- openldap-technical - openldap.org

a newbie trying to get the basics of syncrepl going
by Seger, Mark 25 Feb '10

25 Feb '10

I'm an admitted ldap lightweight but have been able to bring up an ldap server and populate it with the contents of my /etc/passwd file. Now I want to set up a replica on another machine using sync replication and am having a few issues getting it to work. My most recent success was getting simple authentication working because before it was failing and now it's not so I've at least gotten that far. Here's what my replication section looks like in ldap.conf: syncrepl rid=123 provider=ldap://10.99.99.99:389 type=refreshOnly interval=01:00:00:00 searchbase="dc=myldap,dc=com" filter="(objectClass=account)" scope=sub schemachecking=off updatedn="cn=replica,dc=myldap,dc=com" bindmethod=simple binddn="uid=lsfadmin,ou=People,dc=myldap,dc=com" credentials=Something I'm pretty sure I have the search parameters set correctly because if I run: ldapsearch -x -h 10.99.99.99 -b 'dc=myldap,dc=com' -A uid it dumps all my uids. The part I'm on clear on is how to define things on the slave side. For example I have the main part of the conf set the same on the master, just to make things easy on me and so I have the following which is exactly how I have the master set up. database bdb suffix "dc=myldap,dc=com" rootdn "cn=Manager,dc=myldap,dc=com" rootpw {SSHA}ZmTfiKLVf8X5GERsT3b3AoB3/hFV3l7R directory /var/lib/ldap I'm guessing my problem may be with updatedn="cn=replica,dc=myldap,dc=com", but I'm not sure what it should be and whether or not I have to prime the replica with any special authentication to be able to write to it. If I run "ldapsearch -x -b 'dc=myldap,dc=com'" against the replica it comes up empty so I'm sure nothing is getting replicated. Further if I run the slave slapd with -d128 I get: [root@hpdc3dmgt1 ~]# slapd -d 128 @(#) $OpenLDAP: slapd 2.3.43 (Nov 6 2008 02:53:24) $ brewbuilder@hs20-bc1-5.build.redhat.com:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd slapd starting request done: ld 0x2ac52b507c70 msgid 1 => bdb_entry_get: cannot find entry: "dc=myldap,dc=com" do_syncrep2: rid 123got search entry without control do_syncrepl: rid 123 quitting but I have no idea where it's looking for the entry, on the master or the slave? But I do have that entry on the master. I'm sure I'm doing something wrong but am also hoping it's relatively minor. -mark

5 9

Re: Adding a schema to OpenLdap
by Francis, Steve (IHG) 23 Feb '10

23 Feb '10

Thanks, I just figured it out. Somehow the ftp of the other ldif made it unusable. So I moved over my java program that creates the ldif file, and all is well. Steve Francis IHG - z/OS Technical Advisor Sent from my BlackBerry ________________________________ From: Jonathan Clarke <jonathan(a)phillipoux.net> To: Francis, Steve (IHG) Cc: <openldap-technical(a)openldap.org> <openldap-technical(a)openldap.org> Sent: Tue Feb 23 17:21:50 2010 Subject: Re: Adding a schema to OpenLdap On 23 févr. 2010, at 17:38, "Francis, Steve (IHG)" <Steve.Francis(a)ihg.com> wrote: I have a schema that I have used on a z/OS Ldap server for over six years. I received a NOID from IANA and have had no issues running ldapmodify commands on the z/OS ldap server to allow the objectclass's use. Now, I'm working to port he application that uses this ldap server to Linux and can't seem to get OpenLdap to allow the use of my objectclass. I have created my own schema file and have included it in the slapd.conf, which start with no errors; however, the ldapadd to process the ldif file fails with the famous "ldap_add: Invalid syntax (21) additional info: objectclass: value #1 invalid per syntax" . I know this to be my objectclass, since the following is my ldif file. dn: cn=10.172.50.0, o=SAH objectclass: top objectclass: saHolidex cn: 10.172.50.0 sn: AADAL ou: HOTEL mtrStatus: N ipAddr: 10.172.50.0 pqsStatus: MQSOFF subNetMask: 255.255.255.0 Make sure that you don't have any spaces trailing after your objectClass name in your LDIF file. This is a common source of this error. If this doesn't solve your problem, start slaps with "loglevel config" in slapd.conf and make sure your objectclass is read in. Hope this helps, Jonathan The z/OS ldap server had gotten away from including schema files and so I simply issued the ldapmodify command to update "cn=schema,o=sah" as my suffix was o=sah. The schema file I created looks like the following, as my IANA number is 15132: attributetype ( 1.3.6.1.4.1.15132.0.1.2.4 NAME 'mtrStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) attributetype ( 1.3.6.1.4.1.15132.0.1.2.3 NAME 'ipAddr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) attributetype ( 1.3.6.1.4.1.15132.0.1.2.5 NAME 'pqsStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) attributetype ( 1.3.6.1.4.1.15132.0.1.2.6 NAME 'subNetMask' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) objectClass ( 1.3.6.1.4.1.15123.0.1.2.1 NAME 'saHolidex' DESC 'IHG Sah' SUP top STRUCTURAL MUST ( cn $ sn ) MAY ( ou $ mtrStatus $ ipAddr $ pqsStatus $ subNetMask ) ) The old ldif file for the z/OS systems looks like the following: dn: cn=schema,o=SAH changetype:modify add:x attributetypes: ( 15132.0.1.2.4 NAME 'mtrStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) ibmattributetypes: ( 15132.0.1.2.4 ACCESS-CLASS normal) attributetypes: ( 15132.0.1.2.3 NAME 'ipAddr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) ibmattributetypes: ( 15132.0.1.2.3 ACCESS-CLASS normal) attributetypes: ( 15132.0.1.2.5 NAME 'pqsStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) ibmattributetypes: ( 15132.0.1.2.5 ACCESS-CLASS normal) attributetypes: ( 15132.0.1.2.6 NAME 'subNetMask' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) ibmattributetypes: ( 15132.0.1.2.6 ACCESS-CLASS normal) objectclasses: ( 15123.0.1.2.1 NAME 'saHolidex' SUP top MUST ( cn $ sn ) MAY ( ou $ mtrStatus $ ipAddr $ pqsStatus $ subNetMask ) ) Can anyone help me figure out why I can't get this objectclass to work. It works fine with the z/OS Ldap Server, and has for many years, all the way back to the OS390 days, prior to z/OS. Thanks, i advance, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

1 0

Adding a schema to OpenLdap
by Francis, Steve (IHG) 23 Feb '10

23 Feb '10

I have a schema that I have used on a z/OS Ldap server for over six years. I received a NOID from IANA and have had no issues running ldapmodify commands on the z/OS ldap server to allow the objectclass's use. Now, I'm working to port he application that uses this ldap server to Linux and can't seem to get OpenLdap to allow the use of my objectclass. I have created my own schema file and have included it in the slapd.conf, which start with no errors; however, the ldapadd to process the ldif file fails with the famous "ldap_add: Invalid syntax (21) additional info: objectclass: value #1 invalid per syntax" . I know this to be my objectclass, since the following is my ldif file. dn: cn=10.172.50.0, o=SAH objectclass: top objectclass: saHolidex cn: 10.172.50.0 sn: AADAL ou: HOTEL mtrStatus: N ipAddr: 10.172.50.0 pqsStatus: MQSOFF subNetMask: 255.255.255.0 The z/OS ldap server had gotten away from including schema files and so I simply issued the ldapmodify command to update "cn=schema,o=sah" as my suffix was o=sah. The schema file I created looks like the following, as my IANA number is 15132: attributetype ( 1.3.6.1.4.1.15132.0.1.2.4 NAME 'mtrStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) attributetype ( 1.3.6.1.4.1.15132.0.1.2.3 NAME 'ipAddr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) attributetype ( 1.3.6.1.4.1.15132.0.1.2.5 NAME 'pqsStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) attributetype ( 1.3.6.1.4.1.15132.0.1.2.6 NAME 'subNetMask' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) objectClass ( 1.3.6.1.4.1.15123.0.1.2.1 NAME 'saHolidex' DESC 'IHG Sah' SUP top STRUCTURAL MUST ( cn $ sn ) MAY ( ou $ mtrStatus $ ipAddr $ pqsStatus $ subNetMask ) ) The old ldif file for the z/OS systems looks like the following: dn: cn=schema,o=SAH changetype:modify add:x attributetypes: ( 15132.0.1.2.4 NAME 'mtrStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) ibmattributetypes: ( 15132.0.1.2.4 ACCESS-CLASS normal) attributetypes: ( 15132.0.1.2.3 NAME 'ipAddr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) ibmattributetypes: ( 15132.0.1.2.3 ACCESS-CLASS normal) attributetypes: ( 15132.0.1.2.5 NAME 'pqsStatus' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch ) ibmattributetypes: ( 15132.0.1.2.5 ACCESS-CLASS normal) attributetypes: ( 15132.0.1.2.6 NAME 'subNetMask' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) ibmattributetypes: ( 15132.0.1.2.6 ACCESS-CLASS normal) objectclasses: ( 15123.0.1.2.1 NAME 'saHolidex' SUP top MUST ( cn $ sn ) MAY ( ou $ mtrStatus $ ipAddr $ pqsStatus $ subNetMask ) ) Can anyone help me figure out why I can't get this objectclass to work. It works fine with the z/OS Ldap Server, and has for many years, all the way back to the OS390 days, prior to z/OS. Thanks, i advance, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

2 1

Re: the parent of a result.
by Peter Mogensen 23 Feb '10

23 Feb '10

This sounds like an inherent relational problem. Any special reason for using a directory to store the forum data? /Peter

1 0

the parent of a result.
by Mihamina Rakotomandimby 22 Feb '10

22 Feb '10

Manao ahoana, Hello, Bonjour, I look for the way to search for the parent of the matched target. FOr example, let's image a forum, with multiple topics - boys - girls - dogs Each topic has comments (for simplicit let's make them flat) - boys - comment 234 - comment 65 - girls - comment 659 - comment 4 - dogs - comment 351 - comment 323 Comments ID are unique. I perform a search: ldapsearch (...) commentId=659 The only way to have the parent (girls) is for me to parse the resulting "dn" of that search, splitting it by ",". Bad & Dirty. How (which argument/option) to get the parent of commentId=659? Misaotra, Thanks, Merci. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34 / +261 33 11 207 36

2 1

Syncrepl for AD replication
by Siddhartha Jain 22 Feb '10

22 Feb '10

Hi, I am looking to setup a LDAP server that can pull certain user attributes from Active Directory like userid (sAMAccountName), cn, sn and populate some other attributes like public keys via user input. Is it possible to automate the AD to LDAP replication using syncrepl? Also, looking at syncrepl documentation, it isn't clear how syncrepl adds records? For example, if a new user gets added on the master, how does the replica know what objectclasses to include while adding that user? Thanks, Siddhartha

5 5

openldap client GSSAPI authentication segfaults in fbgsd8-stable i386
by George Mamalakis 22 Feb '10

22 Feb '10

Dear all, I have submitted this email to freebsd-stable mailing list as well, but with no luck until now; so, I decided to share it with this list as well. The email is large, only because I have tested my setup in six different machines, and I explain my results for each one. The problem is more simple; my email subject explains it all. So, here is how it goes: I am facing many instabilities in FBSD8 with openldap-client and sasl authentication (GSSAPI in particular). I have setup an openldap 2.4.1 server with gssapi support (through cyrus-sasl-2.1.23) on a fbsd8-stable amd64 latest sources, in a esxi host. In the same host I have setup two fbsd8-stable i386 clients; one has latest sources, the other one is installed via the iso-image of January's fbsd snapshot; on both systems openldap client and sasl is installed (all ldap/cyrus versions on all hosts mentioned in this email are the same). My laptop has fbsd8-i386 stable (sources 25 January 2010), and on my laptop I have setup an fbsd8-stable i386 (snapshot iso image) on a virtualbox client. Lastly, on the esxi host I have setup another fbsd8-stable amd64 system, to act as an ldap client (latest sources). To summarize, and put a label-number on each host, we have: 1 - esxi: fbsd8(latest) amd64 openldap server 2 - esxi: fbsd8(latest) i386 openldap client 3 - esxi: fbsd8(snapshot) i386 openldap client 4 - esxi: fbsd8(latest) amd64 openldap client 5 - laptop: fbsd8(jan 25) i386 openldap client 6 - laptop/vbox: fbsd8(snapshot) i386 openldap client The openldap server is installed in a jail, and the client is tested in the same jail. Kerberos works on all machines (same /etc/krb5.conf), and ldap as well. In all machines, line 96 of /usr/bin/krb5-config is changed to read: lib_flags="$lib_flags -lgssapi -lgssapi_spnego -lgssapi_krb5 -lheimntlm" instead of: lib_flags="$lib_flags -lgssapi -lheimntlm" which was the default, since without these lines I couldn't get gssapi authentication to work for cyrus (and spnego). This change was made after recommendations given from freebsd-stable mailing list, and I was very happy to see that after this change the ldap server worked as I expected. On all system, cat /usr/local/etc/openldap/ldap.conf: BASE dc=ee,dc=auth,dc=gr URI ldap://ldap.ee.auth.gr SASL_MECH GSSAPI without kiniting in any client I get the following outcomes when I give ldapwhoami (with no arguments): 1: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (unknown mech-code 2 for mech unknown) which is expected. 2: SASL/GSSAPI authentication started Segmentation fault: 11 (core dumped) which is not rational at all 3: SASL/GSSAPI authentication started Segmentation fault: 11 (core dumped) 4: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (unknown mech-code 2 for mech unknown) which is the same as 1 (as expected) 5: SASL/GSSAPI authentication started Segmentation fault: 11 (core dumped) 6: SASL/GSSAPI authentication started Segmentation fault: 11 (core dumped) if I kinit to mamalos, ldapwhoami returns: 1: SASL/GSSAPI authentication started SASL username: mamalos(a)EE.AUTH.GR SASL SSF: 56 SASL data security layer installed. dn:uid=mamalos,ou=people,dc=ee,dc=auth,dc=gr which is super! 2: SASL/GSSAPI authentication started Segmentation fault: 11 (core dumped) which is dramatic. 3: SASL/GSSAPI authentication started Segmentation fault: 11 (core dumped) 4: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (unknown mech-code 2529638919 for mech unknown) which is very strange, since mech-code seems unnaturally large. 5: SASL/GSSAPI authentication started SASL username: mamalos(a)EE.AUTH.GR SASL SSF: 56 SASL data security layer installed. dn:uid=mamalos,ou=people,dc=ee,dc=auth,dc=gr which is super, but without kinit the same command segfaulted on this machine 6: SASL/GSSAPI authentication started SASL username: mamalos(a)EE.AUTH.GR SASL SSF: 56 SASL data security layer installed. dn:uid=mamalos,ou=people,dc=ee,dc=auth,dc=gr which is the exact same behavior as 5 above. All this means that there is no single pattern!!!!!!! If I gdb ldapwhoami in the clients that segfault, I get: GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)... (gdb) run -d0 Starting program: /usr/local/bin/ldapwhoami -d0 (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...SASL/GSSAPI authentication started Program received signal SIGSEGV, Segmentation fault. 0x2831e187 in free () from /lib/libc.so.7 (gdb) where #0 0x2831e187 in free () from /lib/libc.so.7 #1 0x2850fb82 in gss_release_buffer () from /usr/lib/libgssapi.so.10 #2 0x2850f552 in gss_release_name () from /usr/lib/libgssapi.so.10 #3 0x2850bea9 in gss_init_sec_context () from /usr/lib/libgssapi.so.10 #4 0x283f9abf in gssapi_client_mech_step () from /usr/local/lib/sasl2/libgssapiv2.so.2 #5 0x280e84b1 in sasl_client_step () from /usr/local/lib/libsasl2.so.2 #6 0x28443100 in ?? () #7 0x00000000 in ?? () #8 0x00000000 in ?? () #9 0xbfbfe968 in ?? () #10 0xbfbfe954 in ?? () #11 0xbfbfe964 in ?? () #12 0x28445860 in ?? () #13 0x280e83fe in sasl_client_step () from /usr/local/lib/libsasl2.so.2 #14 0xbfbfe8a8 in ?? () #15 0x280e9135 in sasl_client_start () from /usr/local/lib/libsasl2.so.2 #16 0x00000000 in ?? () #17 0x00000000 in ?? () #18 0xbfbfe968 in ?? () #19 0xbfbfe954 in ?? () #20 0xbfbfe964 in ?? () #21 0xd7a3b2da in ?? () #22 0x283abad8 in ?? () from /lib/libc.so.7 #23 0x00000000 in ?? () #24 0x283ab730 in __stderrp () from /lib/libc.so.7 #25 0xbfbfe878 in ?? () #26 0x2838c764 in vfprintf () from /lib/libc.so.7 Previous frame inner to this frame (corrupt stack?) I built openldap and cyrus-sasl on this machine from sources (not ports), and (after a long time of trying to find out how to run configure successfully in both installations) the outcome was exactly the same (meaning segfaults). So, one of my admins wrote a c program that overrides gss_release_buffer returning always 0 (what is expected after normal operation) and compiled it as a library. The program code is nothing more than just: int gss_release_buffer(void *a, void *b) { return 0; } we ld_preloaded the library, and when we ran ldapwhoami the outcome was: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (unknown mech-code 2529638919 for mech unknown) When we ran it with no kerberos tickets, we got: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (unknown mech-code 2 for mech unknown) The exact same errors as the aforementioned client 4 (esxi, amd64)!!!!!!!!!!!!! What on earth is happening?!?!!?!?! Now one can easily see that there is a definite problem regarding memory freeing, and after overcoming that the mech-code 2529638919 implies that some segment in memory is overwritten by some "random" value, so mech-code returns the number 2529638919 instead of a number of marginality 1. What is more definite, is that openldap doesn't work out-of-the-box if gssapi support is required, and behaves randomly in different architectures/virtualHosts/platforms. The problem may have been something related to line 96 in /usr/bin/krb5-config... I don't know. What is sure, is that I am having second thoughts on using fbsd as my openldap/heimdal server for my setup, which would be quite disappointing for me, since I am using fbsd for the last many-many years, on all my laptops and servers. The only "good part" is that the only machine that works seamlessly (until now, at least) is the heimdal/ldap server. Thank you all in advance and I hope that we will find an answer to all this. -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

2 5

Check password module/ppolicy problem on Solaris 10 (2.4.21 OL sources) server
by Jose G. Torres 22 Feb '10

22 Feb '10

Hello everyone!, I am trying to get my solaris 10 openldap 2.4.21 server to use my check_password.so module using the ppolicy overlay. When I try to change a user's password from a linux client, I get the following error message. passwd ldapuser Changing password for ldapuser. Enter login(LDAP) password: New Password: Reenter New Password: LDAP password information update failed: Constraint violation Password fails quality checking policy passwd: Permission denied Within my logs, I do not see any error messages from my check_password.so module. I created the directory /opt/openldap/etc/openldap/modules and placed my module in that directory and I added the modulepath in my slapd.conf. Is there something I missed? Is this a PAM thing? I know this setup works on a OpenSUSE 11.2 openldap server. Help. I included part of my slapd.conf, openldap configure, check_password.c source, makefile and ldd of my check_password.so. Thanks!!!! Jose Torres openldap configure ****************** CC=/usr/sfw/bin/gcc CPPFLAGS=-I/opt/openldap/include \ LDFLAGS="-L/opt/openldap/lib -R/opt/openldap/lib" \ ./configure --prefix=/opt/openldap --with-tls \ --enable-spasswd --enable-crypt --with-gnu-ld \ --enable-ppolicy --enable-modules --enable-dynamic slapd.conf: ********** include /opt/openldap/etc/openldap/schema/ppolicy.schema # Add password policies. modulepath /opt/openldap/etc/openldap/modules overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=caci,dc=ymp,dc=com" ppolicy_use_lockout I tried ppolicy_clear_txt I still have the same problem. check_password.c: **************** #include <stdio.h> #include <stdlib.h> #include <string.h> #include <ctype.h> #include "portable.h" #include "slap.h" int init_module() { return 0; } int check_password(char *pPasswd, char **ppErrStr, Entry *pEntry) { char error=0; char retmsg[255]; char *message,*buffer,*token; const char special[] ="!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"; const char number[] ="1234567890"; const char CAPS[] ="ABCDEFGHIJKLMNOPQRSTUVWXYZ"; error = 0; if (strstr( pPasswd, " ") != NULL) { error = 1; strcpy(retmsg , "******** CHECKPW: Password contains SPACES! ********"); } buffer = strdup(pPasswd); token = strtok(buffer,special); if ( !(strcmp(token,pPasswd)) || (token == NULL) ) { error = 1; strcpy(retmsg , "******** CHECKPW: Password does not contain any special c haracters! ********"); } buffer = strdup(pPasswd); token = strtok(buffer,number); if ( !(strcmp(token,pPasswd)) || (token == NULL) ) { error = 1; strcpy(retmsg , "******** CHECKPW: Password does not contain any numbers! ********"); } buffer = strdup(pPasswd); token = strtok(buffer,number); if ( !(strcmp(token,pPasswd)) || (token == NULL) ) { error = 1; strcpy(retmsg , "******** CHECKPW: Password does not contain any CAPITAL L ETTERS! ********"); } if (error) { /* Allocate */ message = (char *)malloc(sizeof(char) * (strlen(retmsg)+1)); /* Copy the contents of the string. */ strcpy(message, retmsg); *ppErrStr=message; } return error; } Makefile: ********* check_password.so: check_password.o gcc -L/opt/openldap/lib -lldap -shared -o check_password.so check_passwo rd.o check_password.o: check_password.c gcc -fpic -I../../include -I. -c check_password.c clean: rm check_password.so check_password.o It seems to find the right libraries. $ ldd modules/check_password.so libldap-2.4.so.2 => /opt/openldap/lib/libldap-2.4.so.2 libgcc_s.so.1 => /usr/sfw/lib/libgcc_s.so.1 liblber-2.4.so.2 => /opt/openldap/lib/liblber-2.4.so.2 libresolv.so.2 => /usr/lib/libresolv.so.2 libgen.so.1 => /usr/lib/libgen.so.1 libnsl.so.1 => /usr/lib/libnsl.so.1 libsocket.so.1 => /usr/lib/libsocket.so.1 libsasl.so.1 => /usr/lib/libsasl.so.1 libssl.so.0.9.7 => /usr/sfw/lib/libssl.so.0.9.7 libcrypto.so.0.9.7 => /usr/sfw/lib/libcrypto.so.0.9.7 libc.so.1 => /usr/lib/libc.so.1 libmp.so.2 => /usr/lib/libmp.so.2 libmd.so.1 => /usr/lib/libmd.so.1 libscf.so.1 => /usr/lib/libscf.so.1 libdoor.so.1 => /usr/lib/libdoor.so.1 libuutil.so.1 => /usr/lib/libuutil.so.1 libssl_extra.so.0.9.7 => /usr/sfw/lib/libssl_extra.so.0.9.7 libcrypto_extra.so.0.9.7 => /usr/sfw/lib/libcrypto_extra.so.0.9.7 libm.so.2 => /usr/lib/libm.so.2

1 0

Re: objectclass not found inetorgperson?
by Ray Carrender 22 Feb '10

22 Feb '10

Actually it was that slapd.conf wasn't restarting correctly, I did a full reboot on my server and got this stuff to start to work. Not exactly sure why this is the case versus /usr/local/libexec/slapd.d restart but it works now and I'm all the wiser. Thanks! *Ray* Message: 13 > Date: Mon, 22 Feb 2010 05:47:12 +0100 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > Subject: Re: objectclass not found inetorgperson? > To: openldap-technical(a)openldap.org > Message-ID: <87zl3198rz.fsf(a)rubin.avci.de> > Content-Type: text/plain; charset=utf-8 > > Ray Carrender <mrsmiley32(a)gmail.com> writes: > > > I keep getting a ldap_add: Invalid syntax (21) > > ???????????????????????????? additional info: objectclass: value #0 > invalid > > per syntax > > > > (ldif) > > dn: cn=Charlton Heston,ou=people,dc=afranius,dc=com > > cn: Charlton > > sn: Heston > > mail: heston(a)actor.com > > telephoneNumber:508-555-1212 > > objectclass: inetOrgPerson > > check the ldif file whether inetorgPerson is followed by a space. > > -Dieter > > -- > Dieter Kl?nter | Systemberatung > http://dkluenter.de > GPG Key ID:8EF7B6C6 > 53?37'09,95"N > 10?08'02,42"E >

1 0

Syncrepl in OpenLDAP-2.4.20
by Ralf Zimmermann 22 Feb '10

22 Feb '10

Hi all, today I have made tests with Version 2.4.21 and my 2.4.20 configuration. When I start slapd I get following error message: config error processing olcDatabase={1}hdb,cn=config: <olcSyncrepl> invalid URL olcSyncrepl: value #0: <olcSyncrepl> invalid URL In the slapd.conf is a syncrepl section. If I add a 'uri=ldap://<server>' to the syncrepl directive and I create a online configuration with 'slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d' the olc ldif file contains a uri with 'uri=ldap://<server>'. If I didn't define uri in slapd.conf syncrepl directive the uri in the olc ldif file was empty and slapd is not starting. I have take a look to the CHANGES and the man pages, but I didn't found anything about the uri parameter in the syncrepl section. Why is this parameter not documented or where is my problem? regards Ralf Zimmermann -- .''`. Ralf Zimmermann : :' : SIEGNETZ.IT GmbH `. `' Schneppenkauten 1a `- 57076 Siegen Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen

2 1

objectclass not found inetorgperson?
by Ray Carrender 22 Feb '10

22 Feb '10

I keep getting a ldap_add: Invalid syntax (21) additional info: objectclass: value #0 invalid per syntax (ldif) dn: cn=Charlton Heston,ou=people,dc=afranius,dc=com cn: Charlton sn: Heston mail: heston(a)actor.com telephoneNumber:508-555-1212 objectclass: inetOrgPerson slapd.conf's include /usr/local/etc/oplenldap/schema/core.schema include /usr/local/etc/oplenldap/schema/cosine.schema include /usr/local/etc/oplenldap/schema/inetorgperson.schema it successfully added the two objects prior to this, do you guys have any ideas what might be going on? Thanks! *Ray*

2 1

idea for access rules #2
by Stefan Palme 21 Feb '10

21 Feb '10

Hi again, Have a subtree like this: ou=users cn=me ou=data ou=data1 cn=fact1 cn=fact2, owner=cn=me,ou=users ou=data2 cn=fact3 cn=fact4 So this time, some child elements of a dataX-subtree are "owned" by certain users. What I want: when a user (cn=me) traverses the LDAP tree, (s)he should only see the dataX-subtrees with at least one child owned by this user. For the example above, the user cn=me should get read access to "ou=data1" and to "cn=fact2,ou=data1", but he should NOT get read access to ou=data2 and its children. Specifying the access to the "cn=factX" entries is already solved, now the only problem is to deny access to some of the "ou=dataX" subtrees: My current idea is something like this: access to dn.regex="(ou=[^,]+,ou=data)" by set.expand="([ldap://127.0.0.1?base=$1?scope=sub]/owner) & user" which should find all entries in a dataX subtree, collect their owners and "compare" them with the current user. But this does not look "nice" to me because of the additional required LDAP search. Is there a more straightforward solution for this? If not: is this search operation really EXECUTED? Which bind DN is used to execute the search? The "current" one? I guess, to find the search results for the LDAP query all access rules for the current user apply? Thanks and regards -stefan-

1 0

idea for access rules
by Stefan Palme 21 Feb '10

21 Feb '10

Hi all, maybe this is not the right list for this question, in this case I apologize for this post.. I have no idea to define access rules for the following case. Have an LDAP tree like this: ou=users cn=me ou=data ou=data1, owner=cn=me,ou=users cn=fact1 cn=fact2 ou=data2, owner=cn=somebodyelse,ou=users cn=fact3 cn=fact4 (one line represents one LDAP entry with some of its attributes, the level of indentation represents the tree structure) The point is the subtree starting at "ou=data1". The root node of this subtree (ou=data1) has an attribute "owner" with a DN of a user account which can be used to bind to the LDAP server (cn=me,ou=users). Now I want to define, that this specific user has write access to some attributes of cn=fact1,ou=data1 and cn=fact2,ou=data2 etc... I am searching for a rule like this: access to "cn=[^,]+,ou=data1,ou=data" attrs="attr1,attr2,attr3" by dnattr="owner of node ou=data1,ou=data" write Obviously, this dnattr syntax is not valid, but I guess you see what I want. Any ideas how to realize this? Thanks for any hints Regards -stefan-

2 6

attributes order
by Mihamina Rakotomandimby 20 Feb '10

20 Feb '10

Manao ahoana, Hello, Bonjour, Hi all I have 3 custom attributes: - actionDate - commentContent - commentId I populated my OpenLDAP with a shell script and "ldapadd", and when searching with "ldapsearch", attributes are displayed all in the order: - actionDate - commentContent - commentId Now I use the Ocaml LDAP binding (ocamldap) to add several entries. While searching again, entries added with shell+ldap has the same atribute order display, but the ones added through the Ocaml binding are displayed in a different order. That mean while displaying all the objects (stricly of the same objectClass), I have a mixed attribute order display. How could I force openLDAP to always display attributes in the same order for one objectClass? Misaotra, Thanks, Merci. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34 / +261 33 11 207 36

2 1

password change hangs: bug?
by Stefano Zanmarchi 19 Feb '10

19 Feb '10

Hi, I'm running slapd 2.4.9 on Solaris10. I searched with no result: does anyone know if there is a bug on 2.4.9 regarding password changes? I'd like to know if newer releases have bug fixes specifically for this issue This is what happened to me. I have a client performing many password changes, which usually results in my logs like this: ... Feb 19 12:17:33 db1 slapd[49]: [ID 848112 local4.debug] conn=591 fd=22 ACCEPT from IP=192.168.2.253:49108 (IP=0.0.0.0:12312) Feb 19 12:17:33 db1 slapd[49]: [ID 215403 local4.debug] conn=591 op=0 BIND dn="uid=mario.rossi(a)unipd.it,ou=people,dc=unipd,dc=it" method=128 Feb 19 12:17:33 db1 slapd[49]: [ID 600343 local4.debug] conn=591 op=0 BIND dn="uid=mario.rossi(a)unipd.it,ou=people,dc=unipd,dc=it" mech=SIMPLE ssf=0 Feb 19 12:17:33 db1 slapd[49]: [ID 588225 local4.debug] conn=591 op=0 RESULT tag=97 err=0 text= Feb 19 12:17:33 db1 slapd[49]: [ID 270379 local4.debug] conn=591 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Feb 19 12:17:33 db1 slapd[49]: [ID 461300 local4.debug] conn=591 op=1 PASSMOD new Feb 19 12:17:33 db1 slapd[49]: [ID 875301 local4.debug] conn=591 op=1 RESULT oid= err=0 text= Feb 19 12:17:33 db1 slapd[49]: [ID 218904 local4.debug] conn=591 op=2 UNBIND Feb 19 12:17:33 db1 slapd[49]: [ID 952275 local4.debug] conn=591 fd=22 closed ... Always went fine, but yesterday this happened: ... Feb 18 22:45:41 db1 slapd[21872]: [ID 848112 local4.debug] conn=3186 fd=22 ACCEPT from IP=192.168.2.253:49820 (IP=0.0.0.0:12312) Feb 18 22:45:41 db1 slapd[21872]: [ID 215403 local4.debug] conn=3186 op=0 BIND dn="uid=maria.verdi(a)unipd.it,ou=people,dc=unipd,dc=it" method=128 Feb 18 22:45:41 db1 slapd[21872]: [ID 600343 local4.debug] conn=3186 op=0 BIND dn="uid=maria.verdi(a)unipd.it,ou=people,dc=unipd,dc=it" mech=SIMPLE ss f=0 Feb 18 22:45:41 db1 slapd[21872]: [ID 588225 local4.debug] conn=3186 op=0 RESULT tag=97 err=0 text= Feb 18 22:45:41 db1 slapd[21872]: [ID 270379 local4.debug] conn=3186 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Feb 18 22:45:41 db1 slapd[21872]: [ID 461300 local4.debug] conn=3186 op=1 PASSMOD new ... that is, no "RESULT" for PASSMD and the client performing the password change received no answer (hung), and this has caused us many problems. Could it possibly be an openldap bug? Thank you very much, Stefano

2 1

Server-Side Sort Overlay ordering problems
by Diego Lima 19 Feb '10

19 Feb '10

Hello, I have enabled the server-side sorting overlay and I received the following error on a search: sssvlv: no ordering rule specified and no default ordering rule for attribute uid <= get_ctrls: n=1 rc=18 err="serverSort control: No ordering rule" send_ldap_result: conn=1000 op=7 p=3 send_ldap_response: msgid=8 tag=101 err=18 ber_flush2: 50 bytes to sd 13 ldap_write: want=50, written=50 0000: 30 30 02 01 08 65 2b 0a 01 12 04 00 04 24 73 65 00...e+......$se 0010: 72 76 65 72 53 6f 72 74 20 63 6f 6e 74 72 6f 6c rverSort control 0020: 3a 20 4e 6f 20 6f 72 64 65 72 69 6e 67 20 72 75 : No ordering ru 0030: 6c 65 le conn=1000 op=7 do_search: get_ctrls failed Where should I specify the ordering rule for the uid attribute? The core schema? Thank you -- Diego Lima

6 6

ppolicy & sambaNTPassword
by Ralf Zimmermann 17 Feb '10

17 Feb '10

Hi all, I have a problem with overlay ppolicy and samba. My samba backend is openldap-2.4.20. I have a default ppolicy and a pwdCheckModule. If I change the userPassword all works fine. I read the slapo-ppolicy man page and I know that the only pwdAttribute is userPassword. If I change the userPassword with smbpasswd the policy works also fine. But if I want to change the Password with a Windows client the problem begins. The sambaNTPassword is set everytime to the new Password because the ppolicy overlay checks only the userPassword. So the both Passwords are different and there is no control for the sambaNTPassword. Exists any solution or a workaround for this problem. Any help is appreciated. Mit freundlichen Gruessen Ralf Zimmermann -- .''`. Ralf Zimmermann : :' : SIEGNETZ.IT GmbH `. `' Schneppenkauten 1a `- 57076 Siegen Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen

3 11

Problem with nss-ldap using GSSAPI
by Wojtek Polcwiartek 17 Feb '10

17 Feb '10

Hello, we use ldap as name source in our system (libnss-ldap). Until now we used anonymous bind with LDAP and it worked fine. Now we want to switch to GSSAPI (MIT Krb5), but getting names ('getent passwd <name>') does not work: no result is returned/printed. Strange is that, when we run the query in debug-mode (debug 7 in /etc/ldap.conf), you can see the correct result in the debug part (in "hexes") but at the end no result is printed . The only error message we could see is: res_errno: 14, res_error: <SASL(0): successful result: >, res_matched: <> Querying LDAP with ldapsearch still works fine. Do You have any idea how to get closer to the source of the problem? We use Ubuntu Karmic as client (repo package) and Solaris10 (with OpenLdap 2.4.16) as server. Greetings! -- Wojtek Polcwiartek ------ tubIT TU-Berlin Web : www.tubit.tu-berlin.de Email : tubit(a)tu-berlin.de Tel : +49.30.314.28000

2 3

binding to an alias entry?
by Stefan Palme 17 Feb '10

17 Feb '10

Hi, I have two ldap entries: dn:cn=me,ou=users,dc=kapott,dc=org objectclass:person cn:me userPassword:... dn:cn=me,ou=imap,ou=groups,dc=kapott,dc=org objectclass:alias objectclass:extensibleObject aliasedObjectName:cn=me,ou=users,dc=kapott,dc=org cn:me I can use the first DN to successfully bind to the LDAP server, but not the second one. It would be nice to be able to use "cn=me,ou=imap,ou=groups,dc=kapott,dc=org" as bind DN too, but without duplicating the whole "person" entry with the userPassword. Is this possible? Thanks and regards -stefan-

2 1

Slightly O/T: Duplicating eDirectory server ...
by Garry 16 Feb '10

16 Feb '10

I have a customer install that is running a Novell based eDirectory setup. As of lately, the setup seems to be a bit flakey, but either way could use a backup server ... I was wondering, is it possible to pull the schema definitions and plain (ldif) data out of an eDirectory and import to OpenLDAP? Don't need a hot standby replication, but daily cron job would suffice ... Tnx, Garry

2 1

ldap rebind proc problem
by Jeremiah Martell 15 Feb '10

15 Feb '10

I'm trying to get my code to rebind appropriately when it's automatically chasing referrals, but I'm running into a strange problem. I bind to server A, which returns me a referral to server B. My rebind proc is called, which tries to bind to server B. That succeeds, and (accoring to Wireshark) I get a couple referrals. (DomainDnsZones, ForestDnsZones, and server C). Then my rebind proc is called to bind to server C, but then recursively it is called (on the same thread, says pthread_self) to bind to DomainDnsZones, and then recursively again it is called to bind to ForestDnsZones, which is where my code hangs for at least 5 minutes before I kill it. My rebind proc is calling ldap_sasl_bind_s, which seems to be what is then re-calling my rebind proc in each case. The problem is that my code hangs in one of the ldap_sasl_bind_s calls, and never returns, but Wireshark shows that it successfully binds to all thee of the referred servers. I'm using openldap-2.3.24. My questions are: - Is my rebind proc correct? It seems that calling ldap_sasl_bind_s is correct and allowed. - Was there a bug that has been fixed since 2.3.24 in direct regard to rebinding? - Any tips or hints on what could be hanging up the code? Thanks, - Jeremiah

1 0

Too many open files?
by Jaap Winius 15 Feb '10

15 Feb '10

Hi all, My latest test system includes a Kerberos server that uses OpenLDAP via IPC as its back-end database. It usually works, but not always. For example, recently, after failing to get kadmin to add a new principal to the Kerberos database, I found this error in the provider's syslog: Feb 10 22:37:29 kls1 slapd[1722]: bdb_db_cache: db_open(entryUUID) failed: Too many open files (24) Feb 10 22:37:29 kls1 slapd[1722]: bdb_index_read: Could not open DB entryUUID Feb 10 22:37:29 kls1 slapd[1722]: conn=4 op=13 RESULT tag=105 err=80 text=index generation failed A restart of the Kerberos KDC and admin servers seemed to solve the problem, but obviously that's not ideal. Later on, I had a look at the numbers of open files on the system: ~# lsof -i |grep slapd slapd 1722 openldap 8u IPv6 4603 TCP *:ldap (LISTEN) slapd 1722 openldap 9u IPv4 4604 TCP *:ldap (LISTEN) slapd 1722 openldap 545u IPv4 12823 TCP kls1.example.com:ldap->kls2.example.com:51555 (ESTABLISHED) slapd 1722 openldap 744u IPv4 8899 TCP kls1.example.com:ldap->kls2.example.com:49100 (ESTABLISHED) 545 and 745u!? A restart of the Kerberos servers didn't make a difference, although restarting slapd brought these values down to 8 and 9u respectively. However, I have no idea what caused these numbers to rise. See my provider/master server's config files below. Does anyone have an idea what might be going on and how I might prevent this situation from occurring again? Thanks, Jaap ==/etc/ldap/slapd.conf================ include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/kerberos.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 tool-threads 1 authz-regexp uid=admin,cn=example.com,cn=gssapi,cn=auth cn=admin,dc=example,dc=com authz-regexp uid=ldap/([^/\.]+).example.com,cn=example.com,cn=gssapi,cn=auth cn=$1,ou=consumers,dc=example,dc=com authz-regexp uid=([^,]+),cn=example.com,cn=gssapi,cn=auth uid=$1,ou=people,dc=example,dc=com sasl-realm EXAMPLE.COM authz-policy to backend hdb database hdb suffix "dc=example,dc=com" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq index uid eq index krbPrincipalName eq,pres,sub index entryUUID eq index entryCSN eq lastmod on checkpoint 512 30 access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by dn="cn=kls2,ou=consumers,dc=example,dc=com" read by anonymous auth by self write by * none access to dn.subtree="ou=krb5,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by dn="cn=adm-srv,ou=krb5,dc=example,dc=com" write by dn="cn=kdc-srv,ou=krb5,dc=example,dc=com" read by dn="cn=kls2,ou=consumers,dc=example,dc=com" read by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ====================================== ==/etc/default/slapd================== SLAPD_CONF= SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_PIDFILE= SLAPD_SERVICES="ldap:/// ldapi:///" SLAPD_SENTINEL_FILE=/etc/ldap/noslapd export KRB5_KTNAME=/etc/krb5.keytab SLAPD_OPTIONS="" ====================================== ==/etc/krb5.conf====================== [libdefaults] default_realm = EXAMPLE.COM forwardable = true proxiable = true [realms] EXAMPLE.COM = { kdc = kls1.example.com admin_server = kls.example.com database_module = openldap_ldapconf } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [login] krb4_convert = true [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kerberos_container_dn = ou=krb5,dc=example,dc=com ldap_kdc_dn = cn=kdc-srv,ou=krb5,dc=example,dc=com ldap_kadmind_dn = cn=adm-srv,ou=krb5,dc=example,dc=com ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_conns_per_server = 5 } [logging] kdc = FILE:/var/log/krb5/kdc.log admin_server = FILE:/var/log/krb5/kadmin.log default = FILE:/var/log/krb5/klib.log ====================================== Note: "ldap_servers" option omitted, as the default is to use IPC. ======================================

2 7

openldap proxy of Windows Server 2003
by Nicolas Michel 15 Feb '10

15 Feb '10

Hello experts, I'm searching a way to set up an openldap proxy for an AD Windows Server 2003. I want to authenticate some clients on the openldap with Windows Server Users. I'm trying doing it for some days with no success... If someone would have some hints or a wonderfull tuto, or even a great paper book which talk about that topic, it would be really nice to tell me! ;) Thank you, nm

3 3

OID for private objectclasses and attributes
by Stefan Palme 15 Feb '10

15 Feb '10

Hi all, I want to extend the schema of an OpenLDAP server installation by some own objectclasses and attributetypes. Now I am not sure which range of OIDs I can safely use for this purposes. I've something calles "Internet Private Enterprise Numbers" with OIDs of the form 1.3.6.1.4.1.X As far as I've understood, the "private" subtree is 1.3.6.1.4, where the ".1" sub-subtree of this is "reserved" for enterprise use. So I think, for my very private and personal solution OID like 1.3.6.1.4.10.1.1 (for an objectclass) and 1.3.6.1.4.10.2.1 (for an attributetype) would be absolutely ok. Any comments? Thanks and regards -stefan-

2 1

dynlist (at least for me) strange behaviour
by Benjamin Griese 14 Feb '10

14 Feb '10

Hello Mailinglist, for some days/weeks now, I try to figure out, how dynlist is meant to be used and how it is to be used. But it is hard for one to get in the game, who is neither familiar with openLDAP at all. :) I tried to build the, I guess, popular 'dynamic posixgroups'. Some older ML posts helped me to build the default structure for the dynlist overlay. i.e. this one http://www.openldap.org/lists/openldap-technical/200912/msg00005.html and this http://www.openldap.org/faq/data/cache/1209.html # getent group testgroup1:*:1011:test1,test2 testgroup2:*:1012:test1,test2 this looks good to me, as expected. # id test1 uid=1011(test1) gid=1011(testgroup1) Gruppen=1011(testgroup1) # id test2 uid=1012(test2) gid=1012(testgroup2) Gruppen=1012(testgroup2) but this isn't what it is expected to be, too bad its not only a display problem, the permissions of testgroup1 and testgroup2 vice versa are really missing. # id test1 uid=1011(test1) gid=1011(testgroup1) Gruppen=1011(testgroup1), 1012(testgroup2) # id test2 uid=1012(test2) gid=1012(testgroup2) Gruppen=1012(testgroup2), 1011(testgroup1) thats what I wish it would be If I delete the Attribute labeledURI and set the memberUid for test1 and test2 by hand, everything works as expected, but it would be nice to have it dynamically managed :) Any help, guide and/or howto is highly appreciated. Thank you for your time reading this :) bye, Benjamin. -------------------------------------------------- my general config: dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=exa mple,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to * by dn="cn=admin,dc=example,dc=com" write by * read olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: memberUid pres,eq olcDbIndex: uniquemember pres,eq olcDbIndex: gidnumber pres,eq olcDbIndex: uid pres,eq olcDbIndex: uidnumber pres,eq olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW: olcSuffix: dc=example,dc=com dn: olcOverlay={0}dynlist,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcDynamicList olcOverlay: {0}dynlist olcDlAttrSet: {0}posixGroup labeledURI memberUid:uid dn: olcOverlay={1}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=Policies,dc=example,dc=com olcPPolicyHashCleartext: TRUE my testgroups: dn: cn=testgroup1,ou=People,ou=Groups,dc=example,dc=com objectClass: posixGroup objectClass: top objectClass: labeledURIObject cn: testgroup1 gidNumber: 1011 labeledURI: ldap:///ou=test,ou=Users,dc=example,dc=com?uid?sub?(objectClass =Posixaccount) memberUid: test1 (dynamically set) memberUid: test2 (dynamically set) dn: cn=testgroup2,ou=People,ou=Groups,dc=example,dc=com objectClass: posixGroup objectClass: top objectClass: labeledURIObject cn: testgroup2 gidNumber: 1012 labeledURI: ldap:///ou=test,ou=Users,dc=example,dc=com?uid?sub?(objectClass =Posixaccount) memberUid: test1 (dynamically set) memberUid: test2 (dynamically set) my testusers: dn: uid=test1,ou=test,ou=Users,dc=example,dc=com objectClass: posixAccount objectClass: inetOrgPerson objectClass: shadowAccount objectClass: top cn: test1 gidNumber: 1011 homeDirectory: /home/test1 sn: test1 uid: test1 uidNumber: 1011 userPassword: dn: uid=test2,ou=test,ou=Users,dc=example,dc=com objectClass: posixAccount objectClass: inetOrgPerson objectClass: shadowAccount objectClass: top cn: test2 gidNumber: 1012 homeDirectory: /home/test2 sn: test2 uid: test2 uidNumber: 1012 userPassword: some log entries with ACL logging enabled: Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access to "dc=example,dc=com" "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr entry Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (entry) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "dc=example,dc=com", attr "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to all values by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr uid Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (uid) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr entry Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (entry) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to all values by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "cn" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr cn Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (cn) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "cn" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "homeDirectory" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr homeDirectory Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (homeDirectory) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "homeDirectory" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "userPassword" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [1] attr userPassword Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (userPassword) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "userPassword" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: anonymous Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying auth(=xd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: auth(=xd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access denied by auth(=xd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: no more rules Feb 14 16:58:13 openldaphost slapd[8673]: send_search_entry: conn 366 access to attribute userPassword, value #0 not allowed Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "uidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr uidNumber Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (uidNumber) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "uidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr uid Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (uid) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "gidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr gidNumber Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (gidNumber) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "gidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) -- Charles de Gaulle<http://www.brainyquote.com/quotes/authors/c/charles_de_gaulle.html> - "The better I get to know men, the more I find myself loving dogs."

1 0

Expiration of root CA
by Philippe Bloix 12 Feb '10

12 Feb '10

Hi, My root CA will expire soon. What is the best method to avoid break between ldap server and ldap client communication? If i create a new root CA, then i will have to copy this new root CA on each ldap client (several hundred). In this case, is it possible to switch from the old root CA to the new root CA without a break between server and client? How? Regards Philippe

2 2

Re: Where is DB_CONFIG file?
by Echedey Lorenzo 12 Feb '10

12 Feb '10

Hi, The method suggested by Quanah worked perfectly. I also find very useful the information given by Dieter since I'll take of creating a DB_CONFIG file in new deployments. My last question has to be with db_checkpoint. Should I call it periodically or will Berkeley delete logs by its own? Thanks a lot 2010/2/12 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Thursday, February 11, 2010 7:21 PM +0100 Dieter Kluenter < > dieter(a)dkluenter.de> wrote: > > Quanah Gibson-Mount <quanah(a)zimbra.com> writes: >> >> ----- Echedey Lorenzo <echedey(a)gmail.com> wrote: >>> >>>> I think the best option, as you suggest, is to recreate >>>> everything. Is it enough to remove all /var/lib/ldap contents, >>>> restart the ldap service, and populate all again? My intention is to >>>> have 8M entries as max. >>>> >>>> Thanks for your help >>>> >>>> >>> There is zero need to recreate everything. Dieter is wrong. Simply >>> stop slapd, create the DB_CONFIG file, run db_recover to regenerate >>> the bdb database profile, then start slapd. This has been the standard >>> way to do this since OpenLDAP 2.1. Dieter should know this. >>> >> >> I have experienced some problems in the past, that's why I prefer a >> clean recreation. >> > > Then you should have collected data and filed an ITS. I've never had a > problem in nearly 10 years of configuring and modifying DB_CONFIG files back > to 2.1.4 when it's done correctly. > > --Quanah > > -- > > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

2 1

Brining up replication with an already live server?
by Adam Tauno Williams 12 Feb '10

12 Feb '10

I have two DSAs of the same version (2.4.20). One is empty and the other is stand-alone. I want to configure multi-master; can I add the syncrepl directives to the live server and then bring up the other server and add the syncrepl directives - will the second server then syncronize with the live server (which already contains configuration, etc...). Or do I need to start with two empty DSAs? -- Adam Tauno Williams <awilliam(a)whitemice.org> LPIC-1, Novell CLA <http://www.whitemiceconsulting.com> OpenGroupware, Cyrus IMAPd, Postfix, Samba

2 2

Where is DB_CONFIG file?
by Echedey Lorenzo 12 Feb '10

12 Feb '10

Hi, I'm new to this mailing list. I have a simple question... I have deployed a huge subscriber ldap database with more than 400 000 entries in a SUSE machine installing OpenLDAP with Yast. I've found huge log files in /var/lib/ldap that I cannot delete. Google says that I should tune my DB_CONFIG file to optimize the use of the the Berkeley backend, but I don't find this file. Should I create it? Thanks a lot -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

3 8

nss_map_attribute gidNumber problem
by Liam Gretton 11 Feb '10

11 Feb '10

I have user accounts for various systems within an OpenLDAP db (OpenLDAP 2.4.12 on openSUSE 11.1). Clients are running the same version on the same OS. As accounts have different requirements depending on which host is being logged into, I've created a custom schema which implements the following custom attributes: loginShellSYS1 homeDirectorySYS1 gidNumberSYS1 ...and so on for multiple SYSn systems. On the client using nss_ldap side I am mapping these to the plain attributes as so in /etc/ldap.conf: nss_map_attribute loginShell loginShellSYS1 nss_map_attribute homeDirectory homeDirectorySYS1 nss_map_attribute gidNumber gidNumberSYS1 Everything works perfectly EXCEPT for the gidNumber mapping. If that's in place then 'getent group' does not return the LDAP groups. The logs on the LDAP server suggest that the correct information has been requested, and it does indeed churn out all the expected results, but the client seems to be failing in doing the mapping at the last step. ldapsearch on an account from the client returns all the expected attributes including the gidNumberSYSn ones. The LDAP accounts also have a normal gidNumber attribute, and if I remove the mapping and use that, then getent group returns the expected results. In fact, checking the LDAP server logs, it seems that when gidNumber is mapped, getent is requesting 'cn' instead of 'gidNumber' from the record. Without the mapping, it correctly requests the gidNumber attribute. It's entirely likely that I've done something plain silly which is causing this problem, but is there any special behaviour regarding group mapping that I should have taken into account? -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

1 0

Strange nisMapEntry
by David LEROUX 11 Feb '10

11 Feb '10

Hi all, I have in my ldifs, whatever the way I do them (slapcat ldapsearch -LLL...) some strange entry, like if it was hashed. Here is a sample: nisMapEntry:: LXJ3LHRjcCxpbnRyLHJzaXplPTMyNzY4LHdzaXplPTMyNzY4LHRpbWVvPTUwLHJldHJhbnM9MTAgeWFrMjA6L3VzcjIvdXNlcnMvJiA= Which should be: nisMapEntry: -rw,tcp,intr,rsize=32768,wsize=32768,timeo=50,retrans=10 yak20:/usr2/users/& If I re import them from a fresh "normal" ldif generated from my nis automount maps, it does the same, it's alway the same affected entries... In phpldapadmin I can see it well, but not in my ldifs and its a bit annoying for me... Any idea ? Thanks, -- David Leroux

4 4

OpenLDAP 2.4 replicated to 2.3?
by Jakov Sosic 10 Feb '10

10 Feb '10

Hi to all! I've set up Zimbra LDAP (2.4) as master, and I want to use RHEL v5 LDAP (2.3) as a slave. This is relevant part of my slapd.conf on LDAP 2.3: # syncrepl directives syncrepl rid=101 provider=ldap://192.168.1.86 bindmethod=simple binddn="uid=zimbra,cn=admins,cn=zimbra" credentials=PASSword searchbase="dc=company,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://192.168.1.86 Replication works OK, when I first start LDAP, it populates automatically. But after that initial data, it just doesn't pull anything anymore. I have to restart it, or it won't pull data from Master :( Problem is, when I add user to Zimbra LDAP (master), it does not propagate immediately data to slave LDAP. I don't even know what the interval is, I've never seen it happen in a few minutes after the Master LDAP is updated... Am I missing something? Shouldn't "refreshAndPersist" do it without any delay (or with minimal delay)? Should I run someting on zimbra LDAP side, or is the sync from LDAP 2.4 to LDAP 2.3 impossible? Would it be better to set something like: type=refreshOnly interval=00:00:00:01 but this just seems like a bruteforce to me :( I repeat, after I restart slave LDAP, all the new enteries appear magically. I'm really confused. Ideas? -- | Jakov Sosic | ICQ: 28410271 | PGP: 0x965CAE2D | ================================================================= | start fighting cancer -> http://www.worldcommunitygrid.org/ |

3 3

(no subject)
by Mark Beavis 10 Feb '10

10 Feb '10

I've setup an OpenLDAP server to use MySQL as a backend - and everything works wonderfully. When I add a new record to the table, I can see the new record in an LDAP browser immediately. However, when I insert a record into the database using JDBC (via a hello world-ish java app), the record does not appear in my LDAP browser. I can see the record in the DB so the data is there - it just doesn't appear in the LDAP browser. That is, until, I restart the LDAP server, then the new record (inserted via JDBC )appears OK in my LDAP browser... Would anyone have any idea as to why this is happening? Thanks - This email may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are for those of the individual sender and may not necessarily reflect the views of RHE Group.

1 0

slapd dying, what next?
by Bryan J. Maupin 10 Feb '10

10 Feb '10

A few weeks ago, we upgraded to OpenLDAP 2.4.19. All seemed well, for about 4 weeks, and then within the last few days (starting Jan 14), slapd has been dying on our replica servers. It doesn't seem to follow any pattern, and the system seems fine when slapd dies; it isn't out of memory, and doesn't show any load spikes. In our logs we get messages like: Jan 14 22:18:34 slapd[7940]: ch_malloc of 14698087920909635104 bytes failed (from ldap.log) Jan 15 16:58:03 kernel: slapd[22663] general protection rip:2ac667af65cc rsp:4659d970 error:0 Jan 16 15:42:34 kernel: slapd[10272] general protection rip:2b71f6c6d9c4 rsp:45441980 error:0 Jan 16 17:20:01 kernel: slapd[7538] general protection rip:2aec51954ae0 rsp:449518d0 error:0 Jan 19 13:38:46 kernel: slapd[2821] general protection rip:2aeac3070ae0 rsp:4918f8d0 error:0 (from /var/log/messages) from another replica server: Jan 16 20:56:15 kernel: slapd[17948] general protection rip:2aedf150d9c4 rsp:4154f980 error:0 Jan 18 01:42:46 kernel: slapd[9446] general protection rip:2ae369401ae0 rsp:454c08d0 error:0 Jan 19 13:04:29 kernel: slapd[25339] general protection rip:2b9803877ae0 rsp:4b6bc8d0 error:0 We're running on RHEL 5.4, with Heimdal 1.2.1-3, OpenSSL 0.9.8k, Cyrus-SASL 2.1.23, BDB 4.7.25 (with patches), libunwind 0.99 (for Google tcmalloc), Google tcmalloc 1.3. 1. Is there any useful information that can be obtained from these log entries, or do we simply need to change to a more verbose log level and wait for slapd to die again? 2. If we need to change our log level, what is a suggested level? Right now we're using "loglevel sync stats". Would it be wise to change the log level to -1 (any)? These are production servers, and I imagine that'd be a huge performance hit. 3. Also, we're logging asynchronously at the moment. Should we disable this while debugging? Thanks!

3 13

accesslog overlay - filter by ip addresses (advise)
by Aravind Gottipati 09 Feb '10

09 Feb '10

Hi, I'd like to extract successful bind operations and filter them based on the connection's originating ip address. From the docs, it looks like enabling and querying the accesslog database is a good way to go. Unfortunately, it looks like the ip addresses for the operations aren't recorded in the accesslog db. Is this information recorded in the accesslog at all? I dumped the db with a slapcat and couldn't find it there. Are there some configuration options that I could enable to record this information. My worst case scenario would be to log this into the ldap log file and scrape that. Is there a better way to do this? Thanks in advance, Aravind.

1 0

LDAP and DNS-SRV: questions
by Keutel, Jochen 09 Feb '10

09 Feb '10

Hello, we are trying to use the DNS-SRV backend of OpenLDAP. This gets difficult when ldaps is used. I'm not sure whether we do this correctly - so I'd like to ask the following questions: 1. If I run an LDAP server (administrative point: dc=keutel,dc=de) with both ldap and ldaps enabled: Is it right that I should put *two* lines into DNS? Like: _ldaps._tcp.keutel.de IN SRV 10 0 636 ldap.keutel.de _ldap._tcp.keutel.de IN SRV 10 0 389 ldap.keutel.de Or, when using non-default ports: _ldaps._tcp.keutel.de IN SRV 10 0 1636 ldap.keutel.de _ldap._tcp.keutel.de IN SRV 10 0 1389 ldap.keutel.de 2. If there is another LDAP server, e.g. ldap.abcdefg.hi , configured using DNS-SRV backend: If I search this server like: ldapsearch -H ldaps://ldap.abcdefh.hi/ -b dc=keutel,dc=de sn=meier Then I would expect that this requested is chained (using back-meta) to ldaps://keutel.de:1636/ with search base dc=keutel,dc=de . Is this understanding correct? 3. If yes: I think that OpenLDAP code currently doesn't handle this correctly: a) independent on the original request (ldap or ldaps): Always the _ldap._tcp DNS record is used (never _ldaps._tcp) b) independent on the original request (ldap or ldaps): Always ldap URLs are returned (never ldaps://...) c) the search base is omitted in the chained request: So keutel.de is searched with empty search base See ITS 6462 and 6463 for details. I think fixing b) and c) is not that difficult: Just dnssrv_back_referrals() has to be changed. I'll try to send a patch. Fixing a) seems more difficult because ldap_domain2hostlist() isn't used only in the DNS SRV backend but also in the tools (ldapsearch etc.) and the NSS overlay. Best regards, Jochen.

1 0

LDAP w/mysql as backend
by Radosław Antoniuk 09 Feb '10

09 Feb '10

Hi, I need a pointer please. I need to configure an LDAP server that presents (only read!) data from a mysql database. I have found some nice article for ndb configuration but I think that's not what I need, because this scenario is bi-directional, i.e. It assumes a clean mysql database and r/w access via LDAP that uses mysql as backend per say. What I want to do is to treat LDAP just as an "interface" to mysql database (or even one table). Can anybody point me to a good direction of reading? Thanks. -- Best regards, Radek Antoniuk

4 3

nssov overlay and hostservice
by ben thielsen 08 Feb '10

08 Feb '10

hi i'm experimenting with the nssov overlay, and am trying to get the hostservice approach working as described in man 5 slapo-nssov. i'm using slapd 2.4.18 and the 0.6.11 nss-pam-ldapd stub libraries, both via ubuntu packages. the nss side of things appears to be working as desired, but in my testing with sshd and pam, authentication succeeds even when the user is in a group that's denied the compare operation for the authorizedservice attribute. testing a bit with ldapcompare seems to indicate my acls are working as expected, and i see compare references in slapd's log when running ldapcompare, but not during ssh authentication. i'm relatively confident the authentication is not occurring via another mechanism (like nss/shadow) - if i remove the auth line that references pam_ldap from the pam config for sshd, authentication fails. i've included a few snippits below that will hopefully help illustrate things. overlay config: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,cn=config' -b 'olcOverlay={6}nssov,olcDatabase={2}bdb,cn=config' -s base Enter LDAP Password: dn: olcOverlay={6}nssov,olcDatabase={2}bdb,cn=config objectClass: olcNssOvConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {6}nssov olcNssMap: group uniquemember member olcNssPam: authz2dn hostservice olcNssPamSession: sshd olcNssPamSession: login acls: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,cn=config' -b 'olcDatabase={2}bdb,cn=config' -s base olcaccess Enter LDAP Password: dn: olcDatabase={2}bdb,cn=config olcAccess: {0}to dn.base="" by * read olcAccess: {1}to attrs=userPassword by self =dxw by anonymous auth by * none olcAccess: {2}to dn.base=cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net attrs=authorizedservice by set="[cn=directory_administrators,ou=general,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" manage by set="[cn=ssh,ou=all_servers,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" compare by set="[cn=ssh,ou=under,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" compare by * =dxrs olcAccess: {3}to * by self write by set="[cn=directory_administrators,ou=general,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" manage by users read by * none related group membership: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,dc=groundnoise,dc=net' -b 'dc=groundnoise,dc=net' '(cn=ssh)' member Enter LDAP Password: dn: cn=ssh,ou=under,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net member: uid=alien,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net member: uid=lisa,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net dn: cn=ssh,ou=all_servers,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net member: uid=rwetzel,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net entry for the host running sshd: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,dc=groundnoise,dc=net' -b 'cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net' -s base Enter LDAP Password: dn: cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net objectClass: device objectClass: top objectClass: ipHost objectClass: authorizedServiceObject cn: under.groundnoise.net ipHostNumber: 192.168.1.1 authorizedService: sshd authorizedService: login getent for the host entry: >getent hosts under.groundnoise.net 192.168.1.1 under.groundnoise.net nsswitch config: >egrep -v '(^[[:space:]]*#|^[[:space:]]*$)' /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns ldap networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis ldapcompare test: >ldapcompare -vxWH 'ldaps://ldap.groundnoise.net' -D 'uid=luna,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net' 'cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net' 'authorizedservice:login' ldap_initialize( ldaps://ldap.groundnoise.net:636/??base ) Enter LDAP Password: DN:cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net, attr:authorizedservice, value:login Compare Result: Insufficient access (50) UNDEFINED pam config for sshd: >egrep -v '(^[[:space:]]*#|^[[:space:]]*$)' /etc/pam.d/sshd auth required pam_env.so # [1] auth required pam_env.so envfile=/etc/default/locale auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so account required pam_nologin.so account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so account [success=1 default=ignore] pam_ldap.so account requisite pam_deny.so account required pam_permit.so session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session required pam_unix.so session optional pam_ldap.so no_warn session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so password required pam_passwdqc.so min=disabled,16,12,7,6 max=256 password [success=2 default=ignore] pam_unix.so obscure md5 password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass password requisite pam_deny.so password required pam_permit.so ssh test: >ssh luna(a)under.groundnoise.net hostname --fqdn luna(a)under.groundnoise.net's password: under.groundnoise.net i'm hoping someone can point out what i'm missing or what i might be doing wrong. thanks, -ben

2 1

Re: nssov overlay and hostservice
by ben thielsen 06 Feb '10

06 Feb '10

On Feb 05, 2010, at 11.59, Kyle Robinson wrote: > On Thu, Feb 4, 2010 at 7:26 PM, ben thielsen <btb(a)bitrate.net> wrote: > >> hi >> >> i'm experimenting with the nssov overlay, and am trying to get the >> hostservice approach working as described in man 5 slapo-nssov. i'm using >> slapd 2.4.18 and the 0.6.11 nss-pam-ldapd stub libraries, both via ubuntu >> packages. >> ... >> >> ssh test: >>> ssh luna(a)under.groundnoise.net hostname --fqdn >> luna(a)under.groundnoise.net's password: >> under.groundnoise.net >> >> i'm hoping someone can point out what i'm missing or what i might be doing >> wrong. >> >> thanks, >> -ben > > > Turn on debug for pam_unix and pam_ldap in the auth section and check syslog > to make sure it isn't actually pam_unix doing the auth via nss passwd hash. i'm fairly confident that auth isn't happening via pam_unix / nss passwd hash. if i remove the auth line for pam_ldap from the pam config (leaving only pam_unix), authentication fails (other users in local passwd/shadow flat files still work). i also see, in the logs, a pam_unix failure "sshd[10978]: pam_unix(sshd:auth): authentication failure;" prior to success by the ldap module each time authentication occurs. the debug option for the pam_ldap stub library from nss-pam-ldapd is ignored, according to the man page, and adding either debug or audit to pam_unix didn't seem to generate any additional log data. there is plenty of activity in the slap log file, just not the compare operations that i was expecting to see, based on my interpretation of the man page for slapo-nssov.

1 0

memberOf configured via directory based model
by Todd Reed 06 Feb '10

06 Feb '10

I've been stumped for two weeks now trying to implement the memberOf Overlay via directory based model. I even tried it via a slapd.con file and still had trouble. Here is my installation steps on Ubuntu. Is anyone able to spot where I'm going wrong with my configurations? ################ # Setup OpenLDAP ################ sudo apt-get -y install slapd ldap-utils cd /etc/ldap sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif sudo vi db.ldif # Load dynamic backend modules dn: cn=module{0},cn=config objectClass: olcModuleList cn: module {0} olcModulepath: /usr/lib/ldap olcModuleload: {0}back_hdb olcModuleload: {1}memberof.la # Create the database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=com olcRootDN: cn=admin,dc=mydomain,dc=com olcRootPW: password olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif sudo slappasswd -h {MD5} sudo vi base.ldif dn: dc=mydomain,dc=com objectClass: dcObject objectclass: organization o: mydomain.com dc: mydomain description: My LDAP Root dn: cn=admin,dc=mydomain,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin userPassword: {MD5}gdyb21LQTcIANtvYMT7QVQ== description: LDAP administrator sudo ldapadd -Y EXTERNAL -H ldapi:/// -f base.ldif sudo vi config.ldif dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify delete: olcRootDN dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,cn=config dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {MD5}gdyb21LQTcIANtvYMT7QVQ== dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess sudo ldapadd -Y EXTERNAL -H ldapi:/// -f config.ldif sudo vi acl.ldif dn: olcDatabase={1}hdb,cn=config add: olcAccess olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=mydomain,dc=com" write by * read sudo ldapmodify -x -D cn=admin,cn=config -W -f acl.ldif

2 1

sizelimit doesn't seem to be reflected into "ldap" backends?
by Jason Haar 06 Feb '10

06 Feb '10

Hi there I'm wanting to use slapd as a "LAF" - LDAP Application Firewall - to filter and log calls to our backend Active Directory LDAP network. I've just slapd doing the job just fine - except that it can't return large LDAP data dumps... If I use "ldapsearch -E pr=900/noprompt" directly against an AD LDAP server, I can get it to dump everything. However, if I do the same command against a slapd proxy, I get the "size exceeded" error message. It appears slapd doesn't understand this extension, and isn't passing it on to the backend? Any ideas how I could get around this, besides saying we need to touch our AD to get rid of the size limit (I've already thought of that :-) Thanks Jason -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

Re: ppolicy : managing passwords by another user than root
by smainklh＠free.fr 05 Feb '10

05 Feb '10

Hi Buchan, I'm not trying to manage password policies through php. I just had a problem to give the rights of changing passwords to a user. i figured it out now by modifying the acl's. Here is a sample of my slapd.conf: >>>>>>>>CUT<<<<<<<<<<<<< # Default password policy overlay ppolicy ppolicy_default cn=default,ou=policies,o=others,dc=domain,dc=tld ppolicy_hash_cleartext overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # The base of your directory in database #1 suffix "dc=domain,dc=tld" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=domain,dc=tld" rootdn "cn=admin,dc=domain,dc=tld" rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx >>>>>>>CUT<<<<<<<<<<<< # org1 administrators have all the rights on the subtree ou=Users,o=org1,dc=domain,dc=tld access to dn.subtree="ou=Users,o=org1,dc=domain,dc=tld" attrs=userPassword,shadowLastChange by dn="cn=admin.org1,o=others,dc=domain,dc=tld" write by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous auth by self write by * none access to dn.subtree="ou=Users,o=org1,dc=domain,dc=tld" by dn="cn=admin.org1,o=others,dc=domain,dc=tld" manage by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous read by * none # org2 administrators have all the rights on the subtree ou=Users,o=org2,dc=domain,dc=tld access to dn.subtree="ou=Users,o=org2,dc=domain,dc=tld" attrs=userPassword,shadowLastChange by dn="cn=admin.org2,o=others,dc=domain,dc=tld" write by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous auth by self write by * none access to dn.subtree="ou=Users,o=org2,dc=domain,dc=tld" by dn="cn=admin.org2,o=others,dc=domain,dc=tld" manage by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous read by * none #### access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=auth,o=others,dc=domain,dc=tld" read by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous auth by self write by * none And my password policy : ldapsearch -Wx -H ldaps://ldap.domain.tld -D cn=admin,dc=domain,dc=tld -b o=others,dc=domain,dc=tld cn=default Enter LDAP Password: # extended LDIF # # LDAPv3 # base <o=others,dc=domain,dc=tld> with scope subtree # filter: cn=default # requesting: ALL # # default, policies, others, domain.tld dn: cn=default,ou=policies,o=others,dc=domain,dc=tld pwdAttribute: userPassword pwdLockout: TRUE pwdLockoutDuration: 10800 pwdMaxFailure: 5 objectClass: pwdPolicy objectClass: organizationalRole cn: default pwdAllowUserChange: TRUE pwdMinLength: 8 pwdMaxAge: 15552000 pwdExpireWarning: 15120000 pwdCheckQuality: 2 pwdInHistory: 4 Now it works, sorry i should have provided you more information. I'll do it next time. Regards, Grifith ----- Mail Original ----- De: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> À: openldap-technical(a)openldap.org Cc: "Smaïne Kahlouch" <smainklh(a)free.fr> Envoyé: Vendredi 5 Février 2010 11h02:22 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: ppolicy : managing passwords by another user than root On Monday, 1 February 2010 21:37:11 Smaïne Kahlouch wrote: > Could somebody help me please ? With what? > I'm asking a last time then i would have to use my root account within > my php code :/ (no secure at all) Assuming your message is relevant to the subject of this thread, php is a dead end, as it has no password policy control. I have some perl scripts to manage password-policy changes. Regards, Buchan

1 0

ppolicy : managing passwords by another user than root
by Smaïne Kahlouch 05 Feb '10

05 Feb '10

Hi everyone, I'm trying to allow a user to change the passwords of users in a specific subtree. For exemple : The user uid=admin-sales,o=Sales,dc=domain,dc=tld is allowed to change the passwords of users in the following directory : ou=Users,o=Sales,dc=domain,dc=tld. I figured it out by playing with the acl's but when enabling password policy the user uid=admin-sales can't change passwords anymore. The only user alloweded is the admin (root user). Is there a way to do so or is it impossible for another user than root to manage passwords with ppolicy enabled? Regards, Grifith

5 6

LDAP/Kerberos client config
by Jaap Winius 05 Feb '10

05 Feb '10

Hi all, Now that I'm satisfied with my OpenLDAP/Kerberos server configuration, I'm attempting to devise a suitable (Debian lenny) client setup for it. Although I hear that it may not be the best approach, I'm currently pursuing a client configuration that includes kstart, libnss-ldap, nscd and libpam-ldap. At the moment I'm happy with all of it except libnss-ldap. Kstart has no problem obtaining an initial Kerberos ticket, but I can't get libnss-ldap to use it to access the DIT. So far my libnss-ldap.conf looks like: base dc=example,dc=com uri ldap://ldapks1.example.com/ ldap_version 3 rootuse_sasl yes krb5_ccname FILE:/tmp/krb5cc_0 Any idea what I might be missing? Thanks, Jaap

2 1

>Proxy Just Binds/Authentications from another LDAP?
by Don Hoover 04 Feb '10

04 Feb '10

Well, I have been working on this question and have had an idea. Would a way to accomplish this is by using SASL? It took me about 10 minutes to figure out how to configure saslauthd to verify binds to the other LDAP server. Openldap can use SASL right? So I just need to get slapd to use SASL to verify the binds to the other external ldap server. So I would have: ldapclient bind request-> openldap slapd -> SASL-> external ldap server bind Is this a good idea? I don't see how to make slapd use the sasl server for this though, the only examples I can find are to use kerberos. Any ideas on how to get slapd to just use sasl like I have it setup?

3 6

Check for attributs modifications
by David LEROUX 04 Feb '10

04 Feb '10

Hi all, I'd like to know if there is an easy way to monitor attributes modification ? In fact I import my users accounts, automount maps and almost everything from nismaps every hour with padl scripts (a bit modified by me). So each time scripts imports entries, it don't care if the entry already exist or not, it try to create it, which results in a lot of errors (existing entries...). Furthermore, for now, if I want to modify an entry I have to do it myself... What I'd like to do, is to supervise created or updated entry, so that I can focus only on those one... I thought about something like replog but I'm not sure that's the good way to do it... Any help is welcome,

3 2

OpenLDAP Log files
by sgmayo＠mail.bloomfield.k12.mo.us 03 Feb '10

03 Feb '10

One of my teachers decided to move things around and plugged a network cable in the wrong place causing a network loop and it seems to have ended up corrupting my ldap database. Where are the log files from slapd at and/or how do I read them? I did a 'slapd -d -1' and the pages just keep flying by and never stop without a ctrl-c. I have run a slapd_db_recover on this Fedora 10 box, but that did not seem to fix the problem I guess. I did slapcat the directory to an ldif file yesterday, but I am wondering if it did not already contain some bad data. I may see if I can slapadd it back in if ldap does not have to be running. If it does then I will have to do something else. Thanks for any info. Took me 7 hours to track down the intermittent problems yesterday since it seemed to be server problems and now I am starting out again on the same track it seems. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

4 3

Problem with chain overlay
by Klaus Nagel 02 Feb '10

02 Feb '10

Hello, I have a little problem with the chain overlay and hope, someone can help me. I have a master and a slave server (both debian lenny with openldap 2.4.11) and a normal syncrepl replication between both, but I can't get the chain working. my slave slapd.conf entries: moduleload back_ldap overlay chain chain-uri "ldap://10.8.0.1:389/" chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=admin,dc=test,dc=de" credentials=testpw mode=self chain-tls start chain-return-error TRUE if i try to delete an entry with ldapdelete on the slave server: ldapdelete -xD "cn=admin,dc=test,dc=de" -w testpw cn=abc,ou=Verteiler,dc=test,dc=de Log from slave server: conn=1 fd=13 ACCEPT from IP=127.0.0.1:48451 (IP=0.0.0.0:389) conn=1 op=0 BIND dn="cn=admin,dc=test,dc=de" method=128 conn=1 op=0 BIND dn="cn=admin,dc=test,dc=de" mech=SIMPLE ssf=0 conn=1 op=0 RESULT tag=97 err=0 text= conn=1 op=1 DEL dn="cn=abc,ou=Verteiler,dc=test,dc=de" conn=1 op=1 RESULT tag=107 err=8 text= conn=1 op=2 UNBIND conn=1 fd=13 closed Log from master server: conn=83 fd=15 ACCEPT from IP=10.8.0.2:44720 (IP=0.0.0.0:389) conn=83 op=0 BIND dn="" method=128 conn=83 op=0 RESULT tag=97 err=0 text= conn=83 op=1 DEL dn="cn=abc,ou=Verteiler,dc=test,dc=de" conn=83 op=1 RESULT tag=107 err=8 text=modifications require authentication conn=83 op=2 UNBIND conn=83 fd=15 closed ...it seems to me, that the bind-dn will not be transmitted and I don't see any start-tls entries. ...any hints for me? best regards: Klaus

3 2

Proxy Just Binds/Authentications from another LDAP?
by Don Hoover 02 Feb '10

02 Feb '10

I have been reading how to use slapd-ldap, and one thing that is not clear is if its possible just to proxy bind's. I have a LDAP directory that has all the unix posix accounts info in it for our users, but we have another LDAP server that has all the applications info and passwords for the users and is what should be doing all the actual authentication. What I would like to do is let the NIX systems get their unix account data from our LDAP server(/etc/passwd data etc), but proxy the bind requests generated from the user logins to the other LDAP server for authentication from the LDAP server that the system is pointed at for the posix account data. Is it possible just to force regular bind requests only to the other LDAP server and use that to authenticate our users? Most of the examples I have seen are all about using the proxy features of slapd-ldap to provide the actual data from the other LDAP server seamlessly, and not really for using that backed proxied LDAP server to just authenticate the binds. Any ideas? --- Don Hoover dxh(a)yahoo.com

1 0

do_syncrepl: ... rc 68 retrying
by Peter Mogensen 02 Feb '10

02 Feb '10

I have a mirror which has stopped replicating. (slapd 2.4.21) Somehow it has ended up in a situation where it looks like it is trying to replicate a modrdn operation, but the new RDN already exists on the consumer. Strangely, it doesn't exists on the producer. Like this: On Server1 (producer) I have: contextCSN: 20100202142811.287095Z#000000#001#000000 cn=A,dc=example,dc=com entryCSN: 20100127080339.261941Z#000000#001#000000 On Server2 (consumer) I have: contextCSN: 20100127075402.694373Z#000000#001#000000 cn=A,dc=example,dc=com entryCSN: 20100113084604.888851Z#000000#001#000000 cn=B,dc=example,dc=com entryCSN: 20100127075357.910468Z#000000#001#000000 I notice that the contextCSN of server2 is only a few seconds after the entryCSN for cn=B,dc=example,dc=com The log says: syncrepl_entry: rid=003 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=003 be_search (0) syncrepl_entry: rid=003 cn=A,dc=example,dc=com syncrepl_entry: rid=003 be_modrdn cn=B,dc=example,dc=com (68) do_syncrepl: rid=003 rc 68 retrying Any suggestion for how this could happen? regards, Peter

1 0

Mingw regex compile issue
by Rasmus Schram 02 Feb '10

02 Feb '10

Hello I am trying to compile the openldap v. 2.4.19 client api with MingW and Msys. It will successfully make the configure command, but when I try to make, it complains about not having a shared version of the regex library. I have tried to use both 'mingw-libgnurx-2.5.1' and 'regex-0.12' but with no luck. I am only interested in building the client api libraries, but the error results in only building a static version of the library and I really need the shared dll's instead. This is the Warning/issue I get trying to compile. --------------------------------------------------------------------- /bin/sh ../../libtool --mode=link gcc -g -O2 -no-undefined -avoid-version -rpath /usr/local/lib -o liblber.la assert.lo decode.lo encode.lo io.lo bprint.lo debug.lo memory.lo options.lo sockbuf.lo nt_err.lo version.lo -lregex -lws2_32 *** Warning: linker path does not have real file for library -lregex. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libregex and none of the candidates passed a file format test *** using a file magic. Last file checked: /bin/libregex.a *** Warning: linker path does not have real file for library -lws2_32. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libws2_32 and none of the candidates passed a file format test *** using a file magic. Last file checked: /mingw/lib/gcc/mingw32/3.4.5/../../..//libws2_32.a *** The inter-library dependencies that have been dropped here will be *** automatically added whenever a program is linked with this library *** or is declared to -dlopen it. *** Since this library must not contain undefined symbols, *** because either the platform does not support them or *** it was explicitly requested with -no-undefined, *** libtool will only create a static version of it. --------------------------------------------------------------------- I have tried various options but cannot find the cause of the problem. Any help would be appreciated. Regards Rasmus _________________________________________________________________ NY Windows Live Messenger med nye fede funktioner. Hent den her! http://download.live.com/messenger

1 1

refint overlay don't works as expected
by Sergei Butakov 01 Feb '10

01 Feb '10

Hi I'm using refint and memberof overlays. Refint overlay don't works as expected - it don't modifying one entry: uid=admin,ou=Users,dc=domain.local (which is a member of cn=webers,ou=Groups,dc=domain.local - see dump.ldif attachment). Changing the memberof-dangling option in the memberof overlay don't help. If I turn off the memberof overlay or move this entry to the end of dump.ldif file (after cn=webers,ou=Groups,dc=domain.local) then the refint overlay works as needed. Can somebody retest it or say where I'm wrong? Steps to reproduce: 1) stop slapd 2) copy the files (slapd.conf, bsl.schema, dump.ldif) from the attachment to the apropriate places. Correct the pathes (include, directory) in slapd.conf file. 3) rm -rf /path/to/openldap-data/* 4) slapadd -l dump.ldif 5) chown -R ldapd:ldapd openldap-data (use your own ldap user) 6) start slapd 7) test #1: $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(cn=webers)' member dn: cn=webers,ou=Groups,dc=domain.local member: uid=admin,ou=Users,dc=domain.local member: uid=u1,ou=Users,dc=domain.local $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(uid=*)' memberOf dn: uid=admin,ou=Users,dc=domain.local memberOf: cn=webers,ou=Groups,dc=domain.local dn: uid=u1,ou=Users,dc=domain.local memberOf: cn=webers,ou=Groups,dc=domain.local All OK. 8) now rename dc=domain.local: $ ldapmodrdn -r -D cn=manager -w 1 dc=domain.local dc=example.org -v ldap_initialize( <DEFAULT> ) Renaming "dc=domain.local" new rdn="dc=example.org" (delete old rdn) Rename Result: Success (0) 9) check #2: $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(cn=webers)' member dn: cn=webers,ou=Groups,dc=example.org member: uid=admin,ou=Users,dc=example.org member: uid=u1,ou=Users,dc=example.org $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(uid=*)' memberOf modifiersName dn: uid=admin,ou=Users,dc=example.org memberOf: cn=webers,ou=Groups,dc=domain.local memberOf: cn=webers,ou=Groups,dc=example.org modifiersName: cn=Manager dn: uid=u1,ou=Users,dc=example.org memberOf: cn=webers,ou=Groups,dc=example.org modifiersName: cn=Referential Integrity Overlay Error: refint overlay didn't change the uid=admin entry. -- Regards, Sergei Butakov

1 1

ACLs based on attributes?
by Jaap Winius 01 Feb '10

01 Feb '10

Hi all, Is it possible to define an ACL that gives a DN access to a particular attribute in other DNs based on the value of one of its own attributes? For example, would it be possible to define an ACL that would allow a DN with title=telephonemanager to update only the telephoneNumber attribute of other DNs? In other words, the ACL would allow updates to telephoneNumber, but only for search filter title=telephonemanager; a simple a change of the title would result in the gain or loss of the right to make such updates. Thanks, Jaap

4 12

understanding userid .vs. uid
by Stefan Palme 31 Jan '10

31 Jan '10

Hi all, This is not a problem, just a question to understand the things "behind the scenes". I am just playing around with some LDAP frontends helping the user to add the correct attributes depending on the selected objectclass(es) when creating new LDAP entries. A have tried to add an entry with objectclass "account", which requires an attribute "userid" and may have some more attributes. After adding the entry with "userid=test", the LDAP tree contained an appropriate entry, but the attributes "userid" is named "uid" now. Although I gave the entry an RDN with "userid=test", the RDH has also automagically changed to "uid=test". Obviously, userid and uid are "the same" attribute, and here are my questions: 1) The objectclass "account" is defined with "MUST userid" - but I can create an "account" entry either by giving it an "userid" attribute or by using "uid" - both works (I've expected the "uid" approach to fail). Why? 2) Where is the relationship between userid and uid defined? I've found some "attributetype" definitions in the schema files (namely NAME ('uid', 'userid')), but they are commented out. So is this relationship hardcoded in OpenLDAP's source code? If yes - is this a standard relationship also used by other LDAP servers? 3) Are there some more attribute pairs like userid/uid which are "interchangable" in this way? If yes, can I derive the list of such attributes from the schema files somehow? Or is there a RFC or something naming all such attributes? Thanks and regards -stefan- -- --------------------------------------------------------------------- Stefan Palme Email: palme(a)kapott.org WWW: http://hbci4java.kapott.org GnuPG-Fingerprint: 1BA7 D217 36A1 534C A5AD F18A E2D1 488A E904 F9EC ---------------------------------------------------------------------

3 2

Requiring LDAP host entries for user login
by Jaap Winius 30 Jan '10

30 Jan '10

Hi all, My v2.4.11 OpenLDAP server, which runs Debian lenny and requires Kerberos authentication, has these access directives: access to attrs=userPassword,shadowLastChange by * none access to dn.base="" by * read access to * by anonymous auth by users read (The second directive seems not to matter. Why?) Users cannot login unless libnss-ldap on the workstations first uses a Kerberos host key to authenticate and then searches the DIT for a matching user account. I prefer this to allowing libnss-ldap to search the DIT anonymously. I've also created LDAP entries for the hosts that are matched to their Kerberos (GSSAPI) counterparts with: authz-regexp uid=host/([^/\.]+).example.com,cn=example.com,cn=gssapi,cn=auth cn=$1,ou=hosts,dc=example,dc=com The server's syslog shows that these LDAP host names are being resolved when clients login to the workstations. However, I've also found that if the above authz-regexp statement is disabled, the host names will remain in their GSSAPI format, but the DIT is still searched and the users can still login. So, is it possible to make the successful authz-regexp resolution of LDAP host entries a requirement for user login? If so, how? Many thanks, Jaap

1 0

Re: Error 53 applying syncrepl LDIF
by Hung Luu 29 Jan '10

29 Jan '10

On Fri, Jan 29, 2010 at 3:06 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, January 29, 2010 2:39 PM -0700 Hung Luu <hung.n.luu(a)gmail.com> > wrote: > > Are you able to get it to work with ldapadd as well? I'm getting a >> segmentation fault using ldapmodify (installed as part of >> openldap-clients.x86_64 rpm 2.3.43-3.el5). >> > > I would suggest you use a 2.4 version of ldapmodify and/or ldapadd. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > This is interesting -- if I apply the hdb LDIF _before_ the config LDIF then ldapadd has no complaints. Reversing the order of my entries in the LDIF so the olcSyncrepl attribute is added to the hdb backend first did the trick. dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=001 provider="ldap://provider:389" type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=ldap,ou=services, dc=example,dc=com" credentials=secret dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=000 provider="ldap://provider:389" type=refreshAndPersist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple binddn="cn=ldap,ou=services,dc=example,dc=com" credentials=secret I will try to find 2.4 versions of ldapadd and ldapmodify. Thanks, Hung

1 0

Re: Error 53 applying syncrepl LDIF
by Hung Luu 29 Jan '10

29 Jan '10

On Fri, Jan 29, 2010 at 2:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, January 29, 2010 1:56 PM -0700 Hung Luu <hung.n.luu(a)gmail.com> > wrote: > > Hello all, >> >> In a syncrepl setup, I understand that the syncrepl specification is >> defined on the consumer server. I understand this to mean that I should >> apply my LDIF (that adds the olcSyncrepl attribute to my config and hdb >> backends) on the consumer server. However, ldapadd was only successful in >> configuring my config backend for syncrepl, which is defined first in the >> LDIF, and failed with LDAP error 53 when attempting to add the >> olcSyncrepl attribute to my hdb backend; additional error info: "shadow >> context; no update referral." >> >> Is this because the olcSyncrepl attribute added to my config backend >> already established my consumer server as a replica and hence subsequent >> writes to the consumer server will not be accepted? >> >> Ideally, I wanted to add the syncrepl configuration in my slapd.conf and >> then convert it to cn=config; however, this doesn't appear to work with >> 2.4.21 because the slaptest added a uri="" to the olcSyncrepl attribute >> that running slapd complained of an invalid URL for olcSyncrepl. This is >> not an issue in 2.4.20. >> >> Anyway, what's the right way for me to configure syncrepl on my 2.4.21 >> consumer server for both the config and hdb backends? >> > > It works for me with 2.4.21: > > dn: olcDatabase={2}hdb,cn=config > changetype: modify > add: olcSyncrepl > olcSyncrepl: rid=100 provider=${ldap_master_url} bindmethod=si > mple timeout=0 network-timeout=0 binddn=uid=zmreplica,cn=admins,cn=zimbra c > redentials=${ldap_replication_password} starttls=critical > filter="(objectclass=*)" searchbase="" > logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" > logbase=cn=access > log scope=sub schemachecking=off type=refreshAndPersist retry="60 +" > syncdat > a=accesslog tls_cacertdir=/opt/zimbra/conf/ca > > is the LDIF I use to ldapmodify my entry. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Are you able to get it to work with ldapadd as well? I'm getting a segmentation fault using ldapmodify (installed as part of openldap-clients.x86_64 rpm 2.3.43-3.el5). Here's my LDIF file: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=000 provider="ldap://provider:389" type=refreshAndPersist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple binddn="cn=ldap,ou=services,dc=example,dc=com" credentials=secret dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=001 provider="ldap://provider:389" type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=ldap,ou=services,dc=example,dc=com" credentials=secret Something else that I tried that seems to get syncrepl working on 2.4.21 is to use a slapd.d converted from a 2.4.20 slapd.conf, but I'm a little uneasy about it. Thanks, Hung.

2 1

Error 53 applying syncrepl LDIF
by Hung Luu 29 Jan '10

29 Jan '10

Hello all, In a syncrepl setup, I understand that the syncrepl specification is defined on the consumer server. I understand this to mean that I should apply my LDIF (that adds the olcSyncrepl attribute to my config and hdb backends) on the consumer server. However, ldapadd was only successful in configuring my config backend for syncrepl, which is defined first in the LDIF, and failed with LDAP error 53 when attempting to add the olcSyncrepl attribute to my hdb backend; additional error info: "shadow context; no update referral." Is this because the olcSyncrepl attribute added to my config backend already established my consumer server as a replica and hence subsequent writes to the consumer server will not be accepted? Ideally, I wanted to add the syncrepl configuration in my slapd.conf and then convert it to cn=config; however, this doesn't appear to work with 2.4.21 because the slaptest added a uri="" to the olcSyncrepl attribute that running slapd complained of an invalid URL for olcSyncrepl. This is not an issue in 2.4.20. Anyway, what's the right way for me to configure syncrepl on my 2.4.21 consumer server for both the config and hdb backends? Thanks, Hung.

2 1

All of slapd's configuration options can be changed on the fly?
by Hung Luu 28 Jan '10

28 Jan '10

Hello all, I am just experimenting with applying LDIF to the dynamic config backend and see what configuration directives I'm allowed to modify. I've tried deleting an olcModuleLoad attribute and replacing the olcModulePath attribute with a new value; both times resulted in an LDAP error code 80. >From the 2.4 Admin Guide on configuration slapd: "The LDAP configuration engine allows all of slapd's configuration options to be changed on the fly, generally without requiring a server restart for the changes to take effect." There is also a note that says: "Some of the backends and of the distributed overlays do not support runtime configuration yet. In those cases, the old style slapd.conf file must be used." Is there a list of slapd configuration directives that are allowed (or not allowed) to be changed dynamically at runtime? Thanks, Hung

2 1

Re: performance on Solaris
by Stefano Zanmarchi 28 Jan '10

28 Jan '10

Thank you very much Quanah, you sound very encouraging. Does anyone knows how OpenLDAP performs on Sun Solaris (10) on Sun's hardware (sparc cpus)? Some more data to complete the picture. - OpenLDAP 2.4.16 + Berkeley BDB 4.7 + back-bdb - 800.000 entries occupy 880MB (log excluded), and a typical entry would just be: dn: uid=657321(a)myunit.myorg.org, ou=people,dc=myorg,dc=org objectClass: account objectClass: simpleSecurityObject uid: 657321(a)myunit.myorg.org userPassword: whatever - The "working set" is around 25% (i.e. most of the bind/updates will be done on the same 200.000 entries) Given these numbers, I thought 500MB be enough, do you agree? Thanks a lot, Stefano On Wed, Jan 27, 2010 at 7:32 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, January 27, 2010 7:06 PM +0100 Stefano Zanmarchi < > zanmarchi(a)gmail.com> wrote: > > Hi, >> I need to set up a LDAP production server with 800.000 entries. >> Performance and stability are >> my main concern, I expect around 250 binds and 50 ldapupdate/insert per >> minute. >> The machine is a SunFire6900 with 8 sparc US-IV+ CPUs and I'd like to >> dedicate around 500MB >> of ram to OpenLdap (more, if necessary). The OS is SunSolaris 10. >> >> >> I'd like to know if OpenLdap is sincerely a good choice with these >> numbers, and if anyone can >> share his on-the-field experience with so many users. >> > > 250 binds/minute and 50 updates/minute is a very low number of each. You > fail to state what version of OpenLDAP you plan on using, or which backend > (sql, bdb, hdb, etc) so it's hard to give you anything concrete. Assuming > you'd be using OpenLDAP 2.4.21 + Berkeley BDB 4.8 with either back-bdb or > back-hdb, you should be fine. I would note however any testing I've ever > done using Solaris as the OS has been significantly slower than Linux > running on the same hardware. > > If you have 800,000 entries, your main concern is definitely going to be > the RAM. 500MB is unlikely to cut it, but it depends on the size of your > entries. You may need upwards of 16GB of RAM depending again on how large > your DB actually is. > > I.e., you fail to provide the data necessary to give you a conclusive > answer. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

help needed
by Piyush Joshi 28 Jan '10

28 Jan '10

Dear All, Is there any option to dump the ldap data in ldif format without base64 encoded value mainly for password field .... -- Regards ****************************** Piyush Joshi System administrator 9415414376 ****************************** "Ability is what you're capable of doing. Motivation determines what you do. Attitude determines how well you do it"

2 1

olcSyncrepl invalid URL - OpenLDAP 2.4.21
by Hung Luu 27 Jan '10

27 Jan '10

Hello everyone, Has anyone experienced the "<olcSyncrepl> invalid URL" error from starting up a consumer slapd? I've tried configuring the provider setting for the syncrepl directive as a domain name and IP address but neither works. Thanks in advance for your help. Here's the error from slapd: *olcSyncrepl: value #0: <olcSyncrepl> invalid URL config error processing olcDatabase={1}hdb,cn=config: <olcSyncrepl> invalid URL* Here's my consumer slapd.conf: include /opt/openldap-2.4.21/etc/openldap/schema/core.schema include /opt/openldap-2.4.21/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.21/etc/openldap/schema/inetorgperson.schema pidfile /opt/openldap-2.4.21/var/run/slapd.pid argsfile /opt/openldap-2.4.21/var/run/slapd.args modulepath /opt/openldap-2.4.21/libexec/openldap moduleload back_hdb.la # Overlay for reverse group membership moduleload memberof.la loglevel 16383 # Global database directives overlay memberof memberof-group-oc groupOfNames memberof-member-ad member memberof-memberof-ad memberOf memberof-dangling error memberof-refint TRUE # Enable cn=config changes from LDAP browser database config rootdn "cn=admin,cn=config" rootpw secret database hdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw secret directory /opt/openldap-2.4.21/var/openldap-data/example-com # Indices to maintain index default eq index cn,uid,member index entryCSN,entryUUID eq index objectClass eq # Other BDB/HDB directives cachesize 10000 checkpoint 1024 10 # Replication syncrepl rid=000 provider=*ldap://192.168.56.3:389* type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials=secret

1 3

performance on Solaris
by Stefano Zanmarchi 27 Jan '10

27 Jan '10

Hi, I need to set up a LDAP production server with 800.000 entries. Performance and stability are my main concern, I expect around 250 binds and 50 ldapupdate/insert per minute. The machine is a SunFire6900 with 8 sparc US-IV+ CPUs and I'd like to dedicate around 500MB of ram to OpenLdap (more, if necessary). The OS is SunSolaris 10. I'd like to know if OpenLdap is sincerely a good choice with these numbers, and if anyone can share his on-the-field experience with so many users. Thank you very much, Stefano

2 1

Re: (ITS#6453) OpenLDAP memory leak on LDAP_TIMEOUT
by alin vasile 27 Jan '10

27 Jan '10

We found out that this call : ldap_msgfree(res); does not get executed because the LDAPMessage is NULL (res is null) in case the timeout is on the client side. There is any other way to clean it?

1 0

Load difference from 2.4.20 to 2.4.21
by Peter Mogensen 27 Jan '10

27 Jan '10

Hi, I've recently upgrade slapd from 2.4.20 to 2.4.21 and I'm a little surprised to see how huge a difference in load this made. With 2.4.20 idle-time for the machine was around 80%, now it's around 60%. I/O-wait time has also increased, but seems to fluctuate less now. Are there any know reason for large load differences from 2.4.20 to 2.4.21 ? /Peter

1 0

cn=config config problem
by Alex Samad 27 Jan '10

27 Jan '10

Hi I have setup a multimaster setup and some slave nodes, using cn=config. I am looking at trying to create a user in the cn=config space i have test.ldif that looks like dn: cn=test,cn=config objectClass: simpleSecurityObject objectClass: organizationalRole cn: test userPassword: test description: test structuralObjectClass: organizationalRole and I use ldapadd -D "cn=config" -w T25src1Rbe65RR6vwd53VTrB1x6EszFGMjhh7m8OOPjNyJ9h7nJO97p00lHMn08m -f test.ldif I get adding new entry "cn=test,cn=config" ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral Which from my investigation tells me my ldap server doesn't know where to send the update, which is strange because I can make other changes to cn=config - add a olcsyncrepl and make changes to loglevel Alex

3 3

meta database - password problems with one target
by Matthew Harrell 27 Jan '10

27 Jan '10

Before I forget the link here is the config file I'm using http://alecto.bittwiddlers.com/files/slapd.conf I have two separate databases of user information and a meta database at the bottom of the file that joins them together so both can log in. The meta database is what's used for the system pam and nss settings. All of that seems to work fine - no problems with the logging in, groups, or any of that. Users that belong to the second database, zone2, can change their passwords using any of the standard commands including passwd. Users in the first database, zone1, are unable to change their passwords {153}: passwd New password: Re-enter new password: LDAP password information update failed: Strong(er) authentication required modifications require authentication passwd: Permission denied passwd: password unchanged I've looked at the ACL and stats logs for both the accounts that work and those that don't but there's a lot of information there and I can't tell what the problem is. I'm rather new to LDAP in general. Can someone give me some pointers or ideas for what I can look for? Thanks for any help

1 0

Bind accepts any password where the real password is a prefix?
by Christopher Kenna 27 Jan '10

27 Jan '10

Greetings, We are running OpenLDAP at our organization to do authentication for Linux machines. One strange thing I noticed is that I can bind to the server using my password, or *any* password that contains my actual password as a prefix. Let me explain with an example. Suppose my password is "banana" (it's not). Then these passwords work to bind to the database: - banana - banana2 - bananafjksdfs But these won't work: - mbanana - banan I'm testing this with this command: ldapsearch -x -W -ZZ -H ldap://<server_address>.com \ -b dc=mydomain,dc=com \ -D 'uid=<my_uid>,ou=people,dc=mydomain,dc=com' \ '(uid=<my_uid>)' Any ideas about why this happens? Thanks. -- Chris

2 1

LDAP logging
by Ivan Ordonez 26 Jan '10

26 Jan '10

Hi, I want to create logging for LDAP (version 2.4.19-r1) using syslog-ng on Gentoo box. Hope someone here can point me in the right direction. I'm lost here. Here is my syslog-ng conf file: @version: 3.0 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3.0,v 1.1 2009/05/25 20:07:21 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux options { chain_hostnames(no); # The default action of syslog-ng is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats_freq(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; #options { sync(n); }; destination messages { file("/var/log/messages"); }; destination authlog { file("/var/log/auth.log"); }; #destination syslog { file("/var/log/syslog"); }; destination ldap { file("/var/log/ldap.log"); }; destination cron { file("/var/log/cron.log"); }; # Create Filters filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_authpriv { facility(auth, authpriv); }; #filter f_syslog { not facility(auth, authpriv) and not match(slapd); }; filter f_ldap { match("regexp" value ("slapd")); }; filter f_cron { facility(cron); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; # Connect Filters and Destinations #log { source(src); destination(messages); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_authpriv); destination(authlog); }; #log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_ldap); destination(ldap); }; log { source(src); filter(f_cron); destination(cron); }; # Default Log log { source(src); destination(console_all); }; Thanks in advance. -Ivan

5 9

Ppolicy, password lockout status
by Radosław Antoniuk 26 Jan '10

26 Jan '10

Hi, Quick question. How is it possible to check the account lock status? I've configured the ppolicy according to the guide, the lock is working, the account is locked. And now how can I find out which accounts are currently locked out? -- Best regards, Radek Antoniuk w: www.radek.org.pl

3 4

back-sql quote characters in query
by Anatoly 24 Jan '10

24 Jan '10

Hello. I'm using openldap 2.4.19 with sql backend. I have a troubles with queries that contains single-quote ( ' ) character. For example, if I searching for (cn=Zool'man): <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,phpbb_users.user_id,varchar_ci('phpbbUser') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,phpbb_users WHERE phpbb_users.user_id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND (varchar_ci(phpbb_users.username)='ZOOL'MAN') Constructed query: SELECT DISTINCT ldap_entries.id,phpbb_users.user_id,varchar_ci('phpbbUser') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,phpbb_users WHERE phpbb_users.user_id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND (varchar_ci(phpbb_users.username)='ZOOL'MAN') id: '2' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=7 SQLengineState=S1000 msg="[unixODBC]ERROR: syntax error at or near "MAN" at character 271; In this case query should be like varchar_ci(phpbb_users.username)='ZOOL\'MAN' instead of 'ZOOL'MAN' How to solve this issue? Thanks.

2 1

supported SASL mechanisms
by Mark Beavis 24 Jan '10

24 Jan '10

Hi - Is anyone able to tell me the complete list of SASL mechanisms that OpenLDAP supports. Also, does OpenLDAP support custom SASL mechanisms (in this case written using the Java SASL API). Thanks - Mark This email may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are for those of the individual sender and may not necessarily reflect the views of RHE Group.

2 1

openldap mirror mode
by Megan 23 Jan '10

23 Jan '10

Good Day All! I am running two boxes with CentOS 5.4 and openldap-servers-2.3.43-3.el5. I am trying to configure openldap in mirrormode. I have a third box with CentOS 5.4 and openldap-servers-2.3.43-3.el5 that I will be using as a proxy,but ldap is not yet configured on this server. Below are my two ldap servers that I want in mirror mode. If I set the standard Syncrepl configuration, the master and slave talk, I can write to the master, and the slave is updated. But when I switch to mirror mode with the below configuration, and try to write to either of them, I get: ldapadd: Server is unwilling to perform (53) additional info: shadow context; no update referral Which makes me think they are both in read-only mode???? I thought with mirrormode server 1 would be writable until server 1 went down, then server 2 would know to be writable, and they stay in sync with each other #========================== #Server1 #========================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema loglevel 256 serverID 1 allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap #moduleload accesslog.la #moduleload auditlog.la #moduleload denyop.la #moduleload dyngroup.la #moduleload dynlist.la #moduleload lastmod.la #moduleload pcache.la moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la #moduleload smbk5pwd.la #moduleload translucent.la #moduleload unique.la #moduleload valsort.la TLSCACertificateFile /etc/openldap/cacerts/server1cacert.pem TLSCertificateFile /etc/openldap/cacerts/server1crt.pem TLSCertificateKeyFile /etc/openldap/cacerts/server1key.pem TLSVerifyClient try sasl-secprops noanonymous,noplain,noactive access to * by * write by * read database bdb suffix "dc=domain" rootdn "uid=admin,ou=service,dc=domain" rootpw {SSHA}secret directory /var/ldap/databases/users index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.3 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=domain" schemachecking=off retry="60 +" filter="(objectClass=*)" attrs="*" bindmethod=simple binddn="uid=userrepl,ou=services,ou=administrative,dc=domain" credentials=password mirrormode on #=========================== #server 2 #=========================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema ##LOG Level loglevel 256 serverID 2 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap #moduleload accesslog.la #moduleload auditlog.la #moduleload denyop.la #moduleload dyngroup.la #moduleload dynlist.la #moduleload lastmod.la #moduleload pcache.la moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la #moduleload smbk5pwd.la #moduleload translucent.la #moduleload unique.la #moduleload valsort.la TLSVerifyClient try sasl-secprops noanonymous,noplain,noactive access to * by * write by * read database bdb suffix "dc=domain" rootdn "uid=admin,ou=service,dc=domain" rootpw {SSHA}secret directory /var/ldap/databases/users index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=domain" schemachecking=off filter="(objectClass=*)" attrs="*" retry="60 +" bindmethod=simple binddn="uid=userrepl,ou=services,ou=administrative,dc=domain" credentials=password #updateref ldap://192.168.1.3 mirrormode on

2 1

Re: OpenLDAP does not seem to start
by sgmayo＠mail.bloomfield.k12.mo.us 23 Jan '10

23 Jan '10

Jaap Winius wrote: > Hi Scott, > > Did you ever manage to fix your problem? I'd be interested to hear > what the problem and the solution turned out to be, and maybe a few > other people on the mailing list would be as well. > > Cheers, > > Jaap > Yes, the problem was what I really expected from the first. It was just a corrupt DB I guess. I did a db_recover (actually on fedora it was a slapd_db_recover) and that fixed everything. Got it all back to working now. thanks for all the replies. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

1 0

Re: Server-Side Sort Overlay ordering problems
by Diego Lima 22 Jan '10

22 Jan '10

Hi, 2010/1/15 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 15, 2010 12:06 PM -0500 Edward Capriolo < > edlinuxguru(a)gmail.com> wrote: > > Diego, >> >> You and I have the same issue. UID and CN are not in the schema they >> are compiled into LDAP some how, so there is no way to apply an >> ordering rule. I can not find if this is possible, or what is involved >> in making it happen. > > I'm currently testing a quick and dirty hack that I made to servers/slapd/schema_prep.c: --- schema_prep.c.ori 2010-01-15 13:28:04.000000000 -0200 +++ /root/openldap-2.4.21/servers/slapd/schema_prep.c 2010-01-15 13:04:56.000000000 -0200 @@ -915,6 +915,7 @@ static struct slap_schema_ad_map { offsetof(struct slap_internal_schema, si_ad_name) }, { "cn", "( 2.5.4.3 NAME ( 'cn' 'commonName' ) " "DESC 'RFC4519: common name(s) for which the entity is known by' " + "ORDERING caseIgnoreOrderingMatch " "SUP name )", NULL, 0, NULL, NULL, @@ -924,6 +925,7 @@ static struct slap_schema_ad_map { "DESC 'RFC4519: user identifier' " "EQUALITY caseIgnoreMatch " "SUBSTR caseIgnoreSubstringsMatch " + "ORDERING caseIgnoreOrderingMatch " "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )", NULL, 0, NULL, NULL, By making these changes I've been able to get around my current problem, but it might not be as stable as you expect. > You can find these attributes defined in the code in servers/slapd. > > However, I will note, the definitions of these attributes are RFC defined. > They have no ORDERING rule on purpose. > > --Quanah Thanks for the input Quanah, but the problem is we have some legacy applications that used a really old LDAP server where this was allowed. I'm trying to migrate the server (that's a fedora directory from fedora 6) to a new openldap-based one. I must, however, maintain compatibility with the existing applications. Is there any problem (despite not being RFC-compliant) on enabling ordering on these attributes? -- Diego Lima

2 2

OpenLDAP does not seem to start
by sgmayo＠mail.bloomfield.k12.mo.us 22 Jan '10

22 Jan '10

Everything has been running fine for months. We had a power outage this morning and I restarted my servers and things still seemed to be fine. A bit later network drives could not be reached and so on. I tried restarting LDAP and Samba, but it seems after the LDAP daemon was stopped, it could not restart. I decided to reboot the server just in case and now the server just hangs while starting services. This is a Fedora 10, so I booted with the CD to recovery mode so I could see logs. Here is what my message log looks like. Jan 20 11:27:56 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:27:56 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:27:56 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: could not search LDAP server - Server is unavailable Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Jan 20 11:29:04 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:04 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:04 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Jan 20 11:29:12 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:12 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:12 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... The 10.0.0.100 and 127.0.0.1 are the same server and is the one that LDAP is sitting on so it is not trying to contact another server with the 10.0.0.100. Is my db corrupted possibly after the electric outage? If so, is there a fix to run on it or will I just have to have a backup of it? Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

7 16

olcaccess question
by Alex Samad 22 Jan '10

22 Jan '10

Hi with cn=config if I have dn: olcDatabase={2}hdb,cn=config olcAccess: to * by * read Does this allow read access to the hdb database ie the * in to is a subset of hdb name space ? is it equal to dn: olcDatabase={2}hdb,cn=config olcAccess: to dn.subtree <hdb tree> by * read alex

1 0

cn=Subschema and acl
by Alex Samad 22 Jan '10

22 Jan '10

Hi I was wonder were do I place acl for cn=Subschema as there doesn;t seems to be a db defined for it or is it the same as cn=schmea ? thanks Alex

4 6

Berkley db error.
by Saha, Indranil 21 Jan '10

21 Jan '10

Hi I have taken the openldap 2.4.11 version.My berkley db is 4.5.20 version.When am running the configure--enable-backends script its telling like checking for db.h... yes checking for Berkeley DB major version... 4 checking for Berkeley DB minor version... 5 checking for Berkeley DB link (-ldb-4.5)... yes checking for Berkeley DB version match... no configure: error: Berkeley DB version mismatch But have checked the configure script ,and its allowing berkley version major >=4 and minor >=2 .Can anyone explain then why am getting this error.Its urgent. Regards Indranil

2 2

problem configuring overlay module and cn=config
by Alex Samad 19 Jan '10

19 Jan '10

Hi I am trying to ldapadd dn: olcOverlay={2}unique,olcDatabase={1}hdb,cn=config changetype: modify add: olcunique_uri olcunique_uri: ldap:///?uid?sub but it fails ldap_modify: Undefined attribute type (17) additional info: olcunique_uri: AttributeDescription contains inappropriate characters not sure what is going wrong I tried changing to base64 and using :: Can't seem to find any examples of using unique in cn=config Thanks

2 2

Best objectClass for an LDAP server?
by Jaap Winius 19 Jan '10

19 Jan '10

Hi folks, Busy again with the configuration of my OpenLDAP 2.4.11 test system, which includes Kerberos, SASL and GSSAPI, I now not only have replication working with Kerberos authentication and encryption), but also SASL proxy authorization, which makes chaining possible (chasing referrals on behalf of clients). For proxy authorization to work, I first had to create an LDAP object to represent the DN that the consumer server was authenticating with -- after the name of its Kerberos principal. Here it is in GSSAPI-format: uid=ldap/ldapks2.example.com,cn=gssapi,cn=auth Not wanting to use the person objectClass for this purpose, I used this instead: dn: cn=ldap/ldapks2.example.com,ou=consumers,dc=example,dc=com cn: ldap/ldapks2.example.com objectClass: simpleSecurityObject objectClass: organizationalRole description: LDAP server2 replicator saslAuthzTo: dn.regex:^uid=[^,]*,ou=users,dc=example,dc=com$ userPassword: {CRYPT}* Does this look like the best solution? It does force me to include a userPassword attribute, for which I use an invalid hash, but otherwise there are no other unnecessary attributes. Still, I wonder if I could do better. Any opinions? Thanks, Jaap

1 0

Verifying refint
by Peter Mogensen 19 Jan '10

19 Jan '10

Hi, I have a large database which I've migrated from slapd 2.3 (bdb) to slapd 2.4.20 (hdb) with: overlay refint refint_attributes member Unfortunately, after the migration I've experienced at least twice where a Group object had members referring to non-existent objects. The migration was done by stopping slapd 2.3, dumping with slapcat and then loading into 2.4.20. So the LDIF and DIT migrated should be ok. Do I have any way checking my database for other occurrences of refint violations, apart from writing a script to traverse an entire LDIF dump? /Peter

1 0

Some openldap 2.4 questions
by Radosław Antoniuk 19 Jan '10

19 Jan '10

Hi, Three quick issues about slapd 2.4. 1. I'm setting up a syncrepl replication. In the process of testing, I had added three syncprov overlays instead of one, and I ended up with: dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 600b89e6-9317-102e-9872-8714c398f98b creatorsName: cn=admin,cn=config createTimestamp: 20100111160900Z entryCSN: 20100111160900.858973Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100111160900Z dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 20 10 structuralObjectClass: olcSyncProvConfig entryUUID: 600ba142-9317-102e-9873-8714c398f98b creatorsName: cn=admin,cn=config createTimestamp: 20100111160900Z entryCSN: 20100111160900.859584Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100111160900Z dn: olcOverlay={2}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {2}syncprov olcSpSessionlog: 500 structuralObjectClass: olcSyncProvConfig entryUUID: 600badea-9317-102e-9874-8714c398f98b creatorsName: cn=admin,cn=config createTimestamp: 20100111160900Z entryCSN: 20100111160900.859909Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100111160900Z The thing is, that I cannot delete any of them because cn=config does not support delete operation. Is this ok to leave it as is? or any workaround to get rid of the unwanted ones? 2. About N-Way replication... What's the best authentication to use? Because RootDN is the admin, and in simple authentication I would store cleartext password in the syncrepl configuration, I'm assuming that the best here would be to use some SASL mech? 3. Assuming a running normal replication(master-slave) with refreshAndPersist, is there any method of checking of the status of the replication? like show slave status in MySQL. I have tested it with cutting the transmission by iptables, and ok, it caught up after reconnection, but the master did not complain at all when the connection was not there... -- Best regards, Radosław Antoniuk

6 13

Auth access for search-based mappings?
by Jaap Winius 18 Jan '10

18 Jan '10

Hi folks, Today I've been using my OpenLDAP v2.4.11 lab setup, the config for which includes MIT Kerberos V, SASL and GSSAPI, to experiment with this feature: 15.2.6. Search-based mappings http://www.openldap.org/doc/admin24/sasl.html#Search-based mappings It doesn't seem to difficult, but it's not really working for me either. In particular, I can't get slapd to search beyond the first of several authz-regexp statements, as shown in the "more complex site" example. Then I noticed this statement at the very end of the section: "Note as well that authz-regexp internal search are subject to access controls. Specifically, the authentication identity must have auth access." It sounds important, but I'm not sure what to do with it. Does it mean all users need auth access to the entire DIT? I tried that, but to no avail. Can someone please explain? Thanks, Jaap

4 8

Translucent with syncrepl to Active Directory
by Pascal Lalonde 15 Jan '10

15 Jan '10

Hello, I'm trying to get syncrepl work from a provider that is configured as a back-ldap to an Active Directory with the translucent overlay. Although the master is also an OpenLDAP, since it uses the back-ldap backend to AD, the entryUUID and entryCSN fields are not present, thus preventing syncrepl from working. But I really only need to replicate the local modifications stored in my translucent (HDB). And doing a slapcat shows that the entryUUID and entryCSN are present in the translucent DB. So I'm wondering if there's a way to tell syncrepl to bother only with entries stored in my hdb, and ignore anything that doesn't have the entryUUID/CSN fields (the fields proxied from AD). I'm getting the following error on the slave: syncrepl_entry: rid=100 entry unchanged, ignored (dc=testdomain,dc=org) do_syncrep2: rid=100 got empty syncUUID with LDAP_SYNC_ADD Server in the example (using OpenLDAP 2.4.11 on Debian Lenny): tst-dc01.testdomain.org = Active Directory ldap.tst.testdomain.org = OpenLDAP master ldap-slave.tst.testdomain.org = OpenLDAP slave Master configuration: --------------------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/testdomain.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap moduleload back_hdb moduleload translucent moduleload syncprov TLSCACertificateFile /etc/ssl/certs/testdomainca.pem TLSCertificateFile /etc/ldap/ssl/ldap.tst.testdomain.org.crt TLSCertificateKeyFile /etc/ldap/ssl/ldap.tst.testdomain.org.key TLSVerifyClient never defaultsearchbase "dc=testdomain,dc=org" sizelimit unlimited backend hdb backend ldap database hdb directory /var/lib/ldap suffix "dc=testdomain,dc=org" index objectclass,entryCSN,entryUUID eq rootdn cn=ldaproot,dc=testdomain,dc=org rootpw blah overlay translucent uri "ldap://tst-dc01.testdomain.org" idassert-bind bindmethod=simple binddn="CN=readonly,DC=testdomain,DC=org" credentials="pw" mode=none chase-referrals no rebind-as-user yes lastmod on translucent_strict overlay syncprov syncprov-checkpoint 64 30 syncprov-sessionlog 1024 access to dn.subtree="dc=testdomain,dc=org" by * read Slave configuration: -------------------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/testdomain.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap moduleload back_hdb moduleload translucent TLSCACertificateFile /etc/ssl/certs/testdomainca.pem TLSCertificateFile /etc/ldap/ssl/ldap-slave.tst.testdomain.org.crt TLSCertificateKeyFile /etc/ldap/ssl/ldap-slave.tst.testdomain.org.key TLSVerifyClient never defaultsearchbase "dc=testdomain,dc=org" sizelimit unlimited backend hdb backend ldap database hdb directory /var/lib/ldap suffix "dc=testdomain,dc=org" index objectclass,entryCSN,entryUUID eq rootdn cn=ldaproot,dc=testdomain,dc=org rootpw blah syncrepl rid=100 provider=ldaps://ldap.tst.testdomain.org type=refreshAndPersist interval=00:00:15:00 retry="300 20 7200 +" searchbase="dc=testdomain,dc=org" attrs="gecos" schemachecking=off bindmethod=simple binddn="CN=repl,DC=testdomain,DC=org" credentials="pw" overlay translucent uri "ldap://tst-dc01.testdomain.org ldap://tst-dc02.testdomain.org" idassert-bind bindmethod=simple binddn="CN=readonly,DC=testdomain,DC=org" credentials="pw" mode=none chase-referrals no rebind-as-user yes lastmod on translucent_strict access to dn.subtree="dc=testdomain,dc=org" by * read Thanks for any info! -- Pascal

1 0

how to use ipv6 addresses in olcaccess statements
by Alex Samad 15 Jan '10

15 Jan '10

Hi I am trying to build a olcaccess statement and I am wondering how to implement a ipv6 network Currently I have 'to dn.sub="ou=SUDOers,dc=samad,dc=com,dc=au" '. 'by dn.exact="cn=libnss-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by dn.exact="cn=libpam-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by peername.ip=192.168.12.0%255.255.252.0 read '. 'by peername.ip=192.168.8.0%255.255.252.0 read '. 'by peername.ip=192.168.4.0%255.255.252.0 read '. 'by peername.ip=127.0.0.1 read '. 'by peername.ipv6=::1 read '. 'by peername.path=/var/run/slapd/ldapi read '. 'by * none ', I have a ipv6 network 2002:3cf1:f856::/48 but I can't seem to put in 'by peername.ipv6=2002:3cf1:f856::%48 read '. do I need to write out a complete mask 'by peername.ipv6=2002:3cf1:f856::%<mask> read '. I am not sure what that mask would look like 65535.65535.65535.0.0.0.0.0 ? Alex -- About the only thing we have left that actually discriminates in favor of the plain people is the stork.

2 2

Syncrepl reliability
by Marco Innocenti 15 Jan '10

15 Jan '10

Hi, we are testing a 2 way multimaster setup (debian 64bit, openldap 2.4.21). If a client that try to e.g. add a record to a node is stopped (killed, crashed, ...) the record hit the master but it is not replicated and that is for us a showstopper. I think that behavior is well known among the developer as I think I'm talking of ITS#6059. When that bug is expected to be solved? -- ********************************************************************** Marco Innocenti Dipartimento Sistemi E Tecnologie CINECA phone:+39 0516171553 / fax:+39 0516132198 Via Magnanelli 6/3 e-mail: innocenti(a)cineca.it 40033 Casalecchio di Reno Bologna (Italia) **********************************************************************

1 0

Openldap installation problem
by Murat Uğur Eminoğlu 15 Jan '10

15 Jan '10

Dear all, i 've problem openldap installation. i'm using debian lenny, openldap 2.4.19. Error's below. openldap-2.4.19# ./configure --prefix=/usr/local/mailserver/openldap --enable-crypt --enable-backends --enable-bdb --enable-ldbm --enable-perl=no checking for ndb_init in -lndbclient... no configure: error: could not locate ndbclient library config.log configure:30018: checking for ndb_init in -lndbclient configure:30053: cc -o conftest -g -O2 -L/usr/lib/mysql -lmysqlclient_r conftest.c -lndbclient -lstdc++ -lresolv >&5 /usr/lib/mysql/libndbclient.so: undefined reference to `base64_needed_decoded_length' /usr/lib/mysql/libndbclient.so: undefined reference to `base64_decode' /usr/lib/mysql/libndbclient.so: undefined reference to `decimal_bin_size' collect2: ld returned 1 exit status configure:30059: $? = 1 configure: failed program was: thanks for helps / regards. -- Murat Uğur Eminoğlu http://ipucu.murat.ws http://fotoblog.murat.ws

4 7

Need help setting up n-way + cn=config
by Alex Samad 15 Jan '10

15 Jan '10

Hi I am in the process of testing a new n-way setup, I have come across some problem's. when trying to setup unique I keep getting undefined attribute error dn: olcOverlay={2}unique,olcDatabase={1}hdb,cn=config changetype: modify add: olcunique_uri olcunique_uri: ldap:///?uid?sub but it fails ldap_modify: Undefined attribute type (17) additional info: olcunique_uri: AttributeDescription contains inappropriate characters also while trying to setting olcaccess parameter I can't find any information on how setup a ipv6 network Currently I have 'to dn.sub="ou=SUDOers,dc=samad,dc=com,dc=au" '. 'by dn.exact="cn=libnss-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by dn.exact="cn=libpam-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by peername.ip=192.168.12.0%255.255.252.0 read '. 'by peername.ip=192.168.8.0%255.255.252.0 read '. 'by peername.ip=192.168.4.0%255.255.252.0 read '. 'by peername.ip=127.0.0.1 read '. 'by peername.ipv6=::1 read '. 'by peername.path=/var/run/slapd/ldapi read '. 'by * none ', I have a ipv6 network 2002:3cf1:f856::/48 but I can't seem to put in 'by peername.ipv6=2002:3cf1:f856::%48 read '. do I need to write out a complete mask 'by peername.ipv6=2002:3cf1:f856::%<mask> read '. I am not sure what that mask would look like 65535.65535.65535.0.0.0.0.0 ? Thanks

1 0

Unable to Search/Authenticate Users
by Todd Reed 14 Jan '10

14 Jan '10

I'm trying to get a Web Application to authenticate to OpenLDAP. I have one user account that I am binding as (user: webldapauth). I have another user account that I am trying to log in via the application (user: webuser). The "webuser" is in a OU called "WebAppUsers". With an LDAP Browser, I can bind to LDAP as both users. But, when I try to log in to the web app, I'm binding with the user "webldapauth", but cannot log in with the "webuser" account. The web application calls are good because I can point it to an ActiveDirectory server and it works fine. This is my first attempt with OpenLDAP. I believe there is a configuration problem with OpenLDAP, but I'm not sure where to look or troubleshoot at. Would anyone be able to provide any guidance? I've looked at the manuals and other help files, but nothing has worked so far. --Todd

2 1

2.4.19 freezed at Debian Lenny
by Frank Bonnet 14 Jan '10

14 Jan '10

Hello I've compiled and installed 2.4.19 on a Debian Lenny server (64 bits) it freezed few hours ago I had to restart slapd to make it working again. any info about this problem at this release ? Thank you

2 2

Debian Lenny and Openldap installation Problem?
by Murat Uğur Eminoğlu 14 Jan '10

14 Jan '10

Dear List, I changed debian/configure.options --enable-backends=yes --enable-bdb=yes --enable-ldbm=yes dpkg-buildpackage -b errors cp: cannot stat `./debian/tmp/etc/ldap/schema': No such file or directory dh_install: command returned error code 256 make: *** [binary-arch] Error 1 dpkg-buildpackage: failure: debian/rules binary gave error exit status 2 how i can solve this problem ? thanks. -- Murat Uğur Eminoğlu http://ipucu.murat.ws http://fotoblog.murat.ws

1 0

Abandon with ldap search free openldap resources ?
by Eduardo Ramos Testillano 13 Jan '10

13 Jan '10

Hello all, I have my ldap client with always ldap connection up; never unbind is performed. When certain ldap search expire, i send AbandonRequest to the server. ¿openLdap memory resources will grow if i avoid send that? That is to say: openldap 'ldap_abandon' primitive implies free internal openLdap resources? thanks Regards

1 0

openldap
by Aravind Arjunan 13 Jan '10

13 Jan '10

hi, I am having my Openldap server acting as master/slave in RHEL 3 its in 32 bit architecture.It acts as primary authentication for all my services.I need to enhance my servers with new version of OS which will be in high availability. I preferred to go for RHEL 5 in 64 bit architecture. I need to know if i configure Slave LDAP server in my new setup i.e in RHEL 5, whether i can able get all the users informations which is stored in my old setup through Master/Slave communication without any downtime. with regards A.Aravind

1 0

seg fault during slapindex
by tpublic＠metro-email.com 12 Jan '10

12 Jan '10

Hello, I'm looking for help with an index building problem. I am running Apple (Tiger) Open Directory which uses slapd 2.2.19. Upgrading is unfortunately not an option because the OS has tools / GUI built around the database. I had noticed some errors in our slapd.log indicating we needed additional indexes built: bdb_equality_candidates: (kerio-Mail-AccountEnabled) index_param failed (18)\n bdb_equality_candidates: (kerio-Mail-Address) index_param failed (18)\n bdb_substring_candidates: (apple-group-realname) index_param failed (18)\n bdb_substring_candidates: (givenName) index_param failed (18)\n bdb_substring_candidates: (mail) index_param failed (18)\n So I attempted to create the missing indexes, but slapindex crashes with a segmentation fault unless I disable most of my config changes. The lines commented out are the ones which caused a fault: slapd.conf: include /etc/openldap/slapd_macosxserver.conf #index kerio-Mail-Address eq # Seg faults. index kerio-Mail-AccountEnabled eq slapd_macosxserver.conf (included via slapd.conf): # Adding ",sub" to apple-group-realname, due to errors in /var/log/slapd.log #index apple-group-realname eq index apple-group-realname eq,sub [...] # Adding mail & givenName indices, due to errors in /var/log/slapd.log # Both of these cause seg fault on slapindex #index mail sub #index givenName sub I verified that the index names I configured match exactly the spelling in the error messages. Also slaptest ran successfully. I ran db_recover to no avail (slapindex was initially hanging even if I just used my base configuration). Any hints would be greatly appreciated. I realize this is an older version, but hopefully there are some tricks that I could use to work around it? If not, could I install the current openldap, in a different location, build the indexes, and copy them over?

2 1

Standard objectClass for representing web services
by Hung Luu 12 Jan '10

12 Jan '10

Does anyone know of a standard objectClass that is appropriate for representing web services in the directory? I want to represent web services like users in the directory, and assign their DN's to groups for authorization, so I suppose I'm looking for an inetOrgPerson equivalent for web services. Thanks, Hung.

2 2

Multi Master w/ SASL Authentication
by James Dingwall 12 Jan '10

12 Jan '10

Hi, I have been migrating my OpenLDAP 2.3 slapd.conf configuration to a 2.4 slapd.d replacement. Previously I had a single master and two slaves but I have moved it to multi-master with a replicated cn=config and database. I am using Sasl and Heimdal Kerberos with the principles stored in the ldap database. I have managed to almost complete this but I'm now stuck on the following point, I can only get GSSAPI LDAP authentication to work on the host whose name is equal to the value of olcSaslHost. As I have 3 masters and a replicated cn=config this can only be true on one host at a time. i.e. olcSaslHost: ldap1.my.domain ldapsearch -H ldaps://ldap1.my.domain -Y GSSAPI = works ldapsearch -H ldaps://ldap2.my.domain -Y GSSAPI = fails ldapsearch -H ldaps://ldap3.my.domain -Y GSSAPI = fails update olcSaslHost to ldap2.my.domain ldapsearch -H ldaps://ldap1.my.domain -Y GSSAPI = fails ldapsearch -H ldaps://ldap2.my.domain -Y GSSAPI = works ldapsearch -H ldaps://ldap3.my.domain -Y GSSAPI = fails I tried setting olcSaslHost to localhost but then none work so I assume the olcSaslHost value is being used to build a Kerberos principle. Am I missing a trick or do I have to stop replicating cn=config in order to make it work on all 3? I can post configuration files if this will help. Thanks, James This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

1 0

Directory layout help
by Hung Luu 12 Jan '10

12 Jan '10

Hello, Suppose I have the following DN's: inetOrgPerson: [uid=alice,dc=example,dc=com] organizationalRole: [cn=manager,ou=groups,dc=example,dc=com] [cn=supervisor,ou=groups,dc=example,dc=com] locality: [l=phoenix,ou=division,dc=example,dc=com] [l=portland,ou=division,dc=example,dc=com] How can I store in my directory the fact that Alice is a manger at the Phoenix division, but she is only a supervisor at the Portland division? I know group membership is involved here, but what's the best way to represent that group membership to optimize searches such as: Return all the people with a specific role at a specific locality, or return all the roles and localities for a person. -Hung.

4 6

Syncrepl with Kerberos support
by Jaap Winius 12 Jan '10

12 Jan '10

Hi all, Although I know how to configure syncrepl with the "simple" bindmethod, using a clear-text password exchange and clear-text database replication, and I know how to setup an provider server with MIT Kerberos V encryption support, can anyone explain how to configure a consumer so that syncrepl also uses Kerberos? Thanks, Jaap

3 4

Compiling OpenLDAP 2.4.21 on RHEL 5
by Diego Lima 11 Jan '10

11 Jan '10

Hello all, I've recently installed OpenLDAP 2.4.21 on a couple of Debian servers but I ran into problems while trying to install on some RHEL5 servers: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends It seems that it doesn't like Red Hat's shipped version of Berkeley DB (Version: 4.3.29). I installed it via yum (yum install db4-devel). How can I get around this problem? Thanks a lot, -- Diego Lima

3 2

overlay "syncprov" not found
by Andrew Debenham 11 Jan '10

11 Jan '10

Hello - I am new to LDAP and I'm trying to setup Sync Replication on a Fedora Core 8 system (2.6.23.9-85.fc8). However, when I start the LDAP service, I get the following error message: Checking configuration files for slapd: [FAILED] overlay "syncprov" not found slaptest: bad configuration file! I've searched the archived threads for this group (as well as many others) and wasn't able to find any postings that matched what I'm seeing. If I missed an old post by mistake, I apologize in advance. I've included a copy of my slapd.conf file below. The interesting thing is that when I comment out the following lines, LDAP will start without any issues: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 This leads me to believe that the issue is with the replication process, but I can't figure out what I'm doing wrong. I've followed the examples given in the OpenLDAP Admin Guide, but it just doesn't seem to want to work for me. Also, in case anyone asks, here are the packages installed on the server in question: openldap-2.3.39-3.fc8 openldap-devel-2.3.39-3.fc8 openldap-servers-2.3.39-3.fc8 openldap-clients-2.3.39-3.fc8 Any information or recommendations to what is happening would be greatly appreciated. Also, please let me know if I need to supply more information. Thanks in advance. - Andy # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema loglevel -1 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la moduleload back_sql.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=jets,dc=local" write by * none access to * by self write by dn.base="cn=Manager,dc=jets,dc=local" write by * read ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=jets,dc=local" rootdn "cn=Manager,dc=jets,dc=local" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw b0xster rootpw {SSHA}/5PsWrAXNKNKJmhiZAfUPLkMOUcgbtXN # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID,entryCSN eq # Replicas of this database #replogfile /var/lib/ldap/openldap-slave-replog overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #lastmod on serverID 2 syncrepl rid=002 provider=ldap://10.xx.x.xx type=refreshAndPersist searchbase="dc=jets,dc=local" schemachecking=on bindmethod=simple binddn="cn=mirrormode,dc=jets,dc=local" credentials=mirrormode retry="60 +" #updateref ldap://10.xx.x.xx mirrormode on ________________________________ This email and any attachments may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient of this email, the following stipulations govern the use of this information: You may not take any action based upon its contents. You may not copy or show this message or attachments to anyone. You should contact the sender and subsequently delete this message and all attachments. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Special Operations Technology, Incorporated. While antivirus software has been applied, you should perform due diligence to check this email and attachments for the presence of viruses. No warranties or assurances are made in relation to the safety and content of this email and attachments. Special Operations Technology, Incorporated accepts no liability for any damages caused by any virus transmitted by or contained in this email and attachments. No liability is accepted for any consequences arising from this email transmission whatsoever. Special Operations Technology, Incorporated is a premier IT professional services firm focused in the government and law enforcement space.

3 3

OpenLDAP Baseline Security Analyzer
by Inmaculada Bravo 11 Jan '10

11 Jan '10

Hello My name is Inma Bravo, I work at the University of Salamanca (Spain) mainly administrating our OpenLDAP directory. I have done a project called OpenLDAP Baseline Security Analyzer.[1] The project website is written in Spanish and in English. The purpose of this project is to develop a list of criteria that should be taken into account for the initial plan of securing the directory, and to show the most common mistakes that we must try to avoid. It briefly documents the main attacks and threats that we face as directory administrators. It is written to be easy, straightforward, and useful. These criteria are encoded in XML Schema, adhering to OCIL to use the OCIL Interpreter. I presented this project in our technical winter meeting of the institutions that are affiliated with RedIRIS (the Spanish academic and research network) [2], and it was well-received by the technicians. In conclusion, the reason I am writing you is to announce the project and to ask you for suggestions to improve and to correct it. I hope the project will be of your interest. Thanks very much Inmaculada Bravo García [1] http://openldap-bsa.forja.rediris.es/ [2] http://www.rediris.es/

1 0

Problems allowing users to change their own passowrds
by James Hammett 09 Jan '10

09 Jan '10

I know this is an old issue and I've searched on the net and tried those, but haven't had any luck. I'm using openldap 2.3.43. In /etc/openldap/slapd.conf, I have set: access to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none (Of course restarted the slapd), but no luck. Insufficient permissions. The logs shows the account binding successfully, but then: vm001 slapd[pid]: => access_allowed: backend default write access denied to "uid=james,ou=Users,o=dallas" The complete logs are below. As a test I even tried giving global write access to the password, but it still doesn't work. (The only one who is able to change a users password is the Directory administrator) General log: ------------ vm001 slapd[pid]: conn=2 fd=17 ACCEPT from IP=127.0.0.1:36479 (IP=0.0.0.0:389) vm001 slapd[pid]: conn=2 op=0 BIND dn="uid=james,ou=users,o=masprt" method=128 vm001 slapd[pid]: conn=2 op=0 BIND dn="uid=james,ou=users,o=masprt" mech=SIMPLE ssf=0 vm001 slapd[pid]: conn=2 op=0 RESULT tag=97 err=0 text= vm001 slapd[pid]: conn=2 op=1 PASSMOD id="uid=james,ou=users,o=masprt" new vm001 slapd[pid]: conn=2 op=2 UNBIND vm001 slapd[pid]: conn=2 op=1 RESULT oid= err=50 text= vm001 slapd[pid]: conn=2 fd=17 closed With Debuging with ACL Listing: -------------------------------- vm001 slapd[pid]: conn=5 fd=16 ACCEPT from IP=127.0.0.1:47612 (IP=0.0.0.0:389) vm001 slapd[pid]: conn=5 op=0 BIND dn="uid=james,ou=users,o=masprt" method=128 vm001 slapd[pid]: => access_allowed: auth access to "uid=james,ou=Users,o=masprt" "userPassword" requested vm001 slapd[pid]: => access_allowed: backend default auth access granted to "(anonymous)" vm001 slapd[pid]: conn=5 op=0 BIND dn="uid=james,ou=Users,o=masprt" mech=SIMPLE ssf=0 vm001 slapd[pid]: conn=5 op=0 RESULT tag=97 err=0 text= vm001 slapd[pid]: conn=5 op=1 PASSMOD id="uid=james,ou=users,o=masprt" new vm001 slapd[pid]: => access_allowed: backend default write access denied to "uid=james,ou=Users,o=masprt" vm001 slapd[pid]: conn=5 op=1 RESULT oid= err=50 text= vm001 slapd[pid]: conn=5 op=2 UNBIND vm001 slapd[pid]: conn=5 fd=16 closed Any help or idea would be appreciated. thanks, James

2 2

refint_repair: dependent modify failed: 16
by Hung Luu 08 Jan '10

08 Jan '10

Hello, I haven't had any luck getting referential integrity to work with OpenLDAP 2.4.19 (and BerkeleyDB 4.8). Neither delete nor modify operations on DN's are triggering referenced member attributes to be removed as expected. I've tried building the overlays statically into the slapd executable and loading the overlays as dynamic modules - neither way worked for me. Thanks in advance for any help you can provide. *Here's my OpenLDAP configure settings:* env CPPFLAGS="-I/opt/BerkeleyDB.4.8/include" LDFLAGS="-L/opt/BerkeleyDB.4.8/lib" ./configure --prefix=/opt/openldap-2.4.19 --with-tls --enable-crypt --enable-syslog --enable-modules --enable-overlays=mod *Here's my slapd.config:* include /opt/openldap-2.4.19/etc/openldap/schema/core.schema include /opt/openldap-2.4.19/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.19/etc/openldap/schema/inetorgperson.schema moduleload refint.la loglevel 16383 database bdb suffix "dc=phoenix,dc=edu" rootdn "cn=Manager,dc=phoenix,dc=edu" rootpw secret directory /opt/openldap-2.4.19/var/openldap-data/phoenix-edu index default eq index cn,uid,member index objectClass eq cachesize 10000 checkpoint 128 15 overlay refint refint_attributes member refint_nothing "cn=Manager" *Here's the syslog entries - starting with the delete operation and ending with the refint error:* Jan 7 10:00:58 localhost slapd[28030]: conn=0 op=37 *do_delete* Jan 7 10:00:58 localhost slapd[28030]: >>> dnPrettyNormal: <l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu> Jan 7 10:00:58 localhost slapd[28030]: <<< dnPrettyNormal: <l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu>, <l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=ed$ Jan 7 10:00:58 localhost slapd[28030]: conn=0 op=37 DEL dn="l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" Jan 7 10:00:58 localhost slapd[28030]: bdb_dn2entry("l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu") Jan 7 10:00:58 localhost slapd[28030]: ==> bdb_delete: l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu Jan 7 10:00:58 localhost slapd[28030]: bdb_dn2entry("l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu") Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: delete access to "ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" "children" requested Jan 7 10:00:58 localhost slapd[28030]: <= root access granted Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: delete access granted by manage(=mwrscxd) Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: delete access to "l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" "entry" requested Jan 7 10:00:58 localhost slapd[28030]: <= root access granted Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: delete access granted by manage(=mwrscxd) Jan 7 10:00:58 localhost slapd[28030]: => bdb_dn2id_delete 0x8: "l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu" Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 @l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 %ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 @ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 @l=southwest,ou=regions,dc=phoenix,dc=edu Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 @ou=regions,dc=phoenix,dc=edu Jan 7 10:00:58 localhost slapd[28030]: <= bdb_dn2id_delete 0x8: 0 Jan 7 10:00:58 localhost slapd[28030]: => index_entry_del( 8, "l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" ) Jan 7 10:00:58 localhost slapd[28030]: => key_change(DELETE,8) Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 [4066d3f2] Jan 7 10:00:58 localhost slapd[28030]: <= key_change 0 Jan 7 10:00:58 localhost slapd[28030]: => key_change(DELETE,8) Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_delete_key: 8 [0096defd] Jan 7 10:00:58 localhost slapd[28030]: <= key_change 0 Jan 7 10:00:58 localhost slapd[28030]: <= index_entry_del( 8, "l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" ) success Jan 7 10:00:58 localhost slapd[28030]: ====> bdb_cache_delete( 8 ) Jan 7 10:00:58 localhost slapd[28030]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jan 7 10:00:58 localhost slapd[28030]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jan 7 10:00:58 localhost slapd[28030]: daemon: activity on 1 descriptor Jan 7 10:00:58 localhost slapd[28030]: bdb_delete: deleted id=00000008 dn="l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" Jan 7 10:00:58 localhost slapd[28030]: send_ldap_result: conn=0 op=37 p=3 Jan 7 10:00:58 localhost slapd[28030]: send_ldap_result: err=0 matched="" text="" Jan 7 10:00:58 localhost slapd[28030]: send_ldap_response: msgid=38 tag=107 err=0 Jan 7 10:00:58 localhost slapd[28030]: conn=0 op=37 RESULT tag=107 err=0 text= Jan 7 10:00:58 localhost slapd[28030]: daemon: activity on: Jan 7 10:00:58 localhost slapd[28030]: Jan 7 10:00:58 localhost slapd[28030]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jan 7 10:00:58 localhost slapd[28030]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jan 7 10:00:58 localhost slapd[28030]: => bdb_search Jan 7 10:00:58 localhost slapd[28030]: bdb_dn2entry("dc=phoenix,dc=edu") Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: search access to "dc=phoenix,dc=edu" "entry" requested Jan 7 10:00:58 localhost slapd[28030]: <= root access granted Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:58 localhost slapd[28030]: search_candidates: base="dc=phoenix,dc=edu" (0x00000001) scope=2 Jan 7 10:00:58 localhost slapd[28030]: => bdb_dn2idl("dc=phoenix,dc=edu") Jan 7 10:00:58 localhost slapd[28030]: => bdb_filter_candidates Jan 7 10:00:58 localhost slapd[28030]: AND Jan 7 10:00:58 localhost slapd[28030]: => bdb_list_candidates 0xa0 Jan 7 10:00:58 localhost slapd[28030]: => bdb_filter_candidates Jan 7 10:00:58 localhost slapd[28030]: OR Jan 7 10:00:58 localhost slapd[28030]: => bdb_list_candidates 0xa1 Jan 7 10:00:58 localhost slapd[28030]: => bdb_filter_candidates Jan 7 10:00:58 localhost slapd[28030]: EQUALITY Jan 7 10:00:58 localhost slapd[28030]: => bdb_equality_candidates (objectClass) Jan 7 10:00:58 localhost slapd[28030]: => key_read Jan 7 10:00:58 localhost slapd[28030]: bdb_idl_fetch_key: [b49d1940] Jan 7 10:00:58 localhost slapd[28030]: <= bdb_index_read: failed (-30988) Jan 7 10:00:58 localhost slapd[28030]: <= bdb_equality_candidates: id=0, first=0, last=0 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_filter_candidates: id=0 first=0 last=0 Jan 7 10:00:58 localhost slapd[28030]: => bdb_filter_candidates Jan 7 10:00:58 localhost slapd[28030]: OR Jan 7 10:00:58 localhost slapd[28030]: => bdb_list_candidates 0xa1 Jan 7 10:00:58 localhost slapd[28030]: => bdb_filter_candidates Jan 7 10:00:58 localhost slapd[28030]: EXT Jan 7 10:00:58 localhost slapd[28030]: <= bdb_filter_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_list_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_filter_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_list_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_filter_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_list_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: <= bdb_filter_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: bdb_search_candidates: id=-1 first=1 last=15 Jan 7 10:00:58 localhost slapd[28030]: => test_filter Jan 7 10:00:58 localhost slapd[28030]: OR Jan 7 10:00:58 localhost slapd[28030]: => test_filter_or Jan 7 10:00:58 localhost slapd[28030]: => test_filter Jan 7 10:00:58 localhost slapd[28030]: EXT Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: search access to "dc=phoenix,dc=edu" "member" requested Jan 7 10:00:58 localhost slapd[28030]: <= root access granted Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:58 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:58 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:58 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:58 localhost slapd[28030]: bdb_search: 1 does not match filter Jan 7 10:00:58 localhost slapd[28030]: => test_filter Jan 7 10:00:58 localhost slapd[28030]: OR Jan 7 10:00:58 localhost slapd[28030]: => test_filter_or Jan 7 10:00:58 localhost slapd[28030]: => test_filter Jan 7 10:00:58 localhost slapd[28030]: EXT Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: search access to "ou=people,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:58 localhost slapd[28030]: <= root access granted Jan 7 10:00:58 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:58 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:58 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:58 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:58 localhost slapd[28030]: bdb_search: 2 does not match filter Jan 7 10:00:58 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "ou=groups,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 3 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "ou=regions,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 4 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "l=Southwest,ou=regions,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 5 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 6 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "l=Phoenix,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 7 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "cn=enc,ou=groups,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 9 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "cn=enm,ou=groups,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 10 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "cn=aac,ou=groups,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 11 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "uid=alice,ou=people,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 12 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "uid=bob,ou=people,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 13 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "cn=enm,uid=alice,ou=people,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: >>> dnNormalize: <l=Southwest,ou=regions,dc=phoenix,dc=edu> Jan 7 10:00:59 localhost slapd[28030]: <<< dnNormalize: <l=southwest,ou=regions,dc=phoenix,dc=edu> Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 5 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 5 Jan 7 10:00:59 localhost slapd[28030]: bdb_search: 14 does not match filter Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: OR Jan 7 10:00:59 localhost slapd[28030]: => test_filter_or Jan 7 10:00:59 localhost slapd[28030]: => test_filter Jan 7 10:00:59 localhost slapd[28030]: EXT Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access to "cn=enc,uid=bob,ou=people,dc=phoenix,dc=edu" "member" requested Jan 7 10:00:59 localhost slapd[28030]: <= root access granted Jan 7 10:00:59 localhost slapd[28030]: => access_allowed: search access granted by manage(=mwrscxd) Jan 7 10:00:59 localhost slapd[28030]: >>> dnNormalize: <l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu> Jan 7 10:00:59 localhost slapd[28030]: <<< dnNormalize: <l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu> Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 6 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter_or 6 Jan 7 10:00:59 localhost slapd[28030]: <= test_filter 6 Jan 7 10:00:59 localhost slapd[28030]: refint_search_cb <cn=enc,uid=bob,ou=people,dc=phoenix,dc=edu> Jan 7 10:00:59 localhost slapd[28030]: refint_search_cb: member: l=Southern Arizona,ou=campuses,l=Southwest,ou=regions,dc=phoenix,dc=edu (#1) Jan 7 10:00:59 localhost slapd[28030]: send_ldap_result: conn=-1 op=0 p=0 Jan 7 10:00:59 localhost slapd[28030]: send_ldap_result: err=0 matched="" text="" Jan 7 10:00:59 localhost slapd[28030]: refint_search_cb <NOTHING> Jan 7 10:00:59 localhost slapd[28030]: bdb_modify: cn=enc,uid=bob,ou=people,dc=phoenix,dc=edu Jan 7 10:00:59 localhost slapd[28030]: bdb_dn2entry("cn=enc,uid=bob,ou=people,dc=phoenix,dc=edu") Jan 7 10:00:59 localhost slapd[28030]: bdb_modify_internal: 0x0000000f: cn=enc,uid=bob,ou=people,dc=phoenix,dc=edu Jan 7 10:00:59 localhost slapd[28030]: <= acl_access_allowed: granted to database root Jan 7 10:00:59 localhost slapd[28030]: bdb_modify_internal: delete member Jan 7 10:00:59 localhost slapd[28030]: dnMatch 0 "l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=edu" "l=southern arizona,ou=campuses,l=southwest,ou=regions,dc=phoenix,dc=e$ Jan 7 10:00:59 localhost slapd[28030]: bdb_modify_internal: replace modifiersName Jan 7 10:00:59 localhost slapd[28030]: bdb_modify_internal: delete member Jan 7 10:00:59 localhost slapd[28030]: bdb_modify_internal: 16 modify/delete: member: no such attribute Jan 7 10:00:59 localhost slapd[28030]: bdb_modify: modify failed (16) Jan 7 10:00:59 localhost slapd[28030]: send_ldap_result: conn=-1 op=0 p=0 Jan 7 10:00:59 localhost slapd[28030]: send_ldap_result: err=16 matched="" text="modify/delete: member: no such attribute" Jan 7 10:00:59 localhost slapd[28030]: *refint_repair: dependent modify failed: 16*

1 0

Error configuring monitor database
by Diego Lima 07 Jan '10

07 Jan '10

Hello all, I'm trying to set up monitoring via slapd.conf according to this guide: http://www.openldap.org/devel/admin/monitoringslapd.html However after setting it up and trying to test it I receive the following error message: root@gilead:/opt/fedora-ds# bin/ldapsearch -x -D "cn=Directory Manager,o=xxx,o=xxx,c=br" -W -b 'cn=monitor' -s base '(objectClass=*)' '*' '+' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=monitor> with scope baseObject # filter: (objectClass=*) # requesting: * + # # search result search: 2 result: 32 No such object # numResponses: 1 This is what I've added to my slapd.conf: database monitor access to * by dn.exact="cn=Directory Manager,o=xxx,o=xxx,c=br" by * none I've restarted slapd after adding the entries above. Is there something else that must be done? Thanks! -- Diego Lima

2 2

Consumer ACLs
by Jaap Winius 07 Jan '10

07 Jan '10

Hi all, A question regarding ACLs on OpenLDAP consumer servers. If the ACLs on the provider give clients write access to some attributes, such as loginShell or userPassword, shouldn't the ACLs on the consumers do the same? I'm not sure about this, since consumer databases are always read-only, but it seems to me that the clients would otherwise have no way of knowing that changing certain attributes was possible (via the updateref option or the chain overlay). Thanks, Jaap

2 1

Password Policy setting
by Saavedra, Gisella 07 Jan '10

07 Jan '10

I read the entry in Chapter 6 http://www.zytrax.com/books/ldap/ch6/ppolicy.html#examples regarding setting the Password Policy Control. I have installed OpenLDAP through Cygwin. OpenLDAP is version 2.3.43 I created my db and included the Password Policy control schema, but I am getting the following error when I try to load my default and user policies: $ ldapadd -H ldap://localhost:666 -x -D "cn=Manager,dc=zes_example,dc=com" -w secret -f /etc/openldap/data/ppolicy.ldif adding new entry "ou=pwdpolicies,dc=zes_example,dc=com" adding new entry "cn=default,ou=pwdpolicies,dc=zes_example,dc=com" ldapadd: Object class violation (65) additional info: no structural object class provided Any idea? Do I need to add the password policy (ldif file) before I give the directive in slapd.conf? ----------------------------------------- The policy.ldif: dn: ou=pwdpolicies,dc=zes_example,dc=com ou: pwdpolicies description: All password Policies objectclass: organizationalunit # Default Password Policy dn: cn=default,ou=pwdpolicies,dc=zes_example,dc=com objectClass: pwdPolicy cn: default # User can change his/her password pwdAllowUserChange: TRUE # Return warning to bind attempt (seconds) -- 3 days pwdExpireWarning: 259200 # Interval in seconds to reset failure pwd count pwdFailureCountInterval: 100 # Do not allow to bind on expired passwords pwdGraceAuthNLimit: 0 # Reject any password changes in this list pwdInHistory: 3 # Lock out account when user tries more than x attempts using invalid password pwdLockout: TRUE # Do not allow the system to unlock the account pwdLockoutDuration: 0 # Consecutinve # of failure attempts pwdMaxFailure: 5 # How long the password lasts before user has to change it (seconds) -- 90 days pwdMaxAge: 77760000 # Password length pwdMinLength: 6 The commands in my slapd.conf are: ... include /etc/openldap/schema/ppolicy.schema ... (not usre if I need the next line) loadmodule ppolicy.la # invokes password policies for this DIT only overlay ppolicy # Default ppolicy ppolicy_default "cn=default,ou=pwdpolicies,dc=zes_example,dc=com" # Some ppolicy directives ppolicy_use_lockout Gisella Saavedra Sr. Software Engineer gsaavedra(a)zebra.com<mailto:gsaavedra@zebra.com> [cid:image001.gif@01CA8D67.CCDB6A40] 1000 Broadway, Suite 150, Oakland, CA 94607 | T+1 510 267 5123 T Main+1 510 267 5000 F+1 510 267 5100 | http://www.zebra.com/zes ________________________________ - CONFIDENTIAL- This email and any files transmitted with it are confidential, and may also be legally privileged. If you are not the intended recipient, you may not review, use, copy, or distribute this message. If you receive this email in error, please notify the sender immediately by reply email and then delete this email.

3 2

Server Side sort and the cn attribute
by Edward Capriolo 06 Jan '10

06 Jan '10

We use openldap as a back end for many things. One of the thing, it can be used for is an address book for outlook. Recently we upgrade to 2.4.16->2.4.20 from 2.(who knows how old). Outlook 2003 clients stopped working: http://support.microsoft.com/kb/555536 So I followed the instructions here to enable server side sorting: http://bacedifo.blogspot.com/2009/09/server-side-sort-with-openldap2418.html I was able to add the ordering to the sn attribute. attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' ORDERING caseIgnoreOrderingMatch SUP name ) Unfortunately outlook is looking at the cn attribute @400000004b21316a0e808064 sssvlv: no ordering rule specified and no default ordering rule for attribute cn @400000004b21316a0e808834 <= get_ctrls: n=1 rc=18 err="serverSort control: No ordering rule" That unfortunately is not defined in the core.schema # system schema #attributetype ( 2.5.4.3 NAME ( 'cn' 'commonName' ) # DESC 'RFC2256: common name(s) for which the entity is known by' # SUP name ) I am sure there is a good reason why cn does not have an ordering, but I am guessing it used to have this in the distant past since this previously worked. So how would I go about changing the system schema? Or does anyone have a better way to deal with this. (I know I could play with client registry (kb) article but I would like to handle this server side) Thank you for your insights.

1 1

Password Policy - Password Modification
by SAGNIMORTE Thomas (CAMPUS) 06 Jan '10

06 Jan '10

Hello, I get some trouble with the password policy settings. I try to modify an user password when I am connected as an admin, but I can't due tu "User Alteration of Password is not allowed". I connect with an "Admin profile" who have right to write on all the directory Jan 5 15:06:25 clawma01 slapd[4363]: conn=94459 op=0 BIND dn="cn=adm_alecle23,ou=administrator,ou=security,o=oxylane" mech=SIMPLE ssf=0 Jan 5 15:06:25 clawma01 slapd[4363]: conn=94459 op=0 RESULT tag=97 err=0 text= When I try to change a password for a standard user, I get this error message. Jan 5 15:06:43 clawma01 slapd[4363]: conn=94459 op=12 MOD dn="uid=o2alecle23,ou=o2,ou=people,o=oxylane" Jan 5 15:06:43 clawma01 slapd[4363]: conn=94459 op=12 MOD attr=userPassword Jan 5 15:06:43 clawma01 slapd[4363]: conn=94459 op=12 RESULT tag=103 err=50 text=User alteration of password is not allowed Here is the password policy used for this user dn: cn=userDefault,ou=policy,ou=security,o=oxylane objectClass: top objectClass: pwdPolicy objectClass: person cn: userDefault pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 1 pwdExpireWarning: 432000 pwdFailureCountInterval: 1800 pwdGraceAuthNLimit: 0 pwdInHistory: 10 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 2764800 pwdMaxFailure: 15 pwdMinAge: 172800 pwdMinLength: 6 pwdMustChange: FALSE sn: default_user Could I change password for an user with an other account instead of rootdn? How can I allow admin user to change password of standard user? Regards, Thomas

1 0

ldap_modify_s Insufficient access
by Fujisan 04 Jan '10

04 Jan '10

Users in my LDAP database have trouble changing passwords. $ passwd Changing password for user XXX. Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Insufficient access passwd: Authentication token manipulation error In /var/log/message, I have: passwd: pam_ldap: ldap_modify_s Insufficient access In slapd.conf on the server, I have the following: database bdb suffix dc=mydomain,dc=fr checkpoint 1024 15 rootdn cn=Manager,dc=mydomain,dc=fr rootpw {SSHA}XXXXX access to attrs=userPassword by self write by * none access to dn.subtree="dc=mydomain,dc=fr" by dn="cn=Manager,dc=mydomain,dc=fr" write by self write by * read Any idea what is wrong? Thanks in advance. F.

2 1

Encoded entries on LDIF file
by Diego Lima 04 Jan '10

04 Jan '10

Hello all, I'm trying to import an LDIF file where some users have values that appear to be encoded on the file. The values have two : (i.e. ::) and appear like this: # entry-id: 36545 dn: uid=someuser,ou=funcionarios,ou=pessoal,o=xxx,c=xxx l:: UkYgLSAyqiBFc3RhbmNpYQ== This isn't consistent with other entries, as most of them are on this format: # entry-id: 36546 dn: uid=otheruser,ou=funcionarios,ou=pessoal,o=xxx,c=xxx l: DRA-01 NSI Is there any reason why some entries would show up on a different format? I've seen some entries where other attributes are like that, such as sn, telephoneNumber, cn or title. Thank you -- Diego Lima

3 2

changing rootdn password
by Mihamina Rakotomandimby 31 Dec '09

31 Dec '09

Manao ahoana, Hello, Bonjour, On a Debian and a Ubuntu I install OpenLDAP with the package manager. It usually asks for an admin password. But when looking in /etc/ldap/ I found no place where it is stored (even in an encrypted form). I would like to change that admin password without calling 'dpkg-reconfigure slapd'. Is there an ldap utility or built-in command for that purpose? Misaotra, Thanks, Merci. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34 / +261 33 11 207 36

3 3

Clients can't authenticate via consumer server
by Jaap Winius 30 Dec '09

30 Dec '09

Hi all, On my test system, which uses OpenLDAP simple authentication, I'm unable to get clients to authenticate to a consumer server, although they can authenticate to its provider server without a problem. Here's a snippet of the consumer's syslog, for which I've set the slapd.conf loglevel to "acl": ================== Dec 30 02:13:28 ldapc2 slapd[3031]: => acl_mask: access to entry "uid=ccolumbus,ou=People,dc=example,dc=com", attr "userPassword" requested Dec 30 02:13:28 ldapc2 slapd[3031]: => acl_mask: to value by "", (=0) Dec 30 02:13:28 ldapc2 slapd[3031]: <= check a_dn_pat: cn=admin,dc=example,dc=com Dec 30 02:13:28 ldapc2 slapd[3031]: <= check a_dn_pat: anonymous Dec 30 02:13:28 ldapc2 slapd[3031]: <= acl_mask: [2] applying auth(=xd) (stop) Dec 30 02:13:28 ldapc2 slapd[3031]: <= acl_mask: [2] mask: auth(=xd) ================== Judging from this, I suspect that I've misconfigured the account on the consumer server that the client machines must use to access password values in the database to authenticate clients. Currently, the consumer's ACLs look like this: ================== access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" read by anonymous auth by * none access to dn.base="" by * read access to * by * read ================== This is the same admin account that I use on the provider. If I set the client's libnss-ldap configuration to use this account and its matching password to authenticate users via the consumer server, it doesn't work. Any idea about what I'm doing wrong? Thanks, Jaap

1 0

Renaming of attributes in ldap schema
by Thilko Richter 29 Dec '09

29 Dec '09

Hello, I have a general ldap question: I would like to use ldap as configuration store for my applications. Each application gets his own object schema, since then the number properties is deterministic. Since a number of developers are involved, I try to generate the schema definition from a ruby DSL. I am now thinking about what happens to existing entries in the dit if the oids or names of the attribute definitons has changed? Are they invalid after ldap server restart? Would you recommend not to renaming any elements in the schema? I have seen that the attributes on existing entries disappeared if I change the name in the schema. Regards, Thilko

2 1

LDAP programming book
by Murray S. Kucherawy 28 Dec '09

28 Dec '09

Is the 1997 book "LDAP: Programming Directory-Enabled Applications" by Smith & Howes reasonably current to the latest OpenLDAP releases, or has enough changed in the intervening 12 years that it's not worth getting?

2 1

Chain overlay not available in Debian lenny?
by Jaap Winius 26 Dec '09

26 Dec '09

Hi all, Can anyone confirm that the chain overlay is not available in the version of OpenLDAP (2.4.11-1) that comes with Debian lenny? Although the man page for it still exists, loading it as a module result in an error (lt_dlopenext failed: (chain) chain.so: cannot open shared object file: No such file or directory), as does activating it (overlay "chain" not found) as well as attempts to use any of the "chain-" options in slapd.conf. Also, there's a Debian bug report (#502769, 19 Oct. 2008) with the subject "when adding overlay chain to the slapd.conf slapd crashes with overlay chain not found." No mention is made of a solution, but could it be that the chain overlay was simply removed from the slapd package as result? Thanks, Jaap

2 1

ACL problem
by Il Neofita 24 Dec '09

24 Dec '09

Hi I am new and probably I am facing a very basic error I am tring to create an admin for a subset I create this ldif dn: cn=mmmm,dc=test,dc=xx cn: mmmm sn: mmmm objectClass: person objectClass: top userPassword: test then on sladp.conf ... access to dn.subtree="ou=people,dc=test,dc=xx" by dn="cn=mmmm,dc=test,dc=xx" write by * read ... Restarted ldap ldapsearch -x -D "cn=mmmm,dc=test,dc=xx" -W '(objectclass=*)' ldap_bind: Invalid credentials (49) What am I do wrong?

2 5

deprecated function ldap_sort_entries, ldap_sort_values, ldap_sort_strcasecmp
by DT Piotr Wadas 24 Dec '09

24 Dec '09

Hello, using openldap 2.4.17 I'm fixing obsolete things in my old application, e.g. removed some extern statements. When building I got xxx.c:790: error: 'ldap_sort_strcasecmp' undeclared (first use in this function) After further investigation I discovered this http://www.mail-archive.com/openldap-devel@openldap.org/msg01517.html quote: " ldap_sort_entries ldap_sort_values ldap_sort_strcasecmp of which Net::LDAPapi only uses ldap_sort_entries. Is there a replacement function for this? If not, any thoughts on what the steps are to duplicate that functionality? So no one else knows what these functions do either? ;) Well, functions tend to get deprecated due to neglect. If nobody has ever used them thus far..... -- Howard Chu" Well, seems I know what these function do, I used it to sort set of values of the retrieved attribute ( char ** ), specifying function, which is to be used for sorting. The form of call was (is) ldap_sort_values( LDAP * ldc, char ** vals, ( fn & ) ldap_sort_strcasecmp); The idea was, that when I got attribute values set like attrName: /abc/xyz attrName: /abc/x/nnnn attrName: /abc attrName: /abc/xyz/u/m numericAttrName: 10 numericAttrName: 5 numericAttrName: 123 I need to process it in some resonable order, according to application needs, it was easier to use library functions than create my own's. I denoted these with ' //LDAP_SORT_AV_CMP_PROC *cmp ', but don't remember was I meant, must have been about 3 years ago. Any suggestions? Shall I create my own function to sort retrieved values, or use some server control? AFAIR one has no influence on the order, in which attribute values are PUT into the entry, but when it comes to use it, it is important to be sure, that there's NO variable of value "7" processed before value "10" ldap_sort (3) - LDAP sorting routines (deprecated) ldap_sort_entries (3) - LDAP sorting routines (deprecated) ldap_sort_strcasecmp (3) - LDAP sorting routines (deprecated) ldap_sort_values (3) - LDAP sorting routines (deprecated) Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd 8.3.6-(api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

1 1

Is there any accounting software using ldap for customers and suppliers?
by Damiano Venturin 24 Dec '09

24 Dec '09

Hi, that's my first post here. I realize that this is not exactly the kind of message that I should post here but I'm really going mad trying to find an accounting software which uses natively ldap as a backend. I'm not looking for something that can synchronize, import or export into ldap. Are you aware of some good software? It doesn't matter if it's for free or not. It would be cool if it's open. Thank you -- Damiano Venturin http://www.squadrainformatica.com

3 4

Developer's cookbook for adding LDAP support
by Murray S. Kucherawy 24 Dec '09

24 Dec '09

Are there any good documentation sites or books out there for adding LDAP support to a program? The ldap(3) man page is pretty sparse. I've been told that basically studying the OpenLDAP source itself is the best way to figure it out, but I'm hoping there's something better. I have only very rudimentary knowledge of LDAP in general. Almost all of my exposure to OpenLDAP was through a helper library that did a lot of work for me, but that was at a previous job. This is for an open source project. The application to be updated already has support to get key-value pairs from SQL/ODBC and Sleepycat DB sources, and I have a request to include support for LDAP. Essentially in the application I am given an email recipient and I need to get from the database a piece of detail I need to append to that outgoing mail. There's no standard schema for this (yet; it's been suggested we create one through the IETF), so I will need to allow administrators to specify which attributes to request. Any helpful pointers would be appreciated. Happy holidays, -MSK

2 1

LDAPS queries in C/C++ - conceptual question
by Robert Welz 23 Dec '09

23 Dec '09

Hello, I was asked to expand some C++ software to do ldap queries with TLS on a server with SSL certificate. We want the server to authenticate by its certificate so our software is protected from fake servers. Before I dig too deep into the API, I would like to know: - Is it possible with LDAP API to extract the servers certificate data to verify its integrity? - or should I program it directly with openSSL API? Thank you for sharing your wisdom, kind regards, --- Robert Welz

2 1

slapd socket file name and location
by DT Piotr Wadas 23 Dec '09

23 Dec '09

Hello, I'm using openldap 2.4.17 on debian, command line for testing purposes is --- root@host:~# slapd -d16384 -f slapd-1.conf -u openldap -g openldap \ -h "ldapi:///var/run/slapd/foobar/x-mod=-rw-------" @(#) $OpenLDAP: slapd 2.4.17 (Nov 10 2009 18:29:26) $ root@SD6-Casa:/tmp/buildd/openldap-2.4.17/debian/build/servers/slapd slapd starting -- result: root@host:~# lsof -U |grep slapd slapd 2971 openldap 3u unix 0xf65cab80 0t0 967834 socket slapd 2971 openldap 7u unix 0xf65ca380 0t0 967836 /var/run/slapd/ldapi root@lena:~# --- Filesystem directory permissions are fine, well, no matter about x-mod, the problem is I cannot force different file name (location) for socket file, default location seems to be build-dependent, shall I guess it's debian related issue? I expect the socket file to be created where I specify within "ldapi" URI. I tried a few variants of this uri, assuming I misunderstood the triple slash construction, anyway I still have socket file created in the same place. Isn't it supposed to create socket file where specified? What I want, actually, is to start two or more independent slapd servers (completely searated databases), listening on IPC only, on two different IPC sockets on the same machine. Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd 8.3.6-(api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

4 8

Help migrating an OpenLdap 1.x directory to 2.x
by Diego Lima 23 Dec '09

23 Dec '09

Hello All, I'm currently working on migrating a directory that is currently running on OpenLDAP 1.x to OpenLDAP 2.x. Is there any online documents which detail how to convert the old schemas (which are on ldif format) to the format used by 2.x? I tried to google for that but I could not find much info on the subject. Currently the settings, acls and schemas are all present on ldif format. Any help would be greatly appreciated. Thanks a lot, Diego Lima

2 1

MD5 password hash with ppolicy
by Joe Friedeggs 23 Dec '09

23 Dec '09

I am working (with RH via Dell support) to solve an issue (that I believe to be a pam_ldap issue). The problem is that the password policy control messaging does not occur when I set 'pam_password md5', thus the Linux client never knows that the password expires. They have informed me that the password policy overlay in LDAP requires clear-text passwords, and will not handle the password policy stuff if the password is hashed. This makes no sense to me, since ppolicy is only handling expiry times, etc. and pam is handling the rest (length, strength, etc., prior to hash). Does the ppolicy overlay require clear-text? Thanks, Joe _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. http://clk.atdmt.com/GBL/go/177141665/direct/01/

2 1

Re: openldap-2.4.20 installation
by vishesh kumar 22 Dec '09

22 Dec '09

Thanks friends It require BDB 4.4 and i have 4.3.29 on my system. So what next i should do, should i upgrade existing BDB 4.3 to 4.4 or i should install BDB4.4 in separate path. Thanks On Wed, Dec 9, 2009 at 8:34 PM, Gattegno, Victor (EMEA BSS CC) < victor_gattegno(a)hp.com> wrote: > Hi, > > You may know which bdb version is required by current openldap package by > reading the 2.4.20 Release README: > http://www.openldap.org/software/release/readme.html > > SLAPD: > BDB and HDB backends require Oracle Berkeley DB 4.4, 4.5, > 4.6, 4.7, or 4.8. It is highly recommended to apply the > patches from Oracle for a given release. > > Regards, > Victor > > -----Original Message----- > > On Monday, 7 December 2009 11:26:18 vishesh kumar wrote: > > Dear friends > > Today i tried to install openldap2.4.20 on RHEL 5.2. After firing > > ./configure script, i got following error > > > > *Configure:error: Berkeley DB version incomptible with BDB/HDB > > backend. > > > > *But after investigation i found that db4 with version 4.3.29 is > installed > > on my system. So what i should do now, > > Should i replace my Berkeley DB package? I want to be sure that other > > running programs not get any issue after bdb upgradation. > > How one know which bdb version is required by current openldap package > ? > > > > thanks > > -- http://linuxinterviews.blogspot.com

2 1

Finding a provider to write to
by Jaap Winius 22 Dec '09

22 Dec '09

Hi all, Although I've figured out the basics of synchronization between providers and consumers, I'm not yet clear about one aspect from the client's perspective. In particular, if you've set up an LDAP consumer server with a synchronized, read-only copy of the DIT to service a particular group of clients, and you've configured those clients* to use that consumer server for all of their directory queries, how do those clients know where to find the correct provider in case it becomes necessary for them to write to the DIT (e.g. to change a password)? Thanks, Jaap *) With the URI option in /etc/ldap/ldap.conf

3 2

need help with my backup copy of ldap database...
by Louis-M. Carrière 22 Dec '09

22 Dec '09

Hi ! I had a problem with my system and decided to backup my /var/ /etc, etc. files and reinstall everything (Mandriva 2009). But now, my openldap installation complains about my openldap database being corrupted or something (here is the log): Dec 21 21:23:09 p4server slapd[12999]: @(#) $OpenLDAP: slapd 2.4.11 (Sep 15 2008 10:30:35) $ mandrake@n4.mandriva.com:/home/mandrake/rpm/BUILD/openldap-2.4.11/servers/slapd Dec 21 21:23:09 p4server slapd[12999]: daemon_init: listen on ldap://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon_init: listen on ldaps://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon_init: 2 listeners to open... Dec 21 21:23:09 p4server slapd[12999]: daemon: listener initialized ldap://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon: listener initialized ldaps://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon_init: 2 listeners opened Dec 21 21:23:09 p4server slapd[12999]: slapd init: initiated server. Dec 21 21:23:09 p4server slapd[12999]: slap_sasl_init: initialized! Dec 21 21:23:09 p4server slapd[12999]: bdb_back_initialize: initialize BDB backend Dec 21 21:23:09 p4server slapd[12999]: bdb_back_initialize: Berkeley DB 4.6.21: (February 11, 2009) Dec 21 21:23:09 p4server slapd[12999]: hdb_back_initialize: initialize HDB backend Dec 21 21:23:09 p4server slapd[12999]: hdb_back_initialize: Berkeley DB 4.6.21: (February 11, 2009) Dec 21 21:23:09 p4server slapd[12999]: backend_startup_one: starting "cn=config" Dec 21 21:23:09 p4server slapd[12999]: => ldif_enum_tree: failed to open /etc/openldap/slapd.d/cn=config.ldif: No such file or directory Dec 21 21:23:09 p4server slapd[12999]: send_ldap_result: conn=-1 op=0 p=0 Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): file id2entry.bdb has LSN 2/4451165, past end of log at 1/140 Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): Commonly caused by moving a database from one database environment Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): to another without clearing the database LSNs, or by removing all of Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): the log files from a database environment Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): /var/lib/ldap/id2entry.bdb: unexpected file type or format Dec 21 21:23:09 p4server slapd[13000]: bdb_db_open: database "dc=louismc,dc=org": db_open(/var/lib/ldap/id2entry.bdb) failed: Invalid argument (22). Dec 21 21:23:09 p4server slapd[13000]: backend_startup_one: bi_db_open failed! (22) Dec 21 21:23:09 p4server slapd[13000]: bdb_db_close: database "dc=louismc,dc=org": alock_close failed Dec 21 21:23:09 p4server slapd[13000]: slapd stopped. Is there anything I can do to restore it like it was??? Also, but far less important, I have another error but less important since it never prevent me from using openldap before... /etc/openldap/slapd.d/cn=config What can I do about it??? Why does it complain? I never confiruged slapd.conf to use cn=config there... it should look in ldap itself for the config entry.... ?!?!? I'm puzzled and never had chance with google solving this one. thanks ! Louis-Martin Carrière _________________________________________________________________ Tirez parti d’une offre Windows 7 exceptionnelle et voyez comment il vous simplifie la vie. http://go.microsoft.com/?linkid=9691828

2 1

Re: Re : OpenLDAP 2.4 - Problem with rewrite overlay
by masarati＠aero.polimi.it 21 Dec '09

21 Dec '09

> I see your problem, it's when you restart the server using the > in-directory configuration. I couldn't investigate things further right > now; please file an ITS <http://www.openldap.org/its/> I've fixed the problem. I need you to file an ITS to track the issue. p.

2 1

Syncprov & synrepl indices
by Jaap Winius 20 Dec '09

20 Dec '09

Hi all, When configuring a provider for replication with the syncprov option, using the syncprov-sessionlog option requires searching for the entryUUID attribute. While not a requirement, setting an eq index for this attribute can improve the performance of the session log considerably. For the same reason, setting an eq index for the entryCSN attribute when using the syncprov-checkpoint option is also recommended. My question is in regard to the consumer. This documentation... http://www.openldap.org/doc/admin24/replication.html#Syncrepl ... shows an example consumer configuration (18.3.1.3) that also includes setting eq indices for entryCSN and entryUUID. Is this really useful, or only if the consumer is configured to act as a provider as well? Thanks, Jaap

2 1

objectClass=posixAccount search anomaly.
by Prentice Bisbal 19 Dec '09

19 Dec '09

Dear OpenLDAP Tech list: I can't tell if the problem below is with OpenLDAP, or nss_ldap. Since I can reproduce the problem with the ldapsearch command, I'm inclined to think it's with OpenLDAP. Any assistance will be greatly appreciated. At the academic institution where are work, there are several different departments that maintain their own LDAP directory: dc=sns,dc=example,dc=edu dc=math,dc=example,dc=edu dc=itg,dc=example,dc=edu dc=net,dc=example,dc=edu and a top-level LDAP server that just contains referrals to the individual dept servers: dc=example,dc=edu We are now looking to share access to systems without duplicating account information in all the LDAP servers. So if someone from math would like to log into an SNS system, they can authenticate against their credentials in the math LDAP directory, and get their account information from there, too. We are using an RHEL 5.4-based Linux distro. To facilitate this, I added this to my /etc/openldap/slapd.conf: database ldap suffix "dc=example,dc=edu" uri ldaps://ldap.example.edu/ And in /etc/ldap.conf, I changed the base to dc=example, dc=edu. The clients are still searching my local OpenLDAP server first. After making these changes, 'getent passwd no longer works correctly, and these ldapsearch no longer returns results ldapsearch -x objectClass=posixAccount ldapsearch -x -b dc=example,dc=edu objectClass=posixAccount ldapsearch -x -b dc=sns,dc=example,dc=edu objectClass=posixAccount ldapsearch -x -b dc=math,dc=example,dc=edu objectClass=posixAccount However, these ldapsearches work as expected ldapsearch -x objectClass=account ldapsearch -x ldapsearch -x objectClass=inetorgperson ldapsearch -x objectClass=inetlocalmailrecipient ldapsearch -x objectClass=top ldapsearch -x -b dc=math,dc=example,dc=edu Any ideas why the behavior is different for the posixAccount object class vs. the other object classes? Is there any other configurations for OpenLDAP that would achieve the same goal? -- Prentice

2 1

Syncrepl and rootdn
by Jaap Winius 19 Dec '09

19 Dec '09

Hi all, This question has to do with syncrepl and the use of the rootdn option in slapd.conf. My understanding is that on a provider server (where writes are possible), it is not necessary to use the rootdn option in slapd.conf. Instead it is enough to have an account that only exists in the directory, with ACLs that give it the same unrestricted access. This works fine for me. On syncrepl consumers a rootdn in the local slapd.conf is apparently required (according to the man page for slapd.conf). Why is this, and does it make a difference what the name of the account is? For example, should it be the same as the binddn for syncrepl? For that matter, should rootpw also be set, and should it then be the same as the credentials value used for syncrepl? Thanks, Jaap PS -- I'm using OpenLDAP 2.4.11-1 on Debian lenny.

3 3

slapadd: database doesn't support necessary operations
by Sergey Kharlamov 18 Dec '09

18 Dec '09

Hi all! I'm newbie in openldap. I try to setup openldap with mysql-backend. I try to insert ldif file: dn: o=test objectclass: organization o: tester and get error: ==>backsql_get_db_conn() ==>backsql_open_db_conn(4294967295) [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (DSN). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (Host). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (Trace). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (UserName). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (ReadOnly). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (RowVersioning). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (ShowSystemTables). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (ShowOidColumn). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (FakeOidIndex). <==backsql_open_db_conn(4294967295) backsql_open_db_conn(4294967295): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_load_schema_map() backsql_load_schema_map(): oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM ldap_oc_mappings" backsql_load_schema_map(): at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" <==backsql_load_schema_map() ==>backsql_free_db_conn() backsql_free_db_conn(): closing db connection 4294967295 (0x8115530) ==>backsql_close_db_conn(4294967295) <==backsql_close_db_conn(4294967295) <==backsql_free_db_conn() <==backsql_db_open(): test succeeded, schema map loaded slapadd: database doesn't support necessary operations. How I can fix that? Tell me if need some more information -- --------------------------- Best Regards Kharlamov Sergey

1 0

Re: Re : OpenLDAP 2.4 - Problem with rewrite overlay
by Quanah Gibson-Mount 18 Dec '09

18 Dec '09

Please keep replies on the list. --Quanah --On Friday, December 18, 2009 2:36 AM -0800 KISTER RAPHAEL <kraph(a)yahoo.com> wrote: > Hello, > > My command to test the configuration is :su - openldap -c > "/opt/openldap/sbin/slaptest -v -u -F /opt/donnees/etc/openldap/slapd.d/" > If i use this commande line, i don't get any error or warning :su - > openldap -c "/opt/openldap/sbin/slaptest -v -u -f > /opt/donnees/etc/openldap/slapd.conf -F > /opt/donnees/etc/openldap/slapd.d/" > > But, when i want to start my openldap server, i get the same error. I > join you the result of the start command. > > > modulepath is commented out because all my module are includes in > openldap. I try to use modulepath and moduleload, but i still have the > error. > > Best resgards, > Raphael KISTER > > > > > ----- Message d'origine ---- > De : Quanah Gibson-Mount <quanah(a)zimbra.com> > À : KISTER RAPHAEL <kraph(a)yahoo.com>; openldap-technical(a)openldap.org > Envoyé le : Mer 16 Décembre 2009, 20 h 14 min 13 s > Objet : Re: OpenLDAP 2.4 - Problem with rewrite overlay > > --On Wednesday, December 16, 2009 8:07 AM -0800 KISTER RAPHAEL > <kraph(a)yahoo.com> wrote: > >> Hello, >> >> I have to configure an OpenLDAP directory that store some >> informations about users and groups and that is a proxy with Active >> Directory. To do this, i configure two suffix on my openldap server : the >> first one is to store informations about users and groups and the second >> is for the Active Directory proxy (second suffix is embedded in the first >> one. >> >> To configure the Active Directory proxy, i use an ldap backend with rwm >> overlay to rewrite some attributes and objectclass. >> >> When i test my configuration with slaptest binary, i get this error : >> config error processing olcOverlay={0}rwm,olcDatabase={2}ldap,cn=config: >> <olcRwmMap> handler exited with 1 slaptest: bad configuration directory! > > What is your exact slaptest command? Why is modulepath commented out in > your slapd.conf? > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Re : OpenLDAP 2.4 - Problem with rewrite overlay
by Pierangelo Masarati 18 Dec '09

18 Dec '09

KISTER RAPHAEL wrote: > Hello, > > Thank you for your response.I try to test the config file without the microsoft.schema, but i still have the problem. If i delete all the rwm-map lines, OpenLDAP have a good configuration file and start fine. > > The microsoft.schema is the file a find in OpenLDAP source (i just put in this file user objectclass, sAMAccountName attribut and all the user class attributes). > > When i try to start OpenLDAP, i get the same error. I join you the result in the openldap_start.txt file. Please keep replies in CC to the list. I see your problem, it's when you restart the server using the in-directory configuration. I couldn't investigate things further right now; please file an ITS <http://www.openldap.org/its/> p.

1 0

Half-created objects, objectClass: glue
by Peter Mogensen 18 Dec '09

18 Dec '09

Hi, I have a group of objects in my DIT which seems to haven been added at a time where the server was under heavy write load. They exist in a slapcat, but are not visible in a search. They are not fully created but have: objectClass: top objectClass: glue structuralObjectClass: glue Should this happen? slapd. 2.4.20. BDB 4.8, using a back_hdb database. /Peter

1 0

Two index questions
by Jaap Winius 17 Dec '09

17 Dec '09

Hi all, Today I have two questions involving indexing. First, my understanding is that if a new index has been added to slapd.conf, it won't be used until slapd is stopped, slapindex is run and slapd is started again. However, if there aren't any entries yet in the database that carry a new attribute to be indexed, then there's actually nothing to index. Also, the man page for it states that "Slapindex is used to regenerate slapd(8) indices based upon the current contents of a database." Could this also be a hint that slapindex does need relevant data to process before it can produce any indices? I expect to be wrong about this, but I'd rather be sure. Second, regarding consumers, if a new index is added to a provider, does the same index also have to be added and (re)generated with slapindex on its consumers before it will be available there as well? I would expect so, but again, I'm not completely certain. Thanks, Jaap

3 2

OpenLDAP 2.4 - Problem with rewrite overlay
by KISTER RAPHAEL 16 Dec '09

16 Dec '09

Hello, I have to configure an OpenLDAP directory that store some informations about users and groups and that is a proxy with Active Directory. To do this, i configure two suffix on my openldap server : the first one is to store informations about users and groups and the second is for the Active Directory proxy (second suffix is embedded in the first one. To configure the Active Directory proxy, i use an ldap backend with rwm overlay to rewrite some attributes and objectclass. When i test my configuration with slaptest binary, i get this error : config error processing olcOverlay={0}rwm,olcDatabase={2}ldap,cn=config: <olcRwmMap> handler exited with 1 slaptest: bad configuration directory! I am on a CentOS 5.4 server with OpenLDAP 2.4.20 (compile from sources) and Berkeley DB 4.6.21. I'll give you my slapd.conf file : # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # serverid 001 # Inclusion des schemas include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/donnees/etc/openldap/schema/microsoft.schema # Log level loglevel -1 # The maximum number of entries that is returned for a search operation sizelimit unlimited # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 # PID File pidfile /opt/donnees/var/run/slapd.pid argsfile /opt/donnees/var/run/slapd.args # Load dynamic backend modules: #modulepath /opt/openldap/lib #moduleload back_hdb #moduleload back_monitor moduleload rwm # Access control policy: access to attrs=userPassword by self write by anonymous auth by * none access to dn.base="" by * read access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,cn=config" write by users read by * none access to * by self write by dn="cn=admin,cn=config" write by * none # Configuration du backend backend hdb ####################################################################### # BDB database definitions ####################################################################### database monitor # Dynamic Config database config rootdn "cn=admin,cn=config" rootpw secret ####################################################################### # Configuration Proxy Active Directory database ldap suffix ou=proxy,dc=my-company,dc=meta rootdn "cn=admin,cn=config" subordinate uri ldap://192.168.44.88:389 lastmod off acl-authcDN cn=admin,cn=config acl-passwd secret idassert-bind bindmethod="simple" binddn="CN=srv_ldap,OU=Services-account,OU=Administration,dc=my-company,dc=local" credentials="Azerty00" mode="legacy" overlay rwm rwm-suffixmassage dc=my-company,dc=local rwm-map attribute uid sAMAccountName rwm-map attribute cn cn rwm-map attribute displayName displayName rwm-map attribute givenName givenName rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute userPassword userPassword rwm-map attribute * rwm-map objectclass inetOrgPerson user ####################################################################### # Configuration Annuaire technique (habilitations, partenaires, internautes) database hdb suffix "dc=my-company,dc=meta" rootdn "cn=admin,cn=config" directory "/opt/donnees/var/openldap-data" checkpoint 512 30 dbconfig set_cachesize 0 128000000 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass,entryCSN,entryUUID eq index uid pres,eq,sub index sn pres,eq,sub index mail pres,eq,sub index cn pres,eq,sub lastmod on When i install OpenLDAP on my server, i execute this commands : CPPFLAGS="-I/usr/local/BerkeleyDB.4.6/include" LDFLAGS="-L/usr/local/BerkeleyDB.4.6/lib" ./configure --prefix=/opt/openldap --enable-shared --enable-crypt=yes --enable-rewrite=yes --enable-bdb=yes --enable-hdb=yes --enable-ldap=mod --enable-meta=mod --enable-monitor=yes --enable-relay=mod --enable-overlays=yes --with-cyrus-sasl --with-threads=posix --with-tls=openssl make depend make make test make install What's wrong with my installation or my config file ? Is this error is an OpenLDAP bug ? Thank you for your help, Raphaël KISTER

3 2

changing userPassword from custom application
by Zdenek Styblik 15 Dec '09

15 Dec '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, let's open up old wounds. Ok, it sounds jerky, but I don't mean it. Anyway. As the subject suggests, my question is how to code application which allows user to change his password. Or better to ask, if there is some [to me] unknown LDAP function which figures out what password encryption [hash] is used and generates new hash of password, if application should have idea at all what kind of password encryption is used. I think this is just impossible. Login is one thing, changing password is another. Please, don't suggest using % slappasswd; for generating hash. This is really no good way to do it and also, % slappaswd; is not all knowing, or is it? Yeah, it could save up the need to code up for whatever hash is used, yet calling external application, which doesn't even have to be present at system since LDAP can be used over network, it's just no funky enough. Please, don't mind the tone if it doesn't look normal or neutral. There is no intention to be offensive or flame, but to get the answer and solution. So far, I've implemented functions for CRYPT and later for SSHA. Users can't choose what hash will be used - and of course, there is no such intention. The point is, I haven't figured out other way. And it's not just an application, but ldap-tools too. Add new user? Use % slappasswd; Changing password from cmd-line? Use % slappaswd; Regards, Zdenek PS: This question backtracks couple months back. I've tried to ask and clarify this, but ... let's say it got lost in the static :) - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAksmz6wACgkQ8MreUbSH7imZRACeNDO2aY29mWShGTh2PGoZhkcR MFUAn39UYxN2e5oOfLO09YHspCswOtNf =Ww+H -----END PGP SIGNATURE-----

4 8

stuck transactions?
by Peter Mogensen 15 Dec '09

15 Dec '09

Hi, I notice that when I run db4.8tat -t the Active Transaction list does not change very often. I would have expected it to not be the same twice. So I guess I have a lot of stuck transactions? I use back_hdb and slapd is under some load. Could this be related to the messages in the log: Dec 15 15:09:19 server1 slapd[32060]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 15 15:09:19 server1 slapd[32060]: conn=40803 op=18: attribute "entryCSN" index delete failure /Peter Active transactions: 80000003: running; pid/thread 32060/47089260848688; begin LSN: file/offset 0/0 80000004: running; pid/thread 32060/47089260848688; begin LSN: file/offset 0/0 80000006: running; pid/thread 32060/1127287120; begin LSN: file/offset 0/0 80000007: running; pid/thread 32060/1110501712; begin LSN: file/offset 0/0 80000008: running; pid/thread 32060/1118894416; begin LSN: file/offset 0/0 8000006b: running; pid/thread 32060/1135679824; begin LSN: file/offset 0/0 8000006d: running; pid/thread 32060/1088940368; begin LSN: file/offset 0/0 80000076: running; pid/thread 32060/1144072528; begin LSN: file/offset 0/0 80000077: running; pid/thread 32060/1152465232; begin LSN: file/offset 0/0 8000007c: running; pid/thread 32060/1160857936; begin LSN: file/offset 0/0 80000081: running; pid/thread 32060/1169250640; begin LSN: file/offset 0/0 80000082: running; pid/thread 32060/1177643344; begin LSN: file/offset 0/0 800000b7: running; pid/thread 32060/1186036048; begin LSN: file/offset 0/0 ....

2 2

Useless ldapwhoami behavior?
by Jaap Winius 15 Dec '09

15 Dec '09

Hi all, The utility of the "ldapwhoami" tool is a mystery to me. As opposed to the usual Unix "whoami" command, which prints the effective userid, "ldapwhoami" doesn't seem to print the matching LDAP DN... at least not for me. My test setup includes an OpenLDAP server and a separate client. The server's slapd.conf includes these ACLs: access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=umrk,dc=nl" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=umrk,dc=nl" write by * read My LDAP DIT includes an account for a normal user with a password. Without any problem I can use this to login to the client host, but when I want to test, or verify, the account's LDAP DN, all I get is this: ~$ ldapwhoami -x anonymous ~$ _ Even stranger, if I supply the account's DN and password (although this would seem a useless thing to do, since it's the very same info I'm asking for), I get this error: ~$ ldapwhoami -x -D "cn=testuser,dc=umrk,dc=nl" -w testpass ldap_bind: Invalid credentials (49) ~$ _ On the other hand, this does work if I supply the admin DN and password: ~$ ldapwhoami -x -D "cn=admin,dc=umrk,dc=nl" -w adminpass dn:cn=admin,dc=umrk,dc=nl ~$ _ The "ldapsearch" command is the same: I can get a response when binding anonymously ("-x"), as well as when binding as the admin user, but not when I use a normal user account, which results in the same error 49 as above. This behavior seems rather useless to me. Surely I've made a mistake somewhere. Can anyone say what it might be? Thanks, Jaap

6 6

Valid configure options for 2.4.20
by J. Landamore 14 Dec '09

14 Dec '09

I'm trying to build 2.4.20 so that it stores the userPassword attribute crypt'ed rather than in clear text - yes I know it violates the RFC. I tried ./configure --enable-crypt --disable-cleartext This compiled fine but failed test002-populate for bdb Is this a valid configuration and will it achieve what I want? Is it possible to store the userPassword attribute crypt'ed? Thanks John -- John Landamore Department of Computer Science University of Leicester University Road, LEICESTER, LE1 7RH J.Landamore(a)mcs.le.ac.uk Phone: +44 (0)116 2523410 Fax: +44 (0)116 2523604

3 2

ApacheDS + openLDAP
by bren norris 14 Dec '09

14 Dec '09

Anyone using Eclipse based ApacheDS for works with openLDAP? I get a socket closed everytime I try and add a custom objectclass to the DIT... but it works fine with Softerra LDAP administrator. Server is a aptitude installed Ubuntu Karmic release and I thought I'd tap your heads just incase I'm missing the "bleedingly obvious". Happy DAPin'

2 1

Many TCP connections
by Peter Mogensen 14 Dec '09

14 Dec '09

Hi, I tried to increase the number of simultaneous TCP connection to my slapd (to around 800) and was a little surprised to see the result. While slapd still answers very fast in ldapi:/// , TCP connections now takes a while to connect() and after that even longer to answer the query. I can see ldapsearch hanging waiting for response. Eventually it answers - after more than a minute. So it doesn't seem to be a load problem for the backend, but what could make TCP-connections that slow compared to ldapi:/// ? I have no FD limits. /Peter

1 0

proxied attributedescription inserted
by Alexander 'Leo' Bergolth 13 Dec '09

13 Dec '09

Hi! When running slaptest, slapcat or other related utilities, I keep getting 'PROXIED attributeDescription "OU" inserted.' warnings. Initially I thought that some schema definitions could be missing but as far as I can see, the core-schema should be OK. Maybe the problem is that the modifiersName (uid=leoadm,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at) of cn=config is outside of cn=config? Here is the snippet of slaptest output (debuglevel -1) where the errors occur: -------------------- 8< -------------------- backend_startup_one: starting "cn=config" ldif_read_file: read entry file: "/etc/openldap2.4/slapd.d/cn=config.ldif" => str2entry: "dn: cn=config [...] modifiersName: uid=leoadm,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at modifyTimestamp: 20091208164511Z " >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> >>> dnPretty: <cn=config> <<< dnPretty: <cn=config> >>> dnNormalize: <cn=config> <<< dnNormalize: <cn=config> >>> dnPretty: <uid=leoadm,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at> PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. <<< dnPretty: <uid=leoadm,OU=LDAPusers,DC=wu-wien,DC=ac,DC=at> >>> dnNormalize: <uid=leoadm,OU=LDAPusers,DC=wu-wien,DC=ac,DC=at> <<< dnNormalize: <uid=leoadm,OU=LDAPusers,DC=wu-wien,DC=ac,DC=at> <= str2entry(cn=config) -> 0x93a7ee4 -------------------- 8< -------------------- Any hints? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 1

TLS + SSL and openldap
by Bruno Steven 12 Dec '09

12 Dec '09

Hi, I am trying configure openldap work with tls , but I have two question about this, first when I use tls openldap use port 389 and ssl port 639 , is this correct ? Second How I can test connection between client and server, cryptography is working ? Thnaks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

7 10

Re: restrict host login based on group
by Adam Hough 12 Dec '09

12 Dec '09

There are other ways to populate the pam_groupdn that you have associated with each machine but those all correspond to some attribute in the user's profile. I have pam_groupdn setup like this /etc/ldap.conf: pam_groupdn cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com pam_member_attribute member cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com cn: <GROUP_NAME> objectClass: top objectClass: groupOfNames objectClass: labeledURIObject member: uid=nobody,ou=People, dc=domain,dc=com labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(host=<type of system>) labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(gidNumber=XXXX) So as you can see you can have as many labeledURI attributes as you want or need. I tend to use the host name function of what the host does. This is how my account profile would look: uid=<MYUSERID>,ou=People,dc=domain,dc=com host: "cluster" host: sysadmin So "cluster" is a compute cluster that we have and thus for all those machines the pam_groupdn cn="cluster",ou=Systems,dc=domain,dc=com, and for machines where only the sysadmins login to then pam_groupdn cn=sysadmin,ou=Systems,dc=domain,dc=com. As long as you can for a labeledURI: ldap:///ou=People,dc=domain,dc=com??one?<attribute>=<value>) type search you can use it to auto populate the group. Summary: * Do to not think of the host attribute as host = hostname but as host = type of machine and that you can have more then one labeledURI per group to help populate the group. * Use good gidNumbers for groups to help auto populate groupOfName style groups. - Adam On Wed, Dec 9, 2009 at 4:01 AM, Shamika Joshi <shamika.joshi(a)gmail.com>wrote: > Hi Adam, > I'm able to get host auth working by using host attribute.But the drawback > of that is everytime there a new machine, I have to add that host to all the > users I want to grant access to. If I decide to do it based on group > membership, I can use pam_groupdn but then it does not allow multiple group > entries there, plus it has to be managed on client side,which is even more > undesirable by any administrator. > > I went through this article but I'm not sure if it will work if I have some > members already associated with some groups. Like ldap1 & ldap2 members of > qagroup & ldap3 & ldap4 members of sysadmin, would this method allow me to > limit access based on their group membership?? if yes...could you briefly > explain with an example? > > Thank for your time in advance > Shamika > > > > On Wed, Dec 9, 2009 at 9:04 AM, Adam Hough <adam(a)gradientzero.com> wrote: > >> Here is is the write up that I read to figure out how to do setup to >> auto-restrict users to certain hosts. >> >> >> http://www.hurricanelabs.com/september2009_login_security_using_openldap_an… >> >> >> >> On Tue, Dec 8, 2009 at 4:40 PM, Howard Chu <hyc(a)symas.com> wrote: >> >>> Shamika Joshi wrote: >>> >>>> Thanks Howard, >>>> Could you point me to some good documentation or HowTos on that? >>>> >>> >>> Search the archives. I posted an example in here a few months ago. >>> http://www.openldap.org/lists/openldap-technical/200905/msg00108.html >>> >>> >>> -- >>> -- Howard Chu >>> CTO, Symas Corp. http://www.symas.com >>> Director, Highland Sun http://highlandsun.com/hyc/ >>> Chief Architect, OpenLDAP http://www.openldap.org/project/ >>> >> >> >

2 2

MUA that could address LDAP Groups ?
by Frank Bonnet 11 Dec '09

11 Dec '09

Hello I'm searching for a Mail User Agent that could send emails to all users living in a LDAP group. Anyone knows such program ? Thanks

1 0

syncrepl broke, connection loss
by Peter Mogensen 10 Dec '09

10 Dec '09

Hi, I've loaded my mirror mode setup with data and let it run for a few day, Both cn=config and the application database is mirrored. Only server1 is receiving writes from the application. OpenLDAP 2.4.20, BDB 4.8 After about 6 hours the mirror partly broke and I experience 3 symptoms: 1) The syncrepl connection from server1->server2 for the application database is missing and data only flows from server1 to server2 - not the other way. The cn=config connections exists. $ netstat -tna # shows tcp 0 0 192.168.0.102:636 0.0.0.0:* LISTEN tcp 8125 0 192.168.0.102:45535 192.168.0.101:636 ESTABLISHED tcp 0 0 192.168.0.102:636 192.168.0.101:34954 ESTABLISHED tcp 0 0 192.168.0.102:45537 192.168.0.101:636 ESTABLISHED Where it should show, something like: tcp 0 0 192.168.0.101:636 0.0.0.0:* LISTEN tcp 0 0 192.168.0.101:34954 192.168.0.102:636 ESTABLISHED tcp 261 0 192.168.0.101:33409 192.168.0.102:636 ESTABLISHED tcp 0 0 192.168.0.101:636 192.168.0.102:45537 ESTABLISHED tcp 0 0 192.168.0.101:636 192.168.0.102:33226 ESTABLISHED 2) Meanwhile the log on server1 says: Dec 8 02:04:03 server1 slapd[6863]: do_syncrepl: rid=004 rc -1 retrying Dec 8 02:05:03 server1 slapd[6863]: do_syncrepl: rid=004 rc -2 retrying Dec 8 02:06:03 server1 slapd[6863]: do_syncrepl: rid=004 rc -2 retrying etc... The first such entry appear around 6 hours after start of the mirror. 3) If I try to change cn=config with ldapmodify on either server, server1 will hang, not answering queries until I restart it. For instance, if I do: ---------- dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: None sync ----------- ... it'l hang. I was able to connect and search the database on both server, to both servers like (on server1), using client certs: ldapsearch -H ldaps://server2/ -YEXTERNAL -b cn=data,dc=example,dc=com -s sub -D cn=config '(cn=*)' + \* So it's not that the TCP connection can't be established. Which make me suspect that this is related to this thread: http://www.mail-archive.com/openldap-software@openldap.org/msg16028.html Now after 27 hours the connection finally came back by it self, and replication works both ways. The "rc -2 retrying" in the log on server1 stopped and was replaced by: Dec 8 15:39:34 server1 slapd[11177]: do_syncrepl: rid=004 rc -2 retrying Dec 8 15:40:34 server1 slapd[11177]: do_syncrepl: rid=004 rc -2 retrying Dec 8 15:42:15 server1 slapd[11177]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 8 15:47:05 server1 slapd[11177]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 8 15:47:05 server1 slapd[11177]: conn=15694 op=16: attribute "entryCSN" index delete failure Dec 8 15:47:06 server1 slapd[11177]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 8 15:47:06 server1 slapd[11177]: conn=15569 op=36: attribute "entryCSN" index delete failure ... and a bit more of the same. Trying to modify cn=config with ldapmodify still makes server1 (and ldapmodify) hang though. /Peter

3 7

OpenLDAP as a proxy/rewrite/remap to AD for nss_ldap
by Mikolaj Kucharski 09 Dec '09

09 Dec '09

Hi, I have Active Directory server, OpenLDAP server and a client machine. AD is based on Windows Server 2003, OpenLDAP is 2.3.43-3.el5 running on CentOS 5 i386, client machine is as well CentOS 5. Does OpenLDAP server in any version, allows me to rewrite/remap/merge results from: - Active Directory - internal LDAP database (or any database) to make them suitable to nss_ldap? AD doesn't have all attributes which are needed by nss_ldap, so I thought to keep internal LDAP database with missing information (uidNumber, loginShell, etc) and merge, rewrite, remap or meta this information, and then give that result to the nss_ldap. I understand that it is possible to merge with slapd-meta different DIT from different databased as a single DIT, but what I need here is to merge attributes from one db, with second db (Active Directory), then rewrite that, and finaly return result to the querying client. What I mean is, is it possible to rewrite/remap results from AD which look like that: # (sAMAccountName=kucharskim) dn: CN=kucharskim,CN=Users,DC=euops,DC=lan objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: kucharskim distinguishedName: CN=kucharskim,CN=Users,DC=euops,DC=lan instanceType: 4 whenCreated: 20091117183353.0Z whenChanged: 20091117183353.0Z uSNCreated: 15484 uSNChanged: 15488 name: Mikolaj Kucharski objectGUID:: PLah511UiUKib3pt8HCJ+g== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 129041574477164624 lastLogoff: 0 lastLogon: 129046275442578437 pwdLastSet: 129029564332783194 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAA1MNb9pJhAvyslWmgfAcAAA== accountExpires: 9223372036854775807 logonCount: 9 sAMAccountName: kucharskim sAMAccountType: 805306368 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=euops,DC=lan memberOf: CN=testgroup,CN=ActiveDirectoryGroups,DC=euops,DC=lan with pieces missing from another ldap db, to something like that: # (uid=kucharskim) dn: uid=kucharskim,ou=People,dc=ldapdomain,dc=lan uid: kucharskim cn: Mikolaj Kucharski objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12561 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 10207 gidNumber: 10207 homeDirectory: /home/kucharskim gecos: Mikolaj Kucharski # (memberUid=kucharskim) dn: cn=testgroup,ou=Groups,dc=ldapdomain,dc=lan objectClass: posixGroup objectClass: top cn: testgroup gidNumber: 50201 memberUid: kucharskim memberUid: ldapuser1 memberUid: ldapuser2 I see that this is something overly complicated, but I wanted to know is that possible. If it is, could someone give me which version of OpenLDAP supports it and where I can read how to implement that. Thank you. -- best regards q#

3 2

Query performance degrades over time.
by Laurence Field 09 Dec '09

09 Dec '09

Hi, We are experiencing a decay in query performance over time using OpenLDAP 2.3.43 on CentOS 5. After populating the database with about 70 000 entries, the query response time for one entry is about 0.4s. After about two hours the same query takes over 1s. The slapd.conf file and DB_CONFIG files that we use can be found at the following URLs. http://svnweb.cern.ch/trac/gridinfo/browser/bdii/trunk/etc/bdii-slapd.conf http://svnweb.cern.ch/trac/gridinfo/browser/bdii/trunk/etc/DB_CONFIG Does anyone have an idea about what is happening. Thanks Laurence

8 13

100% CPU loading
by Bad Guy 09 Dec '09

09 Dec '09

Dear all, We have been setup a 4 ways multi-master replication openldap version 2.4.11. It has been running for a year. However, recently, we find that one of the server has 100% high CPU and all the replication can't be replicated to that server. After restart the slapd process, it can be resumed normal. But afraid that high CPU will occur again. What changes recently is that we just added 1 field in the schema file in all the 4 servers, there is no other things changed. Any idea of the high CPU ? What data should be collected in case high CPU occurs again ? Thanks _________________________________________________________________ 嶄新的 Windows 7：找出適合您的電腦。深入了解。 http://windows.microsoft.com/shop

3 4

ldapsearch filter and
by Jeff Huang 09 Dec '09

09 Dec '09

Hi all. How to set a filter to connect tow entrys like SQL of database? For example. entry 1: dn:ou=p,o=test ou=p status=active entry 2: dn:cn=1,ou=p,o=test uid=1 status=active result=test1 entry 3: dn:cn=2,ou=p,o=test uid=2 status=inactive result=test2 I need to do a search and the result is: if the entry1's status=active,then research other entry using the query attribute=uid. if the entry1's status=inactive,the the research returen null result. How can I do this search? And if it can do,how to set the ldap.conf located /etc/ldap.conf?

1 0

openldap-2.4.20 installation
by vishesh kumar 09 Dec '09

09 Dec '09

Dear friends Today i tried to install openldap2.4.20 on RHEL 5.2. After firing ./configure script, i got following error *Configure:error: Berkeley DB version incomptible with BDB/HDB backend. *But after investigation i found that db4 with version 4.3.29 is installed on my system. So what i should do now, Should i replace my Berkeley DB package? I want to be sure that other running programs not get any issue after bdb upgradation. How one know which bdb version is required by current openldap package ? thanks * -- * http://linuxinterviews.blogspot.com

4 4

restrict host login based on group
by Serge Fonville 09 Dec '09

09 Dec '09

Hi, While setting up an LDAP server. I noticed that it is not possible to add a host attribute to a posixGroup. Is there a way to limit a user what host they can logon to based on their group membership? Thanks in advance Regards, Serge Fonville -- http://www.sergefonville.nl Convince Google!! They need to support Adsense over SSL https://www.google.com/adsense/support/bin/answer.py?hl=en&answer=10528 http://www.google.com/support/forum/p/AdSense/thread?tid=1884bc9310d9f923&h…

6 11

How To set things up to allow users to change their passwords
by Robert Heller 08 Dec '09

08 Dec '09

I have Openldap set up on a CentOS 5 system (using the stock 2.3.43 RPMS) and I want to allow users to change their passwords, but I am confused by the documentation (it has both too much and not enough information -- there don't appear to be simple HowTos for common setups). I am not sure what to put in /etc/openldap/slapd.conf (I think I need an ACL). I expect I need something in /etc/openldap/ldap.conf (or prossibly /etc/ldap.conf) to allow the authorization. This is on a LAN with diskless clients, behind a firewall, so I *probably* don't need to set up SSL and certs (but I am unsure of this as well). -- Robert Heller -- 978-544-6933 Deepwoods Software -- Download the Model Railroad System http://www.deepsoft.com/ -- Binaries for Linux and MS-Windows heller(a)deepsoft.com -- http://www.deepsoft.com/ModelRailroadSystem/

8 16

Password policy : Check_password module for debian
by Smaïne Kahlouch 08 Dec '09

08 Dec '09

Hi, I would like to know how to use the check_password module that comes with the ppolicy overlay. A rpm package exists but i didn't find a debian one. I could compile it but i don't understand how to use the different options. Is there somebody that figured out how to use it on debian ? Do you know a good howto for debian ? thanks, Grifith

2 2

relay backend and dynlist overlay
by Alexander 'Leo' Bergolth 08 Dec '09

08 Dec '09

Hi! I'd like to use the relay backend to make a whole database suffix available under a different naming context because of a domain name change. So far everything works fine except for entries that have attributes expanded by the dynlist overlay. Those entries are not shown at all in the virtual naming context. (Not even those attributes that are not created dynamically, only an empty dn is shown for those entries.) # real naming context: -------------------- 8< -------------------- $ ldapsearch -LLL -h bach-s49 -b 'dc=wu-wien,dc=ac,dc=at' -x '(cn=dynlisttest)' dn: cn=dynlisttest,ou=LDAPgroups,dc=wu-wien,dc=ac,dc=at objectClass: wuDynGroupOfNames objectClass: groupOfURLs objectClass: top cn: dynlisttest memberURL: ldap:///dc=wu-wien,dc=ac,dc=at??sub?(&(objectclass=wuPerson)(uid=be rgolth*)) member: uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at member: uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at -------------------- 8< -------------------- # virtual naming context: -------------------- 8< -------------------- $ ldapsearch -LLL -h bach-s49 -b 'dc=wu,dc=ac,dc=at' -x '(cn=dynlisttest)' dn: -------------------- 8< -------------------- # dynlist config: -------------------- 8< -------------------- dn: olcOverlay={0}dynlist,olcDatabase={1}bdb,cn=config objectClass: olcDynamicList objectClass: olcOverlayConfig olcOverlay: {0}dynlist olcDlAttrSet: {0}posixGroup labeledURI memberUid:uid olcDlAttrSet: {1}wuDynGroupOfNames memberURL member -------------------- 8< -------------------- I have attached the debug output of the second ldapsearch. I'd appreciate any hints! Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 1 descriptor Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: slap_listener_activate(7): Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 busy Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: >>> slap_listener(ldap:///) Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: listen=7, new connection on 15 Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: added 15r (active) listener=(nil) Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 fd=15 ACCEPT from IP=137.208.89.100:39246 (IP=0.0.0.0:389) Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 2 descriptors Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: 15r Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: read active on 15 Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: connection_get(15) Dec 7 14:09:13 bach-s49 slapd[18802]: connection_get(15): got connid=4 Dec 7 14:09:13 bach-s49 slapd[18802]: connection_read(15): checking for input on id=4 Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=0 do_bind Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <>, <> Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=0 BIND dn="" method=128 Dec 7 14:09:13 bach-s49 slapd[18802]: do_bind: version=3 dn="" method=128 Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_result: conn=4 op=0 p=3 Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_result: err=0 matched="" text="" Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_response: msgid=1 tag=97 err=0 Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=0 RESULT tag=97 err=0 text= Dec 7 14:09:13 bach-s49 slapd[18802]: do_bind: v3 anonymous bind Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 1 descriptor Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 1 descriptor Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: 15r Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: read active on 15 Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: connection_get(15) Dec 7 14:09:13 bach-s49 slapd[18802]: connection_get(15): got connid=4 Dec 7 14:09:13 bach-s49 slapd[18802]: connection_read(15): checking for input on id=4 Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=1 do_search Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <dc=wu,dc=ac,dc=at>, <dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: SRCH "dc=wu,dc=ac,dc=at" 2 0 Dec 7 14:09:13 bach-s49 slapd[18802]: 0 0 0 Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: filter: (cn=dynlisttest) Dec 7 14:09:13 bach-s49 slapd[18802]: attrs: Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=1 SRCH base="dc=wu,dc=ac,dc=at" scope=2 deref=0 filter="(cn=dynlisttest)" Dec 7 14:09:13 bach-s49 slapd[18802]: ==> limits_get: conn=4 op=1 self="[anonymous]" this="dc=wu,dc=ac,dc=at" Dec 7 14:09:13 bach-s49 slapd[18802]: [rw] searchDN: "dc=wu,dc=ac,dc=at" -> "dc=wu-wien,dc=ac,dc=at" Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <dc=wu-wien,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <dc=wu-wien,dc=ac,dc=at>, <dc=wu-wien,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: str2filter "(cn=dynlisttest)" Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_search Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_dn2entry("dc=wu-wien,dc=ac,dc=at") Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "dc=wu-wien,dc=ac,dc=at" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: search_candidates: base="dc=wu-wien,dc=ac,dc=at" (0x00000001) scope=2 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_dn2idl("dc=wu-wien,dc=ac,dc=at") Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_list_candidates 0xa0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: OR Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_list_candidates 0xa1 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_equality_candidates (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => key_read Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_idl_fetch_key: [b49d1940] Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_index_read: failed (-30988) Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_equality_candidates: id=0, first=0, last=0 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=0 first=0 last=0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_equality_candidates (cn) Dec 7 14:09:13 bach-s49 slapd[18802]: => key_read Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_idl_fetch_key: [35ac39fc] Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_index_read 1 candidates Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_equality_candidates: id=1, first=2233, last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=1 first=2233 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_list_candidates: id=1 first=2233 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=1 first=2233 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_list_candidates: id=1 first=2233 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=1 first=2233 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_search_candidates: id=1 first=2233 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "cn=dynlisttest,ou=LDAPgroups,dc=wu-wien,dc=ac,dc=at" "cn" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr cn Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (cn) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "cn=dynlisttest,ou=LDAPgroups,dc=wu-wien,dc=ac,dc=at", attr "cn" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr cn Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (cn) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "cn=dynlisttest,ou=LDAPgroups,dc=wu-wien,dc=ac,dc=at", attr "cn" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <dc=wu-wien,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <dc=wu-wien,dc=ac,dc=at>, <dc=wu-wien,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: str2filter "(&(!(objectClass=posixGroup))(&(objectclass=wuPerson)(uid=bergolth*)))" Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter_list Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: NOT Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter_list Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_filter Dec 7 14:09:13 bach-s49 slapd[18802]: SUBSTRINGS Dec 7 14:09:13 bach-s49 slapd[18802]: begin get_ssa Dec 7 14:09:13 bach-s49 slapd[18802]: INITIAL Dec 7 14:09:13 bach-s49 slapd[18802]: end get_ssa Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter_list Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter_list Dec 7 14:09:13 bach-s49 slapd[18802]: end get_filter 0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_search Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_dn2entry("dc=wu-wien,dc=ac,dc=at") Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "dc=wu-wien,dc=ac,dc=at" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: search_candidates: base="dc=wu-wien,dc=ac,dc=at" (0x00000001) scope=2 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_dn2idl("dc=wu-wien,dc=ac,dc=at") Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_list_candidates 0xa0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: OR Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_list_candidates 0xa1 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_equality_candidates (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => key_read Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_idl_fetch_key: [b49d1940] Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_index_read: failed (-30988) Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_equality_candidates: id=0, first=0, last=0 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=0 first=0 last=0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_list_candidates 0xa0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: NOT Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=-1 first=1 last=2233 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_list_candidates 0xa0 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_equality_candidates (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => key_read Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_idl_fetch_key: [0031ceb6] Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_index_read 1851 candidates Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_equality_candidates: id=1851, first=4, last=2232 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=1851 first=4 last=2232 Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_filter_candidates Dec 7 14:09:13 bach-s49 slapd[18802]: SUBSTRINGS Dec 7 14:09:13 bach-s49 slapd[18802]: => bdb_substring_candidates (uid) Dec 7 14:09:13 bach-s49 slapd[18802]: => key_read Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_idl_fetch_key: [a5239cdb] Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_index_read 3 candidates Dec 7 14:09:13 bach-s49 slapd[18802]: => key_read Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_idl_fetch_key: [09e3cb6a] Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_index_read 2 candidates Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_substring_candidates: 2, first=35, last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_list_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_list_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_list_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_list_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: <= bdb_filter_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: bdb_search_candidates: id=2 first=35 last=1950 Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter_and Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: NOT Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 5 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter_and Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: SUBSTRINGS Dec 7 14:09:13 bach-s49 slapd[18802]: begin test_substrings_filter Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" "uid" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr uid Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (uid) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "uid" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr uid Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (uid) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "uid" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter_and 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter_and 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access to "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access to "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter_and Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: NOT Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at" "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 5 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: AND Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter_and Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: EQUALITY Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at" "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr objectClass Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (objectClass) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "objectClass" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to value by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: => test_filter Dec 7 14:09:13 bach-s49 slapd[18802]: SUBSTRINGS Dec 7 14:09:13 bach-s49 slapd[18802]: begin test_substrings_filter Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access to "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at" "uid" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr uid Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (uid) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "uid" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr uid Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (uid) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "uid" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: search access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter_and 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter_and 6 Dec 7 14:09:13 bach-s49 slapd[18802]: <= test_filter 6 Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access to "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access to "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: dnMatch -5 "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" "uid=bergolth2,ou=ldapusers,dc=wu-wien,dc=ac,dc=at" Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_result: conn=4 op=1 p=3 Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_result: err=0 matched="" text="" Dec 7 14:09:13 bach-s49 slapd[18802]: [rw] searchEntryDN: "cn=dynlisttest,ou=LDAPgroups,dc=wu-wien,dc=ac,dc=at" -> "cn=dynlisttest,ou=LDAPgroups,dc=wu,dc=ac,dc=at" Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <cn=dynlisttest,ou=LDAPgroups,dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <cn=dynlisttest,ou=LDAPgroups,dc=wu,dc=ac,dc=at>, <cn=dynlisttest,ou=ldapgroups,dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: [rw] searchAttrDN: "uid=bergolth,ou=users,dc=wu-wien,dc=ac,dc=at" -> "uid=bergolth,ou=users,dc=wu,dc=ac,dc=at" Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <uid=bergolth,ou=users,dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <uid=bergolth,ou=users,dc=wu,dc=ac,dc=at>, <uid=bergolth,ou=users,dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: [rw] searchAttrDN: "uid=bergolth2,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at" -> "uid=bergolth2,ou=LDAPusers,dc=wu,dc=ac,dc=at" Dec 7 14:09:13 bach-s49 slapd[18802]: >>> dnPrettyNormal: <uid=bergolth2,ou=LDAPusers,dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: <<< dnPrettyNormal: <uid=bergolth2,ou=LDAPusers,dc=wu,dc=ac,dc=at>, <uid=bergolth2,ou=ldapusers,dc=wu,dc=ac,dc=at> Dec 7 14:09:13 bach-s49 slapd[18802]: => send_search_entry: conn 4 dn="(null)" Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access to "(null)" "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [1] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "(null)", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] applying +0 (break) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [2] mask: =0 Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_get: [5] attr entry Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: result not in cache (entry) Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: access to entry "(null)", attr "entry" requested Dec 7 14:09:13 bach-s49 slapd[18802]: => acl_mask: to all values by "", (=0) Dec 7 14:09:13 bach-s49 slapd[18802]: <= check a_dn_pat: * Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 7 14:09:13 bach-s49 slapd[18802]: <= acl_mask: [1] mask: read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => slap_access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: => access_allowed: read access granted by read(=rscxd) Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=1 ENTRY dn="(null)" Dec 7 14:09:13 bach-s49 slapd[18802]: <= send_search_entry: conn 4 exit. Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_result: conn=4 op=1 p=3 Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_result: err=0 matched="" text="" Dec 7 14:09:13 bach-s49 slapd[18802]: send_ldap_response: msgid=2 tag=101 err=0 Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 1 descriptor Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 1 descriptor Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: 15r Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: read active on 15 Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: connection_get(15) Dec 7 14:09:13 bach-s49 slapd[18802]: connection_get(15): got connid=4 Dec 7 14:09:13 bach-s49 slapd[18802]: connection_read(15): checking for input on id=4 Dec 7 14:09:13 bach-s49 slapd[18802]: ber_get_next on fd 15 failed errno=0 (Success) Dec 7 14:09:13 bach-s49 slapd[18802]: connection_read(15): input error=-2 id=4, closing. Dec 7 14:09:13 bach-s49 slapd[18802]: connection_closing: readying conn=4 sd=15 for close Dec 7 14:09:13 bach-s49 slapd[18802]: connection_close: deferring conn=4 sd=15 Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=2 do_unbind Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 op=2 UNBIND Dec 7 14:09:13 bach-s49 slapd[18802]: connection_resched: attempting closing conn=4 sd=15 Dec 7 14:09:13 bach-s49 slapd[18802]: connection_close: conn=4 sd=15 Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: removing 15 Dec 7 14:09:13 bach-s49 slapd[18802]: conn=4 fd=15 closed Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on 1 descriptor Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: activity on: Dec 7 14:09:13 bach-s49 slapd[18802]: Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=7 active_threads=0 tvp=zero Dec 7 14:09:13 bach-s49 slapd[18802]: daemon: epoll: listen=8 active_threads=0 tvp=zero

2 1

userPassword encryption
by Alex Naranjo 07 Dec '09

07 Dec '09

Hi: My problem is the following i need to store user password in an openldap server but the user password can not be encrypted. I know that openldap use hashing algothitm to store this attribute and that i can use clear text, but i want to store user password using a reversible algorithm not clear text. The Active directory accounts has an option (Store Password using Reversible Encryption) that permit this. Is there any option like this in an openldap server? PD: Forgive me my english my native languaje is spanish...

3 2

gidNumber attribute inside group & member
by Shamika Joshi 07 Dec '09

07 Dec '09

Hi all, I need some clarification regarding how permissions of members are taken care when they login to a client machine. As I understand "gidNumber" that I give while creating group entry(like "gidNumber" "4" for "qagroup", which refers to "gid" of "adm" group on a linux machine /etc/group), so permissions of that group are assigned to members of "qagroup" i.e. ldap1 & ldap2 when they login to any client. Is that correct? It is confusing because, members ldap1 & ldap2 belong to posixAccount objectclass which also requires gidNumber as required attribute. So does gidNumber values mentioned in member's entry get overwritten by gidNumber attribute inside their group i.e "qagroup"? What about the case where single member is added to multiple groups? what permissions does the member get when he logs on to particular machine? ldif input: dn: uid=ldap1,ou=Users,dc=test,dc=com objectClass: posixAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person homeDirectory: /home/ldap1 loginShell: /bin/bash cn: ldap1 uidNumber: 10000 gidNumber: 500 <============= sn: ldap1 mobile: 987777787 physicalDeliveryOfficeName: ravi userPassword: ldap1 uid: ldap1 dn: cn=qagroup,ou=Groups,dc=test,dc=com cn: qagroup gidNumber: 4 <=============== objectClass: posixGroup memberUid: uid=ldap1,ou=Users,dc=test,dc=com memberUid: uid=ldap2,ou=Users,dc=test,dc=com Thanks in advance Shamika

2 2

listener question
by DT Piotr Wadas 06 Dec '09

06 Dec '09

Hello, I'm using openldap 2.4.17. slapd -h option specifies the set of local IP addresses for slapd to listen on. Is there a way to specify client address with syncrepl mirror mode ? I reviewed syncrepl directive options in manual and seems there isn't for now. Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd 8.3.6-(api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

3 2

Two contextCSNs
by Peter Mogensen 06 Dec '09

06 Dec '09

I'm trying to understand why changes made to SID 1 in my mirror set while SID 2 is down does not get propagated to SID 2 when it comes up. I did another test, resulting in SID 2 having two contextCSNs: root object: entryCSN: 20091204151327.370998Z#000000#001#000000 contextCSN: 20091204151327.735435Z#000000#001#000000 contextCSN: 20091204151430.680725Z#000000#002#000000 However, no changes has been made to server2. Only to server1. No entry has the CSN with sid=002. Is this expected? /Peter

4 12

changing samba and ldap password at the same time
by Marc Mertes 05 Dec '09

05 Dec '09

Hi everybody, I have a small question. I have here a samba domain authenticating with ldap. If I now change the password for the regular LDAP user, it would be fine if the samba password would be changed at the same time. Can I do that with ldappasswd as well, and if yes, which parameters I need? Or do I still need smbpasswd to change it? It would be great to do that 2in1 like.. Thx and regards Marc

3 4

Authentication failed with ldaps configuration
by smainklh＠free.fr 04 Dec '09

04 Dec '09

Hi everyone, I configured my ldap server (debian lenny) to listen on port 636 (ldaps) but it doesn't seems to work when issuing a remote connexion. Perhaps i did a mistake when generating the certificates ?.... When i try to browse the ldap server from a remote server i get the following message : ---------- root@vmtest:~# ldapsearch -d 1 -Wx -H ldaps://ldapserver.domain.tld -D cn=admin,dc=domain,dc=tld ldap_url_parse_ext(ldaps://ldapserver.domain.tld) ldap_create ldap_url_parse_ext(ldaps://ldapserver.domain.tld:636/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldapserver.domain.tld:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.10.48.40:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: peer cert untrusted or revoked (0x42) ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) ----------- I generated the certificates with the following command : # openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 3650 ----------- Then i tried the connexion : openssl s_client -connect ldapserver.domain.tld:636 -showcerts CONNECTED(00000003) depth=0 /C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld verify error:num=18:self signed certificate verify return:1 depth=0 /C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld verify return:1 --- Certificate chain 0 s:/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld i:/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld -----BEGIN CERTIFICATE----- MIIDDTCCAnagAwIBAgIJAM7IwuTIzhwqMA0GCSqGSIb3DQEBBQUAMGMxCzAJBgNV BAYTAkZSMRMwEQYDVQQIEwpTb21lLVN0YXRlMQ4wDAYDVQQHEwVQYXJpczELMAkG A1UEChMCQlQxIjAgBgNVBAMTGWlwb2MwMS5pcG9jLmJ0c2VydmljZXMuZnIwHhcN MDkxMTI0MTUwMTUxWhcNMTkxMTIyMTUwMTUxWjBjMQswCQYDVQQGEwJGUjETMBEG A1UECBMKU29tZS1TdGF0ZTEOMAwGA1UEBxMFUGFyaXMxCzAJBgNVBAoTAkJUMSIw IAYDVQQDExlpcG9jMDEuaXBvYy5idHNlcnZpY2VzLmZyMIGfMA0GCSqGSIb3DQEB AQUAA4GNADCBiQKBgQCm5FrQ3dN1Jkxj2SZsPr+vkYDlwVnvqDCxnAs3O5NJ/1uY F9/mwsCVdAnp04Eywo3BCbvP6tlzsF3JbAlqMLTb85ZTHOqRQncXGfVZ7bMnR071 tQ70/b3vF/TuMYiOU7vXf2h863aRi11tT9xHD17wFfFaXBtRIIOioc3UpJWWPwID AQABo4HIMIHFMB0GA1UdDgQWBBREqX/HQEzU5TCDrBsbttUxa44fnDCBlQYDVR0j BIGNMIGKgBREqX/HQEzU5TCDrBsbttUxa44fnKFnpGUwYzELMAkGA1UEBhMCRlIx EzARBgNVBAgTClNvbWUtU3RhdGUxDjAMBgNVBAcTBVBhcmlzMQswCQYDVQQKEwJC VDEiMCAGA1UEAxMZaXBvYzAxLmlwb2MuYnRzZXJ2aWNlcy5mcoIJAM7IwuTIzhwq MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAd0Le1JyJF8zBs0RYvEn7 c1nhVbsdD8FDBTa4IaNvkbIt8al6G7bBpfyDxcMVtgFc8zHt/+sYfTxWuHh7m+b1 yjJtD9vMjIigbaZq4VJOz11JEWsQHc8wo3So+G+CelTz4HXPoGh5vqRtTkupjedz 0DDsA1jd9F4KpYSOkzxosdc= -----END CERTIFICATE----- --- Server certificate subject=/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld issuer=/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld --- No client certificate CA names sent --- SSL handshake has read 1107 bytes and written 316 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 9EF5F2D4FD72A0D1161C8334537F1ADF60C8B790A3F699B6DC52557E3C95D427 Session-ID-ctx: Master-Key: 015D50D6D93F502E37EDB577691F05D157E80A439A2B129B370EEA24E651E828A172E43B3F6D29174BF33B96193202F0 Key-Arg : None Start Time: 1259761586 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- ------------------ My ldap.conf ----------------- BASE dc=domain,dc=tld URI ldaps://ldapserver.domain.tld/ TLS_REQCERT allow My slapd.conf : ---------------- ... TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem ... ------------------ My /etc/default/slapd.conf ... SLAPD_SERVICES="ldaps://ldapserver.domain.tld" ... Could you please help me ?

4 6

bootstrapping mirrormode
by Peter Mogensen 04 Dec '09

04 Dec '09

Previously I described problems when using this procedure to bootstrap a mirrormode pair with a large LDIF. I've reproduced it with a much smaller subset of the database, and there must be something wrong with the procedure or a bug. What I do is: 1) Took an slapcat generated LDIF from a 2.3.x setup 2) Removed all entryCSN and contextCSN lines. 3) Ran "slapadd -S 1 -q -w -l ~/load_noCSN.ldif" on server-1 4) Did a "slapcat > toserver2.ldif" on server-1 5) Started server-1 and let applications create and modify objects. 6) Moved toserver2.ldif to server-2. 7) Ran slapadd -q -l toserver2.ldif on server-2 8) Started server-2 Now - I would expect the objects created on step 5 to appear after a while on server-2. They are not. However, objects created on server-1 after both servers has been started are replicated. I would suspect a problem with the index created with slapadd, (olcLinearIndex is FALSE), so syncrepl only finds entries created via LDAP. But I see no reason why. ldapsearch can read the entries. /Peter

2 8

OpenLDAP with SSL
by Chamith Kumarage 04 Dec '09

04 Dec '09

Hi Folks, I have setup openldap with SSL and i'm using self signed certs. I have included the following in my slapd.conf. TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem TLSVerifyClient demand and in my ldap.conf I have; HOST <my_ip> PORT 636 TLS_REQCERT /etc/ldap/ssl/server.pem When I start the service, I see port 636 is up and I can even telnet to it. But I cannot perform any ldap operations there. Any help would be appreciated! Thanks, ~Chamith

4 4

OpenLDAP 2.4.16 hanging - ideas welcome
by J. Landamore 03 Dec '09

03 Dec '09

We run 4 2.4.16 servers as 2 provider/consumer pairs, one pair for our staff systems and one pair for our teaching facilities. They are all on Solaris10u7 xen virtual hosts. The staff pair run fine The consumer on the teaching pair runs fine The provider on the teaching pair runs fine until it gets hit by a heavy load, eg start of a lab when ~100 PCs try and authenticate their user. At this point it refuses to serve LDAP requests. Traffic is still coming in to the box and existing connections seem OK. The break point is about 35PCs, below that there isn't a problem. Restarting slapd cures the problem and off we go until the start of the next big lab. I've run at various log levels but not been able to see any obvious messages. All I see, even when everything is fine, are messages of the form send_search_entry: conn 11639 ber write failed. connection_read(38): no connection! The slapd.conf (minux the syncprov bit) is: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/duaconf.schema include /usr/local/etc/openldap/schema/local.schema pidfile /var/openldap/run/slapd.pid argsfile /var/openldap/run/slapd.args conn_max_pending 200 idletimeout 60 sizelimit 2000 loglevel 256 database bdb suffix "dc=my,dc=domain" rootdn "cn=me,dc=my,dc=domain" rootpw {SSHA}guess directory /var/openldap/openldap-data index cn,entryCSN,entryUUID,gidNumber,ipHostNumber,memberUid eq index objectclass,uid,uidNumber,uniqueMember eq cachefree 16 cachesize 1500 checkpoint 0 60 dncachesize 1500 idlcachesize 3000 access to attrs=userPassword by self write by anonymous auth by dn.base="cn=fred,ou=Profile,dc=my,dc=domain" read by * none access to * by self write by users read by * read The only entry in DB_CONFIG is set_cachesize 0 26214400 0 cache hits are at 99% I'm stumped for a cause/solution, can anyone either give me a pointer as to what to look for in the logs or suggest a possible cause. Could it be hitting the 256 open file limit? Thanks -- John Landamore Department of Computer Science University of Leicester University Road, LEICESTER, LE1 7RH J.Landamore(a)mcs.le.ac.uk Phone: +44 (0)116 2523410 Fax: +44 (0)116 2523604

2 1

Re: How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

> --On Thursday, December 03, 2009 10:49 AM -0700 Michael March > <mmarch(a)gmail.com> wrote: > > >> ... also from the slapadd man page: >> >> "As slapadd is designed to accept LDIF in database order, as produced >> by slapcat(8), it does not verify that superior entries exist before >> adding an entry, does not perform all user and system schema checks, >> and does not maintain operational attributes (such as createTimeStamp >> and modifiersName). " > > That statement is incorrect, and has been corrected in modern releases > (2.4.x). Old 2.3.x man pages have the statement, but were not correct. > > <http://www.openldap.org/software/man.cgi?query=slapadd&apropos=0&sektion=0&…> Yup.. I confirmed this and you are correct.. I'm good now. thanks!

1 0

How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

I need to move all the data from one OpenLDAP instance to another (including operational attributes). What is the best way to do that? My first thought was to tar up all the file in /var/lib/openldap (on Centos) and move that data over but that doesn't seem to be working. Specifically, slapd will not start and no errors are spitting out. Any ideas? Thanks!

8 10

Re: How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

On Thu, Dec 3, 2009 at 10:43 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 03, 2009 9:36 AM -0700 Michael March > <mmarch(a)gmail.com> wrote: > >> Thanks for the response. >> >>> On Thursday, 3 December 2009 11:06:54 Michael March wrote: >>>> >>>> I need to move all the data from one OpenLDAP instance to another >>>> (including operational attributes). What is the best way to do that? >>> >>> slapcat;scp;slapadd >> >> Unfortunately slapadd doesn't maintain operational attributes. > > What in the world are you talking about? slapcat and slapadd maintain all > the attributes in the entry... Every time I import the output from slapcat I have to run the stream through this sed script to strip out operational attributes: /^creatorsName: /d /^createTimestamp: /d /^modifiersName: /d /^modifyTimestamp: /d /^structuralObjectClass: /d /^entryUUID: /d /^entryCSN: /d /^pwdHistory: /,+1d /^pwdChangedTime: /d /^pwdFailureTime: /d ... also from the slapadd man page: "As slapadd is designed to accept LDIF in database order, as produced by slapcat(8), it does not verify that superior entries exist before adding an entry, does not perform all user and system schema checks, and does not maintain operational attributes (such as createTimeStamp and modifiersName). "

2 1

Chaining problem
by Joe Friedeggs 03 Dec '09

03 Dec '09

I have a master-slave configuration, sync'ed with syncrepl. Most of my LDAP clients connect directly to the slave servers. Some of my client can handle referrals, but others cannot. For this reason, I use the 'chain' overlay. The configuration works fine when I have 'pam_password clear' in my clients' ldap.conf. But with 'pam_password md5', the clients are not sending the control messaging for ppolicy. This seems to be a pam_ldap issue, but I cannot seem to track it down and correct it. It has been suggested that I use the 'pam_password exop' option on the clients as a work-around for the pam_ldap issue. Doing this, I get hashed passwords, as well as correct ppolicy control messaging, and everything works fine doing this in my other (lab) scenario where I am not required to use chaining. BUT, in my chaining config, when the user makes a password change, instead of the user's password being changed, the chain's bind password is changed. NOTE: I do not employ SASL. Is this configuration supported? Anyone know why the chain's bind password would be getting changed, instead of the user's? Thanks, Joe _________________________________________________________________ Windows Live Hotmail gives you a free,exclusive gift. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

5 6

Re: changing samba and ldap password at the same time
by Luca Scamoni 02 Dec '09

02 Dec '09

you could use smbk5pwd overlay it's in contrib check out the source >----- Original Message ----- >From: mertes(a)uni-bonn.de >To: openldap-technical(a)openldap.org >Data: Wed, 02 Dec 2009 11:09:55 +0100 >Subject: changing samba and ldap password at the same time >Hi everybody, >I have a small question. > >I have here a samba domain authenticating with ldap. >If I now change the password for the regular LDAP user, it would be fine >if the samba password would be changed at the same time. Can I do that >with ldappasswd as well, and if yes, which parameters I need? >Or do I still need smbpasswd to change it? > >It would be great to do that 2in1 like.. > >Thx and regards Marc > > -- Luca Scamoni Gruppo Partners Associates Tel. Milano +39 02 67380435 - Udine +39 0432 689815 - Roma +39 06 54832300 Fax Milano +39 02 67386214 - Udine +39 0432 570120 - Roma +39 06 91659273 Cell. +39 348 0471710 Email: Luca.Scamoni(a)GruppoPA.it Sito: www.GruppoPA.it Prima di stampare, pensa all'ambiente ** Think about the environment before printing

1 0

Re: Search responses with incorrect msgId
by Eduardo Ramos Testillano 02 Dec '09

02 Dec '09

>Hi all, > >My application is an ldap client based on openLdap suite. I'm having >problems when receiving search responses with incorrect msgId. >The problem is: always returns error -1 being impossible to discriminate >other situations like remote server close. >The application always detach the connection fd when -1 is received (99% >is broken connection). >But we don't want to do close this when "receive a search response with >out-of-context msgId" (usually "out-of-time search result entries" after >sending AbandonRequest from client). > >I can't use ldap_msgid, because 'LDAPMessage*' is NULL and causes abort() >(anyway, no special result code is specified for this situation at >ldap_msgid API description). > >My code: > LDAP* handle = (LDAP*) a_ldap; > LDAPMessage* hmessage (NULL); > resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, >&hmessage); > >// I test the following, hoping result is not -1 with >LDAP_RES_UNSOLICITED, but it returned -1 again... > if (resultCode.getValue () == -1) > resultCode = ldap_result (handle, LDAP_RES_UNSOLICITED, >LDAP_MSG_ONE, NULL, &hmessage); > >?do you know any other way to identify responses with incorrect msgid? > >thnks >Regard, >Edu Hi, When we use: resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, -->NULL<--, &hmessage); I would like to clarify that -1 value was returned due to a signal on our process which interrupt the ldap_int_select within the ldap_result (where penultimate parameter (timeout) was NULL). We removed that signal and test again 'ldap_result' with zeroed-timeout (0 secs and 0 usecs): resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, &zeroed_tv, &hmessage); (even we have test 50 milisecs) Now, received response with out-of-context msgId, abort the application (due to assert over NULL hmessage when openLdap invokes 'ldap_msgid()'). We test this, changing msgId on response with TCP Test Tool, but actually, this could happen, as i said at former post, when expired context send AbandonRequest and then the ldap server sends the search result entry out of time. (The caller can expect that the result of an abandoned operation will not be returned from a future call to ldap_result()). Solutions? ---- 1 - Our ldap server, don't support LDAP_OPT_TIMELIMIT (it is optional), and then could answer out of time after an AbandonRequest received from client (or not) (RFC-compliant). ---- 2 - If we use 'LDAP_RES_ANY' we reach abort() when receive INcorrect message responses. If we use 'LDAP_RES_UNSOLICITED' we reach abort() when receive correct message responses. We can't combine these extract methods: not possible to mask values with OR, they are defined in this way: #define LDAP_RES_ANY (-1) #define LDAP_RES_UNSOLICITED (0) Perhaps it's possible to add a new #define like 'LDAP_RES_ALL=-2' which causes different special value returns on ldap_result() to make a distinction about which kind of message we receive: solicited or unsolicited. Or perhaps it's possible to get a not NULL hmessage on last ldap_result parameter, when something incorrect is received (only would be NULL on break connection event). We reach openldap debug output like this: ../../../libraries/liblber/io.c:516: ber_get_next: Assertion `ber->ber_buf == ((void *)0)' failed. ---- 3 - Avoid sending AbandonRequest in order to keep all (good/bad) contexts, perhaps solve the problem (we suppose ldap_abandon() clears internal openLdap memory resource (*)). We could send the AbandonRequest sometime later (configurable delay), or never send including any "garbage collector" mechanism (not sure if exist any openLdap primitive to do this without ldap_abandon()). We don't like any idea like this. What do you think? (*) anyone could confirm this ? ---- 4 - We are testing the following code now, but think it couldn't be such complex to afford the problem: (the application is single thread and must keep connection all the time even if incorrect msgId is received) ualarm (100000, 0); resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, &hmessage); // If we receive an unexpected message, ldap_result gets blocked on ldap_int_select due to the extract // method (LDAP_RES_ANY), and the penultimate parameter (NULL is infinite timeout). But this situation // is interrupted with former 'ualarm' signal (100 ms delay) int xerrno = errno; ualarm (0, 0); if (resultCode == -1) { int result = -1; bool disconnect (false); if (ldap_get_option (handle, LDAP_OPT_RESULT_CODE, &result) != LDAP_OPT_SUCCESS) disconnect = true; else if (result == LDAP_SERVER_DOWN) disconnect = true; else if (result == LDAP_CONNECT_ERROR) disconnect = true; if (disconnect == true && xerrno == EINTR) disconnect = false; } Indeed, we don't like this method, because we are not sure if fd stream is corrupted after an unexpected message, and probably could affect the next normal ones. We think it must be any simple way to manage this. We can't found a good point to manage the problem. any idea? Thanks Eduardo Regards Edu

1 0

dynlist overlay feature request
by Alexander 'Leo' Bergolth 02 Dec '09

02 Dec '09

Are there any plans to extend the dynlist overlays dynamic group feature to return not the DNs of the matched entries but an attribute of the entries? This would be useful for defining dynamic groups based on posixGroup (which need only the username, not the full DN) and populating them with entries from posixAccounts. If the dynlist-attrset could be extended by one parameter like: dynlist-attrset <group-oc> <URL-ad> [<member-ad>] [<result-ad>] ... where the additional parameter specifies the attribute that should be returned from the search results, a dynamic posixGroup could be configured like that: dynlist-attrset myposixGroup memberURL memberUid uid with a search filter like that: ldap:///ou=users,dc=local,dc=site??sub?(&(objectClass=posixAccount)(<searchfilter>)) I.e. "take the uid attribute of the matched entries and add them as memberUid." Could this extension be easily implemented? Is there currently any workaround? E.g. a way to dynamically add a memberUid to each posixAccount that contains the same data as the uid attribute? If that works, a filter like ldap:///ou=users,dc=local,dc=site?memberUid?sub?(&(objectClass=posixAccount)(<searchfilter>)) ... could work. Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

3 6

PAM EXOP causes chain bind password to change
by Joe Friedeggs 01 Dec '09

01 Dec '09

I am having an issue with my 'chain' bind password getting changed instead of the user's password. In a Red Hat Linux environment, running OpenLDAP 2.3.43(-3.el5 RPM from RH), I am using a master-slave setup, with chaining (as opposed to referral) as a method to allow users to change passwords (most LDAP clients hit the slave). Because I have some other issues when I set (nss_ldap) 'pam_password md5'in ldap.conf, I tried setting it to 'pam_password exop' instead. But, with this setting, when a user attempts a password change from one of the Linux clients, the ldap chain BIND password is changed on the master, instead of the user's password. In my slave slapd.conf, I have: #################################################################### # Chain to Master for updates overlay chain chain-uri "ldap://10.10.1.191" chain-idassert-bind bindmethod="simple" binddn="cn=ldapChain,o=myorg,dc=myco,dc=net" credentials="ldapChain" mode="none" # mode="self" chain-max-depth 2 chain-return-error TRUE chain-rebind-as-user TRUE ####################################################################### # To sync with the LDAP Master database using syncrepl syncrepl rid=222 type=refreshAndPersist provider=ldap://10.10.1.191 retry="30 10 300 3" searchbase="dc=myco,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=myorg,dc=myco,dc=net" credentials="syncRepl" updateref ldap://10.10.1.191 #################################################################### SO, for example, when some user, say 'userbob' issues a 'passwd' and attempts to change his password from a Linux LDAP client (configured to hit the slave LDAP server), the password for "cn=ldapChain,o=myorg,dc=myco,dc=net" instead gets changed. The users password does not get changed. Anyone know what I could possibly have mis-configured that would cause this? Thanks in advance, Joe _________________________________________________________________ Chat with Messenger straight from your Hotmail inbox. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

1 0

ObjectClass for BDB databases
by Peter Mogensen 01 Dec '09

01 Dec '09

Hi, I was trying to manual change and HDB LDIF config to BDB and failed to guess the correct ObjectClass (instead of olcHdbConfig). Looking at the example in section 5.3: http://www.openldap.org/doc/admin24/slapdconf2.html#Configuration%20Example ...It seem the objectclass is olcBdbConfig, but slapd won't accept that and it isn't present in cn=config/cn=schema.ldif where the other objectclasses are defined. Is there a bug in the documentation? /Peter

1 1

Poor Performance on HP-UX 11v3
by 宋杨 30 Nov '09

30 Nov '09

Hi I install openldap(ixOpenLDAP_A.13.00-2.4.16.001_HP-UX_B.11.23_IA_PA.depot) on HP-UX 11v3 But I have a low performance when multi thread search, when one search thead about 0-1 ms, but when 10 search threads about 300+ms. By the way all conf files are default. Any suggestions? Thanks

2 1

/etc/nsswitch cause delay in start
by vishesh kumar 27 Nov '09

27 Nov '09

Dear friends I am facing a unique problem in openldap 2.3.43 on rhel 5. 2. If i specify ldap in /etc/nsswitch.conf like passwd files ldap shadow files ldap group files ldap And then start my ldap server, it takes lots of time to start ldap server. If i remove ldap from /etc/nsswitch.conf , it start immediately. Can anyone suggest be any solution for this problem. Thanks -- http://linuxinterviews.blogspot.com

4 4

Syncrepl : Authentication issue
by smainklh＠free.fr 27 Nov '09

27 Nov '09

Hello guys, I'm meeting an issue when configuring ldap replication. The synchronisation account doesn't authenticate with the provider. Here are my configuration files : /etc/ldap/slapd.conf (provider): ----------------------- moduleload syncprov database bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryCSN,entryUUID eq /etc/ldap/slapd.conf (consumer): -------------------------- Syncrepl rid=666 provider=ldaps://provider.domain.tld:636/ type=refreshOnly retry="60 10 600 +" interval=00:00:30:00 searchbase="dc=domain,dc=tld" scope=sub schemachecking=on bindmethod=simple binddn="cn=syncrepluser,dc=domain,dc=tld" credentials=secret Errors below : >From consumer ------------ slap_client_connect: URI=ldaps://provider.domain.tld:636/ DN="cn=syncrepluser,dc=domain,dc=tld" ldap_sasl_bind_s failed (49) do_syncrepl: rid=666 retrying (9 retries left) >From provider ------------ Nov 26 15:28:47 provider slapd[2514]: do_bind: version=3 dn="cn=syncrepluser,dc=domain,dc=tld" method=128 Nov 26 15:28:47 provider slapd[2514]: bdb_dn2entry("cn=syncrepluser,dc=domain,dc=tld") Nov 26 15:28:47 provider slapd[2514]: => bdb_dn2id("cn=syncrepluser,dc=domain,dc=tld") Nov 26 15:28:47 provider slapd[2514]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) Nov 26 15:28:47 provider slapd[2514]: send_ldap_result: conn=3 op=0 p=3 Nov 26 15:28:47 provider slapd[2514]: send_ldap_response: msgid=1 tag=97 err=49 Nov 26 15:28:47 provider slapd[2514]: connection_get(14): got connid=3 Nov 26 15:28:47 provider slapd[2514]: connection_read(14): checking for input on id=3 Nov 26 15:28:47 provider slapd[2514]: ber_get_next on fd 14 failed errno=0 (Success) Nov 26 15:28:47 provider slapd[2514]: connection_closing: readying conn=3 sd=14 for close Nov 26 15:28:47 provider slapd[2514]: connection_close: deferring conn=3 sd=14 Nov 26 15:28:47 provider slapd[2514]: conn=3 op=1 do_unbind Nov 26 15:28:47 provider slapd[2514]: connection_resched: attempting closing conn=3 sd=14 Nov 26 15:28:47 provider slapd[2514]: connection_close: conn=3 sd=14 Do i have to create an account in the ldap tree? Is there a problem using SSL? Thank you for your help. Regards, Grifith

2 2

LDAP + squid
by Bruno Steven 27 Nov '09

27 Nov '09

Hello ... My squid work fine with Openldap, but I need change method authentication of user for groups , so I made the configuration follow . # As linhas abaixo se referem a autenticaÃ§ de usuÃ¡os no AD auth_param basic program /usr/local/squid/libexec/squid_ldap_auth -R -b "dc=amblivre,dc=com" -D "cn=proxy_user,ou=Internet,dc=amblivre,dc=com" -w "password" -f sAMAccountName=%s -h 192.168.4.55 auth_param basic realm Input your password auth_param basic children 5 auth_param basic credentialsttl 15 minutes #acl senha proxy_auth REQUIRED #http_access allow senha # ACL externa para autenticaÃ§ nas bases LDAP do PDC external_acl_type ldap_group %LOGIN /usr/local/squid/libexec/squid_ldap_group -R -b "dc=amblivre,dc=com" -D "cn=proxy_user,ou=Internet,dc=amblivre,dc=co m" -w "password" -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%a,ou=Internet,dc=amblivre,dc=com))" -h 192.168.4.55 acl AcessoLivre external ldap_group AcessoLivre http_access AcessoLivre When the I input user and passord for auth the Squid doesn´t recognize the credentials . There are some problem in my configuration ? Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

2 1

Migrate BD for Mysql
by Bruno Steven 26 Nov '09

26 Nov '09

Hello I am testing many cenarios of Open-Ldap, now I want test mysql such data base for Openldap . Somebody know how migrate BD Openldap for Mysql ? Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

2 1

Search responses with incorrect msgId
by Eduardo Ramos Testillano 26 Nov '09

26 Nov '09

Hi all, My application is an ldap client based on openLdap suite. I'm having problems when receiving search responses with incorrect msgId. The problem is: always returns error -1 being impossible to discriminate other situations like remote server close. The application always detach the connection fd when -1 is received (99% is broken connection). But we don't want to do close this when "receive a search response with out-of-context msgId" (usually "out-of-time search result entries" after sending AbandonRequest from client). I can't use ldap_msgid, because 'LDAPMessage*' is NULL and causes abort() (anyway, no special result code is specified for this situation at ldap_msgid API description). My code: LDAP* handle = (LDAP*) a_ldap; LDAPMessage* hmessage (NULL); resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, &hmessage); // I test the following, hoping result is not -1 with LDAP_RES_UNSOLICITED, but it returned -1 again... if (resultCode.getValue () == -1) resultCode = ldap_result (handle, LDAP_RES_UNSOLICITED, LDAP_MSG_ONE, NULL, &hmessage); ¿do you know any other way to identify responses with incorrect msgid? thnks Regard, Edu

1 0

Same entry twice in ldapsearch output
by Peter Mogensen 26 Nov '09

26 Nov '09

Hi, It seems weird results are popping up faster than I can assemble test-setups to reproduce. I ran a test in mirrormode were I: 1) Took an slapcat generated LDIF from a 2.3.x setup 2) Removed all entryCSN and contextCSN lines. 3) Ran "slapadd -S 1 -q -w -l ~/load_noCSN.ldif" on server-1 4) Did a "slapcat > toserver2.ldif" on server-1 5) Started server-1 and let applications create and modify objects. 6) Moved toserver2.ldif to server-2. 7) Ran slapadd -q -l toserver2.ldif on server-2 8) Started server-2 Now - I would expect the objects created on step 5 to appear after a while on server-2. They are not. The reason seems to be that the contextCSN has not been updated properly on server-1. The contextCSN in the "toserver2.ldif" file from step 4 is: 20091118173357.690685Z#000000#001#000000 The contextCSN on both servers are now: 20091119140605.714382Z#000000#001#000000 The entry on server-1 having that entryCSN is a modified object, however, the change has not been replicated to server-2. Likewise, the entryCSN for one created object in step 5 is: 20091119094729.719193Z#000000#001#000000 It is not present on server-2, but it appears TWICE in a the result from an ldapsearch (scope sub) on its parent object on server-1. ?!?! .. I'm lost. From all I know this should not happen on a healthy setup - unless there's something badly wrong with the procedure I've described above. It's slapd 2.4.19 with BDB4.8 /Peter

2 3

Re: UPN in BIND request
by Siddharth Sehjpal 25 Nov '09

25 Nov '09

Hi Jonathan, I am working in a test environment where I have dummy accounts in AD and OpenLDAP, I happen to see that AD schema has userPrincipalname attribute and this is missing in OpenLDAP, The application I am trying with is strictly using UPN names so integration with OpenLDAP is not going to work unless UPN is added in the OpenLDAP schema, Can you please guide me in right direction. Regards, Sidharth Sehjpal On Tue, Nov 24, 2009 at 10:40 PM, Jonathan Clarke <jonathan(a)phillipoux.net > wrote: > On 24/11/2009 10:17, Siddharth Sehjpal wrote: > >> Is it possible to use UPN (user principal name) in the bind request, My >> application works fine with Microsoft AD but is giving invalid dn with >> openldap. >> > > UPN is an attribute specific to Microsoft AD. Unless you have explicitly > added it to your OpenLDAP schema, and created entries that use it, then it > can't work. > > What are you trying to achieve? Does your OpenLDAP server contain the same > accounts ad your Microsoft AD? > > Regards, > Jonathan > -- > -------------------------------------------------------------- > Jonathan Clarke - jonathan(a)phillipoux.net > -------------------------------------------------------------- > Ldap Synchronization Connector (LSC) - http://lsc-project.org > -------------------------------------------------------------- >

2 1

UPN in BIND request
by Siddharth Sehjpal 24 Nov '09

24 Nov '09

Is it possible to use UPN (user principal name) in the bind request, My application works fine with Microsoft AD but is giving invalid dn with openldap.

2 1

Openldap compilation with Cyrus SASL in MAC OS X
by Dhruva T S 23 Nov '09

23 Nov '09

Hi list, I have compiled Cyrus SASL 2.1.23 as ./configure --prefix=/Desktop/sasl and OpenLDAP 2.4.19 as env CPPFLAGS="-I/Desktop/sasl/include/sasl" LDFLAGS="-L/Desktop/sasl/lib -R/Desktop/sasl/lib" ./configure --disable-slapd --disable-slurpd --with-ssl --with-cyrus-sasl The compilation is successful and ldapsearch is working. But if I copy the same OpenLDAP libs along with the Cyrus SASL libs to another system and try to use them, I am getting "ldap_sasl_interactive_bind_s : No such Mechanisms available" Is there a way to give relative paths specific to a folder for CPPFLAGS and LDFLAGS? Is it necessary to compile again in the second system? I am using MAC OS X Leopard (10.5). Please help me. Thanks, Dhruva

2 1

Correct way to load LDIF in mirrormode
by Peter Mogensen 22 Nov '09

22 Nov '09

Hi, I have huge LDIF file from openldap 2.3.30, which I try to load in a 2.4.19 mirrormode setup. I've tried different ways to load it. 1) Load the LDIF on server 1 and wait for server 2 to replicate it. - it takes several days and server-2 never seems to get all the way and catch up with server 1. 2) Load the LDIF on both servers and start slapd. - Afterwards not all entries created on server 1 is replicated to server-2. So the first thing to rule out would be to ensure that I've loaded the LDIF correctly: The entryCSN from the 2.3.30 server is in this format: 20071214130312Z#000000#00#000000 The two servers (server1/server2) in the 2.4.19 setup have sid 1, 2 and rid 3,4 (cn=config replication has rid 1,2). I loaded the LDIF like this on both servers: $ slapadd -q -w -l backup-2.3.30.ldif Is that enough to make replication start from a known state? Could someone please exemplify a scenario where the -S option for slapadd is needed? /Peter

6 19

Fwd: [Mitkc-announce] Kerberos Conference Slides, Release 1.8
by Howard Chu 21 Nov '09

21 Nov '09

My slides from last month's Kerberos Conference are now available online. The files used in my demo are attached here: cf.ldif - a basic slapd configuration: use with slapadd -F <path/to>/slapd.d -l cf.ldif -n0 kerberos.ldif - the MIT KDC schema addkrb.sh - simple steps to load KDC schema into slapd /etc/krb5.conf - config file for MIT Kerberos initkdc.sh - commands to initialize the KDC addprinc.sh - commands to add Kerberos attributes to an LDAP user It took about 5 minutes to walk through these steps during the presentation; most of that time was spent explaining the steps... Actually doing the work is about 30 seconds. -------- Original Message -------- Subject: [Mitkc-announce] Kerberos Conference Slides, Release 1.8 Date: Thu, 19 Nov 2009 14:19:43 -0500 From: Stephen Buckley <sbuckley(a)mit.edu> To: mitkc-announce(a)mit.edu Hello all, We have put the slides from our Kerberos Conference up on our web site at: http://www.kerberos.org/events/2009conf/ Keynoters included Kim Cameron, Chief Architect for Identity at Microsoft. Also, the 1.8 release feature set is now complete and documented at: http://k5wiki.kerberos.org/wiki/Release_1.8 We are on track to deliver 1.8 in March 2010. We also started a blog http://blog.kerberos.org/ Lastly, a reminder that we try to provide some useful documentation and links: http://www.kerberos.org/docs/ Kind regards, s _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ Stephen C. Buckley Executive Director MIT Kerberos Consortium http://www.kerberos.org

1 0

Binding with an e-mail address
by Willie Gillespie 21 Nov '09

21 Nov '09

Perhaps someone can point me in the right direction here. Using just simple binds (for now), I am trying to allow users to bind with just a username or e-mail address and have OpenLDAP rewrite their bind to a more complex DN for them before checking against userPassword. Is there a way to do this? I have tried playing with olcAuthIDRewrite and olcRwmRewrite but I must be doing something incorrectly. Thanks! Willie

3 5

Re: Objects with with no parent objects...
by Dave Smith 21 Nov '09

21 Nov '09

Thanks, we ended taking your second suggestion. When we tried to create the parent objects, we were given an error that they already existed. when we tried to query,modify or delete them it returned an error that the did not exist. (bizarre) The exported LDIF's did not contain any of these branches, and we were recover OK. --DS 2009/11/20 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, November 20, 2009 6:13 PM -0500 Dave Smith <dave.smith.to@ > gmail.com> wrote: > > I hope someone can help... >> >> As I say we need to quickly remove these objects. Can anyone give some >> suggestions? >> > > Create the parents, delete the children, delete the parents? > > Or, slapcat, fix the LDIF, reload. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

olcAuthIDRewrite
by Willie Gillespie 21 Nov '09

21 Nov '09

Using OpenLDAP 2.4.18: Anytime I try to put something/anything in the attribute olcAuthIDRewrite for dn: cn=config I get: conn=1 op=8 MOD dn="cn=config" conn=1 op=8 MOD attr=olcAuthIDRewrite conn=1 op=8 RESULT tag=103 err=80 text=<olcAuthIDRewrite> handler exited with 1 Am I putting in the wrong data? I've tried all sorts of combinations, even simply: {0}authid-rewriteEngine "on" I can't seem to find much documentation on the whole thing either. Thanks for any pointers. Willie

2 7

Objects with with no parent objects...
by Dave Smith 21 Nov '09

21 Nov '09

I hope someone can help... We have an directory with a few objects that don't seem to have parents. We're not sure how they got in there. They could have been added using ldapmodify, or our application could have added them via JNDI. This is one of the DN's: ifastProfileId=P_SUPER,ou=profile,ou=prod,ou=ifast,ou=ifastbase,dc=ifdsgroup,dc=com We are fairly sure the organizational units ou=profile,ou=prod never existed, yet the P_SUPER object was create, and is returned in a search. We need to remove these entries in a hurry so I put together this LDIF... DN: ifastProfileId=P_SUPER,ou=profile,ou=prod,ou=ifast,ou=ifastbase,dc=ifdsgroup,dc=com changetype:delete DN: ifastProfileId=P_SSII,ou=profile,ou=prod,ou=ifast,ou=ifastbase,dc=ifdsgroup,dc=com changetype:delete DN: ifastProfileId=P_SSBL,ou=profile,ou=prod,ou=ifast,ou=ifastbase,dc=ifdsgroup,dc=com changetype:delete but the ldifmodify gives this error... deleting entry "ifastProfileId=P_SUPER,ou=profile,ou=prod,ou=ifast,ou=ifastbase,dc=ifdsgroup,dc=com" ldap_delete: Other (e.g., implementation specific) error (80) additional info: could not locate parent of entry As I say we need to quickly remove these objects. Can anyone give some suggestions? Thanks, --DS

2 1

Re: Queries very very slow + strange problem with indexes
by Jan Thiemo Fricke 20 Nov '09

20 Nov '09

Rein Tollevik schrieb: > Jan Fricke wrote: > >> I'm running openLdap 2.3.43 on CentOS 5.3. >> At the moment queries that return one entry of 20 take between 300ms and >> 600ms. The objectClass of the objects I query has no influence. The acl >> rules that allow users to write have also no significant influence on >> query speed. If I add >> >> index telephoneNumber eq >> >> to my slapd.conf, queries with (telephoneNumber=123) are very fast but >> return zero results although they should return one. >> >> Any ideas? I'm running out of ideas (Maybe because I'm new to LDAP :) ) > > You must run slapindex after modifying the index configuration. > > Rein > . > Long question, short answer. Thanks a lot! I won't have the chance to test it until monday. Just to make sure that I got it. I need to run slapindex only once to index existing pieces of data. After adding an attribute to the indexed entries of my slapd.conf and running slapindex the index will be refreshed automatically when datasets are modified. Jan

1 0

Queries very very slow + strange problem with indexes
by Jan Fricke 20 Nov '09

20 Nov '09

Hi members, I'm running openLdap 2.3.43 on CentOS 5.3. At the moment queries that return one entry of 20 take between 300ms and 600ms. The objectClass of the objects I query has no influence. The acl rules that allow users to write have also no significant influence on query speed. If I add index telephoneNumber eq to my slapd.conf, queries with (telephoneNumber=123) are very fast but return zero results although they should return one. Any ideas? I'm running out of ideas (Maybe because I'm new to LDAP :) ) Thanks in advance Jan -------------------------------------------------------------------------------- Here is my slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel acl database bdb suffix "dc=myDomain" rootdn "cn=admin,dc=myDomain" rootpw {SSHA}basdfasdfasdfasdfv directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=myDomain" write by anonymous auth by self write by * none access to dn.base="" by users read by dn="cn=admin,dc=myDomain" write access to dn.exact="dc=myDomain" by * read access to dn.exact="ou=users,dc=myDomain" by * read access to dn.sub="ou=users,dc=myDomain" filter=(objectclass=person) by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by self read access to dn.sub="ou=roles,ou=users,dc=myDomain" by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by * read access to dn.sub="ou=configs,dc=myDomain" by * read access to dn.sub="ou=contacts,dc=myDomain" by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by * read access to dn.sub="ou=roleRights,dc=myDomain" by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by * read --------------------------------------------------------------------------------- And also DB_CONFIG set_cachesize 0 20097152 0 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500

2 1

Password Troubles
by CASEIRO Philippe 20 Nov '09

20 Nov '09

Hello I have some troubles with some users. The user change is password (all works fine) It open sessions during lot of time After some hours the user couldn't login into ldap server clients anymore. Did somebody ever had the same problem ? I don't see anything in logs (Lv 256). The only thing is an "Invalid credentials" returned by pam_ldap on login failures but nothing in ldap logs. If I reset the password all works fine back. Thanks for you help -- Philippe Caseiro

1 1

Accentuation problem
by M. Rodrigo Monteiro 19 Nov '09

19 Nov '09

Hi all! I'm using OpenLDAP 2.4.15 and Samba 3.4.2 (all native from Fedora 11 64 bits). When I try to change the displayName to a name that contains an accent, gives me this error: # cat /tmp/790 dn: uid=antonio.oliveira,ou=Usuarios,DC changetype: modify replace: displayName displayName: Antônio Kelvis Costa de Oliveira # ldapmodify -x -H ldap://localhost -D "cn=root,DC" -w "PASS" -P 3 -f /tmp/790 modifying entry "uid=antonio.oliveira,ou=Usuarios,DC" ldap_modify: Invalid syntax (21) additional info: displayName: value #0 invalid per syntax The problem is with OpenLDAP, Samba, or with the attribute (schema)? Regards, Rodrigo. -- M. Rodrigo Monteiro falecom(a)rodrigomonteiro.net "Free as in Freedom, not free as in free beer" "As we are liberated from our own fear, our presence automatically liberates others" Linux User # 403730

1 0

OpenLdap 2.4.17 and openssl 0.9.8l and datagram-based TLS
by Robert Hanson 18 Nov '09

18 Nov '09

Our customer is requiring us to use openssl 0.9.8l They have determined that there is a problem with datagram based TLS; as long as we're not using datagram-based TLS for communication to slapd, we can go ahead and approve this. How do I find out if I'm using datagram-based TLS? Is it something in the slapd.conf file or is it something in the build of openldap? Or is it just not an issue?

2 1

Issues with SSL/TLS + GSSAPI when modifying uniqueMember attribute (bug???)
by Rahul Amaram 18 Nov '09

18 Nov '09

Hi, With OpenLDAP + TLS/SSL + GSSAPI, trying to modify the value of the multivalued attribute uniqueMember to ["uid=user1,ou=People,dc=example,dc=com", "uid=user2,ou=People,dc=example,dc=com", "uid=user3,ou=People,dc=example,dc=com", ...] hangs when the number of members cross 398. If instead of user1, user2, user3, ... I use usr1, usr2, usr3 ... then also it hangs but that was when the number of members cross 408. Further using u1, u2, u3, ... it hangs when the number of members cross 430. I couldn't figure out the reason for this behaviour. Either way the solution to the problem seemed to be in setting maxssf to 0. Below is an example command on how I used this property: $ LDAPSASL_SECPROPS="maxssf=0" LDAPTLS_CACERT=/etc/ssl/certs/rootcacert-dbs.example.com.pem ldapmodify -H "ldap://dbs.example.com" -Y GSSAPI -f data.ldif -ZZ Is the hanging anticipated behaviour? Is setting maxssf=0 the proper solution or is there a better solution? Regards, Rahul.

2 2

slapcat kills slapadd
by Peter Mogensen 18 Nov '09

18 Nov '09

I know this is probably a "don't do that", but I was somewhat surprised by the outcome. I was doing a: slapadd -S 1 -q -w -l ~/load_noCSN.ldif ... and wanted to see what was actually added to the database, so I ran slapcat - which immediately made bot apps crash. => bdb_last_id: get failed: DB_PAGE_NOTFOUND: Requested page not found (-30986) (slapd 2.4.19, BDB4.8 using hdb) /Peter

2 3

Racecondition when loading schemas?
by Peter Mogensen 18 Nov '09

18 Nov '09

Hi, I experience something weird. I've set up an empty set of mirrormode servers. No databases. Only cn=config. Now I try to add a database on server 1 and see it's existance replicated to server-2. I do this with a small shell-script which calls ldapadd somthing like this: for F in $LDIFDIR/*.ldif; do ldapadd -YEXTERNAL -H ldapi:/// -f $F done $LDIFDIR contains files like this: 00moduleload.ldif 10attributeoptions.ldif 30evolutionperson.ldif 31rfc2739.ldif 70database.ldif It loads OK, but *almost* always "evolutionperson" does not get replicated to server-2. That's almost, because *sometime* it does. If I run the ldapadd command manually it almost always does. So I figure that there's some kind of race condition which prevents "evolutionperson" from getting replicated. But I can't see why. It doesn't depend on anything from the other files. (inetOrgPerson schema is alread loaded before this). /Peter

2 1

How to replicated Account machine
by Dominguez, Gaston Matias 18 Nov '09

18 Nov '09

Hi people, Im having troubles with replication, i use syncrepl and it s working fine but when my PDC is down , the user cannt logon to BDC because it hasnt the account on the ldap base. How i can resolve this ¿? Someone knows about it? Config. PDC Administrador:x:0:0:Netbios Domain Administrator:/home/Administrador:/bin/false nobody:x:999:514:nobody:/dev/null:/bin/false cpu-004$:*:1000:515:Computer:/dev/null:/bin/false tonga01:x:1001:513:System User:/home/tonga01:/bin/bash srvbc01$:*:1002:515:Computer:/dev/null:/bin/false cpu-001$:*:1003:515:Computer:/dev/null:/bin/false tonga02:x:1004:513:System User:/home/tonga02:/bin/bash BDC Administrador:x:0:0:Netbios Domain Administrator:/home/Administrador:/bin/false nobody:x:999:514:nobody:/dev/null:/bin/false tonga01:x:1001:513:System User:/home/tonga01:/bin/bash tonga02:x:1004:513:System User:/home/tonga02:/bin/bash regards.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical