END CERTIFICATE----- 1 s:/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> i:/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> -----BEGIN CERTIFICATE----- MIIDJTCCAo6gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMx FTATBgNVBAgTDFBlbm5zeWx2YW5pYTEXMBUGA1UEChMOTWF2ZW5XaXJlLCBMTEMx EDAOBgNVBAsTB1N1cHBvcnQxFjAUBgNVBAMTDW1hdmVud2lyZS5jb20xMDAuBgkq hkiG9w0BCQEWIW13LWhvc3Rpbmctc3lzYWRtaW5AbWF2ZW53aXJlLmNvbTAeFw0x MDA0MDkyMDUwMDBaFw0xMzA0MDgyMDUwMDBaMIGZMQswCQYDVQQGEwJVUzEVMBMG A1UECBMMUGVubnN5bHZhbmlhMRcwFQYDVQQKEw5NYXZlbldpcmUsIExMQzEQMA4G A1UECxMHU3VwcG9ydDEWMBQGA1UEAxMNbWF2ZW53aXJlLmNvbTEwMC4GCSqGSIb3 DQEJARYhbXctaG9zdGluZy1zeXNhZG1pbkBtYXZlbndpcmUuY29tMIGfMA0GCSqG SIb3DQEBAQUAA4GNADCBiQKBgQC6yVPz1ccamBapkRR8vTjpiKj7JuJKdCecTQ7/ f2KWoIRuYdEWU4njEsu/KHQWmxR0lelqOzM15EHVanOJCsPKCEMQg4lY5cQm8W1Q YCGQyqg0ITQ6nbPuQchFHHnldqYZsfiWjly8SC454B61ItHi9Lcxvfh4cVonSCqw KeoF4wIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUuyKm7Y9uaeepOAXR6V2B t8Y4XYowHwYDVR0jBBgwFoAUuyKm7Y9uaeepOAXR6V2Bt8Y4XYowDQYJKoZIhvcN AQEFBQADgYEAg5xdwSmeF2afO1UJZys5Mmvn7YfUdOIRgVaYN5sQLt1ixCXjDEew 56br5RKs2W6PaqeXl7CN5bYqxDDo3ekds9uquzE91HaKH04gQUc+/NA82y5NiaGZ EOiLoTvc/+PShAjl8ZVwf+eNloay2FChb6S47rX0f28tKXpteWax00k= -----END CERTIFICATE----- --- Server certificate subject=/C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> issuer=/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> --- Acceptable client certificate CA names /C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> /C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> --- SSL handshake has read 2160 bytes and written 2117 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 7475F12DDB7A8CAE5047244136B5CDBD877D9C71E72B7DE379FEEC681ECA635C Session-ID-ctx: Master-Key: 5253A27AAB6096A906DD64C1565110582414DE0B24543D7275D267235BDF06F75EA1E745323E6E34420D90613AD74BF7 Key-Arg : None Krb5 Principal: None Start Time: 1271093212 Timeout : 300 (sec) Verify return code: 0 (ok) That all appears to be OK… which is confusing to me as to why it won’t work? From: Chris Jacobs [mailto:Chris.Jacobs@apollogrp.edu<mailto:Chris.Jacobs@apollogrp.edu>] Sent: Monday, April 12, 2010 12:30 PM To: 'lynn.york(a)mavenwire.com<mailto:lynn.york@mavenwire.com>' Subject: Re: Problem with SSL/TLS Did you setup the CA's cert as a trusted CA on your clients? There is also a setting to skip verifying the cert for /etc/openldap/ldap.conf - but I can't recall atm. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu<mailto:chris.jacobs@apollogrp.edu> ________________________________ From: openldap-technical-bounces+chris.jacobs=apollogrp.edu<http://apollogrp.edu>@OpenLDAP.org To: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Sent: Mon Apr 12 08:13:39 2010 Subject: Problem with SSL/TLS I have created a cert. on the server and openldap starts without any issues, however when I attempt to connect via ldaps I keep getting the following error: ?? ?? ldapsearch -x -H ldaps://localhost:636 -D "cn=Manager,dc=testing,dc=com" -W -b "dc=testing,dc=com" "(objectClass=top)" Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) ?????????????? additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed ?? I can???t quite pin point what the problem might be.?? ?? Lynn York II MavenWire Hosting Admin www.mavenwire.com<http://www.mavenwire.com> (866) 343-4870 x717 ?? MavenWire - We DELIVER http://www.mavenwire.com ?? This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient.?? Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message.?? Please contact the sender by reply e-mail and delete all copies of this message. ?? MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system. MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 6

Overlay Chain Extended Passmod Problem
by Ralf Zimmermann 13 Apr '10

13 Apr '10

Hi all, last week I wrote to the list because I have a problem with overlay chain. Today I traced the problem. The configuration and the host are the same. OpenLDAP syncrepl runs fine over the weekend. But if I want to change a password nothing happens. I can't see any packet with tcpdump from the slave to the master. I traced slapd with loglevel=65535. The slave is openldap 2.4.21. # Here the trace with no successfull passmod operation: ----------------------------------------------------- conn=1126 op=1 BIND dn="cn=ldapadmin,dc=camelot,dc=de" method=128 do_bind: version=3 dn="cn=ldapadmin,dc=camelot,dc=de" method=128 => bdb_entry_get: ndn: "cn=ldapadmin,dc=camelot,dc=de" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=ldapadmin,dc=camelot,dc=de") => bdb_entry_get: found entry: "cn=ldapadmin,dc=camelot,dc=de" bdb_entry_get: rc=0 => bdb_entry_get: ndn: "cn=default,ou=policies,dc=camelot,dc=de" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=default,ou=policies,dc=camelot,dc=de") bdb_entry_get: found entry: "cn=default,ou=policies,dc=camelot,dc=de" bdb_entry_get: rc=0 ==> hdb_bind: dn: cn=ldapadmin,dc=camelot,dc=de bdb_dn2entry("cn=ldapadmin,dc=camelot,dc=de") ) # Here the trace after I restart slapd with exactly the same config # and working passmod oepration: ------------------------------------------------------------------ conn=1000 op=1 BIND dn="cn=ldapadmin,dc=camelot,dc=de" method=128 do_bind: version=3 dn="cn=ldapadmin,dc=camelot,dc=de" method=128 => bdb_entry_get: ndn: "cn=ldapadmin,dc=camelot,dc=de" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=ldapadmin,dc=camelot,dc=de") => hdb_dn2id("cn=ldapadmin,dc=camelot,dc=de") <= hdb_dn2id: got id=0x5 entry_decode: "" <= entry_decode() => bdb_entry_get: found entry: "cn=ldapadmin,dc=camelot,dc=de" bdb_entry_get: rc=0 => bdb_entry_get: ndn: "cn=default,ou=policies,dc=camelot,dc=de" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=default,ou=policies,dc=camelot,dc=de") => hdb_dn2id("ou=policies,dc=camelot,dc=de") <= hdb_dn2id: got id=0x9 => hdb_dn2id("cn=default,ou=policies,dc=camelot,dc=de") <= hdb_dn2id: got id=0xa entry_decode: "" <= entry_decode() => bdb_entry_get: found entry: "cn=default,ou=policies,dc=camelot,dc=de" bdb_entry_get: rc=0 ==> hdb_bind: dn: cn=ldapadmin,dc=camelot,dc=de bdb_dn2entry("cn=ldapadmin,dc=camelot,dc=de") When the passmod operation is successfull there are hdb_dn2id entries in the trace. When the passmod operation ist not successfull the entries doesn't exist. What happens, that I must restart the slapd? The configuration is the same and all other things works fine. Only the write operations to the master hangs. If I make a passmod without TLS everything works fine and I can change the password after I restarted the slapd on the slave. Then I can change the passwords the wholy day. Tomorrow I'll must restart slapd on the slave because the passmod operation is not successfull. Any ideas? regards Ralf Zimmermann -- .''`. Ralf Zimmermann : :' : SIEGNETZ.IT GmbH `. `' Schneppenkauten 1a `- 57076 Siegen Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen

2 2

Problem with SSL/TLS
by Lynn York 12 Apr '10

12 Apr '10

I have created a cert. on the server and openldap starts without any issues, however when I attempt to connect via ldaps I keep getting the following error: ldapsearch -x -H ldaps://localhost:636 -D "cn=Manager,dc=testing,dc=com" -W -b "dc=testing,dc=com" "(objectClass=top)" Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I can’t quite pin point what the problem might be. Lynn York II MavenWire Hosting Admin www.mavenwire.com (866) 343-4870 x717 MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message.

2 2

Re: Problem with SSL/TLS
by Chris Jacobs 12 Apr '10

12 Apr '10

Also, if you've the CA's cert in a file and point the conf directly to it (via tls_cacert) it's unnecessary to use the tls_cacetdir directive. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: Chris Jacobs To: 'lynn.york(a)mavenwire.com' Cc: 'openldap-technical(a)openldap.org' Sent: Mon Apr 12 10:35:51 2010 Subject: Re: Problem with SSL/TLS /etc/ldap.conf is used by nss tools and the ilk. /etc/openldap/ldap.conf would be used by openldap tools - like ldapsearch. I have the same setting there for tls_checkpeer - but in the latter ldap.conf (under openldap). FWIW: there's apparently no real different format for the two files; while one would only be setup on ldap servers, mine are identical and things work with a mirror master, both setup behind a VIP (fail over, not load balanced) and a plethora of slaves in different subdomains. - chris PS: I'd forgotten to 'reply-to-all' earlier. :) Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: Lynn York To: Chris Jacobs Sent: Mon Apr 12 10:29:19 2010 Subject: RE: Problem with SSL/TLS Here is my /etc/ldap.conf: #host 127.0.0.1 base cn=users,dc=testing,dc=com uri ldap://localhost:636 binddn cn=manager,dc=testing,dc=com bindpw password scope sub timelimit 120 bind_policy soft bind_timelimit 120 idle_timelimit 3600 ssl on tls_cacert /etc/openldap/cacerts/servercrt.pem tls_cacertdir /etc/openldap/cacerts tls_checkpeer no nss_base_group cn=groups,dc=testing,dc=com?sub pam_password md5 I have tried it with and without “tls_checkpeer”…. I am sort of at a loss as to what it can be. I also tested it using openssl client.. and here is the output: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> verify return:1 depth=0 /C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> i:/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> -----BEGIN CERTIFICATE----- MIIDPzCCAqigAwIBAgIBATANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMx FTATBgNVBAgTDFBlbm5zeWx2YW5pYTEXMBUGA1UEChMOTWF2ZW5XaXJlLCBMTEMx EDAOBgNVBAsTB1N1cHBvcnQxFjAUBgNVBAMTDW1hdmVud2lyZS5jb20xMDAuBgkq hkiG9w0BCQEWIW13LWhvc3Rpbmctc3lzYWRtaW5AbWF2ZW53aXJlLmNvbTAeFw0x MDA0MDkyMDUwNDlaFw0xMTA0MDkyMDUwNDlaMIGzMQswCQYDVQQGEwJVUzEVMBMG A1UECBMMUGVubnN5bHZhbmlhMRgwFgYDVQQHEw9LaW5nIG9mIFBydXNzaWExFzAV BgNVBAoTDk1hdmVuV2lyZSwgTExDMRAwDgYDVQQLEwdTdXBwb3J0MRYwFAYDVQQD Ew1tYXZlbndpcmUuY29tMTAwLgYJKoZIhvcNAQkBFiFtdy1ob3N0aW5nLXN5c2Fk bWluQG1hdmVud2lyZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMGp U5HS8A2DRokU5TQz1Dyycx/VA2uhrRwatTPq8xtoQigWM2feiXUwtoiQ/gP3IjB5 AJLf8aC8y72Io2IME4aqh1s7bdscV2b0QMs1MfXiL9h2XQWZVCkgDLjjb1XzHhlw 3I6vkrh/uGH2PQyXbuG/6dIguzCHfnGgGXgy1o45AgMBAAGjezB5MAkGA1UdEwQC MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl MB0GA1UdDgQWBBR0mZkOwZZjYFiWlloEvgSpoPxOuzAfBgNVHSMEGDAWgBS7Iqbt j25p56k4BdHpXYG3xjhdijANBgkqhkiG9w0BAQUFAAOBgQARO7OcDgNOZ3WuP9IM mUeQWuGVBAh7MQ3Uv2HrSOAfTHxg/QxjCZZlwULq1EZZDHNgyPMM+5ElWSID5El/ fdxHcizNOjPPuVPwtJIrs8RhTIehn0aKryqtkvpcAnxFuc+VxwcCBhV58wtbSuXL PXRTvoTDXWkiXwdR4m1bubOF5A== -----END CERTIFICATE----- 1 s:/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> i:/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> -----BEGIN CERTIFICATE----- MIIDJTCCAo6gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMx FTATBgNVBAgTDFBlbm5zeWx2YW5pYTEXMBUGA1UEChMOTWF2ZW5XaXJlLCBMTEMx EDAOBgNVBAsTB1N1cHBvcnQxFjAUBgNVBAMTDW1hdmVud2lyZS5jb20xMDAuBgkq hkiG9w0BCQEWIW13LWhvc3Rpbmctc3lzYWRtaW5AbWF2ZW53aXJlLmNvbTAeFw0x MDA0MDkyMDUwMDBaFw0xMzA0MDgyMDUwMDBaMIGZMQswCQYDVQQGEwJVUzEVMBMG A1UECBMMUGVubnN5bHZhbmlhMRcwFQYDVQQKEw5NYXZlbldpcmUsIExMQzEQMA4G A1UECxMHU3VwcG9ydDEWMBQGA1UEAxMNbWF2ZW53aXJlLmNvbTEwMC4GCSqGSIb3 DQEJARYhbXctaG9zdGluZy1zeXNhZG1pbkBtYXZlbndpcmUuY29tMIGfMA0GCSqG SIb3DQEBAQUAA4GNADCBiQKBgQC6yVPz1ccamBapkRR8vTjpiKj7JuJKdCecTQ7/ f2KWoIRuYdEWU4njEsu/KHQWmxR0lelqOzM15EHVanOJCsPKCEMQg4lY5cQm8W1Q YCGQyqg0ITQ6nbPuQchFHHnldqYZsfiWjly8SC454B61ItHi9Lcxvfh4cVonSCqw KeoF4wIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUuyKm7Y9uaeepOAXR6V2B t8Y4XYowHwYDVR0jBBgwFoAUuyKm7Y9uaeepOAXR6V2Bt8Y4XYowDQYJKoZIhvcN AQEFBQADgYEAg5xdwSmeF2afO1UJZys5Mmvn7YfUdOIRgVaYN5sQLt1ixCXjDEew 56br5RKs2W6PaqeXl7CN5bYqxDDo3ekds9uquzE91HaKH04gQUc+/NA82y5NiaGZ EOiLoTvc/+PShAjl8ZVwf+eNloay2FChb6S47rX0f28tKXpteWax00k= -----END CERTIFICATE----- --- Server certificate subject=/C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> issuer=/C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> --- Acceptable client certificate CA names /C=US/ST=Pennsylvania/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> /C=US/ST=Pennsylvania/L=King of Prussia/O=MavenWire, LLC/OU=Support/CN=testing.com/emailAddress=testing@testing.com<http://testing.com/emailAddress=testing@testing.com> --- SSL handshake has read 2160 bytes and written 2117 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 7475F12DDB7A8CAE5047244136B5CDBD877D9C71E72B7DE379FEEC681ECA635C Session-ID-ctx: Master-Key: 5253A27AAB6096A906DD64C1565110582414DE0B24543D7275D267235BDF06F75EA1E745323E6E34420D90613AD74BF7 Key-Arg : None Krb5 Principal: None Start Time: 1271093212 Timeout : 300 (sec) Verify return code: 0 (ok) That all appears to be OK… which is confusing to me as to why it won’t work? From: Chris Jacobs [mailto:Chris.Jacobs@apollogrp.edu<mailto:Chris.Jacobs@apollogrp.edu>] Sent: Monday, April 12, 2010 12:30 PM To: 'lynn.york(a)mavenwire.com<mailto:lynn.york@mavenwire.com>' Subject: Re: Problem with SSL/TLS Did you setup the CA's cert as a trusted CA on your clients? There is also a setting to skip verifying the cert for /etc/openldap/ldap.conf - but I can't recall atm. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu<mailto:chris.jacobs@apollogrp.edu> ________________________________ From: openldap-technical-bounces+chris.jacobs=apollogrp.edu<http://apollogrp.edu>@OpenLDAP.org To: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Sent: Mon Apr 12 08:13:39 2010 Subject: Problem with SSL/TLS I have created a cert. on the server and openldap starts without any issues, however when I attempt to connect via ldaps I keep getting the following error: ?? ?? ldapsearch -x -H ldaps://localhost:636 -D "cn=Manager,dc=testing,dc=com" -W -b "dc=testing,dc=com" "(objectClass=top)" Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) ?????????????? additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed ?? I can???t quite pin point what the problem might be.?? ?? Lynn York II MavenWire Hosting Admin www.mavenwire.com<http://www.mavenwire.com> (866) 343-4870 x717 ?? MavenWire - We DELIVER http://www.mavenwire.com ?? This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient.?? Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message.?? Please contact the sender by reply e-mail and delete all copies of this message. ?? MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system. MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

SSL / Certificates / ... Some confusion
by Götz Reinicke - IT-Koordinator 12 Apr '10

12 Apr '10

Hi, since a couple of days I try to setup a provider and a consumer over ssl following the documentation in a book [1] an dusing two servers. (Red Hat 5.x, openssl-0.9.8e-12, openldap-2.3.43-3 ) Doing so I was confronted with a lot off different warnings/messages but finaly I got the replication crypted. The final step in the tutorial is to use the saslmech=external but the messages I do get are different from the messages I should get. I noticed and googeled some provider debug info and wanted to ask for some prove or clarification or work around: >From the provider log: TLS certificate verification: Error, unsupported certificate purpose ... TLS trace: SSL3 alert write:warning:bad certificate connection_read(13): unable to get TLS client DN, error=49 id=1 >From a posting from 2006 and the answere from Howard Chu [2] I think I do have the same problem: My consumer server certificate "should be" from the providers view a client certificate. >From the certificate: X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Server Am I wrong, right, lost, ... Is there a workaround or any step while creating the certificates? Thanks once more and best regards, Götz [1] http://www.galileocomputing.de/katalog/buecher/titel/gp/titelID-1801 [2] http://www.openldap.org/lists/openldap-software/200604/msg00202.html -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

3 5

TLS issues
by Daniel Gomes 12 Apr '10

12 Apr '10

Dear list members, I am having some problems with TLS I would like to share and hopefully solve with your help. First of all, the specs: it's a OpenLDAP 2.4.19 compiled (manually, not via apt-get) on a Ubuntu 8.04 (Hardy). I don't think it matters, but I am using the dynlist overlay (that's why I had to compile manually and not via apt-get, as I couldn't get it to work with the package Ubuntu provides). Passing on to the problem itself, let me just start by saying that the SSL/TLS setup itself seems to be working fine, and I am always able to ldapsearch on port 636 with ldaps:// (SSL) or on port 389 with ldap:// and -ZZ (TLS). Unfortunately, using other clients (phpLDAPadmin and some custom php scripts I wrote), the behavior is rather random. Sometimes it fails, sometimes it works (at the beginning it worked more often than not, lately it has been working less and less). The server logs, unfortunately, are not so helpful (for me, at least!). The only error I see (with logs at -1, trying to connect via phpLDAPadmin with TLS on port 389) is: connection_read(15): TLS accept failure error=-1 id=23, closing Apr 7 16:45:18 gold slapd[7385]: connection_closing: readying conn=23 sd=15 for close Apr 7 16:45:18 gold slapd[7385]: connection_close: conn=23 sd=15 Apr 7 16:45:18 gold slapd[7385]: daemon: removing 15 Apr 7 16:45:18 gold slapd[7385]: daemon: activity on 1 descriptor Apr 7 16:45:18 gold slapd[7385]: daemon: activity on: Apr 7 16:45:18 gold slapd[7385]: conn=23 fd=15 closed (TLS negotiation failure) Trying on port 636 with ldaps:// yields the same error. But as I mentioned, it just happen sometimes, while on others the connection is successfully established! Although I did notice that even when it does work, I get the following error: connection_read(14): unable to get TLS client DN, error=49 id=8 but it is quickly followed by a "conn=8 fd=14 TLS established tls_ssf=256 ssf=256"... So, this is my problem and it is getting me quite puzzled... The fact that it does work on occasion makes me think it can't be my configuration or the usual file permission culprit... Here's my slapd.conf (I removed the ACL configuration, as I am guessing it's not important here): # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/dyngroup.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #Custom Schemas include /usr/local/etc/openldap/schema/local.schema include /usr/local/etc/openldap/schema/postfix.schema pidfile /home/slapd/run/slapd.pid argsfile /home/slapd/run/slapd.args ####################################################################### # Database definitions ####################################################################### database hdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw secret directory /home/slapd/database index objectClass eq ####################################################################### # Replication ####################################################################### overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ####################################################################### # TLS ####################################################################### TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /home/slapd/ssl/cacert.pem TLSCertificateFile /home/slapd/ssl/servercrt.pem TLSCertificateKeyFile /home/slapd/ssl/serverkey.pem TLSVerifyClient never ####################################################################### # Overlay (for dynamic lists) ####################################################################### overlay dynlist dynlist-attrset ipfnRole memberURL member If it helps for anything, in the ldap.conf files of the client I also have the "TLS_REQCERT never" setting, together with the TLS_CACERT and TLS_CACERTDIR for the CA's certificate. Thanks in advance for any help, -- Daniel Gomes (SysAdmin) dgomes(a)ipfn.ist.utl.pt Ext. 3487 - 218419487 Instituto de Plasmas e usão Nuclear Instituto Superior Técnico - UTL Av. Rovisco Pais - 1049-001 Lisboa - Portugal

2 2

deleting one domain
by Patrick Mburu 12 Apr '10

12 Apr '10

Hi guys i get this output from slapcat; dn: dc=mycompany,dc=com objectClass: dcObject objectClass: organization o: mycompany dc: mycompany structuralObjectClass: organization entryUUID: e235aa56-cd4a-102e-9e99-4f8ab88a5141 creatorsName: cn=root,dc=mycompany,dc=com modifiersName: cn=root,dc=mycompany,dc=com createTimestamp: 20100326174351Z modifyTimestamp: 20100326174351Z entryCSN: 20100326174351Z#000000#00#000000 dn: dc=mycompany,dc=local objectClass: dcObject objectClass: organization o: mycompany dc: mycompany structuralObjectClass: organization entryUUID: 4c85f2e4-cf9e-102e-9a60-f35afa4f4768 creatorsName: cn=root,dc=mycompany,dc=local modifiersName: cn=root,dc=mycompany,dc=local createTimestamp: 20100329164559Z modifyTimestamp: 20100329164559Z entryCSN: 20100329164559Z#000000#00#000000 i want to delete the mycompany.com domain and be left with mycompany.local how do i go abt it? thanks in advance

2 1

Re: Support for multiple suffixes in openldap
by masarati＠aero.polimi.it 12 Apr '10

12 Apr '10

> Hello Sarati > > I did not get what you said by single database rooted at "", the empty > DN. > > Can you please send me a sample config file if you have ? I really > appreciate the same. Please reply to the list. The example is database <whatyoulike> suffix "" p. > > Cheers!!!!!!!!!! > Ram > > > Don't do that. First of all, think if you really need multiple suffixes > in a single databases. In most cases, this requirement can be relaxed by > setting each suffix in a separate database. If you think you really need > to have multiple suffixes, you can use a single database rooted at "", the > empty DN. > > > > > > ________________________________ > From: "masarati(a)aero.polimi.it" <masarati(a)aero.polimi.it> > To: Meena Ram <meenaram21(a)yahoo.com> > Cc: openldap-technical(a)openldap.org > Sent: Sat, April 10, 2010 8:40:16 PM > Subject: Re: Support for multiple suffixes in openldap > >> Hello all: >> >> Is there any work around to get multiple suffixes working in openldap >> for multiple domains >> >> I saw this info in one of the links which says you have to add this >> #define BDB_MULTIPLE_SUFFIXES and then compile. >> >> >> Note: As of OpenLDAP 2.1.2.13, the default configuration will allow only >> one suffix to be defined for each bdb database. The C preprocessor >> directive #define BDB_MULTIPLE_SUFFIXES (file: >> servers/slapd/back-bdb/init.c) may be used if you want to compile in >> multiple suffix support. If you use it, subtree indexing will slow down >> by >> factor of 2. The use of suffixAlias is no longer supported by default in >> version 2.1.13. >> >> Is there any short cut to get multiple suffixes working without having >> to >> re-compile everything again. Any shortcuts really appreciated > > Don't do that. First of all, think if you really need multiple suffixes > in a single databases. In most cases, this requirement can be relaxed by > setting each suffix in a separate database. If you think you really need > to have multiple suffixes, you can use a single database rooted at "", the > empty DN. > > p. > > >

3 3

Support for multiple suffixes in openldap
by Meena Ram 11 Apr '10

11 Apr '10

Hello all: Is there any work around to get multiple suffixes working in openldap for multiple domains I saw this info in one of the links which says you have to add this #define BDB_MULTIPLE_SUFFIXES and then compile. Note: As of OpenLDAP 2.1.2.13, the default configuration will allow only one suffix to be defined for each bdb database. The C preprocessor directive #define BDB_MULTIPLE_SUFFIXES (file: servers/slapd/back-bdb/init.c) may be used if you want to compile in multiple suffix support. If you use it, subtree indexing will slow down by factor of 2. The use of suffixAlias is no longer supported by default in version 2.1.13. Is there any short cut to get multiple suffixes working without having to re-compile everything again. Any shortcuts really appreciated Cheers!!!!!!!!!! Ram

2 1

Slapd-ldap proxy between replica and mirror
by Ubay Dorta 09 Apr '10

09 Apr '10

Hi, We have a similar scenario that the one explained in the post of Javier Manteiga: http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/200907/msg… We have deployed two servers: a master and a replica (delta-syncrepl). We added the chaining configuration that appears in openldap 2.4 administrator's guide (12.3.2) to handle the modifications originated from the replica. Replica slapd.conf: ##################### # Chaining configuration # ##################### overlay chain chain-uri "ldap://192.168.1.10:389" chain-idassert-bind bindmethod="simple" binddn="cn=replicator,dc=example,dc=com" credentials="secret" mode="self" chain-return-error TRUE ########## # Replica # ########## database bdb suffix "dc=example,dc=com" rootdn "cn=Administrator,dc=example,dc=com" rootpw "secret" .... ################## # Syncrepl directives # ################## syncrepl rid=001 provider=ldap://192.168.1.10:389 type=refreshAndPersist retry="60 +" searchbase="dc=example,dc=com" filter="(objectclass=*)" scope=sub attrs="*" schemachecking=on binddn="cn=replicator,dc=example,dc=com" bindmethod=simple credentials=secret sizelimit=unlimited logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog # Refer updates to the master updateref ldap://192.168.1.10:389 The problem appears when we change the single master for a mirrormode configuration (administrator guide 18.3.4.1). In addition, we set up a back-ldap proxy between mirror and replica. back-ldap proxy slapd.conf: ######## # Proxy # ######## database ldap suffix "dc=example,dc=com" rootdn "cn=slapd-ldap" uri "ldap://192.168.1.20:389 ldap://192.168.1.30:389" The IP addresses are: 192.168.1.10 -> Back-ldap proxy 192.168.1.20 -> Mirror mode server 1 192.168.1.30 -> Mirror mode server 2 When we try to modify the password through the replica, we get the following messages in the server where is located the proxy: ldap-proxy[13175]: daemon: activity on 1 descriptor ldap-proxy[13175]: daemon: activity on: ldap-proxy[13175]: 12r ldap-proxy[13175]: ldap-proxy[13175]: daemon: read active on 12 ldap-proxy[13175]: daemon: epoll: listen=7 active_threads=0 tvp=NULL ldap-proxy[13175]: connection_get(12) ldap-proxy[13175]: connection_get(12): got connid=1002 ldap-proxy[13175]: connection_read(12): checking for input on id=1002 ldap-proxy[13175]: op tag 0x66, time 1270632398 ldap-proxy[13175]: conn=1002 op=2 do_modify ldap-proxy[13175]: conn=1002 op=2 do_modify: dn (uid=user,ou=people,dc=example,dc=com) ldap-proxy[13175]: => get_ctrls ldap-proxy[13175]: => get_ctrls: oid="2.16.840.1.113730.3.4.18" (noncritical) ldap-proxy[13175]: parseProxyAuthz: conn 1002 authzid="dn:uid=user,ou=people,dc=example,dc=com" ldap-proxy[13175]: slap_sasl_getdn: conn 1002 id=dn:uid=user,ou=people,dc=example,dc=com [len=38] ldap-proxy[13175]: >>> dnNormalize: <uid=user,ou=people,dc=example,dc=com> ldap-proxy[13175]: <<< dnNormalize: <uid=user,ou=people,dc=example,dc=com> ldap-proxy[13175]: ==>slap_sasl2dn: converting SASL name uid=user,ou=people,dc=example,dc=com to a DN ldap-proxy[13175]: <==slap_sasl2dn: Converted SASL name to <nothing> ldap-proxy[13175]: parseProxyAuthz: conn=1002 "uid=user,ou=people,dc=example,dc=com" ldap-proxy[13175]: ==>slap_sasl_authorized: can cn=replicator,dc=example,dc=com become uid=user,ou=people,dc=example,dc=com? ldap-proxy[13175]: <== slap_sasl_authorized: return 48 ldap-proxy[13175]: <= get_ctrls: n=1 rc=123 err="not authorized to assume identity" ldap-proxy[13175]: send_ldap_result: conn=1002 op=2 p=3 ldap-proxy[13175]: send_ldap_result: err=123 matched="" text="not authorized to assume identity" ldap-proxy[13175]: send_ldap_response: msgid=3 tag=103 err=123 ldap-proxy[13175]: conn=1002 op=2 RESULT tag=103 err=123 text=not authorized to assume identity ldap-proxy[13175]: conn=1002 op=2 do_modify: get_ctrls failed ldap-proxy[13175]: daemon: activity on 1 descriptor ldap-proxy[13175]: daemon: activity on: The authorization is denied for cn=replicator,dc=example,dc=com. Is it the same problem with the propagation of identity? Is there any way to avoid the problem? Thanks in advance. Javier Manteiga wrote: We are trying to set a system with the DIT split in several servers, using the Meta backend to proxy the LDAP requests among them. In the remote servers we would like to check the ACLs using the identity of the client that sent the request, instead of the identity used to create the proxy connections. For this we have configured the idassert parameters in the meta targets as follows: idassert-bind bindmethod=simple binddn="cn=manager,dc=operator,dc=com" (root user of the backend receiving the proxied query) credentials="manager" mode=self iddassert-authzFrom "dn:*" When the first proxy is made everything is OK. The proxyAuthz extension control is added to the LDAP message and the remote server behaves as expected. Our problem is that in some cases we have requests that must be proxied several times. E.g: consider a scenario with three servers in A, B and C. in which the LDAP request sent by the external client is received in A, this server proxies it to B. Finally B proxies it to C. When B tries to set the proxyAuthz control it detects that there is already one and it returns the error "proxyAuthz not allowed within namingContext". Is there anyway in which we can avoid this error and propagate the credentials of the external client to the last server?. No. If you use proxyAuthz to propagate the client's identity to a remote server, then the remote server cannot use the same trick to propagate what it believes the client's identity, while it's actually the first proxy's identity. By design we decided to disallow nested identity assertion. This mechanism requires distributed procedures, where any control like *proxyAuthz would be wrapped by procedure distribution information, thus *allowing nested chaining and so. This was discussed long ago when chaining and identity assertion were first implemented. The I.D. about distributed procedures expired long ago, and was never revitalized, so this functionality is not available. p.

2 1

slapd wont start
by Nick Pappin 09 Apr '10

09 Apr '10

Can someone tell me whats wrong here.. I had a working ldap/samba server and after I restarted the machine due to a power outage the slapd service wont start back up. Here are what the logs show when I try to bring slapd back online: Apr 8 14:06:23 mdc slapd[12286]: @(#) $OpenLDAP: slapd 2.3.43 (Apr 8 2010 13:58:40) $ Apr 8 14:06:23 mdc root@mdc: /var/tmp/portage/net-nds/openldap-2.3.43/work/openldap-2.3.43/servers/slapd Apr 8 14:06:23 mdc slapd[12286]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Apr 8 14:06:23 mdc slapd: Last message 'nss_ldap: failed to ' repeated 1 times, supressed by syslog-ng on mdc.mydomain.org Apr 8 14:06:23 mdc slapd[12286]: nss_ldap: reconnecting to LDAP server... Apr 8 14:06:23 mdc slapd[12286]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Apr 8 14:06:23 mdc slapd[12286]: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)... Apr 8 14:06:24 mdc slapd[12286]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Apr 8 14:06:24 mdc slapd[12286]: nss_ldap: could not search LDAP server - Server is unavailable Apr 8 14:06:24 mdc slapd[12286]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Apr 8 14:06:24 mdc slapd: Last message 'nss_ldap: failed to ' repeated 1 times, supressed by syslog-ng on mdc.mydomain.org Apr 8 14:06:24 mdc slapd[12286]: nss_ldap: reconnecting to LDAP server... Apr 8 14:06:24 mdc slapd[12286]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Apr 8 14:06:24 mdc slapd[12286]: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)... Apr 8 14:06:25 mdc slapd[12286]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Apr 8 14:06:25 mdc slapd[12286]: nss_ldap: could not search LDAP server - Server is unavailable Apr 8 14:06:25 mdc slapd[12287]: bdb(dc=mydomain,dc=org): unable to allocate memory for mutex; resize mutex region Apr 8 14:06:25 mdc slapd[12287]: hdb_db_open: Database cannot be opened, err 12. Restore from backup! Apr 8 14:06:25 mdc slapd[12287]: bdb(dc=mydomain,dc=org): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem Apr 8 14:06:25 mdc slapd[12287]: bdb(dc=mydomain,dc=org): txn_checkpoint interface requires an environment configured for the transaction subsystem Apr 8 14:06:25 mdc slapd[12287]: bdb_db_close: txn_checkpoint failed: Invalid argument (22) Apr 8 14:06:25 mdc slapd[12287]: backend_startup_one: bi_db_open failed! (12) Apr 8 14:06:25 mdc slapd[12287]: bdb_db_close: alock_close failed Apr 8 14:06:25 mdc slapd[12287]: slapd stopped. Apr 8 14:06:25 mdc slapd[12287]: connections_destroy: nothing to destroy. Thanks ~ Nick

3 3

group migration to Ldap
by Francis, Steve (IHG) 09 Apr '10

09 Apr '10

I'm tyring to migrate my /etc/group to openldap. I've used the migration tools, but for some reason, I get the following when trying to do the ldapadd for the group.ldif generated . adding new entry "cn=at,ou=Group,dc=zlinux,dc=hiw,dc=com" ldap_add: Object class violation (65) additional info: no structural object class provided Not sure why, as the /etc/passwd migrated just fine. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

2 4

ProxyAddresses: attribute undefined Any info on how to fix this
by Meena Ram 09 Apr '10

09 Apr '10

ProxyAddresses: attribute undefined Any info on how to fix this ldap_add: Undefined attribute type (17) additional info: proxyAddresses: attribute type undefined

2 1

link object
by Carlo Pradissitto 09 Apr '10

09 Apr '10

Hi, I would like to link an attribute to an object, so that when I perform a search it returns all attributes related to the object referenced, just like the example below: + resource1 + type: this_type + permission: this_permission + location: this_location + resource2 + type: another_type + permission: another_permission + location: another_location + profile1 + resource1 + resource2 + domain + organization + user1 + profile1 ldapsearch [ options ] cn=user1 dc: domain o: organization cn: user1 ( profile: profile1 ) resource: resource1, this_type, this_permission, this_location resource: resource2, another_type, another_permission, another_location Thanks in advance Carlo

2 2

SYntax for Proxy addresses and attribute to be defined for proxy addresess in LDIF file
by Meena Ram 09 Apr '10

09 Apr '10

Dear folks: If any one has the syntax for adding proxy addresses in the LDIF file along with the normal mail attribute that will be really appreciated if you can share the Syntax. Req: Sample LDIF file with proxy addresses along with mail attribute Cheers!!!!!!!!!! RAM

1 0

Re: Sample Large ldiff file to support 1K users
by Meena Ram 09 Apr '10

09 Apr '10

Dear folks: If any one has the syntax for adding proxy addresses in the LDIF file along with the normal mail attribute that will be really appreciated if you can share the Syntax. This is needed for an openldap set up. Req: Sample LDIF file with proxy addresses along with mail attribute Cheers!!!!!!!!!! RAM

1 0

Re: group in groups
by Chris Jacobs 08 Apr '10

08 Apr '10

You're thinking of dyngroups (Dynamic Groups). - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Thu Apr 08 02:10:48 2010 Subject: group in groups Hello list We use our Openldap with a lot of applications like apache, squid, samba ... What for us whould be very usefull is to define in ldap groups with users and other groups therin. Is this possible in Ldap or maybe with the nss-module ? I cant find any documentation. Thank you luis This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

confusing manpage for slapcat for backup
by hai wu 08 Apr '10

08 Apr '10

I have some questions: When I look at manpage for slapcat from openldap-servers-2.3.27-5 in Centos5.0, it says: LIMITATIONS In general, your slapd(8) should not be running (at least, not in read- write mode) when you do this to ensure consistency of the database. But when I look at its manpage from openldap-servers-2.3.43-3.el5 in Centos5.4, it says: LIMITATIONS For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapcat with the slapd-bdb(5), slapd-hdb(5), and slapd-null(5) backends. Question 1: Is it always safe to run slapcat with slapd running even for openldap-servers-2.3.27-5 in Centos5? The administration guide for OpenLDAP 2.4 at http://www.openldap.org/doc/admin24/maintenance.html explains more on this, I quote: "2. Periodically run slapcat and back up the LDIF file: Slapcat can be run while slapd is active. However, one runs the risk of an inconsistent database- not from the point of slapd, but from the point of the applications using LDAP. For example, if a provisioning application performed tasks that consisted of several LDAP operations, and the slapcat took place concurrently with those operations, then there might be inconsistencies in the LDAP database from the point of view of that provisioning application and applications that depended on it. One must, therefore, be convinced something like that won't happen. One way to do that would be to put the database in read-only mode while performing the slapcat. The other disadvantage of this approach is that the generated LDIF files can be rather large and the accumulation of the day's backups could add up to a substantial amount of space. You can use *slapcat*(8) to generate an LDIF file for each of your *slapd*(8) back-bdb or back-hdb databases. slapcat -f slapd.conf -b "dc=example,dc=com" For back-bdb and back-hdb, this command may be ran while slapd(8) is running." Question 2: Is the above also true for openldap-servers-2.3.27-5 in Centos5? Question 3: How to put the database in read-only mode while performing the slapcat? Is there anyone who's doing this just to make sure for consistent backup? Thanks, Hai

3 2

Using "overlay dynlist" with Ubuntu Karmic 9.10 LDAP server using slapd.d (not slapd.conf) ?
by Shamika Joshi 08 Apr '10

08 Apr '10

Hi The desired implementation is to control user logins on different lab machines based on the project groups. Scenario: Bob is part of project group 'mars' & John is part of 'venus' then I have added lab machines x1-x3 to group 'mars' & y1-y3 to group venus. Now I want John to only access machines allocated for project 'mars' i.e x1 to x3 & John to access machines allocated for 'venus' i.e y1 to y3 I went through this link<http://www.hurricanelabs.com/september2009_login_security_using_openldap_an…>learned that it can be achieved using "overlay dynlist". Please correct me if I've got it wrong. However my lab server is Ubuntu 9.10 (karmic koala) and it is using slapd.d (not slapd.conf) So now if I want to attempt to use "overlay dynlist" how should I go about it? Has anyone done this before? Any help will be appreciated. Thanks Shamika

3 17

group in groups
by alois blasbichler 08 Apr '10

08 Apr '10

Hello list We use our Openldap with a lot of applications like apache, squid, samba ... What for us whould be very usefull is to define in ldap groups with users and other groups therin. Is this possible in Ldap or maybe with the nss-module ? I cant find any documentation. Thank you luis

2 1

password-hash
by Paul Soucy 08 Apr '10

08 Apr '10

Hi, I am running OpenLDAP 2.4 on Ubuntu 9.10. I am trying to get user passwords to be stored {SHA}. I understand the way to do this is by adding password-hash {SHA} line to the slapd.conf file. However, on Ubuntu 9.10 the /etc/slapd.conf is a directory not a file. What am I missing here?

3 2

openldap bug: libldap mutex hang on ldap_int_sasl_mutex
by Jeremiah Martell 07 Apr '10

07 Apr '10

After digging into this more, this definitely looks like a bug in openldap. I modified openldap to make all mutex's recursive. Then my GSSAPI rebind proc worked properly, and the search searched all referrals and found the result (two referrals later). Thanks, - Jeremiah ---------- Forwarded message ---------- From: Jeremiah Martell <inlovewithgod(a)gmail.com> Date: Mon, Mar 29, 2010 at 3:11 PM Subject: libldap mutex hang on ldap_int_sasl_mutex To: openldap-technical(a)openldap.org I'm using openldap-2.4.18, library libldap_r. I have three windows active directory servers setup: childA.parent.example.com parent.example.com childB.parent.example.com I do a LDAP+GSSAPI bind to childA.parent.example.com. The bind succeeds. I do a search that returns referrals, (I know I need to be referred to parent, and then childB in order to find my result), and I have openldap follow referrals for me. My rebind proc is a function that only calls: ldap_sasl_interactive_bind_s( ld, NULL, NULL, NULL, NULL, LDAP_SASL_AUTOMATIC, sasl_driver, params ); where sasl_driver and params is the same parameters that I used for the initial bind call to childA. After the seach call, the debug it looks like this: > ldap_chase_v3referrals, where ref[0] = parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s < ldap_sasl_interactive_bind_s < myGSSAPIrebindProc < ldap_chase_v3referrals > ldap_chase_v3referrals, where ref[0] = childB.parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s > ldap_chase_v3referrals, where ref[0] = childA.parent.example.com < ldap_chase_v3referrals > ldap_chase_v3referrals, where ref[0] = ForestDnsZones.parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s ... HANG ON MUTEX Since this is hanging on a mutex, that would suggest a code bug. Perhaps the ldap_int_sasl_mutex needs to be a recursive mutex? Or should my rebind proc do something different than call ldap_sasl_interactive_bind_s? Any other ideas appreciated too. Thanks, - Jeremiah -- - Jeremiah Martell http://inlovewithGod.com

2 1

Partial replication
by Joe Friedeggs 07 Apr '10

07 Apr '10

Is it possible to replicate, on a slave, two branches of the DIT (only)? I have several instances of LDAP running on servers throughout the world. Connection to some of these from our support location is not dependable. I want to do something similar to this: Main LDAP (here, master): dc=example,dc=com | +--o=support | +--o=location_A | +--o=location_B | +--o=location_C In Location A (remote slave): dc=example,dc=com | +--o=support | +--o=location_A In Location B (remote slave): dc=example,dc=com | +--o=support | +--o=location_B Location A & B are two different customers, therefore it would not be prudent to replicate Location B's users in Locations A. But I need the Support group to exist in all locations. Can this be done using syncrepl? Another thought is to have LDAP Masters existing in each location, and somehow replicate the Support branch to each (mirrormode?). Should this be the approach? Thanks, Joe _________________________________________________________________ Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID27925::T:WLMTAGL:ON:…

4 10

RE: Partial replication
by Joe Friedeggs 06 Apr '10

06 Apr '10

The e-mail thread seems to have wandered a bit, hoping I am replying to the correct one. I've tested both methods, ACL vs 'syncrepl search filter', both seem to work well for me. I agree with Andrew's point that controlling this via the ACLs on the provider is more secure (in my case). Thanks for all the help and insight. Joe ---------------------------------------- > On Thu, Apr 01, 2010 at 09:53:07PM +0200, Zdenek Styblik wrote: > >>>> you want to replicate. So, let's say you use cn=mirrorA,dc=domain,dc=tld >>>> for replication, then allow this cn=mirrorA to read only >>>> o=support,dc=example,dc=com and o=location_A,dc=example,dc=com, but nowhere >>>> else. >>> >>> I have used that technique for a fairly complex design with a central >>> office and many small satellites. It works OK *provided* you never change >>> the list of entries that can be seen by the replicas. The syncrepl >>> system has no way to evaluate the effect of an ACL change (and probably >>> no way to know that one has happenned). >>> >> >> Could you please elaborate more on this one? > > My design requirements were similar to Joe's: I had a large central > server holding the master data for a lot of customers. Each customer > needed a local replica of their own data plus some subset of the > service-provider data. In my case the subset was not even complete > subtrees: the customers were allowed to see certain attributes of > certain entries only. I had to protect against the possibility that > someone might modify the config on a customer server to obtain data > that they should not have. > > As there was already a comprehensive default-deny access-control > policy in place, I just factored in the replica servers as principals > with the right to see all data that should be replicated to that site > and nothing else. That meant that every replica server could have an > identical syncrepl clause which just copies everything it can see from > the entire DIT. > > The downside is that if any access permissions change then the > replicas may not reflect the correct new subset of data. > >> Because I'd say if you refuse >> access later to some DN then it must be like DN has been deleted. Same goes >> for adding. I mean, syncrepl won't see data. And it checks, well it should >> check, for changes in some regular intervals, right? > > The problem is that syncrepl does not check every entry exhaustively. > That would be very inefficient (though I would like a way to force it > periodically). The master server maintains something like a timestamp > on the whole DIT, and when the replica server connects they just have > to compare timestamps and transfer things that have changed in the > interval between the two. (This is a gross simplification of the > actual protocol, but close enough for the discussion). > > Now imagine that I change an ACL which affects the visibility of some > entries. The entries themselves have not changed, so the timestamps do > not change and the replication process will not know that the replica > data should change. > > Worse still, I might change the membership of a group that is > referenced in an ACL. The replication process would transfer the group > but would not know that some other entries have changed visibility. > >> I have no need for nor experience with this, yet it's somewhat interesting. > > It is a powerful technique, but the designer *and operators* of such a > system must be aware of the pitfalls. > >> ACLs of anykind in OpenLDAP are kinda ... PITA, no offense to anybody!!! :) >> It just needs a lot of work to maintain and stuff (please please, no >> bashing). > > ACLs of any kind in any system (LDAP, file system, RDBMS etc) can be > hard to get right and harder to modify correctly at a later date. It > all depends on the policy that you are trying to implement. You should > think of ACLs as programs and expect to need programmer-level skill to > work on them. You may find this paper helpful: > > http://www.skills-1st.co.uk/papers/ldap-acls-jan-2009/ > > Of all the LDAP servers that I have worked with, I find OpenLDAP's > ACLs are the easiest for implementing non-trivial policies. > > Andrew > -- _________________________________________________________________ The New Busy is not the old busy. Search, chat and e-mail from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:…

1 0

memberOf overlay
by Chris Alavoine 06 Apr '10

06 Apr '10

Hi all, Am trying to get the memberOf overlay attribute working with openLDAP. I need to authenticate to a Cisco ASA 5510 and set up group mapping policy. I've been round the houses quite a few times and got pretty close but no Marlboro Light (let alone a cigar). My slapd.conf looks like this: # /etc/ldap/slapd.conf # # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb #syncprov added by PT 2009-01-19 moduleload syncprov # cja/ess/2010.03.29 - added memberOf overlay moduleload memberof.la overlay memberof sizelimit 500 tool-threads 1 backend bdb database bdb suffix "dc=essence" rootdn "cn=admin,dc=essence" rootpw xxxxxxxxxxxxxxxxxxxxxxx directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass,entryCSN,entryUUID eq lastmod on checkpoint 512 30 replogfile /var/lib/ldap/replog #syncprov added by PT 2009-01-19 overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=essence" write by dn="cn=samba,dc=essence" write by dn="cn=guest,dc=essence" read by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=essence" write by dn="cn=samba,dc=essence" write by * read # end I've added an LDIF as follows: dn: cn=vpnusers,ou=Groups,dc=essence objectclass: groupOfNames cn: vpnusers member: userid=chris.alavoine,ou=Users,dc=essence Which seems to enter ok. I'm using phpldapadmin to look at my directory. The new group "vpnusers" shows up ok and if I do a: ldapsearch -x -b "dc=essence" '(uid=chris.alavoine)' memberOf I get: # chris.alavoine, Users, essence dn: uid=chris.alavoine,ou=Users,dc=essence memberOf: cn=vpnusers,ou=Groups,dc=essence Unfortunately, when I try and query this information from the Cisco it's not picking up on the memberOf attribute. I've set up attribute mapping on the Cisco which allows me to convert the memberOf attribute into something readable by the Cisco but it's not getting that far. I'm using Ubuntu 8.04 and openLDAP 2.4.9 Any help much appreciated. c:) -- ACS (Alavoine Computer Services) Chris Alavoine mob +44 (0)7724 710 730 www.alavoinecs.co.uk

1 0

forgotten rootdn psw
by Francis, Steve (IHG) 06 Apr '10

06 Apr '10

ok...So i'm an ID10T!! LOL. But seriously, I setup an OpenLdap server and migrated /etc/passwd to it, and all is well: however, I did that months ago, and you guessed it, somehow I'm having a "senior" moment, and can't remember the psw for the rootdn, so that I can add another user to the Ldap server. I'm sure there is probably a way to decode the "hashed/encrypted" password. Any help would be greatly appreciated. I really don't want to have to delete everything and start again, but if that's what I must do, then so be it. Thanks in advance, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

6 6

Sample Large ldiff file to support 1K users
by Meena Ram 06 Apr '10

06 Apr '10

Dear folks: If anyone has sample large ldiff file which supports around 1000 users please let me know. Require it for some particular purpose so that it saves some time.Really appreciate your help on this. Send me the link or the ldif file itself Cheers!!!!!!!!!!! RAM

3 2

too many open files and over 1K xinetd running
by Seger, Mark 06 Apr '10

06 Apr '10

I'm using xinetd forwarding to allow a number of compute nodes that don't have a direct path to our ldap server to get forward on by a host that does. When running a highly parallel job that starts over 1K instances at the same time, I see all these xinetd instances also start up on my forwarding server and in fact they don't seem to go away, at not any time soon. Meanwhile back on my ldap server I see number of 'too many open files' errors in /var/log/messages and if I try to "su user" on one of the nodes I'll see it hang for awhile. I have bumped the number of open files very high on the ldap server and in fact: [root@aicgateway ~]# cat /proc/sys/fs/file-nr 5610 0 201116 So out of a pool of 200K we're only using 5K. Anyhow, I'm wondering if there are any special tricks to configuring the environment to handling this type of load on ldap OR should it be able to handle it the way I'm currently configured? Any special tuning hints? Any more info I can supply? -mark

3 4

failure to connect ldap
by m.anis 05 Apr '10

05 Apr '10

Hi all, i just install open-ldap server, and i'm following this steps: i'm installing it on FreeBSD 8.0 #*cd /usr/local/etc/openldap* #*sed -I .old 's/rootpw/# rootpw/' slapd.conf* #*echo -n "rootpw ">> slapd.conf* #*slappasswd>> slapd.conf *#*ee /usr/local/etc/openldap/slapd.conf* suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" here what i confused about, i'm running this on localhost, so what should i use? suffix "dc=localhost,dc=localdomain" or my host name ( i got it from nslookup from windows) is 11.<unit name>.<institute name>.ac.id suffix "dc=11.<unit name>.<institute name> ,dc=ac.id" or anything else? then when i tried to do this #*ldapadd -x -D "cn=Manager,dc=*example*,dc=*com*" -W -f domainmgr.ldif -c it asks for my password, then i insert my password and then and error messages occured ldap bind: can't contact LDAP server (-1) i had search through google but i don't get the answer, thanks for your help, * -- -- Best Regards Muhammad Anis

2 1

uri="" bug
by DT Piotr Wadas 04 Apr '10

04 Apr '10

Hello, http://www.openldap.org/lists/openldap-technical/201001/msg00181.html Is it in progress or fixed in repository, or should I try to create a patch? P. -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd version: 8.3.7 (api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

1 2

Sample Large ldiff file to support 1K users
by Meena Ram 03 Apr '10

03 Apr '10

Dear folks: If anyone has sample large ldiff file which supports around 1000 users please let me know. Require it for some particular purpose so that it saves some time.Really appreciate your help on this. Send me the link or the ldif file itself . Cheers!!!!!!!!!!! RAM

1 0

handshake failure / SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr
by Götz Reinicke - IT-Koordinator 01 Apr '10

01 Apr '10

Hi, this drives my crazy for about two days: I do have two virtual Red Hat El 5.4 servers in a test environment. One should be an openldap master, the second should be a openldap slave. openssl-0.9.8e-12.el5_4.1, openldap-2.3.43-3.el5 (RH EL original rpms) I followed some instructions to set up TLS: Set up a CA, generate/sign certificates and keys, install tham on the servers and configure openldap, restart. My problem is: tls works on the master (which also is my CA for the test), but not on the slave. I've "openssl verify"ed and "openssl x509 -text"ed the certs - everything seams o.k. I've checked ip addresses, name resolving, locations, pathes, permissions, fileversions - anything I can think of. I've regenerated the key and cert for the slave following an other documentation (at least with the same steps), but alway do get the same error: from the ldap server debug: TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello B TLS trace: SSL_accept:error in SSLv3 read client hello B TLS: can't accept. TLS: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr.c:975 connection_read(13): TLS accept failure error=-1 id=0, closing from the ldap client debug: TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure May be I missed a step or still skiped something ... A thousand kowtows for any helping hint...!! Best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

remote connections cannot write to LDAP
by Ray Carrender 01 Apr '10

01 Apr '10

Not sure what's going on here, but when I try making a non TLS connection to the LDAP Repository and it's local (say using ldapmodify) I can write to it, but when trying to connect to remotely (on the internal network) it doesn't throw an error but it ignores the write command. Am I missing something here? Maybe it's because I'm using JNDI instead of the written ldapmodify. Also, remotely I can read information, just not write it. Thanks!

2 1

New LDAP Appliances
by Howard Chu 01 Apr '10

01 Apr '10

No, not the VMware kind... http://www.symas.com/blog/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ldap_sasl_interactive_bind_s failed (-2) using openldap v2.3.43 when trying to replicate via syncrepl.
by Kristian Kostecky 01 Apr '10

01 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, I have a configuration that consists of 3 ldap servers. One is the provider and there are 2 consumers. I am using syncrepl to do the synchronization. simple and anonymous binds are totally disabled and Kerberos must be used via SASL (GSSAPI) and TLS to connect to the LDAP server. distro: centos 5.4 openldap 2.3.43 cyrus-sasl 2.1.22 Other things: - - clocks are all in sync - - hostnames all have forward and reverse mappings and all dns servers in /etc/resolv.conf respond with proper entries on the consumer and both providers. Here's the catch, the two providers are configured the same (except for hostnames/ips) and the first one works perfect. What is really frustrating is the lack of logging that is available to tell me what the problem is. I've tried loglevel -1 and it gave me even less info in regards to the SASL authentication than leaving it off. The affected consumer is giving me: Mar 31 22:41:00 ZZZ slapd[2442]: slapd starting Mar 31 22:41:02 ZZZ slapd[2442]: do_syncrep1: rid 010 ldap_sasl_interactive_bind_s failed (-2) Mar 31 22:41:02 ZZZ slapd[2442]: do_syncrepl: rid 010 quitting On the "Provider": Mar 31 17:49:54 XXX slapd[3494]: conn=212 fd=21 ACCEPT from IP=10.130.1.230:60288 (IP=0.0.0.0:389) Mar 31 17:49:54 XXX slapd[3494]: conn=212 op=0 STARTTLS Mar 31 17:49:54 XXX slapd[3494]: conn=212 op=0 RESULT oid= err=0 text= Mar 31 17:49:54 XXX slapd[3494]: conn=212 fd=21 TLS established tls_ssf=256 ssf=256 Mar 31 17:49:54 XXX slapd[3494]: conn=212 op=1 UNBIND Mar 31 17:49:54 XXX slapd[3494]: conn=212 fd=21 closed This is what's REALLY weird - from the affected/broken box, ZZZ, after I kinit, I can do an LDAP search or ldapwhoami, no problems! So, kerberos and GSSAPI via SASL is working fine. ie: ldapsearch -H ldaps://XXX/ -Y GSSAPI -> will dump the entries. or ldapwhoami -H ldaps://XXX/ -Y GSSAPI -> shows me that proper creds If I destroy the credentials, it doesn't work as would be expected. ON the working consumer, the behaviour is that I can ldapsearch and ldapwhoami properly after I kinit and when I start ldap it will authenticate properly with the provider via SASL GSSAPI and replicates the DB. If I kdestroy the credentials and start it, I get the same error that I'm struggling with on the box that doesn't work ->ldap_sasl_interactive_bind_s failed (-2) This behaviour leads me to believe that for some reason the ldap server on the box that doesn't work is having problems transmitting the kerberos credentials to the provider, whereas the ldapsearch and ldapwhoami binaries are not having problems. There are some suspicious differences between the consumer that works and the broken one. The provider and consumer that works both have TLDs that match - '.com' and the consumer whose synrepl process won't authenticate is part of the .eu TLD. However, as you can see below in the krb5.conf files, the .com and .eu TLDS are always mapped to the same authentication realm. PLUS, again, ldapsearch and ldapwhoami WORK. It's just the syncrepl process that isn't quite getting the auth right. This is the provider's pertinent configs: slapd.conf: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 This is the consumer's pertinent configs (WORKS ON one, not on the other) slapd.conf: syncrepl rid=10 provider=ldap://xxx.XXX.com starttls=yes type=refreshOnly interval=00:00:01:00 searchbase="dc=XXX,dc=com" schemachecking=off bindmethod=sasl saslmech=GSSAPI krb5.conf [same as provider and kerb server]: [libdefaults] default_realm = BOUNCE.AAA.COM encrypt = true allow_weak_crypto = false clockskew = 600 dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 8h forwardable = no proxiable = no [realms] BOUNCE.AAA.COM = { kdc = XXX.com kdc = YYY.com kdc = ZZZ.eu admin_server = XXX.com } [domain_realm] .com = BOUNCE.AAA.COM .eu = BOUNCE.AAA.COM All help is greatly appreciated! This has been going on for days and I've already yanked out most of my hair. Thank you. Kris. PGP Key: 4CC63A18 PGP Server: pool.sks-keyservers.net -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) iEYEARECAAYFAkuzyroACgkQ2C/J5/UUQWEuUACdH/BhiZgTXFWbNMXS7Q99k8Rg VY8An3YWKcpnkxVYvZMlelkT0TIpYuAP =O9KI -----END PGP SIGNATURE-----

1 2

Re: Re-engaging the Samba4 LDAP backend
by Endi Sukma Dewata 31 Mar '10

31 Mar '10

Hi Andrew, ----- "Andrew Bartlett" <abartlet(a)samba.org> wrote: > - a replacement for the Samba4 rdn_name module. For OpenLDAP I have > tried out ITS#6055 but it fails, sadly. > http://www.openldap.org/its/index.cgi/Development?id=6055;selectid=6055 > I don't know of any comparable effort in Fedora DS. We're considering this proposal for FDS: http://directory.fedoraproject.org/wiki/RDN_Value At this point it's still being designed, so I can't say yet when this would become available. > - Transaction support. While most of the transaction-aware tasks in > Samba have now been either pushed off as 'too hard on LDAP' or into > modules that are now in the LDAP backend, we still do need > transactions > over LDAP. Transaction on FDS is deferred until later this year: http://directory.fedoraproject.org/wiki/LDAP_Transactions > - A way to easily detect that we have OpenLDAP or Fedora DS > installed > on the system, and what it's version is. Once we have that, we could > start trying to run at least some of Samba4's tests against such a > backend regularly (and stop breaking it so often). The buildsamba02 machine is configured to test against FDS: http://build.samba.org/?function=View+Build;host=buildsamba02;tree=samba_4_… I hope there's somebody who could maintain a similar system configured with OpenLDAP. > - Some help debugging the existing 'make test' failures! I've fixed some FDS-specific failures. I'll send you the patches soon. > To address a broader range of use cases, I'm looking forward to the > work > Endi has promised for a 'ldap backend config file' as input to > provision. Hopefully this will reduce the options we have to present > to > users on the provision command line. Sorry about the delay on this. It's coming but slowly because I have to handle other issues as well. Thanks! -- Endi S. Dewata

2 1

Re: "new style" on ubuntu 8.04
by Luis Paulo 31 Mar '10

31 Mar '10

Thanks, Adam I was afraid of that, but see what made me think otherwise. At http://www.openldap.org/doc/admin24/slapdconf2.html: "the slapd(8) runtime configuration in 2.3 (and later) is fully LDAP-enabled and can be managed using the standard LDAP operations with data in LDIF." - I have slapd 2.4.9 "but must be converted to the new *slapd-config*(5) format to allow runtime changes to be saved". - I did that, but I really don't have the slapd-config man page in */etc/default/slapd* there were already a coment about the the cn=config backend # Default location of the slapd.conf file. If empty, use the compiled-in # default (/etc/ldap/slapd.conf). If using the cn=config backend to store # configuration in LDIF, set this variable to the directory containing the # cn=config data. SLAPD_CONF= And, after all, I've already deleted slapd.conf and authentication is being made with slapd.d/ Please forgive me for insisting. Thanks Are you sure it can't be a matter of ACL, admin authentication, or something else? I'll upgrade to lucid, but it may take a couple of months.

1 0

bdb_reader_get: err Cannot allocate memory(12)
by Кардаш Павел Александро вич 31 Mar '10

31 Mar '10

1 0

ldap.conf
by phiroc＠free.fr 31 Mar '10

31 Mar '10

Hi, is there a way to programmatically retrieve the path to the ldap.conf file (in other words, which conf file the program uses by default)? Many thanks. p

1 0

question about exclusion control of slapd
by Tsukasa Hamano 31 Mar '10

31 Mar '10

Hi, I'm reading the source code of slapd 2.4.21, then I found feel uneasy point. in servers/slapd/bind.c:207 cleanup: if ( rs->sr_err == LDAP_SUCCESS ) { if ( op->orb_method != LDAP_AUTH_SASL ) { ber_dupbv( &op->o_conn->c_authmech, &mech ); } op->o_conn->c_authtype = op->orb_method; } I think that this operation need mutex lock as follows. ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); ... ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); Regards, -- Open Source Solution Technology Corporation Tsukasa Hamano <hamano(a)osstech.co.jp> fingerprint = 2285 2111 6D34 3816 3C2E A5B9 16BE D101 6069 BE55

1 0

Configuring OpenLDAP on Ubuntu 9.10.Need help!
by Shamika Joshi 31 Mar '10

31 Mar '10

I have followed following article to install/configure OpenLDAP on Ubuntu Server 9.10 https://help.ubuntu.com/9.10/serverguide/C/openldap-server.html There is no slapd.conf in picture here instead running "dpkg-reconfigure slapd" should come up with following Wizard (got this after running through numerous articles on this) *Wizard steps:* 1. *omit openldap server configuration? – no* 2. *dns domain name? vm.example.org* 3. *organization name? myCompany* 4. *database backend to use? hdb* 5. *do you want the database to be removed when slapd is purged? yes* 6. *may be the question: move old database? yes* 7. *administrator password? the same one as entered during installation* 8. *confirm password? see last step* 9. *allow LDAPv2 protocol? no* However in my installation wizards asks * Omit OpenLDAP server configuration? No Do you want the database to be removed when slapd is purged? No Allow LDAPv2 protocol? No Creating initial slapd configuration... done. Starting OpenLDAP: slapd. *Has anyone attempted this before? What I'm missing here? Could someone like to pitch in for some help? So when I run "ldapsearch -x" it gives me following output admins@x6:/etc/ldap$ ldapsearch -x # extended LDIF # # LDAPv3 # base <> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 where is should give the output like # extended LDIF # # LDAPv3 # base (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # vm.example.org dn: dc=vm,dc=example,dc=org objectClass: top objectClass: dcObject objectClass: organization o: myCompany dc: vm # admin, vm.example.org dn: cn=admin,dc=vm,dc=example,dc=org objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Thanks Shamika

4 6

Not getting password expiry warnings on login
by Chris Jacobs 31 Mar '10

31 Mar '10

Hello, I've gotten our password policy to function as it should - password expire requiring password changes, can't use old passwords, etc. I'm working on last little detail - getting the password expiration warning to display. For example, I see in the logs: "Mar 29 19:27:38 ldapmaster1 slapd[32653]: ppolicy_bind: Setting warning for password expiry for uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net = 3141 seconds" But I never get the notice on login clients - regardless of client type (even from machine to itself). I suspect ya'll are going to be interested in ldap.conf and pam config, so here they are, along with some possibly relevant bits: /etc/ldap.conf: uri ldaps://ldapmaster1.corp.aptimus.net timelimit 10 bind_timelimit 10 bind_policy soft base dc=unix,dc=aptimus,dc=net scope sub ssl on tls_checkpeer no tls_cacertfile /etc/openldap/cacert.pem pam_login_attribute uid pam_lookup_policy yes pam_password exop /etc/pam.d/system-auth-ac: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so # ssh -V OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006 # grep -i pam /etc/ssh/sshd_config # Set this to 'yes' to enable PAM keyboard-interactive authentication # PAMAuthenticationViaKbdInt no UsePAM yes Ppolicy directives in /etc/openldap/slapd.conf (under the sold database definition): overlay ppolicy ppolicy_hash_cleartext ppolicy_use_lockout AND just for giggles, I decided to see if I could get the version of pam_ldap.so that's installed, and ran strings on it. I notice two things: 1.3.6.1.4.1.42.2.27.8.5.1 (objectclass=passwordPolicy) The ppolicy.schema file compiled used IDs 1.3.6.1.4.1.42.2.27.8.1.x - not ..8.5.x - could I possibly have some weird mismatch here? (I suspect and hope that the last bit here is a totally unrelated red herring.) Thanks, - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 4

AD, freeradius, openldap combination
by Serge Fonville 31 Mar '10

31 Mar '10

Hi, I'm setting up a HA environment with centralized user administration. I'm currently considering the following setup For MS clients, authenticate directly to AD For *nix clients, authenticate to an OpenLDAP proxy which authenticate to AD For Routers/switches use FreeRadius to authenticate against the OpenLDAP proxy The goals for the setup are: 1. One login for all networked nodes 2. Centralized user authentication 3. Single resource for user information 4. Highly available authentication service 5. No serious performance impact 6. Alternative login when service is unavailable 7. Easily scalable 8. Easy rollout 1, 2, 3 and 7 are achieved using AD 4 can be achieved by a combination of a loadbalancer for each service and multiple instances of each service not sure if 5 is realistic, but it should be possible I suppose 6 is no problem for any host 8 can be done through scripting What I would like to know now is: Is it advisable to set it up like this? Are there 'better' ways to achieve the same result. (performance, availability, ease of maintenance) Would it be better to let radius talk directly to AD, possibly even using the MS radius server. Is it advisable to use an OpenLDAP proxy for *nix authentication or can I just as well use AD directly. The main reasons for me to assume this setup is the most suitable are: AD replicates by default OpenLDAP proxy does not need to replicate OpenLDAP is more 'compatible' with the *nix clients FreeRadius does not need to replicate All can be loadbalanced easily. The main question I want to know from the OpenLDAP list is: "how well does the OpenLDAP proxy perform?" For the remainder, if anyone wants to shed some light on this, I would greatly appreciate it. Thanks a lot in advance. Regards, Serge Fonville -- http://www.sergefonville.nl Convince Google!! They need to support Adsense over SSL https://www.google.com/adsense/support/bin/answer.py?hl=en&answer=10528 http://www.google.com/support/forum/p/AdSense/thread?tid=1884bc9310d9f923&h…

1 0

Re: Configuring OpenLDAP on Ubuntu 9.10 [using slapd.conf??]
by Shamika Joshi 31 Mar '10

31 Mar '10

Thank you guys for your help! I'll try my way through it. One more question here, i have a old working slapd.conf file from a RHEL server, if I want to same slapd.conf file & provide its path in /etc/default/slapd as SLAPD_CONF=/etc/ldap/slapd.conf should that work? Or should I need to make more changes? Has anyone done this before? Any articles you may want to suggest I should go through to achieve this? Thanks Shamika On Tue, Mar 30, 2010 at 5:43 PM, Matt Kassawara <mkassawara(a)gmail.com>wrote: > Starting with Ubuntu Karmic (9.10), the slapd package changed from creating > a typical LDAP administrator account (i.e., username and password) to using > LDAPI and SASL EXTERNAL which automatically provides LDAP administrator > access via the system root account. As root, run your LDAP utilities with > "-Y external -H "ldapi:///" instead of "-x", "-D", and "-W" where > appropriate. For example, to search your LDAP directory: > > ldapsearch -Y external -H "ldapi:///" -b dc=domain,dc=com > > I'm not sure why the Ubuntu Server Guide for 9.10 did not get updated to > reflect these changes, but if you search the web for "ubuntu sasl external" > you'll get quite a few hits on the issue. You may also want to read these > bugs when configuring clients: > > https://bugs.launchpad.net/bugs/423252 > > https://bugs.launchpad.net/bugs/427842 > > Matt > > > On 3/30/10 4:04 AM, Shamika Joshi wrote: > >> I have followed following article to install/configure OpenLDAP on >> Ubuntu Server 9.10 >> https://help.ubuntu.com/9.10/serverguide/C/openldap-server.html >> >> There is no slapd.conf in picture here instead running "dpkg-reconfigure >> slapd" should come up with following Wizard (got this after running >> through numerous articles on this) >> >> *Wizard steps:* >> >> 1. *omit openldap server configuration? – no* >> 2. *dns domain name? vm.example.org <http://vm.example.org>* >> 3. *organization name? myCompany* >> 4. *database backend to use? hdb* >> 5. *do you want the database to be removed when slapd is purged? yes* >> 6. *may be the question: move old database? yes* >> 7. *administrator password? the same one as entered during installation* >> 8. *confirm password? see last step* >> 9. *allow LDAPv2 protocol? no* >> >> >> However in my installation wizards asks >> * >> Omit OpenLDAP server configuration? No >> Do you want the database to be removed when slapd is purged? No >> Allow LDAPv2 protocol? No >> Creating initial slapd configuration... done. >> Starting OpenLDAP: slapd. >> >> *Has anyone attempted this before? What I'm missing here? Could someone >> like to pitch in for some help? >> >> So when I run "ldapsearch -x" it gives me following output >> >> admins@x6:/etc/ldap$ ldapsearch -x >> # extended LDIF >> # >> # LDAPv3 >> # base <> (default) with scope subtree >> # filter: (objectclass=*) >> # requesting: ALL >> # >> >> # search result >> search: 2 >> result: 32 No such object >> >> # numResponses: 1 >> >> >> where is should give the output like >> >> # extended LDIF >> # >> # LDAPv3 >> # base (default) with scope subtree >> # filter: (objectclass=*) >> # requesting: ALL >> # >> >> #vm.example.org <http://vm.example.org> >> >> >> dn: dc=vm,dc=example,dc=org >> objectClass: top >> objectClass: dcObject >> objectClass: organization >> o: myCompany >> dc: vm >> >> # admin,vm.example.org <http://vm.example.org> >> >> dn: cn=admin,dc=vm,dc=example,dc=org >> >> objectClass: simpleSecurityObject >> objectClass: organizationalRole >> cn: admin >> description: LDAP administrator >> >> # search result >> search: 2 >> result: 0 Success >> >> # numResponses: 3 >> # numEntries: 2 >> >> >> >> Thanks >> Shamika >> >

1 0

"new style" on ubuntu 8.04
by Luis Paulo 31 Mar '10

31 Mar '10

Hi, all I am installing openldap for the first time. On ubuntu 8.04 server. Things are going, I have a server, still without SASL, and a client working. I used the migration tools, and set rootdn and rootpw on my database conf I was reading a bit more, and I saw a command that didn't work $ ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}hdb on https://help.ubuntu.com/9.10/serverguide/C/openldap-server.html (note, 9.10, not 8.04) A bit more reading, and I tried to get the "new style" configuration as in http://www.openldap.org/doc/admin24/slapdconf2.html with $ sudo mkdir /etc/ldap/slapd.d $ sudo chown -R openldap:openldap /etc/ldap/slapd.d $ sudo slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d and change, in */etc/default/slapd*, SLAPD_CONF=/etc/ldap/slapd.d Still can't run the command (with the plain rootpw password from the old slapd.conf) $ ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}hdb ldap_bind: Invalid credentials (49) I've read http://www.openldap.org/doc/admin24/appendix-common-errors.html and am now trying to check things and reading around the "new style" and ACL's. Should I be able to run that command and use the "new style" with ubuntu 8.04 (hardy)? If so, I'll thank you for any help. PS: ii slapd 2.4.9-0ubuntu0.8.04.3 OpenLDAP server (slapd) ii ldap-utils 2.4.9-0ubuntu0.8.04.3 OpenLDAP utilities ii migrationtools 47-3ubuntu2 Migration scripts for LDAP Linux main 2.6.24-27-server #1 SMP Fri Mar 12 01:23:09 UTC 2010 x86_64 GNU/Linux

1 0

ldap_ssl_client_init equivalent?
by phiroc＠free.fr 30 Mar '10

30 Mar '10

Hi, is there a ldap_ssl_client_init function in the openldap C API? I couldn't find any in the openldap header files. What is the equivalent of the following ldapsearch query in C using the API, on Linux? ldapsearch -x -H 'ldaps://activedirectory.abc.com/636' -b 'dc=abc,dc=com' -D 'testdn' -W '(&(objectclass=user)(!(objectclass=computer))(samaccountname=myname))' samaccountname Many thanks. p

2 1

Re: ldap_ssl_client_init equivalent?
by masarati＠aero.polimi.it 30 Mar '10

30 Mar '10

> Hi, > > is there a ldap_ssl_client_init function in the openldap C API? I couldn't > find any in the openldap header files. Because there isn't. > > What is the equivalent of the following ldapsearch query in C using the > API, on Linux? > > ldapsearch -x -H 'ldaps://activedirectory.abc.com/636' > -b 'dc=abc,dc=com' -D 'testdn' > -W '(&(objectclass=user)(!(objectclass=computer))(samaccountname=myname))' > samaccountname You can find that information in clients/tools/common.c clients/tools/ldapsearch.c p.

1 0

Re-engaging the Samba4 LDAP backend
by Andrew Bartlett 30 Mar '10

30 Mar '10

I'm trying to pick up the ball again on the OpenLDAP and Fedora DS backends, and hopefully to bring them back up to speed as a working and respectable solution. LDB will always be the Samba Team's primary backend for Samba4. This is particularly the case as there seems no reasonable prospect that we will do DRS replication against the OpenLDAP or FedoraDS backeed. (This simplifies the requirements dramatically). However, we do need them to work, as far as practical, for the rest of Samba4's DC functionality. The things I need soon from the backends are: - a replacement for the Samba4 rdn_name module. For OpenLDAP I have tried out ITS#6055 but it fails, sadly. http://www.openldap.org/its/index.cgi/Development?id=6055;selectid=6055 I don't know of any comparable effort in Fedora DS. - A RID allocation tool. Fedora DS has the 'distributed numeric assignment' plugin, and I'm sure it will be no challenge for OpenLDAP to match it. Safely adding new users to an OpenLDAP backend really does need a safe way to allocate RID values. - A way to invoke slpad -Ttest -f <config file> -F <config dir> without issuing errors because of the missing databases - Transaction support. While most of the transaction-aware tasks in Samba have now been either pushed off as 'too hard on LDAP' or into modules that are now in the LDAP backend, we still do need transactions over LDAP. - A way to easily detect that we have OpenLDAP or Fedora DS installed on the system, and what it's version is. Once we have that, we could start trying to run at least some of Samba4's tests against such a backend regularly (and stop breaking it so often). - Some help debugging the existing 'make test' failures! To address a broader range of use cases, I'm looking forward to the work Endi has promised for a 'ldap backend config file' as input to provision. Hopefully this will reduce the options we have to present to users on the provision command line. (Apologies in advance for the cross-post to multiple member-only lists, but I just wanted to get everyone on the same page). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc.

3 2

Re: ldap
by Patrick Mburu 30 Mar '10

30 Mar '10

Hi all, Thanks for your help, i created another domain and from my slapcat output i get this dn: dc=mycompnay,dc=com objectClass: dcObject objectClass: organization o: mycompany dc: mycompany structuralObjectClass: organization entryUUID: e235aa56-cd4a-102e-9e99- 4f8ab88a5141 creatorsName: cn=root,dc=mycompany,dc=com modifiersName: cn=root,dc=mycompany,dc=com createTimestamp: 20100326174351Z modifyTimestamp: 20100326174351Z entryCSN: 20100326174351Z#000000#00# 000000 dn: dc=mycompany,dc=local objectClass: dcObject objectClass: organization o: mycompany dc: mycompany structuralObjectClass: organization entryUUID: 4c85f2e4-cf9e-102e-9a60- f35afa4f4768 creatorsName: cn=root,dc=mycompany,dc=local modifiersName: cn=root,dc=mycompany,dc=local createTimestamp: 20100329164559Z modifyTimestamp: 20100329164559Z entryCSN: 20100329164559Z#000000#00# 000000 i want to delete the first domain entry "dc=mycompany,dc=com"so i am left with the last one ie "dc=mycompany,dc=local" Also, i get this error from ldasearch; ldap_bind Can't contact LDAP server, i have gotten a lead on linuxquestions which i will try end of day, but a quick suggestion will be appreciated. I am doing some good reading on openldap so it wont be long until i get openldap right. I am also checking on the forums. This is a small project i am working on, and soon i will be doing ZCS running on CentOS. Thanks in advance. ________________________________ From: Patrick Mburu <patrick_lists(a)yahoo.com> To: openldap-technical(a)openldap.org Sent: Mon, March 29, 2010 12:37:01 PM Subject: ldap Hi all, I have been trying to work with my .ldif file which looks like below but i get an error: All Services are started in this scenario; My ldif file dn: dc=mycompany,dc=COM objectclass: dcObject objectclass: organization o: mycompany dc: mycompany dn: cn=root,dc=mycompany,dc=COM objectclass: organizationalRole cn: root Error => bdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => bdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=mycompnaye,dc=com" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) What am i not getting right, urgent help needed.

2 1

ldap
by Shabbir Ahmed 30 Mar '10

30 Mar '10

hi, i am running a directory service which will hold about a million entries which is running openldap mean time, i m runnig a oracle DB which holds the same db for SQL clients and i store the same data in openldap as well for the client of directory services, now what i want is to run a single DB (oracle) and openldap should be able to access it from there or any other directory service, now i want a good suggestion from you people whether i should run Oracle Internet Directory and make changes in SQL db which is reflected in Directory. second option is to run ldap but compiled with oracle DB as backend besides BDB so the data is saved in one place and when ever directory client accesses it openldap fetches it from the oracle DB and replies to client. third option is that i run it as it is with duplicating data in both oracle db and openldap but i am only worried for the performance issues in future ill face. Ill be thank full for the help.

3 2

Active Directory schema into OpenLDAP
by Shahzad Fateh Ali 30 Mar '10

30 Mar '10

Hi, I need to store Active Directory Data into OpenLDAP and for that I want to create the Active Directory schema into OpenLDAP. How to do it? -- Shahzad Fateh Ali C: +92 334 392 4334

4 5

libldap mutex hang on ldap_int_sasl_mutex
by Jeremiah Martell 29 Mar '10

29 Mar '10

I'm using openldap-2.4.18, library libldap_r. I have three windows active directory servers setup: childA.parent.example.com parent.example.com childB.parent.example.com I do a LDAP+GSSAPI bind to childA.parent.example.com. The bind succeeds. I do a search that returns referrals, (I know I need to be referred to parent, and then childB in order to find my result), and I have openldap follow referrals for me. My rebind proc is a function that only calls: ldap_sasl_interactive_bind_s( ld, NULL, NULL, NULL, NULL, LDAP_SASL_AUTOMATIC, sasl_driver, params ); where sasl_driver and params is the same parameters that I used for the initial bind call to childA. After the seach call, the debug it looks like this: > ldap_chase_v3referrals, where ref[0] = parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s < ldap_sasl_interactive_bind_s < myGSSAPIrebindProc < ldap_chase_v3referrals > ldap_chase_v3referrals, where ref[0] = childB.parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s > ldap_chase_v3referrals, where ref[0] = childA.parent.example.com < ldap_chase_v3referrals > ldap_chase_v3referrals, where ref[0] = ForestDnsZones.parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s ... HANG ON MUTEX Since this is hanging on a mutex, that would suggest a code bug. Perhaps the ldap_int_sasl_mutex needs to be a recursive mutex? Or should my rebind proc do something different than call ldap_sasl_interactive_bind_s? Any other ideas appreciated too. Thanks, - Jeremiah

1 0

ldap
by Patrick Mburu 29 Mar '10

29 Mar '10

Hi all, I have been trying to work with my .ldif file which looks like below but i get an error: All Services are started in this scenario; My ldif file dn: dc=mycompany,dc=COM objectclass: dcObject objectclass: organization o: mycompany dc: mycompany dn: cn=root,dc=mycompany,dc=COM objectclass: organizationalRole cn: root Error => bdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => bdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=mycompnaye,dc=com" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) What am i not getting right, urgent help needed.

2 1

Starting OpenLDAP: slapd - failed: Unrecognized database type (bdb)..Help required!
by Shamika Joshi 29 Mar '10

29 Mar '10

I'm a beginner with Openldap & trying to bring up LDAP server on UbuntuServer with Berkleys db-4.8.26 installed gives following error on starting the slapd service. Previously I have done sucessful configuration on RHEL & Fedora but for some reason it is not working for me on Ubuntu server. Could someone throw some light on this? Am I missing something? shamika@ns1:/etc/ldap$ sudo /etc/init.d/slapd start Starting OpenLDAP: slapd - failed: Unrecognized database type (bdb) shamika@ns1:~$ uname -msrnv Linux ns1.cmsqalab.com 2.6.31-14-server #48-Ubuntu SMP Fri Oct 16 15:07:34 UTC 2009 x86_64 Snapshot from /var/log/syslog Mar 29 19:41:47 x6u slapd[17730]: @(#) $OpenLDAP: slapd 2.4.18 (Sep 8 2009 17:47:22) $#012#011buildd@crested :/build/buildd/openldap-2.4.18/debian/build/servers/slapd Mar 29 19:41:49 x6u slapd[17730]: /etc/ldap/slapd.conf: line 88: <database> failed init (bdb) Mar 29 19:41:49 x6u slapd[17730]: slapd stopped. Mar 29 19:41:49 x6u slapd[17730]: connections_destroy: nothing to destroy. Here is my slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema #include /etc/ldap/schema/dnszone.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la access to * by * write # access to * # by self write # by users read ## by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix dc=cmsqalab,dc=com rootdn cn=Manager,dc=cmsqalab,dc=com # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}+1DFJ0tLWAd1u3zDUw04rDtnwPKbEFy9 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/cmsqalab.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub 69,1 91%

2 1

OpenLDAP Manual/ Broken Links.
by Dzmitry Stremkouski 29 Mar '10

29 Mar '10

Hello guys. The part of OpenLDAP Manual (wich can be found here - http://www.openldap.org/doc/admin23/schema.html) contains a lot of broken links. Please correct. FE: http://www.alvestrand.no/harald/objectid/ - dead A: http://www.bsa-global.com/ - dead (doesn't look good enough for global OID authority) A: http://www.iana.org/cgi-bin/enterprise.pl - should be (redirect, but futher, IMHO, will be dead, try http://pen.iana.org/pen/PenApplication.page) Thanks. -- <pre> (o_ - Dzmitry Stremkouski. //\ - cel: +7 (916) 090-85-68 V_/_- web: http://mitroko.com </pre>

2 1

Where to start a migration from passwd/shadow/smbpasswd to openldap
by Götz Reinicke - IT-Koordinator 29 Mar '10

29 Mar '10

Hi, a couple of weeks ago I started to learn ldap and set up some test servers with the latest openldap for centos 5.4. I learned about schemas, ldif, ldap browsers etc. So I have an advanced basic knowledge about the technical fundamentals. The primary goal is to have the login information for our mail and fileserver system in one place. Right now we do use sendmail, dovecot and samba. After testing some of the migration tools for migrating posix and sambaSam accounts, I was asking myselve: what is the best way to start the migration? Right now the directory is completely empty, so I can start from scratch. Both types of accounts do have different attributes and furthermore I'd like to use some inetOrgPerson/organizationalPerson attributes. So should I first run the smbldaptool or first fill the directory with the migrate_....sh script? Thanks for any suggestion or comment or pointing me to any how to/doc. Best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Staatsrätin für Demographischen Wandel und für Senioren im Staatsministerium Geschäftsführer: Prof. Thomas Schadt

3 4

Re: Re: Re: Pre-requisites to enable SSL/TLS in OpenLDAP 2.4
by Arun Srinivasan 29 Mar '10

29 Mar '10

Thanks, Quanah and Dieter. I was able successfully link TLS/SSL libraries with slapd after installing openssl-devel package. Thanks for your help guys. But I do have one query: when I used the below command, eventhough configure found the openssl libraries, it gave the warning as "Checking gnutls.h ... no" Configure: warning: Could not locate TLS/SSL libraries. Then, when I removed the CPPFLGAS and LDDFLAGS linking openssl libraries, then all worked fine. Is there any reason, why the openldap configure refers the gnutls ?? env CPPFLAGS="-I/usr/local/ssl/include -I/usr/local/BerkeleyDB.4.8/include" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.4.8/lib -R/usr/local/BerkeleyDB.4.8/lib -L/usr/local/ssl/lib" LD_LIBRARY_PATH="/usr/local/BerkeleyDB.4.8/lib" ./configure --with-tls > Did you actually install the openssl-dev RPM package? You must have > the headers and linking libraries on the system so that OpenLDAP can > actually link against it. And yes, you'll have to rebuild OpenLDAP. > I would suggest just running "configure" until you see that it > successfully found the TLS/SSL headers/libraries.

1 0

Re: Problem with getent passwd
by Tyler Gates 27 Mar '10

27 Mar '10

Actually I misspoke earlier -I meant run the command 'setup' from the terminal and select authentication. From there you should see "User Information" and "Authentication" columns. Just check LDAP in "User Information" and you should see getent populate the passwords. That normally does the trick.. pretty simple but if that doesn't work I'd check your /etc/ldap.conf is setup correctly (I mostly have to just add the host information and base dn). Other wise your LDAP server doesn't have the attributes its' expecting from its queries to generate user account information. On 03/24/2010 08:09 AM, Lynn York wrote: > Here is my /etc/pam.d/system-auth file > > > > cat /etc/pam.d/system-auth > > #%PAM-1.0 > > # This file is auto-generated. > > # User changes will be destroyed the next time authconfig is run. > > auth required pam_env.so > > auth sufficient pam_unix.so nullok try_first_pass > > auth requisite pam_succeed_if.so uid >= 500 quiet > > auth sufficient pam_ldap.so use_first_pass > > auth required pam_deny.so > > > > account required pam_unix.so broken_shadow > > account sufficient pam_succeed_if.so uid < 500 quiet > > account [default=bad success=ok user_unknown=ignore] pam_ldap.so > > account required pam_permit.so > > > > password requisite pam_cracklib.so try_first_pass retry=3 > > password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > > password sufficient pam_ldap.so use_authtok > > password required pam_deny.so > > > > session optional pam_keyinit.so revoke > > session required pam_limits.so > > session [success=1 default=ignore] pam_succeed_if.so service in crond > quiet use_uid > > session required pam_unix.so > > session optional pam_ldap.so > > > > > > Also, when I ran authconfig, that didn’t help. The server still queries the > ldap server, but the users don’t actually show when I run getent passwd….. > could it be something with the rwm mappings? > > > > *From:* Tyler Gates [mailto:tgates81@gmail.com] > *Sent:* Tuesday, March 23, 2010 8:26 PM > *To:* Lynn York > *Subject:* Re: Problem with getent passwd > > > > Sounds like it's a problem with your client side pam_ldap authentication. > There's a whole buch of steps to get that working, just google it. If you > have a redhat variant authconfig or setup will step you through it. It would > help if you could post your system_auth file. > > On Mar 23, 2010, at 11:40 AM, Lynn York <lynn.york(a)mavenwire.com> wrote: > > Hello, > > > > When I issue “getent passwd” I can see it query the ldap > server for all the information and the server is returning the correct > information. However, “getent passwd” doesn’t actually show the users that > are in ldap. I am not sure where my problem might be. Can anyone offer any > suggestions on where to look? > > > > Lynn York II > > MavenWire Hosting Admin > > www.mavenwire.com > > (866) 343-4870 x717 > > > > MavenWire - We DELIVER > > http://www.mavenwire.com > > > > This e-mail and any attached files may contain confidential and/or > privileged material for the sole use of the intended recipient. Any review, > use, distribution or disclosure by others is strictly prohibited. If you are > not the intended recipient (or authorized to receive this e-mail for the > recipient), you may not review, copy or distribute this message. Please > contact the sender by reply e-mail and delete all copies of this message. > > > > MavenWire - We DELIVER > > http://www.mavenwire.com > > > > This e-mail and any attached files may contain confidential and/or > privileged material for the sole use of the intended recipient. Any > review, use, distribution or disclosure by others is strictly > prohibited. If you are not the intended recipient (or authorized to > receive this e-mail for the recipient), you may not review, copy or > distribute this message. Please contact the sender by reply e-mail > and delete all copies of this message. > > MavenWire - We DELIVER > http://www.mavenwire.com > > This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. > >

3 6

Problems using OpenLDAP with Active Directory
by Mike Leone 26 Mar '10

26 Mar '10

I'm trying to configure lib-nss to use OpenLDAP against my Active Directory. But I seem to be having lots of problems even getting it to search properly. I have Samba all properly configured for AD - it's properly joined to the AD domain, and all seems to be working fine. Now I'd like to investigate using OpenLDAP to authenticate against AD. AD server = 10.0.0.60 AD server name = dim-win2300.dacrib.local AD domain name = DaCrib.local AD Win2003 SP2 (with Services for Unix installed0 Linux server: IP = 10.0.0.20 Ubuntu 9.04 OpenLDAP 2.4.2 (from repository) Here's the /etc/ldap/ldap.conf: ------------------------ host 10.0.0.60 base dc=DaCrib,dc=local binddn CN=Administrator,CN=Users,dc=DaCrib,dc=local bindpw XXXXX # RFC 2307 (AD) mappings # <to> <from> nss_map_attribute userPassword sambaPassword nss_map_attribute gecos name nss_map_attribute uid unixName nss_map_attribute shadowLastChange pwdLastSet nss_map_objectclass posixGroup group pam_filter objectclass=User pam_password crypt nss_initgroups_ignoreusers avahi,backup,bin,daemon,dhcp,dovecot,festival,games,gnats,haldaemon,hplip,irc,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,polkituser,postfix,proxy,root,saned,sshd,sync,sys, syslog,uucp,www-data -------------------------- Here's what an "ldapsearch" gives me: (command line will wrap in email) -------------------------- ldapsearch -v -x -H ldap://10.0.0.60 "(objectClass=posixAccount)" sAMAccountName ldap_initialize( ldap://10.0.0.60:389/??base ) filter: (objectClass=posixAccount) requesting: sAMAccountName # extended LDIF # # LDAPv3 # base <dc=DaCrib,dc=local> (default) with scope subtree # filter: (objectClass=posixAccount) # requesting: sAMAccountName # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece # numResponses: 1 ---------------------------- So the question is ... why is it failing to bind? No firewalls are running on either server (at the moment). It should bind anonymously (I think). I tried turning up the debug level on the ldapsearch, but that told me nothing I could understand. :-) I tried "-W" so it would prompt for a password, but it says "invalid credentials", even thought I have verified the password of the Administrator account. From Windows, I can run ldp and bind (as administrator) and search with no problems. Similarly, I can use the command line utility "adfind" and search without issues, without binding. So I've got something screwy in my ldap.conf, but I can't figure out where. Thoughts?

2 2

Followup: using OpenLDAP with Active Directory
by Mike Leone 26 Mar '10

26 Mar '10

So I've made *some* progress. I created a new user in AD, and used this new account to bind with. And, using simple authentication and password prompting, my search worked correctly: ldapsearch -Hldap://dim-win2300.dacrib.local -tt -x -D "ldap-proxy(a)dacrib.local" -b "dc=dacrib,dc=local" -W -L "(objectClass=user)" dn However, I can't seem to get it to work, if I don't specify the ID and password to bind with: ---------------------------- ldapsearch -v -x -Hldap://dim-win2300.dacrib.local "(objectClass=user)" sAMAccountName ldap_initialize( ldap://dim-win2300.dacrib.local:389/??base ) filter: (objectClass=user) requesting: sAMAccountName # extended LDIF # # LDAPv3 # base <dc=DaCrib,dc=local> (default) with scope subtree # filter: (objectClass=user) # requesting: sAMAccountName # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece # numResponses: 1 -------------------------- I thought perhaps the problem was that SASL was interferring, so I tried to turn it off in ldap.conf, but that didn't seem to work. As an aside, where does ldap.conf live, in Ubuntu 9.04? I have 2, one in /etc and one in /etc/ldap. And I don't know which one (if either) is being read ... is there any way to tell which one is in use? ------------------- host 10.0.0.60 base dc=DaCrib,dc=local #binddn CN=ldap-proxy,CN=Users,DC=DaCrib,DC=local binddn ldap-proxy(a)dacrib.local bindpw XXXXXXXX use_sasl off SASL_SECPROPS none SSL no # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) # rootbinddn cn=Administrator,dc=dacrib,dc=local # RFC 2307 (AD) mappings # <to> <from> nss_map_attribute userPassword sambaPassword nss_map_attribute gecos name nss_map_attribute uid unixName nss_map_attribute shadowLastChange pwdLastSet nss_map_objectclass posixGroup group pam_filter objectclass=User pam_password crypt nss_initgroups_ignoreusers avahi,backup,bin,daemon,dhcp,dovecot,festival,games,gnats,haldaemon,hplip,irc,klog,li buuid,list,lp,mail,man,messagebus,mysql,news,polkituser,postfix,proxy,root,saned,sshd,sync,sys,syslog,uucp,www-d ata ----------------------- Anyone? I feel I am close, but can't figure out why doing it interactively from the command line binds and searches, and relying on the ldap.conf to supply that information does not ... Thanks

1 0

syncrepl connection / reconnect
by Thorsten Mueller 26 Mar '10

26 Mar '10

Hi, I am using two slapd 2.4.20 in mirror mode. Everything seem to work fine. When I shut down slapd_A, I can see the connection retries in the log of B. After restarting A everything is fine. Replication works in both directions. When I switch off the machine hosting A, B does not log anything. After starting machine A, replication only works from B to A and not from A to B. Only after restarting slapd_B the connection is reestablished and the changes are synced. I see the same behavior, if I just do a "ifconfig eth0 down". The remaining slapd seems not to recognize a loss of the network connection. Is this a bug in openldap, or a configuration issue on my side? Thanks, Thorsten

3 5

Re: tls private key
by Chris Jacobs 26 Mar '10

26 Mar '10

There's one sure fire way to find out... Start it up with a syncrepl, then move the private key, and see if it syncs fine both ways. Wait a day or so, and make a change and see if that synced. If I had to put a dollar on it, if guess that it doesn't need the key after startup. I could be horribly wrong though - I'm not a dev, just a user of the software. :) - chris Chris Jacobs, Jr. Unix System Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Thu Mar 25 18:44:47 2010 Subject: Re: tls private key HI On Fri, Mar 26, 2010 at 12:09 PM, Tyler Gates <tgates81(a)gmail.com> wrote: > Alex, > encrypting the private key really isn't necessary and I highly doubt it > would work for your application nor be worth the hassel. Securing via file > permisssions as mentioned previously is really the best way to tackle this. > Think of 'other layers of protection' being firewalls, intrusion detection, > restricted logins, chroot jails, etc., etc... yep go those, firewalls, permissions etc. I am not sure why every one is against me trying to use another layer of protection, just because I permission it as root.root 440, doesn't mean its safe. I could make it safer, but unecrypting the private key, starting slapd and removing the unecrypted file. Or thing of it another way, my private key could be on a usb key, that i insert into the machine on start up and remove once slapd has started. I have seen secure machine compromised before, somebody installed cvs forgot to change the cvs userid password, root hack and a remote user had access to the system. Some times people do silly things on my laptop - I encrypt the fs and the swap space and my gpg key have userid/passwords and my certs have userid password protection, like to do the same for my ldap setup as well :) I understand the reasons for encrypting and signing packets or information, just asking if slapd needs access to the private key after it has read the file on startup. > Encryption really works best for UDP like transportation like email where > you cannot guarantee the recipient is the only person able to 'see' the > document ;) > [snip] This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

3 2

tls private key
by Alex Samad 26 Mar '10

26 Mar '10

Hi I am setting up my sync repl to use certificates, my problem is I don't want to leave my private key for the server un encrypted. the file pointed to by TLSCertificateKeyFile is is just read at slapd load up time, ie can i unencrypt the file start slapd and then remove the un encrypted file ? Alex

4 5

Slapd database goes corrupt repeatedly after recovery
by Kaspar Fischer 25 Mar '10

25 Mar '10

Dear list, We are using an OpenLDAP/slapd server to manage the user accounts of our Samba server and have recently run into the problem that users cannot connect to Samba drives anymore after some time. Samba complains that it cannot connect to the LDAP server (see below for error message in Samba log) and the slapd log shows Mar 25 11:38:15 office-server slapd[3433]: <= bdb_equality_candidates: (gidNumber) not indexed Mar 25 11:38:15 office-server slapd[3433]: <= bdb_equality_candidates: (gidNumber) not indexed Mar 25 11:38:15 office-server slapd[3433]: <= bdb_equality_candidates: (uid) not indexed Mar 25 11:38:15 office-server slapd[3433]: <= bdb_equality_candidates: (gidNumber) not indexed Mar 25 11:38:15 office-server slapd[3433]: <= bdb_equality_candidates: (sambaSID) not indexed Mar 25 11:38:15 office-server slapd[3433]: <= bdb_equality_candidates: (sambaSID) not indexed Mar 25 11:38:15 office-server slapd[3433]: bdb(dc=foo,dc=org): file id2entry.bdb has LSN 1/382892, past end of log at 1/283666 Mar 25 11:38:15 office-server slapd[3433]: bdb(dc=foo,dc=org): Commonly caused by moving a database from one database environment Mar 25 11:38:15 office-server slapd[3433]: bdb(dc=foo,dc=org): to another without clearing the database LSNs, or by removing all of Mar 25 11:38:15 office-server slapd[3433]: bdb(dc=foo,dc=org): the log files from a database environment Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): DB_ENV->log_flush: LSN of 1/382892 past current end-of-log of 1/283666 Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): Database environment corrupt; the wrong log files may have been removed or incompatible database files imported from another environment Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): id2entry.bdb: unable to flush page: 5 Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): DB_ENV->log_flush: LSN of 1/378772 past current end-of-log of 1/283666 Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): Database environment corrupt; the wrong log files may have been removed or incompatible database files imported from another environment Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): id2entry.bdb: unable to flush page: 7 Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): DB_ENV->log_flush: LSN of 1/373647 past current end-of-log of 1/283666 Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): Database environment corrupt; the wrong log files may have been removed or incompatible database files imported from another environment Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): id2entry.bdb: unable to flush page: 8 Mar 25 11:38:17 office-server slapd[3433]: bdb(dc=foo,dc=org): txn_checkpoint: failed to flush the buffer cache: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 11:38:51 office-server slapd[3433]: conn=62 op=29 do_search: invalid dn (sambaDomainName=,sambaDomainName=foo,dc=foo,dc=org) Mar 25 11:38:51 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 11:39:01 office-server slapd[3433]: last message repeated 26 times Mar 25 11:39:01 office-server CRON[3657]: (root) CMD ( [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -n 200 -r -0 rm) Mar 25 11:39:14 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 11:39:47 office-server slapd[3433]: last message repeated 35 times Mar 25 11:39:48 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 11:39:49 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 11:39:50 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 11:40:51 office-server slapd[3433]: last message repeated 164 times Mar 25 11:40:51 office-server slapd[3433]: last message repeated 3 times Mar 25 11:40:52 office-server slapd[3433]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 11:41:53 office-server slapd[3433]: last message repeated 294 times Strangely, restarting slapd helps and users can use Samba again for a limited and arbitrary period of time until the problem pops up again. I tried fixing the database using db4.7_recover -v -h /var/lib/ldap but again, the problem pops up again later. I realized that when I shut down slapd using "/etc/init.d/slapd stop", it complains about the database being corrupt (even if so far no problems appeared): Mar 25 10:12:35 office-server slapd[16880]: slapd shutdown: waiting for 0 operations/tasks to finish Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): DB_ENV->log_flush: LSN of 1/382892 past current end-of-log of 1/278482 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): Database environment corrupt; the wrong log files may have been removed or incompatible database files imported from another environment Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): id2entry.bdb: unable to flush page: 5 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): DB_ENV->log_flush: LSN of 1/378772 past current end-of-log of 1/278482 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): Database environment corrupt; the wrong log files may have been removed or incompatible database files imported from another environment Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): id2entry.bdb: unable to flush page: 7 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): DB_ENV->log_flush: LSN of 1/373647 past current end-of-log of 1/278482 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): Database environment corrupt; the wrong log files may have been removed or incompatible database files imported from another environment Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): id2entry.bdb: unable to flush page: 8 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 10:12:35 office-server slapd[16880]: bdb_db_close: database "dc=foo,dc=org": txn_checkpoint failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974). Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): File handles still open at environment close Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): Open file handle: /var/lib/ldap/log.0000000001 Mar 25 10:12:35 office-server slapd[16880]: bdb(dc=foo,dc=org): PANIC: fatal region error detected; run recovery Mar 25 10:12:35 office-server slapd[16880]: bdb_db_close: database "dc=foo,dc=org": close failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Mar 25 10:12:35 office-server slapd[16880]: slapd stopped. Mar 25 10:12:46 office-server slapd[19194]: @(#) $OpenLDAP: slapd 2.4.18 (Sep 8 2009 17:47:22) $#012#011buildd@crested:/build/buildd/openldap-2.4.18/debian/build/servers/slapd Does anybody have an idea what the problem might be? Many thanks for any hints or pointers! Kaspar -- Samba Log File: [2008/09/23 11:22:22, 0] lib/smbldap.c:smbldap_connect_system(982) failed to bind to server ldap://localhost/ with dn="cn=admin,dc=foo,dc=org" Error: Can't contact LDAP server (unknown) [2008/09/23 11:22:22, 1] lib/smbldap.c:another_ldap_try(1153) Connection to LDAP server failed for the 1 try! [2008/09/23 11:22:23, 2] lib/smbldap.c:smbldap_open_connection(786) smbldap_open_connection: connection opened [2008/09/23 11:22:23, 2] lib/smbldap.c:smbldap_connect_system(982) failed to bind to server ldap://localhost/ with dn="cn=admin,dc=foo,dc=org" Error: Can't contact LDAP server (unknown) [2008/09/23 11:22:23, 1] lib/smbldap.c:another_ldap_try(1153) Connection to LDAP server failed for the 2 try! Server details: Ubuntu 9.10, slapd 2.4.18 Slapd configuration file (slapd.conf): # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 392 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=baselgovernance,dc=org" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=baselgovernance,dc=org" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=baselgovernance,dc=org" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=baselgovernance,dc=org" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=baselgovernance,dc=org" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" # Indices to maintain ## required by OpenLDAP #index objectclass eq index cn pres,sub,eq index sn pres,sub,eq ## required to support pdb_getsampwnam index uid pres,sub,eq ## required to support pdb_getsambapwrid() index displayName pres,sub,eq ## uncomment these if you are storing posixAccount and ## posixGroup entries in the directory as well ##index uidNumber eq ##index gidNumber eq ##index memberUid eq index sambaSID pres,sub,eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub

3 3

Re: Re: Pre-requisites to enable SSL/TLS in OpenLDAP 2.4
by Arun Srinivasan 24 Mar '10

24 Mar '10

Thanks for the reply, Dieter. Yes it seems slapd has not been built with openssl. Here is the output of ldd: $ ldd /usr/local/libexec/slapd libdb-4.8.so => /usr/local/BerkeleyDB.4.8/lib/libdb-4.8.so (0x00002ad9ac26a000) libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003542a00000) libresolv.so.2 => /lib64/libresolv.so.2 (0x000000354ba00000) libc.so.6 => /lib64/libc.so.6 (0x0000003541e00000) /lib64/ld-linux-x86-64.so.2 (0x0000003541a00000) Can you please let me know if there is any workaround for this or do we need to re-configure openldap with (--with-tls=openssl) ? Also let me know if we need to configure openldap with any other configuration options for TLS/SSL to work properly. Please suggest. Thanks. On Wed, 24 Mar 2010 19:24:29 +0530 wrote >"Arun Srinivasan" writes: > Hi All, > > I am using OpenLDAP 2.4.21 on RHEL 5.3. > > I have configured the openldap with "./configure --with-tls" option to enable > ssl in the server. I used the built-in openssl that comes with RHEL 5.3. > Berkley GB is 4.8.26. [...] > > then I get the following output: >>>>>>>>> > daemon_init: ldap:// ldaps:// > daemon_init: listen on ldap:// > daemon_init: listen on ldaps:// > daemon_init: 2 listeners to open... > ldap_url_parse_ext(ldap://) > daemon: listener initialized ldap:// > ldap_url_parse_ext(ldaps://) > daemon: TLS not supported (ldaps://) > slapd stopped. > connections_destroy: nothing to destroy. >>>>>>>>>> [...] It seems that slapd has not been built with openssl, you may check the shared libraries linked to slapd calling ldd(1). -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

2 1

Re: OpenLDAP DB_CONFIG values for a big Server
by Echedey Lorenzo 24 Mar '10

24 Mar '10

Thanks, this guide is helping me a lot. KR 2010/3/12 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, March 12, 2010 10:24 AM +0000 Echedey Lorenzo < > echedey(a)gmail.com> wrote: > > > Any help will be appreciated since my experiences with OpenLDAP >> performance against Sun Directory Server 5.2 has not been good, taking >> several seconds to answer any ldaprequest :( >> > > OpenLDAP, when properly tuned, is always magnitudes faster than SunOne DS. > > I suggest reading over: > > <http://wiki.zimbra.com/index.php?title=OpenLDAP_Performance_Tuning_6.0> > > which, particularly with the BDB portions, should give you a lot of > guidance. > > Someday when the OpenLDAP foundation has a real wiki, I'll put this > information there. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

1 0

Pre-requisites to enable SSL/TLS in OpenLDAP 2.4
by Arun Srinivasan 24 Mar '10

24 Mar '10

Hi All, I am using OpenLDAP 2.4.21 on RHEL 5.3. I have configured the openldap with "./configure --with-tls" option to enable ssl in the server. I used the built-in openssl that comes with RHEL 5.3. Berkley GB is 4.8.26. But after creating the certificates and configuring the slapd.conf with the below lines: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/serverkey.pem However, when I try to run the slapd with the -h option as "/usr/local/libexec/slapd -h "ldap:// ldaps://" -d 255" then I get the following output: >>>>>>>> daemon_init: ldap:// ldaps:// daemon_init: listen on ldap:// daemon_init: listen on ldaps:// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap://) daemon: listener initialized ldap:// ldap_url_parse_ext(ldaps://) daemon: TLS not supported (ldaps://) slapd stopped. connections_destroy: nothing to destroy. >>>>>>>>> I am guessing something is wrong at the openldap configuration level itself. Can somebody let me know what are the pre-requisites to be followed while configuring openldap (configure options)so that SSL can be enabled successfully. Thanks

2 1

Quick help on ldap modify with different domain name
by Meena Ram 24 Mar '10

24 Mar '10

Dear folks: Wanted some quick help in deleting the entries and adding more users with a different set of DN Our DN earlier was like this cn = manager, dc = ind, dc=ban, dc =com. now it is changed to three levels like cn = manager, dc = gubbi, dc = ind, dc=ban, dc =com. when i try to modify using ldap modify i can not modify instead i get the following error: One more level is added. I get the following error if i try to modify using ldapmodify modifying entry "dc=gubbi,dc=ind,dc=ban,dc=com" ldap_modify: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Cheers!!!!!!! RAM ________________________________ From: Meena Ram <meenaram21(a)yahoo.com> To: openldap-technical(a)openldap.org Sent: Thu, March 11, 2010 6:07:03 PM Subject: brief tips and tricks for running ldaps on slackware Dear folks: If any one has a brief tips, tricks or cheatsheet for running slapd with SSL/TLS can you please post it. plain ldap works perfect but ldaps search and related stuff seams to have some issues Cheers!!!!!!!!

2 1

Re: Problem with getent passwd
by Tyler Gates 24 Mar '10

24 Mar '10

And don't forget nsswitch. ldap should be first for group and passwd. On Mar 23, 2010, at 8:25 PM, Tyler Gates <tgates81(a)gmail.com> wrote: > Sounds like it's a problem with your client side pam_ldap > authentication. There's a whole buch of steps to get that working, > just google it. If you have a redhat variant authconfig or setup > will step you through it. It would help if you could post your > system_auth file. > > On Mar 23, 2010, at 11:40 AM, Lynn York <lynn.york(a)mavenwire.com> > wrote: > >> Hello, >> >> >> >> When I issue “getent passwd” I can see it query >> the ldap server for all the information and the server is returnin >> g the correct information. However, “getent passwd” doesn’t >> actually show the users that are in ldap. I am not sure where my >> problem might be. Can anyone offer any suggestions on where to look? >> >> >> >> Lynn York II >> >> MavenWire Hosting Admin >> >> www.mavenwire.com >> >> (866) 343-4870 x717 >> >> >> >> MavenWire - We DELIVER >> >> http://www.mavenwire.com >> >> >> >> This e-mail and any attached files may contain confidential and/or >> privileged material for the sole use of the intended recipient. >> Any review, use, distribution or disclosure by others is strictly >> prohibited. If you are not the intended recipient (or authorized to >> receive this e-mail for the recipient), you may not review, copy or >> distribute this message. Please contact the sender by reply e-mail >> and delete all copies of this message. >> >> >> >> MavenWire - We DELIVER >> http://www.mavenwire.com >> >> This e-mail and any attached files may contain confidential and/or >> privileged material for the sole use of the intended recipient. >> Any review, use, distribution or disclosure by others is strictly >> prohibited. If you are not the intended recipient (or authorized to >> receive this e-mail for the recipient), you may not review, copy or >> distribute this message. Please contact the sender by reply e-mail >> and delete all copies of this message. >>

2 1

Re: Tips when implementing password policies
by Chris Jacobs 24 Mar '10

24 Mar '10

Okay, it says: "If pwdChangedTime does not exist, the user's password will not expire." How have you guys dealt with this? I suspect that just asking people to please change their passwords so we can make sure they expire will result in a low turn-out rate. :p I also don't want people to just end-up locked out either, if at all possible. Thoughts? Thanks! - chris Chris Jacobs, Jr. Unix System Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: Howard Chu <hyc(a)symas.com> To: Chris Jacobs Cc: 'tgates81(a)gmail.com' <tgates81(a)gmail.com>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> Sent: Tue Mar 23 19:27:53 2010 Subject: Re: Tips when implementing password policies Chris Jacobs wrote: > I've a few accounts that I was testing with - after I set the password /after/ ppolicy was in place, things work as expected. Password history, # grace auths, etc. > > However, for those accounts existing before the ppolicy was in place, no enforcement - there's no password change date set, nor any other policy items added - other than the pwdpolicysubentry. Please read the slapo-ppolicy(5) manpage. In particular, read the description of the pwdChangedTime attribute. > One note: early on in the old ldap installations use, inetorgperson wasn't > a class on accounts. Is that necessary for pwdpolicy? Would that make everything else work for the legacy accounts? > > I'll send an example LDIF of a test account and a legacy account later. > - chris -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

3 3

Re: Tips when implementing password policies
by Chris Jacobs 24 Mar '10

24 Mar '10

I've a few accounts that I was testing with - after I set the password /after/ ppolicy was in place, things work as expected. Password history, # grace auths, etc. However, for those accounts existing before the ppolicy was in place, no enforcement - there's no password change date set, nor any other policy items added - other than the pwdpolicysubentry. One note: early on in the old ldap installations use, inetorgperson wasn't a class on accounts. Is that necessary for pwdpolicy? Would that make everything else work for the legacy accounts? I'll send an example LDIF of a test account and a legacy account later. - chris Chris Jacobs, Jr. Unix System Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: Tyler Gates <tgates81(a)gmail.com> To: Chris Jacobs Cc: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Tue Mar 23 18:55:21 2010 Subject: Re: Tips when implementing password policies pwdPolicySubentry should work -it's honored in place of the default password policy which is set in your config. If it doesn't work than likely your config lacks the necessary directives to use ppolicy. As far as enforcement pwdMustchange can be set in your policy which looks at the entrys pwdReset value. If both are true then ldap will allow a limited set of rights on the dn enough to bind as tls or ssl and change his or her password. On Mar 23, 2010, at 5:19 PM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu> wrote: > Hello, > > I'm upgrading our LDAP infrastructure (it'll be a cut-over) and I've > noticed that after adding pwdPolicySubentry to a user's account, it > doesn't seem to have any affect. > > This user hasn't /ever/ reset their password, and the user's account > doesn't show any password policy grace period usage after the test. > > The pwdPolicySubentry is still the only password policy related > entry on his account. > > This suggests that I'll need to force people to change their > password's at some point. > > 1) Is what I'm seeing normal/expected? > 2) What method(s) have you used to force people to change their > password - beyond asking them? > > Thanks! > - chris > > Chris Jacobs, Jr. Linux Administrator, Information Technology & > Operations > Apollo Group | Apollo Marketing | Aptimus, Inc. > 2001 6th Ave | Ste 3200 | Seattle, WA 98121 > phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 > email: chris.jacobs(a)apollogrp.edu > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Tips when implementing password policies
by Chris Jacobs 24 Mar '10

24 Mar '10

Hello, I'm upgrading our LDAP infrastructure (it'll be a cut-over) and I've noticed that after adding pwdPolicySubentry to a user's account, it doesn't seem to have any affect. This user hasn't /ever/ reset their password, and the user's account doesn't show any password policy grace period usage after the test. The pwdPolicySubentry is still the only password policy related entry on his account. This suggests that I'll need to force people to change their password's at some point. 1) Is what I'm seeing normal/expected? 2) What method(s) have you used to force people to change their password - beyond asking them? Thanks! - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Re: brief tips and tricks for running ldaps on slackware
by Meena Ram 23 Mar '10

23 Mar '10

Dear folks: Wanted some quick help in deleting the entries and adding more users with a different set of DN Our DN earlier was like this cn = manager, dc = ind, dc=ban, dc =com. now it is changed to three levels like cn = manager, dc = gubbi, dc = ind, dc=ban, dc =com. when i try to modify using ldap modify i can not modify instead i get the following error: One more level is added. I get the following error if i try to modify using ldapmodify modifying entry "dc=gubbi,dc=ind,dc=ban,dc=com" ldap_modify: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Cheers!!!!!!! RAM ________________________________ From: Meena Ram <meenaram21(a)yahoo.com> To: openldap-technical(a)openldap.org Sent: Thu, March 11, 2010 6:07:03 PM Subject: brief tips and tricks for running ldaps on slackware Dear folks: If any one has a brief tips, tricks or cheatsheet for running slapd with SSL/TLS can you please post it. plain ldap works perfect but ldaps search and related stuff seams to have some issues Cheers!!!!!!!!

1 0

Problem with getent passwd
by Lynn York 23 Mar '10

23 Mar '10

Hello, When I issue “getent passwd” I can see it query the ldap server for all the information and the server is returning the correct information. However, “getent passwd” doesn’t actually show the users that are in ldap. I am not sure where my problem might be. Can anyone offer any suggestions on where to look? Lynn York II MavenWire Hosting Admin www.mavenwire.com (866) 343-4870 x717 MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message.

1 0

RE: attribute 'pwdPolicySubentry' cannot have multiple values
by Chris Jacobs 23 Mar '10

23 Mar '10

Howard, Tyler, Michael, My apologies: I take that back. The entry is indeed on the account - and it is, in fact, a system attribute. I will endeavor to not reply to messages at 4am in the future - a bit too quick on the /assume/ thing. BTW: How do you identify whether an attribute will be a system attribute or not? I've plenty to learn on ldap, but even I knew to look at the schema file - and I'm not certain how one could know whether an attribute would be a system attribute. Anyway - assuming the policy functions as expected - I'm nearly done with this beast of a one-man project. Thanks! - chris PS: I'd failed to reply-to-all on my previous emails. Please pardon my mailing list etiquette and use failure. :) ________________________________________ From: Chris Jacobs Sent: Monday, March 22, 2010 4:12 AM To: Howard Chu Subject: RE: attribute 'pwdPolicySubentry' cannot have multiple values No - there's no pwdPolicySubEntry entry. The contents of the LDAP db were built via a slapcat dump from an OpenLDAP 2.2 installation, with no ppolicy. As you can see from the LDIF of the chrisjtest 'account' - there's no pwdPolicySubEntry currently. Apache's directory studio and slapcat agree. - chris ________________________________________ From: Howard Chu [hyc(a)symas.com] Sent: Saturday, March 20, 2010 2:49 AM To: Tyler Gates Cc: Chris Jacobs; openldap-technical(a)openldap.org Subject: Re: attribute 'pwdPolicySubentry' cannot have multiple values Tyler Gates wrote: > I'm pretty sure pwdPolicySubEntry requires the pwdPolicy objectClass > in the target dn No. The pwdPolicy class is for the entry that contains the policy attributes, not the entry being controlled by the policy. > although that wouldn't explain the error message... The error message is quite clear - the pwdPolicySubentry attribute is single-valued, you can't set multiple values for it. > Are you sure the attribute doesn't already exist? It is a system > attribute so depending on the browser you are using at may not appear. That's most likely what's going on here. > On Mar 19, 2010, at 6:59 PM, Chris Jacobs<Chris.Jacobs(a)apollogrp.edu> > wrote: > >> Hello, >> >> I've got my ldap infrastructure (mirrormode masters, 2 slaves per >> datacenter) working fantastic (I can clear a db on a remote slave >> and in less than 30 seconds after startup, it'll reacquire the >> entire db!). >> >> I'm now having an issue with one of the very last things: getting a >> password policy into effect. >> >> When I attempt to add the 'pwdPolicySubentry' attribute to a user >> account, I get the error: >> >> Mar 19 22:51:24 ldapmaster1 slapd[8731]: Entry >> (uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net), attribute >> 'pwdPolicySubentry' cannot have multiple values >> Mar 19 22:51:24 ldapmaster1 slapd[8731]: entry failed schema check: >> attribute 'pwdPolicySubentry' cannot have multiple values >> >> I get that error in the logs whether I try to add it by hand via >> Apache Directory Studio, or an ldif import/modify: >> >> dn: uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net >> changetype: modify >> add: pwdPolicySubentry >> pwdPolicySubentry: cn=default,ou=policies,dc=unix,dc=aptimus,dc=net >> >> Here are the related slapd.conf overlay directives: >> >> overlay ppolicy >> ppolicy_hash_cleartext >> ppolicy_use_lockout >> >> (Notice there's no ppolicy_default set - I'm still testing this >> feature out before I roll it out.) >> >> And for completeness, here's the entry that I'm attempting to add >> this attribute to: >> >> dn: uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net >> objectClass: top >> objectClass: inetOrgPerson >> objectClass: posixAccount >> objectClass: shadowAccount >> cn: ChrisJ Test >> gidNumber: 200 >> homeDirectory: /home/chrisjtest >> sn: chrisjtest >> uid: chrisjtest >> uidNumber: 583 >> description: ChrisJ Test >> gecos: ChrisJ Test >> loginShell: /bin/bash >> shadowLastChange: 14657 >> userPassword::<<snipped>> >> >> And here's the password policy ldif: >> >> dn: ou=policies,dc=unix,dc=aptimus,dc=net >> objectClass: organizationalUnit >> objectClass: top >> ou: policies >> >> dn: cn=default,ou=policies,dc=unix,dc=aptimus,dc=net >> objectClass: top >> objectClass: device >> objectClass: pwdPolicy >> cn: default >> pwdAttribute: userPassword >> pwdAllowUserChange: TRUE >> pwdExpireWarning: 172800 >> pwdFailureCountInterval: 0 >> pwdGraceAuthNLimit: 0 >> pwdInHistory: 10 >> pwdLockout: TRUE >> pwdLockoutDuration: 1200 >> pwdMaxAge: 15897600 >> pwdMaxFailure: 3 >> pwdMinLength: 8 >> pwdMustChange: FALSE >> pwdSafeModify: TRUE >> >> When I built openldap, I enabled all overlays (I know, not the most >> efficient), and when I attempt to add moduleload ppolicy.la or >> ppolicy.so I get in the logs: >> >> line 18 (moduleload ppolicy.la) >> module_load: (ppolicy.la) already present (static) >> >> Which I'm pretty sure means it's already loaded... >> >> Any idea as to what I'm doing wrong? >> >> Thanks, >> - chris >> >> Chris Jacobs, Jr. Linux Administrator, Information Technology& >> Operations >> Apollo Group | Apollo Marketing | Aptimus, Inc. >> 2001 6th Ave | Ste 3200 | Seattle, WA 98121 >> phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 >> email: chris.jacobs(a)apollogrp.edu >> >> >> This message is private and confidential. If you have received it in >> error, please notify the sender and remove it from your system. >> >> > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Difficulty configuring a shared addressbook
by Jonathan 22 Mar '10

22 Mar '10

Despite following 2 tutorials, seems we're not able to get openldap configured correctly. Since this had to be done yesterday, is there anyone on this list who is available for an hour or 2 of consulting to get this running? Ideally tonight (Pacific time). Server is running fine, and no problem logged in as manager, but can't add the schema or a new user (dies with "Server is unwilling to perform (53) -- additional info: no global superior knowledge" or "ldapadd: No such object (32)"). Also TLS dies with "TLS: peer cert untrusted or revoked (0x42)" even though we are using a good, working SSL certificate. Also concerned about any unexpected issues trying to get a shared addressbook working across Thunderbird, Outlook, and others. Many thanks.

1 0

attribute 'pwdPolicySubentry' cannot have multiple values
by Chris Jacobs 21 Mar '10

21 Mar '10

Hello, I've got my ldap infrastructure (mirrormode masters, 2 slaves per datacenter) working fantastic (I can clear a db on a remote slave and in less than 30 seconds after startup, it'll reacquire the entire db!). I'm now having an issue with one of the very last things: getting a password policy into effect. When I attempt to add the 'pwdPolicySubentry' attribute to a user account, I get the error: Mar 19 22:51:24 ldapmaster1 slapd[8731]: Entry (uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net), attribute 'pwdPolicySubentry' cannot have multiple values Mar 19 22:51:24 ldapmaster1 slapd[8731]: entry failed schema check: attribute 'pwdPolicySubentry' cannot have multiple values I get that error in the logs whether I try to add it by hand via Apache Directory Studio, or an ldif import/modify: dn: uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=default,ou=policies,dc=unix,dc=aptimus,dc=net Here are the related slapd.conf overlay directives: overlay ppolicy ppolicy_hash_cleartext ppolicy_use_lockout (Notice there's no ppolicy_default set - I'm still testing this feature out before I roll it out.) And for completeness, here's the entry that I'm attempting to add this attribute to: dn: uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: ChrisJ Test gidNumber: 200 homeDirectory: /home/chrisjtest sn: chrisjtest uid: chrisjtest uidNumber: 583 description: ChrisJ Test gecos: ChrisJ Test loginShell: /bin/bash shadowLastChange: 14657 userPassword:: <<snipped>> And here's the password policy ldif: dn: ou=policies,dc=unix,dc=aptimus,dc=net objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=unix,dc=aptimus,dc=net objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdExpireWarning: 172800 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 10 pwdLockout: TRUE pwdLockoutDuration: 1200 pwdMaxAge: 15897600 pwdMaxFailure: 3 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: TRUE When I built openldap, I enabled all overlays (I know, not the most efficient), and when I attempt to add moduleload ppolicy.la or ppolicy.so I get in the logs: line 18 (moduleload ppolicy.la) module_load: (ppolicy.la) already present (static) Which I'm pretty sure means it's already loaded... Any idea as to what I'm doing wrong? Thanks, - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

5 4

Re: ldap_sasl_bind vs. ldap_sasl_interactive_bind_s
by masarati＠aero.polimi.it 20 Mar '10

20 Mar '10

> On Fri, Mar 19, 2010 at 1:27 PM, <masarati(a)aero.polimi.it> wrote: >>> Hi, >>> >>> I am still trying to make an sasl bind. Now I use ldap_sasl_bind_s >>> with 'CRAM-MD5'. The server sends a 'LDAP_SASL_BIND_IN_PROGRESS' back, >>> but as far as I can see the server cred are empty. How do I make the >>> next call with ldap_sasl_bind_s? >>> >>> In the documentation I have seen that the use of ldap_sasl_bind is not >>> recommended as client use, instead the ldap_sasl_interactive_bind_s >>> should be preferred. Has anyone a working example of how to use this >>> method, or some api doc? I have no clue how to set 'flags' the >>> LDAP_SASL_INTERACT_PROC, an the 'defaults' params.. >> >> You first say that you're using ldap_sasl_bind_s(), and then you note >> that >> ldap_sasl_bind() is not recommended. Do you realize that despite some >> similarities in the name, the two functions are profoundly different? >> By >> no means ldap_sasl_bind_s() can return LDAP_SASL_BIND_IN_PROGRESS. > > Yes, I know that those methods behave differently - as I have read in > the docs, I just search for the simplest alternative as possible for > ldap_simple_bind, since I have seen that the ldap_simple_bind methods > are deprecated. > > Nevertheless ldap_sasl_bind_s returns LDAP_SASL_BIND_IN_PROGRESS which > I understand as a challenge which should be returned back to the > server. This one seems to had a similiar issue: http://bit.ly/awT4D4 > > But I think I have to look at the examples for better understanding - > thx for the tip! ldap_sasl_bind_s() can be used, passing LDAP_SASL_SIMPLE, in lieu of ldap_simple_bind_s(). ldap_sasl_interactive_bind_s(), only need to be used for those methods that require multiple steps; LDAP_SASL_BIND_IN_PROGRESS indicates that a further step is expected, which never happens when performing a simple bind. See the code snippet in slap_client_connect(), in servers/slapd/config.c for a complete example of how both functions can be used in the most complete form. p.

2 2

ldap_sasl_bind vs. ldap_sasl_interactive_bind_s
by Thilko Richter 19 Mar '10

19 Mar '10

Hi, I am still trying to make an sasl bind. Now I use ldap_sasl_bind_s with 'CRAM-MD5'. The server sends a 'LDAP_SASL_BIND_IN_PROGRESS' back, but as far as I can see the server cred are empty. How do I make the next call with ldap_sasl_bind_s? In the documentation I have seen that the use of ldap_sasl_bind is not recommended as client use, instead the ldap_sasl_interactive_bind_s should be preferred. Has anyone a working example of how to use this method, or some api doc? I have no clue how to set 'flags' the LDAP_SASL_INTERACT_PROC, an the 'defaults' params.. Thx, Thilko

2 1

replication
by Frank Bonnet 19 Mar '10

19 Mar '10

Hello I wanted to start a "replicant/backup" server at our site. Actually we only have one openldap server that serve our LAN and I want to start a slave server in case of master's crash. I've read documentaion here http://www.openldap.org/doc/admin24/replication.html But I need some help to choose the best config for our site ( a backup server , that's all ) Thank you

4 5

Can't get password passthrough to work with openldap
by k pur 16 Mar '10

16 Mar '10

Hi, I am trying to get Pass-Through authentication to work for password verification. Following the 'Pass-Through authentication' (14.5) in the openldap 2.4 admin guide, I hve configured saslauthd and slapd.conf (sasl) and managed to successfully authenticate with Active Directory (AD) using the 'testsaslauthd' utility. Setting a user password in my openldap database in the form dn: uid=user,ou=org,dc=org.com userPassword: {SASL}joe(a)ad.example.com <SASL%7Duser(a)ad.example.com> where joe(a)ad.example.com <user(a)ad.example.com> is the userPrincipalName defined for this user in AD. I can't authenticate, when using the ldapsearch command $ ldapsearch -x -v -D 'uid=joe,ou=people,dc=myorg.com' -W -h ldaphost Comes up with error (49) I have enabled --enable-spasswd --with-cyrus-sasl when compiling openldap Has anybody configured this type of setup successfully? My question is - how do I configure my openldap server to talk to 'saslauthd' - which openldap's passthrough delegates password authentication to, when the userpassword is in the form userPassword: {SASL}joe(a)ad.example.com <SASL%7Duser(a)ad.example.com> Do I need to have some extra configurations in my openldap slapd.conf file? Currently I only have sasl-host and sasl-secprops defined, as:- sasl-host 127.0.0.1 # (where my openldap server runs as well) sasl-secprops none Do I need to do any auth-regex for any translation? This is my openldap entry for user joe dn: uid=joe,ou=people,dc=myorg.com objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson cn: Joe sn: Bloggs telephoneNumber: 3333 userPassword: {SASL}joe(a)ad.example.com <SASL%7Djoe(a)ad.example.com> physicalDeliveryOfficeName: J2B/1 givenName: joe uid: joe Below is my /usr/lib/sasl2/slapd.conf file mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux Below is my /etc/saslauthd.conf file ldap_servers: ldap://ad.example.com:389 ldap_search_base: ou=People,dc=ad,dc=example,dc=com ldap_filter: (userPrincipalName=%u) ldap_bind_dn: cn=admin,cn=Users,dc=ad,dc=example,dc=com ldap_password: mypassword Any help will be greatly appreciated. Many Thanks krishan

2 1

LDAP_AUTH_METHOD_NOT_SUPPORTED with ldap_sasl_bind
by Thilko Richter 16 Mar '10

16 Mar '10

Hi, obviously I don´t have an appropriate 'supportedSASLMechanisms:' entry. But after adding supportedSASLMechanisms: PLAIN to some ldap entries, the ldap_sasl_bin still does not work. Where I have to add these informations, and are they correct for a simple bind? Thx, Thilko

2 3

detecting password expiration warnings by admin
by Tyler Gates 15 Mar '10

15 Mar '10

Hi Guys, We are currently looking into implementing password expirations (pwdMaxAge) along with password expiration warnings (pwdExpireWarning) so that email notifications may be sent to those offending entries via a cronjob run as the admin (or some other ACL user). The problem is, if I understand it correctly, these warning messages are only relayed (via password policy controls ?) when the USER itself binds to the tree. Is there some other way for a privileged user to obtain these messages or at least some other set attribute before pwdMaxAge has been reached? If you are thinking of increasing the pwdAuthGraceNLimit that wont work because the user could login and try binding several other times through the course of the day before receiving a "password is about to expire in nlogin attempts" which is preformed each time they login to their machine. Below is an example of what works to get the info I need, binding as a user (again not what I want): ##################################################################################################### #!/usr/bin/perl use strict; use Net::LDAP; use Net::LDAP::Constant qw(LDAP_EXTENSION_START_TLS); use Net::LDAP::Control::PasswordPolicy; use Net::LDAP::Constant qw(LDAP_CONTROL_PASSWORDPOLICY); use POSIX; my $ldap_host = "ldap://hostname.mydomain.com"; my $ldap_port = "389"; my $ldap = Net::LDAP->new($ldap_host, port => $ldap_port); my $seconds_in_a_day = 86400; my $seconds_in_an_hour = 3600; my $pp = Net::LDAP::Control::PasswordPolicy->new; my $mesg = $ldap->bind("uid=someuser,ou=People,dc=mydomain,dc=com", password => "secret", control => [ $pp ] ); # Get password policy reponse my($resp) = $mesg->control(LDAP_CONTROL_PASSWORDPOLICY); if (defined($resp)) { my $v = $resp->pp_error; print "Password policy error $v\n" if defined $v; $v = $resp->time_before_expiration; my $days = ceil($v/$seconds_in_a_day); my $hours = ($v/$seconds_in_an_hour); print "Your password expires in less than $days day(s) ($hours hour(s))\n" if defined $v; } ####################################################################################################

3 5

I can't get root level access rights(sudo) from ldap
by Zengming Zhang 15 Mar '10

15 Mar '10

Hi everyone: Please help me, I can't get root level access rights(sudo) from ldap.When I try to use sudo command, there is an error report: "user is not in the sudoers file. This incident will be reported." I am going to build a cluster systems, there is a file server and some client computers. The operating system of file server is Redhat Enterprise Linux v5.3, and the client's is Ubuntu 8.10 desktop edition. When users login on a client, the client will get user authorization info from server and mount its HOME folder automatically. I installed openldap server(openldap-2.3.43-3.el5) on file-server, and use libnss-ldapd, libpam-ldap, auth-client-config ldap-auth-client and ldap-auth-config packages to change client's user authorization methods. But the problem is I do can get user authorization info from the ldap server, but I can't get root level access rights from ldap server as followed the steps here: http://www.gratisoft.us/sudo/man/sudoers.ldap.html. ################## My server configurations are: [1]/etc/openldap/slapd.conf： ------------------------------ The sudoers.schema has been included and indexed: include /etc/openldap/schema/sudoers.schema index sudoUser eq [2]/etc/ldap.conf: ------------------------------ sudoers_base has been set: sudoers_base ou=SUDOers,dc=file-server [3]Some contents in ldap database: ------------------------------ # SUDOers, file-server dn: ou=SUDOers,dc=file-server ou: SUDOers objectClass: top objectClass: organizationalUnit # %sysadmins, SUDOers, file-server dn: cn=%sysadmins,ou=SUDOers,dc=file-server objectClass: top objectClass: sudoRole cn: %sysadmins sudoUser: %sysadmins sudoHost: ALL sudoCommand: ALL (sysadmins is a group name that I created in my ldap server, what I want is user in this group can get root level access rights.) ################## ################## My client configurations are: [1]sudo-ldap: ------------------------------ A "sudo-ldap" package of version 1.6.9p17-1ubuntu2.2 has been installed. [2]/etc/ldap.conf: ------------------------------ sudoers_base has been set: sudoers_base ou=SUDOers,dc=file-server [3]/etc/nsswitch.conf ------------------------------ # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. # pre_auth-client-config # passwd: compat passwd: files ldap # pre_auth-client-config # group: compat group: files ldap # pre_auth-client-config # shadow: compat shadow: files ldap # added by zengming, for sudo issue. sudoers: ldap files hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 networks: files protocols: db files services: db files ethers: db files rpc: db files # pre_auth-client-config # netgroup: nis netgroup: nis [4]I do can see that the user is in the sysadmins group as authorized from ldap server: jingna@zzm-desktop:~$ id uid=10001(jingna) gid=10000(bioinf)groups=10000(bioinf),10004(sysadmins) ################## So, any ideas of you? Please let me know, thanks very much in advance! Best wishes, Zengming -- Zengming Zhang <nicegiving(a)gmail.com>

4 3

Help with roles
by antprado 14 Mar '10

14 Mar '10

(I did post this question to the software portion of the list also, my apologies if you seeing this in redundancy) Hi, I am being in contact with LDAP for the first and I do need to create a role for some users. Do you have any points or how to do this? What I need to do: role: ==> administrator user: admin001 role:==> developer user: dev001 user: dev002 role: ==> it user: operator001 user: operator002 I did create these accounts under fedora already. I need to create a role also for certain directories: for example: /home/bug ==> for developer /home/operations ==> for it /home ==> for administrator Thank you all for your help

1 0

How to make a simple bind using ldapv3?
by Thilko Richter 14 Mar '10

14 Mar '10

Hi, I am a litle bit confused: Do I use ldap_sasl_bind with null as mechanism or should I use ldap_simpl_bind, which is marked as deprecated in ldap.h? I cant´t find really helpful docs about this. Thx a lot, Thilko

2 1

RE: database is not a shadow
by Chris Jacobs 13 Mar '10

13 Mar '10

Ok, this is embarrassing. Issue: I'd set the provider to itself (on ldapmaster2): syncrepl rid=1 provider=ldaps://ldapmaster2.corp.aptimus.net type=refreshAndPersist interval=00:00:10:00 searchbase="dc=unix,dc=aptimus,dc=net" bindmethod=simple binddn="uid=root,ou=people,dc=unix,dc=aptimus,dc=net" credentials="Ten%20two" retry="15 20 60 +" mirrormode on changed to what it should be (ldapmaster1) and it started up fine. Odd error though. PS: I'd love to reply to my original message, but I haven't received it (I had recently changed my options to receive an email for each, rather than a digest) -----Original Message----- From: Chris Jacobs Sent: Friday, March 12, 2010 2:54 PM To: 'openldap-technical(a)openldap.org' Subject: database is not a shadow I'm getting a really odd error when trying to start slapd: [root@ldapmaster2 ~]# /usr/local/libexec/slapd -u ldap -h 'ldap:/// ldaps:///' -d5 @(#) $OpenLDAP: slapd 2.4.21 (Mar 9 2010 10:37:55) $ root@localhost.localdomain:/cust/appbuilds/openldap-2.4.21/servers/slapd ldap_pvt_gethostbyname_a: host=ldapmaster2.corp.aptimus.net, r=0 daemon_init: ldap:/// ldaps:/// daemon_init: listen on ldap:/// daemon_init: listen on ldaps:/// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// ldap_url_parse_ext(ldaps:///) daemon: listener initialized ldaps:/// daemon_init: 4 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) ==> translucent_initialize >>> dnNormalize: <> <<< dnNormalize: <> >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> >>> dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=assets,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <dc=unix,dc=aptimus,dc=net>, <dc=unix,dc=aptimus,dc=net> >>> dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net>, <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ber_scanf fmt (m) ber: ldap_url_parse_ext(ldaps://ldapmaster2.corp.aptimus.net) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldaps:///) /etc/openldap/slapd.conf: line 75: <mirrormode> database is not a shadow slapd destroy: freeing system resources. syncinfo_free: rid=001 slapd stopped. connections_destroy: nothing to destroy. Needless to say, this server will be a mirror - and I'd had this config working previously. The other server, setup seemingly identically works fine. What the heck does this error mean? - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

database is not a shadow
by Chris Jacobs 12 Mar '10

12 Mar '10

I'm getting a really odd error when trying to start slapd: [root@ldapmaster2 ~]# /usr/local/libexec/slapd -u ldap -h 'ldap:/// ldaps:///' -d5 @(#) $OpenLDAP: slapd 2.4.21 (Mar 9 2010 10:37:55) $ root@localhost.localdomain:/cust/appbuilds/openldap-2.4.21/servers/slapd ldap_pvt_gethostbyname_a: host=ldapmaster2.corp.aptimus.net, r=0 daemon_init: ldap:/// ldaps:/// daemon_init: listen on ldap:/// daemon_init: listen on ldaps:/// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// ldap_url_parse_ext(ldaps:///) daemon: listener initialized ldaps:/// daemon_init: 4 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) ==> translucent_initialize >>> dnNormalize: <> <<< dnNormalize: <> >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> >>> dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=assets,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <dc=unix,dc=aptimus,dc=net>, <dc=unix,dc=aptimus,dc=net> >>> dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net>, <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ber_scanf fmt (m) ber: ldap_url_parse_ext(ldaps://ldapmaster2.corp.aptimus.net) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldaps:///) /etc/openldap/slapd.conf: line 75: <mirrormode> database is not a shadow slapd destroy: freeing system resources. syncinfo_free: rid=001 slapd stopped. connections_destroy: nothing to destroy. Needless to say, this server will be a mirror - and I'd had this config working previously. The other server, setup seemingly identically works fine. What the heck does this error mean? - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Issues migrating from Linux passwd file to OpenLDAP
by Steve Cross 12 Mar '10

12 Mar '10

Hello all, Here is the issue that I am having. I have recently setup an OpenLDAP database for my local network. My goal is to use this for authentication for all clients on my network. I have been able to configure slapd.conf and the server will start up and run just fine. I have been using the migration tools to convert from the Linux style passwd file to .ldif files to import into my shiny new LDAP database. Everything goes smoothly, including the ldapadd command to import the ldif files. I am importing my users and my groups, as well as the base information for my site. Everything imports in, and i can find every user's DN using ldapsearch, but whenever I try to authenticate with any user imported from the passwd file, it fails authentication. However, if i go and change the user's password with ldappasswd then it will let me authenticate just fine for that user. I think this issue has to do with the fact that ldapadd automatically hashes the value stored in userPassword, but this seems to be causing issues with the SMD5 passwords that are stored in my shadow file. I've tried using {CLEARTEXT}, {CRYPT}, {MD5}, and {SMD5} before the value in the userPassword field, but no matter what i cannot login with the user's actual password. Is there any way to prevent ldapadd from hashing the userPassword value, since it already is encrypted? If not, what is the correct method for importing from passwd file that will not require me to change every user's password manually once imported into the LDAP directory. Below is my system setup. Slackware Linux 12.2 OpenLDAP 2.4.21 compiled from source passwd file encryption type: Salted MD5 If you need any more information please don't hesitate to ask. I am willing to provide any information necessary to get this going. Any help or pointers that I can get on this situation would be GREATLY appreciated. Thanks, Steve

2 1

OpenLDAP DB_CONFIG values for a big Server
by Echedey Lorenzo 12 Mar '10

12 Mar '10

Hi, Soon I'll have a x64 Suse machine with 16GB RAM and 4 Intel Cores. We need our OpenLDAP Server to be as fast as possible. I wonder which DB_CONFIG values are suitable for this. Maybe... set_cachesie 14 0 4 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE ...? Directory will have around 6~8 million entries. I'm not sure if they will be entirely uploaded to the RAM cache, but at least part of will improve speed, I think. Any help will be appreciated since my experiences with OpenLDAP performance against Sun Directory Server 5.2 has not been good, taking several seconds to answer any ldaprequest :( -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

4 8

syncrepl not working for pwdFailureTime attribute
by Alex Samad 12 Mar '10

12 Mar '10

Hi I have setup a multi master as per the online doco. When I was checking recently, the 2 DB were out of sync, some record hadn't been transferred over, I force this by setting -c rid=,csn= But whilst checking this, I noticed that some attributes haven't been moved across pwdFailureTime was on a record on the primary ldap server and not on the secondary master, try what I could I couldn't force it over is this a feature or a bug ? Alex

5 5

brief tips and tricks for running ldaps on slackware
by Meena Ram 12 Mar '10

12 Mar '10

Dear folks: If any one has a brief tips, tricks or cheatsheet for running slapd with SSL/TLS can you please post it. plain ldap works perfect but ldaps search and related stuff seams to have some issues Cheers!!!!!!!!

2 1

Error code -12 with ldap_sasl_bind
by Thilko Richter 12 Mar '10

12 Mar '10

Hello, In the following debug snippet I make an ldap_intit and an ldap_sasl_bind_s afterwards. In the end an unbind follows. My problem is, that I get an error code '-12' for the ldap_sasl_bind. Does anyone has a clue why the bin doesnt work? Mar 8 12:03:06 matrix slapd[3505]: conn=3 fd=15 ACCEPT from IP=[::1]:56601 (IP=[::]:389) Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on 1 descriptor Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on: Mar 8 12:03:06 matrix slapd[3505]: Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on 1 descriptor Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on: Mar 8 12:03:06 matrix slapd[3505]: 15r Mar 8 12:03:06 matrix slapd[3505]: Mar 8 12:03:06 matrix slapd[3505]: daemon: read active on 15 Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: connection_get(15) Mar 8 12:03:06 matrix slapd[3505]: connection_get(15): got connid=3 Mar 8 12:03:06 matrix slapd[3505]: connection_read(15): checking for input on id=3 Mar 8 12:03:06 matrix slapd[3505]: op tag 0x42, time 1268046186 ======== I think here is the problem Mar 8 12:03:06 matrix slapd[3505]: ber_get_next on fd 15 failed errno=0 (Success) Mar 8 12:03:06 matrix slapd[3505]: connection_read(15): input error=-2 id=3, closing. ======== Mar 8 12:03:06 matrix slapd[3505]: connection_closing: readying conn=3 sd=15 for close Mar 8 12:03:06 matrix slapd[3505]: connection_close: deferring conn=3 sd=15 Mar 8 12:03:06 matrix slapd[3505]: conn=3 op=0 do_unbind Mar 8 12:03:06 matrix slapd[3505]: conn=3 op=0 UNBIND Mar 8 12:03:06 matrix slapd[3505]: connection_resched: attempting closing conn=3 sd=15 Mar 8 12:03:06 matrix slapd[3505]: connection_close: conn=3 sd=15 Mar 8 12:03:06 matrix slapd[3505]: daemon: removing 15 Mar 8 12:03:06 matrix slapd[3505]: conn=3 fd=15 closed Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on 1 descriptor Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on: Mar 8 12:03:06 matrix slapd[3505]: Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=10 active_threads=0 tvp=zero Since I try to build up a ruby Binding for OpenLdap with ffi I dont have c code here, but the ruby snippet is: handle = ldap_init "localhost", 389 res = ldap_sasl_bind_s handle, 'cn=admin,ou=users,dc=thilko,dc=net', '', 'x', nil, nil, nil p " the result: #{res}" and the result is '-12'. Note that I am using ffi, so the function 'ldap_sasl_bind_s' is a call to the native function defined in ldap.h. I try to use LDAP_SASL_SIMPLE. I also tried to use a ber_val struct as password and servercred - the same effect. I stepped through some source code in openLdap, but I dont know where the error code '-12' comes from and where to find some documentation. Thx a lot for help, Thilko

1 0

Is there an "authconfig" tool in ubuntu?
by Zengming Zhang 11 Mar '10

11 Mar '10

Hi everyone: In redhat system there is a tool named "authconfig" which is used to configure user authentication method on clients. What I want to know is that is there a similar tool in ubuntu system? I am going to set up a group system and all client computers are running ubuntu linux. I searched something use google, someone said that they are working on it. But the history of ubuntu is not short, someone must use some similar tools to change user authentication method on ubuntu. Anyone knows something about it? Please let me know! Thanks in advance. -- Zengming Zhang <nicegiving(a)gmail.com>

2 2

Problem getting monitor backend and syncrepl overlay to work
by DeMoNs＠web.de 10 Mar '10

10 Mar '10

Hi all, i have a problem getting openldap to run monitor backend AND syncrepl overlay. i'm running freebsd-7.2-release-p6 in combination with openldap-server-2.4.19 with sasl support compiled in. i use the following slapd config: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/ldapns.schema include /usr/local/etc/openldap/schema/radius.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args logfile /var/log/slapd.log password-hash {SSHA} modulepath /usr/local/libexec/openldap moduleload back_bdb moduleload back_monitor access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by ssf=128 dn="cn=admin,dc=example,dc=de" write by dn="cn=admin,dc=example,dc=de" peername.ip=127.0.0.1 write by ssf=96 dn="cn=nssadmin,dc=example,dc=de" read by dn="cn=nssadmin,dc=example,dc=de" peername.ip=127.0.0.1 read by anonymous auth by * none access to attrs=userPassword by self write by anonymous auth by * none database bdb suffix "dc=example,dc=de" rootdn "dc=example,dc=de" directory /var/db/openldap-data index objectClass,entryCSN,entryUUID eq index uid pres,eq,sub index memberUID eq index uidNumber,gidNumber eq index host eq database monitor rootdn "cn=monitoring,cn=Monitor" rootpw monitoring access to dn.subtree="cn=Monitor" by dn="cn=nssadmin,dc=example,dc=de" by * none syncrepl rid=041 provider=ldap://ldap-master.example.de type=refreshOnly interval=00:00:35:00 searchbase="dc=example,dc=de" schemachecking=off bindmethod=simple starttls=yes binddn="cn=syncuser,dc=example,dc=de" credentials="strongsecretpassword" TLSCertificateFile /usr/local/etc/openldap/ssl/ldap-crt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/ldap-key.pem TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem loglevel 256 now, when i run slaptest i receive following error: /usr/local/etc/openldap/slapd.conf: line 59: database monitor does not support operations required for syncrepl slaptest: bad configuration file! Line 59 corresponds to the credentials option in the synrepl statement. i can't figure out whats wrong, so if anyone can point me in the right direction that would be really helpful. thanks in advance, david

5 4

Steps after Crash
by Jeff Burdon 10 Mar '10

10 Mar '10

Hello, I have two LDAP-Master with refresh and persist configured. Both are located in different countries and the bandwidth between them is only 10Mbit/s. Both masters are used for read and writing entires (writing from the local country), the Setup is running well. But now, somehow one Server is crashing. My application is detecting this and is now writing to the other remote Server in the different country. To recover the crashed server, I stop the slapd with the crashed database, and delete the whole database directory and start the slapd again. The slapd now is syncing with the other remote slapd (present and delete phase). The syncing will take about 1,5 hour. But what will happen during this time. My application is detection that the local slapd is running again and will read an write entires to the this server which is in the syncing state. In this same time, the other server in the remote site is trying to establish the replication to the crashed server who is not fully synchronized, but who may have some new entires. * Can it be, that the remote server now receive false information an gets delete entires during this state? * Do I have (manually) prevent for writing to the syncing server? Can someone help me for this Setup - Especially the recovery procedure? .. Thanx in advance Jeff

1 0

OpenLDAP replicated from Sun One DS 5.2?
by David Jeffress 10 Mar '10

10 Mar '10

Has anyone had any success getting automatic replication working to an openldap from a Sun Directory Server? Our university has a Sun DS that we are not allowed to auth against due to licensing agreements, so we want to replicate that ldap to a secondary ldap to use basically as a provisioning LDAP for all of our external accounts. Has anyone had any success with replicating a Sun DS? Thanks! -- David Jeffress, Applications Analyst Murray State University david.jeffress(a)murraystate.edu

2 1

LDAP_MOD_BVALUES / "Binary option"
by Peter Mogensen 10 Mar '10

10 Mar '10

Hi, I'm trying to make sense of the use of "binary" in misc client API's. Some API's (like perl Net::LDAPapi) seem to offer a "b" option do add/modify operations which controls whether the ";binary" AttributeOption is set on an attribute. For Net::LDAPapi this translates (from what I see in the libldap source) to LDAP_MOD_BVALUES But when reading the sources and RFC it seems to me that LDAP_MOD_BVALUES and ";binary" is two completely different things. (Also ";binary" has been removd from RFC4511). Am I right in concluding that LDAP_MOD_BVALUES (and thus "b" in Net::LDAPapi) only controls which BER type is used and as such is completely orthogonal to whether one chooses to set the ";binary" attributedescription options? ";binary" use often used with jpegPhoto, but does it have any influence on which BER type the server uses to send data to the client? I would assume that it would be completely safe to ignore ";binary" and the only reason to set LDAP_MOD_BVALUES would be if the attribute value data contained "\0" bytes. (which would prevent using a string) Is this correct? /Peter

2 3

getting ca/ca subordinate cert to work with openldap
by Chris Jacobs 10 Mar '10

10 Mar '10

Hello, I'm having a heck of a time getting certs to function correctly. This server is being setup with another server in mirrormode - and currently they cannot talk to each other (or themselves when using ldapsearch). We have a root CA, with a subordinate CA used to sign the cert our ldap server is using. I have both appended to the /etc/pki/tls/certs/ca-bundle.crt file (CentOS5) - root first, sub second. I have both (also in the same order) in the cacert.pem used by slapd.conf. TLS directives: TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/ldapcrt.pem TLSCertificateKeyFile /etc/openldap/cacerts/ldapkey.pem When I test the cacert.pem file or the ldapcrt.pem file using "openssl verify [cert]", everything comes back with OK (I tested removing those from the ca-bundle.crt file and they fail - those are below too). I have those certs available separately and tested them too. ------ Test with CA and Sub-CA in ca-bundle.crt ------ # openssl verify cacert.pem cacert.pem: OK # openssl verify ldapcrt.pem ldapcrt.pem: OK # openssl verify carootcrt.pem carootcrt.pem: OK # openssl verify casubcrt.pem casubcrt.pem: OK ------ Test without CA and Sub-CA in ca-bundle.crt ------ # openssl verify cacert.pem cacert.pem: /DC=edu/DC=apollogrp/CN=Apollo Group Enterprise CA error 18 at 0 depth lookup:self signed certificate OK # openssl verify ldapcrt.pem corp-ldapcrt.pem: [verify specific cert subject snipped] error 20 at 0 depth lookup:unable to get local issuer certificate # openssl verify carootcrt.pem carootcrt.pem: /DC=edu/DC=apollogrp/CN=Apollo Group Enterprise CA error 18 at 0 depth lookup:self signed certificate OK # openssl verify casubcrt.pem casubcrt.pem: /DC=edu/DC=apollogrp/CN=Apollo Group Subordinate CA error 20 at 0 depth lookup:unable to get local issuer certificate I'm using OpenLDAP build: 2.4.21 built with the following options: ./configure --with-tls=openssl \ --enable-crypt \ --enable-dynamic \ --enable-ldap \ --enable-lmpasswd \ --enable-modules \ --enable-overlays \ --enable-spasswd \ --sysconfdir=/etc After loading ldif data from our older 2.2 openldap servers, I verified the data was there using Apache Directory Studio (even got some work done on removing/re-adding/comparing ldifs). Ldapsearch though is another beast all together though. # ldapsearch -H ldaps://localhost/ ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain) If you're interested in more details: # ldapsearch -H ldaps://localhost/ -d5 ldap_url_parse_ext(ldaps://localhost/) ldap_create ldap_url_parse_ext(ldaps://localhost:636/??base) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 2, err: 19, subject: /DC=edu/DC=apollogrp/CN=Apollo Group Enterprise CA, issuer: /DC=edu/DC=apollogrp/CN=Apollo Group Enterprise CA TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain). ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain) Help? - chris This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

DNS discovery for OpenLDAP?
by Jaap Winius 08 Mar '10

08 Mar '10

Hi all, In the course of my research into a solution involving Kerberos, OpenLDAP and OpenAFS (a.k.a. the Magic Trio), I've discovered that both Kerberos and OpenAFS support methods of DNS discovery, but that OpenLDAP apparently does not. Is this correct? If so, might there be a reason for this, other than that it has occurred to the developers, but that they just haven't had time yet to create it? It seems to me that it would be great to have. Thanks, Jaap

4 5

Many entries, deletes getting painfully slow
by Peter Mogensen 06 Mar '10

06 Mar '10

Hi, I have a database with close to 11 million entries and lately deletes have started to get painfully slow. I've set up a new server with a lot of improvements, but if anyone have an idea about what the deciding factor for the performance difference is, then I would be grateful. On the old server: -16 cores. 42Gb RAM, entire database in memory -XFS file system on (hw)RAID-1 -Database and BerkeleDB log on same filesystem -some, but not much load (~35 read waiters) -time to delete 157 entries: 9 minutes. New server: -16 cores, 48Gb RAM, entire database in memory -ext3 filesystem on (hw)RAID-10 -Database and log on difference disk -no load. -time to delete the same 157 entries: 6.2 seconds I'm aware that the new server has all the benefits, but even under low load conditions, the old server is only able to delete an entry every 3 seconds and there's orders of magnitude difference between 6 and 540 seconds. My suspicion is that there's one of the above factors (XFS?, db/log on same fs?) which get very pronounced when the database gets above a certain size, since this slowdown for deletes seem to have accelerated with the growth of the database the last few months. /Peter

2 1

rwm-map like functionality that copies attributes
by Alexander 'Leo' Bergolth 05 Mar '10

05 Mar '10

Hi! I'd like to implement some kind of attribute-mapping so that the attributes cn and displayName contain the same values. I am thinking about something similar to rwm-map attribute displayName cn However, I don't want to map the attribute names but I want to copy the attribute values, so I guess rwm-map won't be the right way to do it. I found an old mail in the archives that suggests to write an own overlay for that job... http://www.mail-archive.com/openldap-software@openldap.org/msg12720.html I wonder if such kind of functionality has already been developed since that time? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

1 0

OpenLDAP authentication problem, need help
by Veikko "Wexi" Skurnik 05 Mar '10

05 Mar '10

Hi all, my OpenLDAP server was working fine, user authentication for workstations and the postfix/dovecot mail server worked as they should, I was about to configure gnarwl and now for some reason users cannot authenticate using the LDAP server. Dovecot also say that it cannot connect to the server (the mail server and OpenLDAP are running on the same machine). I can login to the LDAP server using phpLDAPadmin but i cannot find anything that would be the cause of the problem. The starnge thing is that I did not do any modifications to the OpenLDAP config files that could cause the problem (or at least i think so =)). I've been looking through the config files and made sure that OpenLDAP is running and now I'm running out of ideas. Any help would be greatly appreciated and I'll be more than happy to provide more info needed to solve this problem. Thanks in advance Veikko "Wexi" Skurnik -- * Veikko "Wexi" Skurnik: +358(44)5288338 * * wexi(a)wexin.net Wexi@IRCNet * * Näyttämönkatu 4 B 12 33720 Tampere * * "Kosminen balanssi ei saa järkkyä" *

1 0

SASL Auth with -d ok, otherwise internal error 80
by lists＠supported.de 05 Mar '10

05 Mar '10

Hello list, this is my first time trying to set up SASL, I'm probably doing something wrong. Anyhow: - I'm on OpenSolaris snv_127 - using SUNWopenldap from IPS (which links with bdb 4.7.25) I got strange slapd (and slapcat) hangs (probably in bdb). This forced me to set it all up from source. - I've compiled latest bdb 4.8 from source - I've compiled latest OpenLDAP 2.4.21 from source with this configure args: $ cat myconfigure export CFLAGS="-I/usr/local/BerkeleyDB.4.8/include" \ CPPFLAGS="-I/usr/local/BerkeleyDB.4.8/include" \ LDFLAGS="-L/usr/local/BerkeleyDB.4.8/lib \ -R/usr/local/BerkeleyDB.4.8/lib" ./configure -C \ --prefix=/usr/local/openldap \ --enable-spasswd \ --with-cyrus-sasl \ --enable-syslog - I've got my slapd.conf [1] in place and initialized my directory - simple bind always works - I want SASL with DIGEST-MD5 auth. - when starting slapd with -d XXX (-d 256) SASL auth. works !! $ ldapsearch -v -h localhost -p 10389 -LLL -U ldapadmin -D "cn=ldapadmin,ou=Users,dc=hh,dc=supported,dc=de" -b "ou=Users,dc=hh,dc=supported,dc=de" -s sub "cn=ldapadmin" '*' ldap_initialize( ldap://localhost:10389 ) SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: ldapadmin SASL SSF: 128 SASL installing layers filter: cn=ldapadmin requesting: * dn: cn=ldapadmin,ou=Users,dc=hh,dc=supported,dc=de cn: ldapadmin gidNumber: 5000 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: posixAccount objectClass: person objectClass: top sn: Admin uid: ldapadmin uidNumber: 5000 homeDirectory: /tmp userPassword:: ******** - when starting slapd without -d I get: $ ldapsearch -v -h localhost -LLL -U ldapadmin -D "cn=ldapadmin,ou=Users,dc=hh,dc=supported,dc=de" -b "ou=Users,dc=hh,dc=supported,dc=de" -s sub "cn=ldapadmin" ldap_initialize( ldap://localhost:10389 ) SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Internal (implementation specific) error (80) additional info: SASL(-1): generic failure: There's an additional problem in that slapd is not logging to syslogd. Cf. below I configured "loglevel 8191", my syslog.conf contains: local4.debug /var/log/openldap.log Upon slapd startup I get two entries in the log, but nothing else, no debugging: Mar 4 12:48:10 os slapd[8083]: [ID 702911 local4.debug] @(#) $OpenLDAP: slapd 2.4.21 (Mar 4 2010 12:12:43) $ Mar 4 12:48:10 os ralph@os:/export/home/ralph/openldap-2.4.21/servers/slapd Can anybody point me in the right direction? Thanks! Cheers, Ralph [1] slapd.conf: include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 8191 moduleload back_hdb.la ############## # I've added these in sick attempts security ssf=0 sasl=0 sasl-secprops none ############ authz-regexp uid=(.*),cn=DIGEST-MD5,cn=auth cn=$1,ou=Users,dc=hh,dc=supported,dc=de access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,shadowLastChange by dn="cn=ldapadmin,ou=Users,dc=hh,dc=supported,dc=de" write by anonymous auth by self write by * none access to * by dn="cn=ldapadmin,ou=Users,dc=hh,dc=supported,dc=de" write by self write by users read by anonymous auth rootdn "cn=root,ou=Users,dc=hh,dc=supported,dc=de" rootpw ****** database hdb suffix "dc=hh,dc=supported,dc=de" directory /var/openldap index objectClass eq

2 2

OpenLdap mirrormode cluster with 2 slaves.
by Jan Hugo Prins 04 Mar '10

04 Mar '10

Hello, I have the following setup that gives me some issues at the moment. I have 2 servers running Fedora 10 with OpenLDAP 2.4.19 that are running in Mirrormode. The sync between those 2 servers works just fine. Besides that we have 2 frontend servers that rely heavily on ldap for mail delivery and mail transfers. To make this workable we thought about creating a readonly replica on these servers and tell the sendmail to use the local ldap as primary. When we had an old version on these servers (I think 2.4.12) everything worked fine. We now upgraded all servers to 2.4.19 and the configuration moved to slapd.d format, and now it looks like those 2 servers don't see the updates on the mirrormode backend anymore. I have to following config's, this was from before the migration to slapd.d: ================== master 1 ================== overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 3 # # Configure a replication consumer # syncrepl rid=1 provider=ldap://server2:389 type=refreshAndPersist retry="60 10 300 +" interval=00:00:05:00 searchbase="dc=domain,dc=com" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncrepl,dc=domain,dc=com" credentials=password mirrormode on ================== master 2 ================== overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 4 # # Configure a replication consumer # syncrepl rid=1 provider=ldap://server1:389 type=refreshAndPersist retry="60 10 300 +" interval=00:00:05:00 searchbase="dc=domain,dc=com" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncrepl,dc=domain,dc=com" credentials=password mirrormode on =================== slaves =================== overlay syncprov syncprov-checkpoint 100 10 # # Configure a replication consumer # syncrepl rid=1 provider=ldap://ldap:389 type=refreshOnly retry="60 1 120 1" interval=00:00:05:00 searchbase="dc=domain,dc=com" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncrepl,dc=domain,dc=com" credentials=password updateref ldap://ldap.svc.be.nl:389 updateref ldap://ldap.lan.domain.com:389 ============================================ When I empty the DIT on a slave and start it again it gets the full DIT just fine and I checked this. But after that it is not updated anymore. Does anyone see here some obvious things I'm missing in these slave or master configs? Thanks a lot, Jan Hugo Prins

1 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical