- openldap-technical - openldap.org

How create OU
by Bruno Steven 18 Nov '09

18 Nov '09

Hi ... I have squid integrated with OpenLdap . I need create an Ou and a lot of groups but my Openldap is integrated with Samba too. How I could create OUs in enviroment integrated ? For examaple, I create users using smbldap-tools but this tool doesn´t create Ou. Thanks . -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

3 2

OpenLDAP not finding Cyrus SASL
by Dhruva T S 17 Nov '09

17 Nov '09

Hi, I have compiled OpenLDAP 2.4.19 using env CPPFLAGS="-I/Desktop/libs/include/sasl" LDFLAGS="-L/Desktop/libs/lib/sasl2 -R/Desktop/libs/lib/sasl2" ./configure --with-cyrus-sasl. The version of Cyrus SASL is 2.1.23. When I use /usr/local/bin/ldapsearch -H ldap://ldap.example.org -x -b "" -s base supportedSASLMechanisms, I get NTLM and GSS-SPNEGO as the mechanisms from server. But when I give /usr/local/bin/ldapsearch -Y NTLM -H ldap://ldap.example.org -b 'ou=users,ou=readimanager' '(cn=dhruva)' I am getting ldap_sasl_interactive_bind_s : Local error (-2). Is there a way to solve this? Thanks, Dhruva

1 0

checkpoint and DB_TXN_NOSYNC
by jakjr 17 Nov '09

17 Nov '09

Hello Guys, A little doubt. When using DB_TXN_NOSYNC flag in DB_CONFIG is it necessary to config checkpoint on slapd.conf ? I ask this, because when restarting a old openldap version (2.3.30) it always start the bdb recovery, and this recovery access all log,0000(XXX) and it is too slow. I checked this using lsof. Best regards, João Alfredo

1 0

Reg Profile in OpenLdap
by Asimananda Mohanty 16 Nov '09

16 Nov '09

Hi All, I have openLDAP on ubuntu and LDAP client on Solaris. What I need is a user should be able to log in to the solaris server with a user that is present in LDAP (not in /etc/passwd of Solaris machine) I have added object classes nisDomainObject, ndsLoginProperties and ndsContainerLoginProperties (all inherits from organizationalUnit) and also added an attribute nisDomain. Then I created a user asmii like : dn: uid=asmii,ou=people,dc=ldap-company,dc=com objectClass: organizationalUnit objectClass: nisDomainObject objectClass: posixAccount objectClass: shadowAccount uid: asmii ou: asmii cn: asmii uidNumber: 1006 gidNumber: 10000 userPassword: password gecos: asmii loginShell: /bin/bash homeDirectory: /home/asmii nisDomain: ldap-company.com shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 postalCode: 122015 l: Toulouse postalAddress: Now I need to create a profile so that the LDAP client on Solaris can download it. Please let me know what is this profile and how do I create this. I googled a bit and found that I need a ObjectClass DUAConfigProfile in my LDAP. Is this the ObjectClass I need in my LDAP server? What would I do next? How do I connect the user "asmii" with a profile? Please suggest. Thanks in advance. Regards Asimananda Mohanty

2 2

Recursive ACL entries (group member of group)
by Jan Thiemo Fricke 16 Nov '09

16 Nov '09

Hi list members, I use a openldap server for the user management of an proprietary client/server application. Users are modified person class objects. Groups are groupOfName objects. Rights are also groupOfNames. Users are members of groups and groups are members of rights. To exemplify my problem: User: cn=example,ou=users,dc=mydomain Group: cn=supervisors,ou=groups,dc=mydomain Right: cn=someRight,ou=rights,dc=mydomain For instance someRight should give all members of supervisors the right to modify other users. At the moment the ACL is related to the group. Access to dn.sub="ou=users,dc=mydomain" By group.exact="cn=supervisor,ou=groups,dc=mydomain" write By self read To use the rights I'd need an ACL with a group of group. Access to dn.sub="ou=users,dc=mydomain" By group.exact="cn=someRight,ou=rights,dc=mydomain" write Should allow all members of all groups that are member of someRight to modify users. Is this possible or is groupOfNames the wrong class to represent group rights? Thanks in advance! Jan

3 4

For openldap suggestion
by bfmyvmqj 16 Nov '09

16 Nov '09

Hello, everyone: I want to use openldap for my parallel compting environment in CentOS 5.2. Because I'm fresh person for openldap, so I don't know whether it is feasible. Therefore, a pretty advice is rather appreciated. Thanks.

1 0

Re: slapo-auditlog doesn't log the time and name for delete operation
by Michael Ströder 15 Nov '09

15 Nov '09

Ben, please follow-up on the mailing list so others can answer and learn as well. Ben Leo wrote: > Can I get the timestamp and name for the delete operation with > slapo-accesslog? > FYI, what I need is to log all the changes made in LDAP, which is the > what, the when, and the who. > So, I don't want to log the request as it is not relevant. See slapo-accesslog. You probably want in your slapd.conf: overlay accesslog logops writes Ciao, Michael.

1 0

slapo-auditlog doesn't log the time and name for delete operation
by Ben Leo 15 Nov '09

15 Nov '09

Hi, I have successfully implemented slapo-auditlog but as I test the logging, I found a problem on the logging for "delete" operation. I noticed that, for "add" and "modify" operation, the auditlog shows the Timestamp and Name of each operation, as the following example: # add 1257968890 dc=example,dc=com cn=manager,dc=example,dc=com dn: uid=test,ou=People,dc=example,dc=com changetype: add uid: test sn: test cn: test objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson *creatorsName*: cn=manager,dc=example,dc=com *createTimestamp*: 20091111194810Z entryCSN: 20091111194810.672178Z#000000#000#000000 *modifiersName*: cn=manager,dc=example,dc=com *modifyTimestamp*: 20091111194810Z # end add 1257968890 But, for "delete" operation, it doesn't show the Timestamp and Name at all, as the following example: # delete 1258152007 dc=example,dc=com cn=manager,dc=example,dc=com dn: uid=test,ou=People,dc=example,dc=com changetype: delete # end delete 1258152007 How can I get the Timestamp and Name to show for the "delete" operation? If slapo-auditlog cannot provide this, is there any other way to do this? Please kindly help. Thanks, Ben

2 1

ldap clients cant connect to replica after failure
by Scott Behrens 13 Nov '09

13 Nov '09

Hello, I am running 2 hosts CentOS release 5.3 (Final) with kernel 2.6.18-164.el5l. One box is the provider and the other is a consumer using syncrepl. When the primary goes down, I can perform searches against the domain from the replica so I know the replica has replicated the data (when I stop both hosts I can't preform the search obviously). When I point a client to the replica, I get a timeout when trying to perform searches or pull data. ldap_bind: Can't contact LDAP server (-1). Any ideas? I will provide more information if needed. Scott .

3 8

unique overlay
by Piyush Joshi 13 Nov '09

13 Nov '09

Dear Expert, I am currently using unique overlay with uid and mail attributes which is working perfectly for me but now i want to make it unique across the directory like if i am using mailAlternateAddress attribute and try to add any value which is already defined in mail attribute should not be allowed. Example -- mail: piyush(a)xxx.com is already there in ldap dit then piyush(a)xxx.com should not be allowed in mailAlternateAddress attribute's value and vice versa. Any help would be appreciated !!! OpenLDAP version - 2.4.19 BDB version - 4.7.25 -- Regards ****************************** Piyush Joshi System administrator 9415414376 ****************************** "Ability is what you're capable of doing. Motivation determines what you do. Attitude determines how well you do it"

2 1

Problem with ldaps:// when switching from 2.3 to 2.4
by Tomasz Welman 13 Nov '09

13 Nov '09

I have to machine, on the first there is no problem in connecting to the LDAP server (IBM directory server). The first machine is RedHat RHEL5 Client, the second is Ubuntu karmic 9.10. First machine looks like this: <root@trog /etc/openldap># uname -a Linux trog.krakow.pl.ibm.com 2.6.30 #1 SMP Fri Jun 26 08:44:06 CEST 2009 i686 i686 i386 GNU/Linux <root@trog /etc/openldap># rpm -qa |grep ldap python-ldap-2.2.0-2.1 openldap-2.3.43-3.el5 openldap-devel-2.3.43-3.el5 nss_ldap-253-21.el5 mozldap-6.0.5-1.el5 openldap-clients-2.3.43-3.el5 openldap-compat-2.1.30-1.oc2 <root@trog /etc/openldap># cat ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/openldap/cacerts/bp.cert On the second the configuration is: root@xwing:/etc/ldap# uname -a Linux xwing 2.6.31-server #1 SMP Thu Oct 1 11:55:18 CEST 2009 i686 GNU/Linux root@xwing:/etc/ldap# dpkg -l |grep ldap ii ldap-utils 2.4.15-1ubuntu3 OpenLDAP utilities ii libldap-2.4-2 2.4.15-1ubuntu3 OpenLDAP libraries root@xwing:/etc/ldap# cat ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/ldap/cacerts/bp.cert When I start the ldapsearch on the second machine, I get the error: root@xwing:/etc/ldap# ldapsearch -d5 -x -H ldaps://myldapserver.com ldap_url_parse_ext(ldaps://myldapserver.com) ldap_create ldap_url_parse_ext(ldaps://myldapserver.com:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP myldapserver.com:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 9.17.186.253:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) What is more... when using ldap:// instead of ldaps:// on the second machine everything works perfectly, but since it's not secured connection I cannot accept that solution. The ldapsearch works fine on the first machine for both secure and insecure connection. Can anyone help? -- Tomasz 'Trog' Welman Software Developer external: 48-12-628-9449 ITN: 34819449 T/L: 9449 IBM SWG Lab, Krakow, Poland IBM Polska Sp. z o.o. oddział w Krakowie ul. Armii Krajowej 18 30 -150 Kraków NIP: 526-030-07-24, KRS 0000012941 Kapitał zakładowy: 33.000.000 PLN

3 6

logging question - source of queries
by wes 13 Nov '09

13 Nov '09

Does anyone know offhand which logging category (if any) will log the IP address or other information about who is making any given query to the LDAP database? thanks, -wes

2 1

Best practice for choosing RID
by Peter Mogensen 12 Nov '09

12 Nov '09

Hi, I'm moving more and more towards loading new databases via ldapadd to cn=config. All databases are replicated between two mirrormode servers - including cn=config. From my unserstanding I need to syncrepl directives for each database. For cn=config it could be: syncrepl rid=1 provider=ldaps://<SERVER1>/ searchbase="cn=config" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=sasl binddn="cn=config" saslmech="EXTERNAL" tls_cert=/etc/ldap/ssl/config.crt tls_key=/etc/ldap/ssl/config.nopass.key tls_cacert=/etc/ldap/ssl/ca.crt tls_cipher_suite="NULL-SHA" syncrepl rid=2 provider=ldaps://<SERVER2>/ searchbase="cn=config" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=sasl binddn="cn=config" saslmech="EXTERNAL" tls_cert=/etc/ldap/ssl/config.crt tls_key=/etc/ldap/ssl/config.nopass.key tls_cacert=/etc/ldap/ssl/ca.crt tls_cipher_suite="NULL-SHA" The two directives are needed since the configuration will be replicated and the two servers have to contain the same configuration. As long as Server-2 can recognize it self as <SERVER2> it will ignore the directive pointing to it self - correct? So cn=config will use RID 1 and RID 2. When I add a new database it will also have to have 2 syncrepl directives, but will have to use RID 3 and RID 4 - correct? Now, I would like not to have to specify the RID in the LDIF loaded to create a new database. In principle I would not know how many other replications were in place on the server I load it into, so it would be a bad thing to hardwire the RID into the LDIF for the new database. Are there any mechanism/best practice to do chose new RIDs automatically? /Peter

3 5

Replication problems
by Dominguez, Gaston Matias 12 Nov '09

12 Nov '09

Hi people, Im having troubles with samba & openldad. I configurated two server (PDC & BDC), the replication is working fine with the ldap base. But i was wondering if i can replicated the next share logon path = \\%L\Profiles\%U Why i ask this ¿? Because this folders was created on the first server PDC and when the first is down ths user cannt logo non the BDC . Someon know what i can do to resolve this? Regards.

2 1

index on modifyTimestamp?
by Peter Mogensen 11 Nov '09

11 Nov '09

Hi, I have an application which searches on entries with modifyTimestamp in a specific interval, so I thought an index on this attribute was appropriate. But I read that (at least earlier) indexes on operational attributes was not supported? /Peter

2 1

Problem in sb_stream_read
by Dave Daugherty 11 Nov '09

11 Nov '09

We very occasionally see a problem that goes like this: 1) Send an LDAP search request to a Windows DC 2) Call ldap_int_select from result.c - wait4msg() 3) After ldap_int_select returns okay - (eventually) call down into the sockbuf.c function sb_stream_read() which calls read(...) 4) The read() hangs forever if it has to do multiple calls to get the entire response (very very occasionally) I was not able to get a network trace to see why recv() hangs forever (AIX 5.3 BTW), but it does have to do with a large response that comes back in several TCP fragments. I solved the issue by adding an additional select() call in sb_stream_read() Here is what I did in code base 2.2.6 static ber_slen_t sb_stream_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len ) ... #elif defined( HAVE_NCSA ) /* * NCSA Telnet TCP/IP stack (under DOS) */ return nread( sbiod->sbiod_sb->sb_fd, buf, len ); #else { int rc = ber_int_sb_read_wait(sbiod->sbiod_sb); <- The new check if (rc > 0) { rc = read( sbiod->sbiod_sb->sb_fd, buf, len ); } return rc; } #endif } New Function /** * If there is a timeout - wait for data, to avoid * permanent blocking on a read. * * @param sb Socket buf with socket id and timeout * @return -1=error : 0=timeout : 1=proceed */ static int ber_int_sb_read_wait(Sockbuf *sb) { struct timeval tm = sb->sb_timeout; int rc = 1; /* If no timeout was specified skip the select */ if (tm.tv_sec || tm.tv_usec) { int sock = sb->sb_fd; fd_set rfds; FD_ZERO(&rfds); FD_SET(sock, &rfds); ber_log_printf(LDAP_DEBUG_PACKETS, sb->sb_debug, "ber_int_sb_read_wait start: timeout is %d %d", (int)tm.tv_sec, (int)tm.tv_usec); rc = select(sock+1, &rfds, NULL, NULL, &tm); ber_log_printf(LDAP_DEBUG_PACKETS, sb->sb_debug, "ber_int_sb_read_wait end: sock=%d rc=%d %s\n", sock, rc, (rc >= 0) ? "" : STRERROR(errno)); } return rc; } In open.c - ldap_int_open_connection(), I added some code to propagate the timeout down to ber_int_sb_read_wait(( { /* * Propagate the network timeout to sockbuf layer for * select calls. */ struct timeval *tm = 0; int ret = ldap_get_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *)&tm); if (ret == LDAP_OPT_SUCCESS && tm) { ber_sockbuf_ctrl(conn->lconn_sb, LBER_SB_OPT_SET_TIMEOUT, tm); LDAP_FREE(tm); } } Regards Dave Daugherty Centrify Corp.

2 2

Problem with ber_flatten2
by Dave Daugherty 10 Nov '09

10 Nov '09

We use ber_flatten2 in an unusual way, but I think this issue is generic int ber_flatten2( BerElement *ber, struct berval *bv, int alloc ) { ... /* copy the berval */ ber_len_t len = ber_pvt_ber_write( ber ); if ( alloc ) { bv->bv_val = (char *) ber_memalloc_x( len + 1, ber->ber_memctx ); if ( bv->bv_val == NULL ) { return -1; } AC_MEMCPY( bv->bv_val, ber->ber_buf, len ); } else { bv->bv_val = ber->ber_buf; } bv->bv_val[len] = '\0'; <- ???? bv->bv_len = len; The problem I have is a crash, because of the bv->bv_val[len] = '\0' when alloc is set to zero, AND the buffer that was passed in was generated by ber_realloc, which did not leave an extra byte at the end, resulting in a write beyond the allocated memory block. The questions I have are: 1) Is the zero terminator really necessary? 2) If so, seems like it should only be don if we actually allocated a new buffer (which does leave one byte at the end). Thanks Dave Daugherty Centrify Corp. BTW I this is my first post here, so let me know

2 2

ldap overlays
by srg 10 Nov '09

10 Nov '09

Hello: We are running openldap 2.4.11. The "base" dn is "dc=foo,dc=com", under this, there are two organizationalunits "ou=people,dc=foo,dc=com" and "dc=groups,dc=foo,dc=com". Entries under "groups" use objectclass groupOfNames. Entries under "people" use objectclass inetOrgPerson. Each group entry has some "member" attributes, each of them "pointing" to one user dn. With this we have the "list of members that the group has". Also we are using the "memberof" overlay (memberof.la) that automatically "inserts" "memberof" attributes to each user, so each user, has a list of memberof attributes (one for each group that the user belongs to). At this point all is OK and working fine. Now we need another overlay that "inserts" a new "text" attribute for each user called for example "groups" that contains a string with all the groups that the user belongs to. Note that we need to have this with only ONE attribute (NOT one attribute for each group that the user belongs to). For example: groups: g1,g2,g3 Not: groups: g1 groups: g2 groups: g3 It is possible? How? Thanks a lot and best regards

2 1

Error building OpenLDAP source code 2.3.43 on CentOS 5.3
by Swaminathan Saikumar 09 Nov '09

09 Nov '09

I'm using CentOS 5.3. I downloaded openldap-2.3.43 (which I installed using "Add/Remove Programs" in CentOS) and tried to build it. (Ultimately, I'm trying to get a C program to initialize my local ldap server and want to link to the relevant library in gcc). ./configure worked make depend worked make gave me an error ... cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o component.o component.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o version.o version.c /bin/sh ../..//libtool --mode=link cc -static -g -O2 -o slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o repl.o lock.o controls.o extended.o kerberos.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o version.o libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/libldap_r.la ../../libraries/liblber/liblber.la -ldb-4.3 -lsasl2 -lssl -lcrypto -lresolv -pthread \ cc -g -O2 -o slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o repl.o lock.o controls.o extended.o kerberos.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o version.o -pthread libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/.libs/libldap_r.a /home/swami/official/Aprius/ldap/openldap-2.3.43/libraries/liblber/.libs/liblber.a ../../libraries/liblber/.libs/liblber.a /usr/lib/libdb-4.3.so -lpthread -lsasl2 -lssl -lcrypto -lresolv -pthread /usr/lib/libdb-4.3.so: could not read symbols: File in wrong format collect2: ld returned 1 exit status make[2]: *** [slapd] Error 1 make[2]: Leaving directory `/home/swami/official/Aprius/ldap/openldap-2.3.43/servers/slapd' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/home/swami/official/Aprius/ldap/openldap-2.3.43/servers' make: *** [all-common] Error 1 How do I resolve this? Thanks

3 2

unable to user evolutionperson.schema
by cornjump 09 Nov '09

09 Nov '09

Hi all. First, excuse me for my bad english. I use openldap 2.3.27 on RHEL5. Openldap is needed for authentication and addresssbook storage for egrouware. I have only one last thing to do : getting contact's categories in the addressbook. For that, I have added the evolutionperson.schema given in the egroupware package. After adding the evolutionperson.schema and restarting openldap, I've no error messages. Then, if I want to add the objectClass evolutionPerson to an uid in the addressbook, I have the following error : ############### $slapadd -n 1 -l /tmp/importbase.ldif str2entry: invalid value for attributeType objectClass #2 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=8463) ############## Here is the modified entry (line 8463) in /tmp/importbase.ldif ############## dn: uid=6f945b6f9556393d9151252790d2f7a4,cn=aldevar,ou=personal,ou=contacts,ou =Users,dc=domain,dc=fr uid: 6f945b6f9556393d9151252790d2f7a4 objectClass: inetOrgPerson objectClass: person objectClass: evolutionPerson cn: sebastien quettier2 givenName: sebastien sn: quettier2 mail: sebastien.quettier2(a)revnew.domain.fr displayName: quettier2, sebastien structuralObjectClass: inetOrgPerson entryUUID: d91d6e36-5284-102e-8370-b3fd7d4e5e39 creatorsName: cn=Manager,dc=domain,dc=fr createTimestamp: 20091021115853Z entryCSN: 20091021115853Z#0001a6#00#000000 modifiersName: cn=Manager,dc=domain,dc=fr modifyTimestamp: 20091021115853Z ################ And finally here is slapd.conf : ################ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema inculde /etc/openldap/schema/evolutionperson.schema include /etc/openldap/schema/mozillaabpersonalpha.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/hopital.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args moduleload back_bdb.la moduleload back_ldap.la moduleload back_ldbm.la moduleload back_passwd.la moduleload back_shell.la access to dn.one="ou=Users,dc=domain,dc=fr" attrs=entry,sn,mail,cn,givenName,telephoneNumber,uid,objectClass by anonymous read access to dn.one="ou=Groups,dc=domain,dc=fr" attrs=cn,memberUid,objectClass by anonymous read access to dn.one="ou=People,dc=domain,dc=fr" attrs=entry,sn,mail,cn,givenName,telephoneNumber by anonymous read include /etc/openldap/acl_addressbooks.conf access to * by * peername.ip=194.146.14.189 read access to * by * none database bdb suffix "dc=domain,dc=fr" rootdn "cn=Manager,dc=domain,dc=fr" rootpw passord directory /var/lib/ldap index default pres,eq index uid index cn,sn,mail pres,eq index objectClass eq ################## Can someone help me to find a solution for this problem?

4 4

Fail-Over
by Dominguez, Gaston Matias 06 Nov '09

06 Nov '09

Hi people, Someone knows how to prepare a fail-over between two servers with samba & ldap. regards

2 1

Duda¡
by Dominguez, Gaston Matias 06 Nov '09

06 Nov '09

Martin te cuento que me esta sucediendo. Yo estoy en una lista de distribución de Linux de LDAP que hace que me lleguen mails por diferentes tema de Linux. La dirección es la siguiente: openldap-technical(a)openldap.org Quería saber si esta filtrada ya que hace tiempo que no recibo mails desde esta dirección. Saludos. Dominguez Gastón Matías Informática y Telecomunicaciones ELECTROINGENIERIA S.A. División Nuclear Tel.: 0054-03487-481880 Fax: 0054-03487-481880 Int. 120/121 E-mail: gdominguez(a)eling.com.ar Web: <http://www.eling.com.ar/> www.eling.com.ar

1 0

How to monitor no of connections on LDAP
by Kiran Sama 05 Nov '09

05 Nov '09

Hi, Can you please help me to monitor the connections on LDAP Server. Best Regards, Kiran Sama

3 2

slapd(8) adds objects without adding structuralObjectClass -> blocks replication
by Christian Haugan Toldnes 05 Nov '09

05 Nov '09

I'm running openldap 2.4.9 (Ubuntu 8.04.3) in a N-way multimaster setup with two masters and two slaves. I've just switched to this setup from an old SLES system, and used slapcat and slapadd to populate the masters. In syslog of my slaves, I find the following: Nov 3 12:20:43 stooge01 slapd[19271]: syncrepl_entry: rid=101 be_search (0) Nov 3 12:20:43 stooge01 slapd[19271]: syncrepl_entry: rid=101 uid=foobar,ou=people,dc=ntnu,dc=no Nov 3 12:20:43 stooge01 slapd[19271]: No structuralObjectClass for entry (uid=foobar,ou=people,dc=ntnu,dc=no) Nov 3 12:20:43 stooge01 slapd[19271]: entry failed schema check: no structuralObjectClass operational attribute Nov 3 12:20:43 stooge01 slapd[19271]: null_callback : error code 0x50 Nov 3 12:20:43 stooge01 slapd[19271]: syncrepl_entry: rid=101 be_modify (80) Nov 3 12:20:43 stooge01 slapd[19271]: syncrepl_entry: rid=101 be_modify failed (80) 'foobar' is in this case a very recently added user, which was added using ldap_add from a remote python script. A slapcat on the masters shows me the following: dn: uid=foobar,ou=people,dc=ntnu,dc=no uid: foobar norEduPersonBirthDate: 19800101 title: temp eduPersonAffiliation: member eduPersonAffiliation: employee eduPersonOrgDN: dc=ntnu,dc=no eduPersonPrincipalName: foobar(a)ntnu.no sn: Foo mail: foo.bar(a)math.ntnu.no givenName: Foo Bar norEduPersonNIN: 01018012345 cn: Foo Bar entryUUID: f397404e-5be3-102e-8099-a37fef513806 creatorsName: cn=bdb_admin,dc=ntnu,dc=no createTimestamp: 20091102101220Z userPassword:: e1NTXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: eduPerson objectClass: norEduPerson objectClass: ntnuPerson entryCSN: 20091103001746.825477Z#000000#002#000000 modifiersName: cn=oidsync_admin,dc=ntnu,dc=no modifyTimestamp: 20091103001746Z Now, as you can see, this user has no structuralObjectClass, even though it's been added using slapd(8). The older users, which was added using slapcat, have structuralObjectClass: inetOrgPerson. And since it lacks the structuralObjectClass, it apparently cannot be replicated to the slaves. I could replicate with schemachecking=off, however, this will only populate the slaves with the same rotten data, and that has other unwanted implications. Can anyone point me in the right direction here? I have found a lot of material on google, however, it seems nobody has had slapd(8) populate its database with this kind of bad data before. Kind regards c The following is the schema files, in case they are interesting: SCHEMA: cn={0}core.ldif: dn: cn={0}core objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: kno wledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (f amily) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial numb er of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC2256: ISO- 3166 country 2-letter code' SUP name SINGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: loc ality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2 256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC225 6: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui de, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: busin ess category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal a ddress' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Off ice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2 256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnor eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Teleph one Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Numb er' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC22 56: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DE SC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Addr ess' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256 : international ISDN number' EQUALITY numericStringMatch SUBSTR numericString SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: regi stered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: d estination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} ) olcAttributeTypes: {24}( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC2256 : preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE-VALU E ) olcAttributeTypes: {25}( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: pr esentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.43 SINGLE-VALUE ) olcAttributeTypes: {26}( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'RFC 2256: supported application context' EQUALITY objectIdentifierMatch SYNTAX 1. 3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {27}( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a gro up' SUP distinguishedName ) olcAttributeTypes: {28}( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the ob ject)' SUP distinguishedName ) olcAttributeTypes: {29}( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupant of role' SUP distinguishedName ) olcAttributeTypes: {30}( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.509 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.8 ) olcAttributeTypes: {31}( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.8 ) olcAttributeTypes: {32}( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC2256 : X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.9 ) olcAttributeTypes: {33}( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC22 56: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.9 ) olcAttributeTypes: {34}( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X .509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 0 ) olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: fir st name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {36}( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of s ome or all of names, but not the surname(s).' SUP name ) olcAttributeTypes: {37}( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: na me qualifier indicating a generation' SUP name ) olcAttributeTypes: {38}( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X .500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.6 ) olcAttributeTypes: {39}( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN qualifi er' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcAttributeTypes: {40}( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: en hanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 ) olcAttributeTypes: {41}( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: pr otocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.42 ) olcAttributeTypes: {42}( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique me mber of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .34 ) olcAttributeTypes: {43}( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: house identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {44}( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: su pported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 ) olcAttributeTypes: {45}( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: de lta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) olcAttributeTypes: {46}( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' S UP name ) olcAttributeTypes: {47}( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudonym for the object' SUP name ) olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIg noreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA LUE ) olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DE SC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {51}( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'p kcs9email' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUA LITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.26{128} ) olcObjectClasses: {0}( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP to p STRUCTURAL MUST c MAY ( searchGuide $ description ) ) olcObjectClasses: {1}( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SUP top STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ description ) ) olcObjectClasses: {2}( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organizat ion' SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ b usinessCategory $ x121Address $ registeredAddress $ destinationIndicator $ pr eferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNu mber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOffi ceBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ de scription ) ) olcObjectClasses: {3}( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an org anizational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destination Indicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ str eet $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {4}( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP top STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) ) olcObjectClasses: {5}( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an o rganizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ regis teredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facs imileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l ) ) olcObjectClasses: {6}( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an org anizational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ registeredAd dress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ telete xTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTe lephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $ p ostOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l $ description ) ) olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of n ames (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) ) olcObjectClasses: {8}( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an res idential person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x121Ad dress $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDN Number $ facsimileTelephoneNumber $ preferredDeliveryMethod $ street $ postOf ficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) ) olcObjectClasses: {9}( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an ap plication process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ descri ption ) ) olcObjectClasses: {10}( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an ap plication entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MAY ( supportedApplicationContext $ seeAlso $ ou $ o $ l $ description ) ) olcObjectClasses: {11}( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory system agent (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformation ) olcObjectClasses: {12}( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP to p STRUCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ desc ription ) ) olcObjectClasses: {13}( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC2256 : a strong authentication user' SUP top AUXILIARY MUST userCertificate ) olcObjectClasses: {14}( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256: a certificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ c ertificateRevocationList $ cACertificate ) MAY crossCertificatePair ) olcObjectClasses: {15}( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a gr oup of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uni queMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ descript ion ) ) olcObjectClasses: {16}( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC2256: a user security information' SUP top AUXILIARY MAY supportedAlgorithms ) olcObjectClasses: {17}( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP certif icationAuthority AUXILIARY MAY deltaRevocationList ) olcObjectClasses: {18}( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTURA L MUST cn MAY ( certificateRevocationList $ authorityRevocationList $ deltaRe vocationList ) ) olcObjectClasses: {19}( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST dmdName MA Y ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ r egisteredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumb er $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddres s $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {20}( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' SUP top AUXILIARY MAY userCertificate ) olcObjectClasses: {21}( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate a uthority' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRevoca tionList $ cACertificate $ crossCertificatePair ) ) olcObjectClasses: {22}( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SUP top AUXILIARY MAY deltaRevocationList ) olcObjectClasses: {23}( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'RFC 2079: object that contains the URI attribute type' SUP top AUXILIARY MAY labe ledURI ) olcObjectClasses: {24}( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject' DESC 'RFC1274: simple security object' SUP top AUXILIARY MUST userPassword ) olcObjectClasses: {25}( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: do main component object' SUP top AUXILIARY MUST dc ) olcObjectClasses: {26}( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid obje ct' SUP top AUXILIARY MUST uid ) structuralObjectClass: olcSchemaConfig entryUUID: eeea40e4-d26a-102d-8211-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={1}cosine.ldif: dn: cn={1}cosine objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC ' RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {23}( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' D ESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIg noreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {24}( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {25}( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTel ephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNum berMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.50 ) olcAttributeTypes: {26}( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelep honeNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumber Match SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .50 ) olcAttributeTypes: {27}( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCount ryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBS TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {28}( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DE SC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15{256} ) olcAttributeTypes: {29}( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus ' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseI gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {30}( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC ' RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {31}( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption ' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: {32}( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC ' RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {33}( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RF C1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE ) olcAttributeTypes: {34}( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SIN GLE-VALUE ) olcAttributeTypes: {35}( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQualit y' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 13 SINGLE-VALUE ) olcAttributeTypes: {36}( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQualit y' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 13 SINGLE-VALUE ) olcAttributeTypes: {37}( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' D ESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 23 ) olcAttributeTypes: {38}( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'R FC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.12 ) olcAttributeTypes: {39}( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274 : audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} ) olcAttributeTypes: {40}( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' D ESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: {0}( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilo tPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822 Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ hom ePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ busine ssCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelep honeNumber $ organizationalStatus $ mailPreferenceOption $ personalSignature ) ) olcObjectClasses: {1}( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCT URAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationNam e $ organizationalUnitName $ host ) ) olcObjectClasses: {2}( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUC TURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ loca lityName $ organizationName $ organizationalUnitName $ documentTitle $ docume ntVersion $ documentAuthor $ documentLocation $ documentPublisher ) ) olcObjectClasses: {3}( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURA L MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) ) olcObjectClasses: {4}( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ l ocalityName $ organizationName $ organizationalUnitName ) ) olcObjectClasses: {5}( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCT URAL MUST domainComponent MAY ( associatedName $ organizationName $ descripti on $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $ stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalAdd ress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ tel exNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) ) olcObjectClasses: {6}( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP d omain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telepho neNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOffi ceBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDelivery Method $ destinationIndicator $ registeredAddress $ x121Address ) ) olcObjectClasses: {7}( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAME Record ) ) olcObjectClasses: {8}( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' D ESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associat edDomain ) olcObjectClasses: {9}( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP c ountry STRUCTURAL MUST friendlyCountryName ) olcObjectClasses: {10}( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SU P ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName ) olcObjectClasses: {11}( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STR UCTURAL MAY dSAQuality ) olcObjectClasses: {12}( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximu mQuality ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea58f4-d26a-102d-8212-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={2}nis.ldif: dn: cn={2}nis objectClass: olcSchemaConfig cn: {2}nis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; th e common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolut e path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to th e login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 6 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactI A5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY ca seExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgr oup triple' SYNTAX 1.3.6.1.1.1.0.0 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY int egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP address ' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP netw ork' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netm ask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootp aramd parameter' SYNTAX 1.3.6.1.1.1.0.1 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image nam e' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseExac tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.26{1024} SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction o f an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNu mber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional a ttributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPassword $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ description ) ) olcObjectClasses: {2}( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPas sword $ memberUid $ description ) ) olcObjectClasses: {3}( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Abstraction an I nternet Protocol service' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipSe rviceProtocol ) MAY description ) olcObjectClasses: {4}( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Abstraction of an IP protocol' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber $ description ) MAY description ) olcObjectClasses: {5}( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Abstraction of an O NC/RPC binding' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber $ description ) M AY description ) olcObjectClasses: {6}( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Abstraction of a ho st, an IP device' SUP top AUXILIARY MUST ( cn $ ipHostNumber ) MAY ( l $ desc ription $ manager ) ) olcObjectClasses: {7}( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Abstraction of a n IP network' SUP top STRUCTURAL MUST ( cn $ ipNetworkNumber ) MAY ( ipNetmas kNumber $ l $ description $ manager ) ) olcObjectClasses: {8}( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Abstraction of a netgroup' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberNisNe tgroup $ description ) ) olcObjectClasses: {9}( 1.3.6.1.1.1.2.9 NAME 'nisMap' DESC 'A generic abstracti on of a NIS map' SUP top STRUCTURAL MUST nisMapName MAY description ) olcObjectClasses: {10}( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'An entry in a NIS map' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY descri ption ) olcObjectClasses: {11}( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'A device w ith a MAC address' SUP top AUXILIARY MAY macAddress ) olcObjectClasses: {12}( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'A device with boot parameters' SUP top AUXILIARY MAY ( bootFile $ bootParameter ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea6a38-d26a-102d-8213-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={3}inetorgperson.ldif: dn: cn={3}inetorgperson objectClass: olcSchemaConfig cn: {3}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC ' RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI NGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF C2798: numerically identifies an employee within an organization' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ ini tials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre ferredLanguage $ userSMIMECertificate $ userPKCS12 ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea74c4-d26a-102d-8214-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={4}EduPerson.ldif: dn: cn={4}EduPerson objectClass: olcSchemaConfig cn: {4}EduPerson olcObjectIdentifier: {0}MACE 1.3.6.1.4.1.5923.1 olcObjectIdentifier: {1}eduP MACE:1 olcObjectIdentifier: {2}eduPAttribute eduP:1 olcObjectIdentifier: {3}eduPObjClass eduP:2 olcObjectIdentifier: {4}eduO MACE:2 olcObjectIdentifier: {5}eduOAttribute eduO:1 olcObjectIdentifier: {6}eduOObjClass eduO:2 olcAttributeTypes: {0}( eduPAttribute:1 NAME 'eduPersonAffiliation' DESC 'eduP erson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.15 ) olcAttributeTypes: {1}( eduPAttribute:2 NAME 'eduPersonNickname' DESC 'eduPers on per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15 ) olcAttributeTypes: {2}( eduPAttribute:3 NAME 'eduPersonOrgDN' DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {3}( eduPAttribute:4 NAME 'eduPersonOrgUnitDN' DESC 'eduPer son per Internet2 and EDUCAUSE' EQUALITY distinguishedNameMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {4}( eduPAttribute:5 NAME 'eduPersonPrimaryAffiliation' DES C 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {5}( eduPAttribute:6 NAME 'eduPersonPrincipalName' DESC 'ed uPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4 .1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {6}( eduPAttribute:7 NAME 'eduPersonEntitlement' DESC 'eduP erson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.15 ) olcAttributeTypes: {7}( eduPAttribute:8 NAME 'eduPersonPrimaryOrgUnitDN' DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {8}( eduOAttribute:2 NAME 'eduOrgHomePageURI' DESC 'eduOrg per Internet2 and EDUCAUSE' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.15 ) olcAttributeTypes: {9}( eduOAttribute:3 NAME 'eduOrgIdentityAuthNPolicyURI' DE SC 'eduOrg per Internet2 and EDUCAUSE' EQUALITY caseExactMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.15 ) olcAttributeTypes: {10}( eduOAttribute:4 NAME 'eduOrgLegalName' DESC 'eduOrg p er Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.15 ) olcAttributeTypes: {11}( eduOAttribute:5 NAME 'eduOrgSuperiorURI' DESC 'eduOrg per Internet2 and EDUCAUSE' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.15 ) olcAttributeTypes: {12}( eduOAttribute:6 NAME 'eduOrgWhitePagesURI' DESC 'eduO rg per Internet2 and EDUCAUSE' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.15 ) olcObjectClasses: {0}( eduPObjClass NAME 'eduPerson' AUXILIARY MAY ( eduPerson Affiliation $ eduPersonNickname $ eduPersonOrgDN $ eduPersonOrgUnitDN $ eduPe rsonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlement $ eduP ersonPrimaryOrgUnitDN ) ) olcObjectClasses: {1}( eduOObjClass NAME 'eduOrg' AUXILIARY MAY ( cn $ eduOrgH omePageURI $ eduOrgIdentityAuthNPolicyURI $ eduOrgLegalName $ eduOrgSuperiorU RI $ eduOrgWhitePagesURI ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea7d8e-d26a-102d-8215-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={5}norEduPerson.ldif: dn: cn={5}norEduPerson objectClass: olcSchemaConfig cn: {5}norEduPerson olcAttributeTypes: {0}( 1.3.6.1.4.1.2428.90.1.5 NAME 'norEduPersonNIN' DESC 'N ational Identity Number, assigned by public authorities' EQUALITY caseIgnoreM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.4.1.2428.90.1.4 NAME 'norEduPersonLIN' DESC 'L ocally defined unique identifier for a person' EQUALITY caseIgnoreMatch SUBST R caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.2428.90.1.6 NAME 'norEduOrgAcronym' DESC ' Acronym for the organization.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.2428.90.1.3 NAME 'norEduPersonBirthDate' D ESC 'Birth date for a person.' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.2428.90.1.11 NAME 'norEduOrgSchemaVersion' DESC 'Version number of the norEdu schema used by the organization' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 1.3.6.1.4.1.2428.90.1.7 NAME 'norEduOrgUniqueIdentifie r' DESC 'Unique identifier describing the organization.' EQUALITY caseIgnoreM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.2428.90.1.8 NAME 'norEduOrgUnitUniqueIdent ifier' DESC 'Unique identifier describing the organizational unit.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.2428.90.1.12 NAME 'norEduOrgNIN' DESC 'Ide ntifier assigned to the organization by public authorities' EQUALITY caseIgno reMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.2428.90.1.1 NAME 'norEduOrgUniqueNumber' D ESC 'The number describing the institution.' EQUALITY integerMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.2428.90.1.2 NAME 'norEduOrgUnitUniqueNumbe r' DESC 'The number describing the organizational unit.' EQUALITY integerMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.2428.90.1.9 NAME 'federationFeideSchemaVe rsion' DESC 'The norEdu scheme version used by the LDAP of the organization . ' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.2428.90.2.1 NAME 'norEduOrg' DESC 'Suppleme ntary attributes for an educational organization' AUXILIARY MAY ( norEduOrgUn iqueIdentifier $ norEduOrgNIN $ norEduOrgAcronym $ norEduOrgSchemaVersion $ d c $ mail $ labeledURI ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.2428.90.2.2 NAME 'norEduOrgUnit' DESC 'Supp lementary attributes for a unit of an educational organization' AUXILIARY MAY ( norEduOrgUnitUniqueIdentifier $ norEduOrgAcronym $ cn $ mail $ labeledURI ) ) olcObjectClasses: {2}( 1.3.6.1.4.1.2428.90.2.3 NAME 'norEduPerson' DESC 'Suppl ementary attributes for a person affiliated with an educational organization' AUXILIARY MAY ( norEduPersonNIN $ norEduPersonLIN $ norEduPersonBirthDate ) ) olcObjectClasses: {3}( 1.3.6.1.4.1.2428.90.2.4 NAME 'norEduObsolete' DESC 'Att ributes obsoleted in norEdu 1.4 or later' AUXILIARY MAY ( norEduOrgUniqueNumb er $ norEduOrgUnitUniqueNumber $ federationFeideSchemaVersion ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea86ee-d26a-102d-8216-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={6}postfix.ldif: dn: cn={6}postfix objectClass: olcSchemaConfig cn: {6}postfix olcAttributeTypes: {0}( 1.3.6.1.4.1.15347.2.102 NAME 'transport' SUP name ) olcAttributeTypes: {1}( 1.3.6.1.4.1.15347.2.101 NAME 'mailRoutingAddress' SUP mail ) olcAttributeTypes: {2}( 1.3.6.1.4.1.15347.2.110 NAME 'maildest' DESC 'Restrict ed to send only to local network' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {3}( 1.3.6.1.4.1.15347.2.111 NAME 'mailaccess' DESC 'Can be mailed to restricted groups' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {4}( 1.3.6.1.4.1.15347.2.100 NAME 'maildrop' DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {5}( 1.3.6.1.4.1.10018.1.1.1 NAME 'mailbox' DESC 'The absol ute path to the mailbox for a mail account in a non-default location' EQUALIT Y caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.15347.2.1 NAME 'mailUser' DESC 'E-Mail User ' SUP top AUXILIARY MUST ( uid $ mail $ maildrop ) MAY ( cn $ mailbox $ maild est $ mailaccess ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.15347.2.2 NAME 'mailGroup' DESC 'E-Mail Gro up' SUP top STRUCTURAL MUST ( cn $ mail ) MAY ( mailRoutingAddress $ member $ description ) ) olcObjectClasses: {2}( 1.3.6.1.4.1.15347.2.3 NAME 'transportTable' DESC 'MTA T ransport Table' SUP top STRUCTURAL MUST ( cn $ transport ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea8e64-d26a-102d-8217-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={7}amavis.ldif: dn: cn={7}amavis objectClass: olcSchemaConfig cn: {7}amavis olcAttributeTypes: {0}( 1.3.6.1.4.1.15312.2.2.1.1 NAME 'amavisVirusLover' DESC 'Virus Lover' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SING LE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.4.1.15312.2.2.1.2 NAME 'amavisBannedFilesLover ' DESC 'Banned Files Lover' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.7 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.15312.2.2.1.3 NAME 'amavisBypassVirusCheck s' DESC 'Bypass Virus Check' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.15312.2.2.1.4 NAME 'amavisBypassSpamChecks ' DESC 'Bypass Spam Check' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.7 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.15312.2.2.1.5 NAME 'amavisSpamTagLevel' DE SC 'Spam Tag Level' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.15312.2.2.1.6 NAME 'amavisSpamTag2Level' D ESC 'Spam Tag2 Level' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.15312.2.2.1.7 NAME 'amavisSpamKillLevel' D ESC 'Spam Kill Level' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.15312.2.2.1.8 NAME 'amavisSpamModifiesSubj ' DESC 'Modifies Subject on spam' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.15312.2.2.1.9 NAME 'amavisWhitelistSender' DESC 'White List Sender' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Sub stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {9}( 1.3.6.1.4.1.15312.2.2.1.10 NAME 'amavisBlacklistSender ' DESC 'Black List Sender' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {10}( 1.3.6.1.4.1.15312.2.2.1.11 NAME 'amavisSpamQuarantine To' DESC 'Spam Quarantine to' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA 5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.15312.2.2.1.12 NAME 'amavisSpamLover' DES C 'Spam Lover' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SING LE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.15312.2.2.1.13 NAME 'amavisBadHeaderLover ' DESC 'Bad Header Lover' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.15312.2.2.1.14 NAME 'amavisBypassBannedCh ecks' DESC 'Bypass Banned Files Check' EQUALITY booleanMatch SYNTAX 1.3.6.1.4 .1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.15312.2.2.1.15 NAME 'amavisBypassHeaderCh ecks' DESC 'Bypass Header Check' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.15312.2.2.1.16 NAME 'amavisVirusQuarantin eTo' DESC 'Virus quarantine location' EQUALITY caseIgnoreIA5Match SUBSTR case IgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VAL UE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.15312.2.2.1.17 NAME 'amavisBannedQuaranti neTo' DESC 'Banned Files quarantine location' EQUALITY caseIgnoreIA5Match SUB STR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SI NGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.4.1.15312.2.2.1.18 NAME 'amavisBadHeaderQuara ntineTo' DESC 'Bad Header quarantine location' EQUALITY caseIgnoreIA5Match SU BSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} S INGLE-VALUE ) olcAttributeTypes: {18}( 1.3.6.1.4.1.15312.2.2.1.19 NAME 'amavisLocal' DESC 'I s user considered local' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.7 SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.4.1.15312.2.2.1.20 NAME 'amavisMessageSizeLim it' DESC 'Message size limit' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA 5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.4.1.15312.2.2.1.21 NAME 'amavisWarnVirusRecip ' DESC 'Notify virus recipients' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {21}( 1.3.6.1.4.1.15312.2.2.1.22 NAME 'amavisWarnBannedReci p' DESC 'Notify banned file recipients' EQUALITY booleanMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {22}( 1.3.6.1.4.1.15312.2.2.1.23 NAME 'amavisWarnBadHeaderR ecip' DESC 'Notify bad header recipients' EQUALITY booleanMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {23}( 1.3.6.1.4.1.15312.2.2.1.24 NAME 'amavisVirusAdmin' DE SC 'Virus admin' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {24}( 1.3.6.1.4.1.15312.2.2.1.25 NAME 'amavisNewVirusAdmin' DESC 'New virus admin' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {25}( 1.3.6.1.4.1.15312.2.2.1.26 NAME 'amavisSpamAdmin' DES C 'Spam admin' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {26}( 1.3.6.1.4.1.15312.2.2.1.27 NAME 'amavisBannedAdmin' D ESC 'Banned file admin' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {27}( 1.3.6.1.4.1.15312.2.2.1.28 NAME 'amavisBadHeaderAdmin ' DESC 'Bad header admin' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Sub stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {28}( 1.3.6.1.4.1.15312.2.2.1.29 NAME 'amavisBannedRuleName s' DESC 'Banned rule names' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5S ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcObjectClasses: {0}( 1.3.6.1.4.1.15312.2.2.2.1 NAME 'amavisAccount' DESC 'Am avisd Account' SUP top AUXILIARY MAY ( amavisVirusLover $ amavisBypassVirusCh ecks $ amavisSpamLover $ amavisBypassSpamChecks $ amavisBannedFilesLover $ am avisBypassBannedChecks $ amavisBadHeaderLover $ amavisBypassHeaderChecks $ am avisSpamTagLevel $ amavisSpamTag2Level $ amavisSpamKillLevel $ amavisWhitelis tSender $ amavisBlacklistSender $ amavisSpamQuarantineTo $ amavisVirusQuarant ineTo $ amavisBannedQuarantineTo $ amavisBadHeaderQuarantineTo $ amavisSpamMo difiesSubj $ amavisLocal $ amavisMessageSizeLimit $ amavisWarnVirusRecip $ am avisWarnBannedRecip $ amavisWarnBadHeaderRecip $ amavisVirusAdmin $ amavisNew VirusAdmin $ amavisSpamAdmin $ amavisBannedAdmin $ amavisBadHeaderAdmin $ ama visBannedRuleNames $ cn $ description ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeea9b16-d26a-102d-8218-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={8}calendar.ldif: dn: cn={8}calendar objectClass: olcSchemaConfig cn: {8}calendar olcAttributeTypes: {0}( 1.3.6.1.4.1.2672.1.1 NAME 'ctCalAccess' EQUALITY caseI gnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.4.1.2672.1.2 NAME 'ctCalAccessDomain' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.15 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.2672.1.3 NAME 'ctCalAdmd' EQUALITY caseIgn oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 5 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.2672.1.4 NAME 'ctCalDefaultNoteReminder' E QUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1 466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.2672.1.5 NAME 'ctCalDefaultReminder' EQUAL ITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.2672.1.6 NAME 'ctCalDefaultTaskReminder' E QUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1 466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.2672.1.7 NAME 'ctCalDisplayPrefs' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.15 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.2672.1.8 NAME 'ctCalFlags' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.2672.1.9 NAME 'ctCalHost' EQUALITY caseIgn oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 5 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.2672.1.10 NAME 'ctCalLanguageId' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.15 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.2672.1.11 NAME 'ctCalNodeAlias' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.15 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.2672.1.12 NAME 'ctCalNotifMechanism' EQUA LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.2672.1.13 NAME 'ctCalOperatingPrefs' EQUA LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.2672.1.14 NAME 'ctCalOrgUnit2' EQUALITY c aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.2672.1.15 NAME 'ctCalOrgUnit3' EQUALITY c aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.2672.1.16 NAME 'ctCalOrgUnit4' EQUALITY c aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.2672.1.17 NAME 'ctCalPasswordRequired' EQ UALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.4.1.2672.1.18 NAME 'ctCalPrmd' EQUALITY caseI gnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 SINGLE-VALUE ) olcAttributeTypes: {18}( 1.3.6.1.4.1.2672.1.19 NAME 'ctCalRefreshPrefs' EQUALI TY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.4.1.2672.1.20 NAME 'ctCalResourceCapacity' EQ UALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.4.1.2672.1.21 NAME 'ctCalResourceNumber' EQUA LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {21}( 1.3.6.1.4.1.2672.1.22 NAME 'ctCalServerVersion' EQUAL ITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {22}( 1.3.6.1.4.1.2672.1.23 NAME 'ctCalSysopCanWritePasswor d' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4 .1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {23}( 1.3.6.1.4.1.2672.1.24 NAME 'ctCalTimezone' EQUALITY c aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 SINGLE-VALUE ) olcAttributeTypes: {24}( 1.3.6.1.4.1.2672.1.25 NAME 'ctCalXItemId' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {25}( 1.3.6.1.4.1.2672.1.26 NAME 'ctCalOrgUnit1' EQUALITY c aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 SINGLE-VALUE ) olcAttributeTypes: {26}( 1.3.6.1.4.1.2672.1.27 NAME 'ctCalOrganization' EQUALI TY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {27}( 1.3.6.1.4.1.2672.1.28 NAME 'ctCalCountry' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {28}( 1.3.6.1.4.1.2672.1.29 NAME 'ctCalMobileTelephoneType' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {29}( 1.3.6.1.4.1.2672.1.30 NAME 'ctCalPreferredSMSCTelepho neNumber' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1. 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {30}( 1.3.6.1.4.1.2672.1.31 NAME 'ctCalPublishedType' EQUAL ITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {31}( 1.3.6.1.4.1.2672.1.32 NAME 'ctCalSMSTimeRange' EQUALI TY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.15 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.2672.3.1 NAME 'ctCalAdmin' DESC 'Object cla ss for calendar administrators' SUP top STRUCTURAL MUST ctCalXItemId MAY ( c $ cn $ facsimileTelephoneNumber $ generationQualifier $ givenName $ initials $ mail $ o $ ou $ postalAddress $ sn $ telephoneNumber $ userPassword $ ctCal Access $ ctCalAccessDomain $ ctCalAdmd $ ctCalFlags $ ctCalHost $ ctCalLangua geId $ ctCalNodeAlias $ ctCalOrgUnit2 $ ctCalOrgUnit3 $ ctCalOrgUnit4 $ ctCal PasswordRequired $ ctCalPrmd $ ctCalServerVersion $ ctCalSysopCanWritePasswor d $ ctCalOrgUnit1 $ ctCalOrganization $ ctCalCountry ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.2672.3.2 NAME 'ctCalResource' DESC 'Object class for calendar resources' SUP top STRUCTURAL MUST ( cn $ ctCalXItemId ) M AY ( c $ facsimileTelephoneNumber $ givenName $ mail $ postalAddress $ sn $ t elephoneNumber $ userPassword $ ctCalAccess $ ctCalAccessDomain $ ctCalDefaul tNoteReminder $ ctCalDefaultReminder $ ctCalDefaultTaskReminder $ ctCalDispla yPrefs $ ctCalFlags $ ctCalHost $ ctCalLanguageId $ ctCalNodeAlias $ ctCalNot ifMechanism $ ctCalOperatingPrefs $ ctCalPasswordRequired $ ctCalServerVersio n $ ctCalSysopCanWritePassword $ ctCalRefreshPrefs $ ctCalResourceCapacity $ ctCalResourceNumber $ ctCalTimeZone ) ) olcObjectClasses: {2}( 1.3.6.1.4.1.2672.3.3 NAME 'ctCalUser' DESC 'Object clas s for calendar users' AUXILIARY MUST ctCalXItemId MAY ( c $ employeeNumber $ generationQualifier $ givenName $ mail $ facsimileTelephoneNumber $ o $ ou $ postalAddress $ title $ telephoneNumber $ ctCalAccess $ ctCalAccessDomain $ c tCalDefaultNoteReminder $ ctCalAdmd $ ctCalDefaultReminder $ ctCalDefaultTask Reminder $ ctCalDisplayPrefs $ ctCalFlags $ ctCalHost $ ctCalLanguageId $ ctC alNodeAlias $ ctCalNotifMechanism $ ctCalOperatingPrefs $ ctCalOrgUnit2 $ ctC alOrgUnit3 $ ctCalOrgUnit4 $ ctCalPasswordRequired $ ctCalServerVersion $ ctC alSysopCanWritePassword $ ctCalRefreshPrefs $ ctCalPrmd $ ctcalTimeZone $ ctC alXItemId $ ctCalOrgUnit1 $ ctCalOrganization $ ctCalCountry $ ctCalMobileTel ephoneType $ ctCalPreferredSMSCTelephoneNumber $ ctCalPublishedType $ ctCalSM STimeRange $ mobile ) ) structuralObjectClass: olcSchemaConfig entryUUID: eeeaaaca-d26a-102d-8219-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z SCHEMA: cn={9}ntnu.ldif: dn: cn={9}ntnu objectClass: olcSchemaConfig cn: {9}ntnu olcObjectIdentifier: {0}NTNU 1.3.6.1.4.1.13207.2 olcObjectIdentifier: {1}ntnuAttribute NTNU:1 olcObjectIdentifier: {2}ntnuObjClass NTNU:2 olcObjectIdentifier: {3}ntnuAttrSynt NTNU:3 olcAttributeTypes: {0}( ntnuAttribute:1 NAME 'ntnuAccessCardId' DESC 'The id d escribing a NTNU accesscard.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.15 ) olcAttributeTypes: {1}( ntnuAttribute:2 NAME 'ntnuEduPersonScopedAffiliation' DESC 'What type of affiliation and where e.g. student(a)idi.ntnu.no' EQUALITY c aseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( ntnuAttribute:3 NAME 'ntnuEduPersonScopedAffiliationEx piration' DESC 'Same as ntnuEduPersonScopedAffiliation, but has a comma and a date stamp appended to it. E.g. student(a)idi.ntnu.no,20080515' EQUALITY caseI gnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {3}( ntnuAttribute:4 NAME 'ntnuAccessCardId0' DESC 'The id describing a NTNU accesscard.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {4}( ntnuAttribute:5 NAME 'ntnuAccessCardId1' DESC 'The id describing a NTNU accesscard.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( ntnuAttribute:6 NAME 'ntnuPrintDepartment' DESC 'Organizatory location for print users' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {6}( ntnuAttribute:7 NAME 'ntnuPrintHomeServer' DESC 'The print server prefered for this print user' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: {0}( ntnuObjClass:1 NAME 'ntnuAccessCardHolder' DESC 'Supplementary local attributes.' AUXILIARY MUST uid MAY ( ntnuAccessCardId $ ntnuAccessCardId0 $ ntnuAccessCardId1 $ ntnuPrintDepartment $ ntnuPrintHomeServer ) ) olcObjectClasses: {1}( ntnuObjClass:2 NAME 'ntnuPerson' DESC 'Supplementary lo cal attributes.' AUXILIARY MUST uid MAY ( ntnuAccessCardId $ ntnuEduPersonSco pedAffiliation $ ntnuEduPersonScopedAffiliationExpiration $ norEduOrgAcronym ) ) olcObjectClasses: {2}( ntnuObjClass:3 NAME 'ntnuHiddenObject' DESC 'Objectlass used for Access Restrictions' AUXILIARY ) structuralObjectClass: olcSchemaConfig entryUUID: eeeab4a2-d26a-102d-821a-5fbab7f27ddf creatorsName: cn=config createTimestamp: 20090511113054Z entryCSN: 20090511113054.364338Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090511113054Z -- Christian Haugan Toldnes Overingeniør, Plattform IT-avdelingen, NTNU Tel: (735)98054 Mob: 93060023

5 9

Problem with ldapmodify command
by Kiran Sama 04 Nov '09

04 Nov '09

Hi, I am not able to update the data by using ldapmodify command. I am giving a ldif file to ldapmodify which is having update statements but its giving error message as ldapmodify: invalid format (line 5) entry: "mdn=9874938748,dc=onmobile,dc=com". Command: ldapmodify -D "cn=Manager,dc=onmobile,dc=com" -w secret -x -f insert2.ldif Output: ldapmodify: invalid format (line 5) entry: "mdn=9874938748,dc=onmobile,dc=com". Sample Data in insert2.ldif # Subscriber Data number 10000410 dn:mdn=9874942807,dc=onmobile,dc=com changetype: modify replace: model model:Vodafone225 - replace: gprsEnabled gprsEnabled:false # Subscriber Data number 10000411 dn:mdn=9874942816,dc=onmobile,dc=com changetype: modify replace: model model:Nokia7310Classic - replace: gprsEnabled gprsEnabled:false # Subscriber Data number 10000412 dn:mdn=9874942825,dc=onmobile,dc=com changetype: modify replace: model model:Nokia1208 - replace: gprsEnabled gprsEnabled:false # Subscriber Data number 10000413 dn:mdn=9874942826,dc=onmobile,dc=com changetype: modify replace: model model:Nokia1100 - replace: gprsEnabled gprsEnabled:false # Subscriber Data number 10000414 dn:mdn=9874942833,dc=onmobile,dc=com changetype: modify replace: model model:Nokia5200b - replace: gprsEnabled gprsEnabled:false # Subscriber Data number 10000415 dn:mdn=9874942855,dc=onmobile,dc=com changetype: modify replace: model model:Nokia1600 - replace: gprsEnabled gprsEnabled:false # Subscriber Data number 10000416 dn:mdn=9874942861,dc=onmobile,dc=com changetype: modify replace: model model:SamsungS3500 - replace: gprsEnabled gprsEnabled:false Please help me to resolve this issue. Best Regards, Kiran Sama 9663371026

5 4

Help on Replication
by Márcio Luciano Donada 04 Nov '09

04 Nov '09

Hi People, I am doing replication and until yesterday I was doing successfully, but now to include two new users to master the slave server does not have the information yet, I'm checking the logs with the following message: got empty syncUUID with LDAP_SYNC_ADD configuration of the master server: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index entryCSN,entryUUID eq lastmod on configuration of the slave server: syncrepl rid=001 provider=ldap://xxx.xxx.xxx.245 type=refreshOnly interval=00:00:10:00 searchbase="dc=xxxxxxxxxxxxxx,dc=com,dc=br" filter="(objectclass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=yyyyyyyyyy,dc=xxxxxxxxxxxx,dc=com,dc=br" credentials="xxxxxxxxxxxxx" updateref ldap://xxx.xxx.xxx.245 -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

4 5

Propagation of LDAP passwrod change to samba system
by pcinformace pcinformace 03 Nov '09

03 Nov '09

Hi all, I am trying to set up LDAP + SAMBA to propagate password in both directions but unfortunately I have some small issues I do not know how to resolve. I set up LDAP and SAMBA server and I can connect to them ( all on one machine ) I can connect to samba server and browse shares with smbclient //192.168.1.199/home -U user100 Also I can connect using ssh user100(a)192.168.1.199 ( wirt password I set up for user100 in LDAP system ) where user "user100" is added to samba conf as samba user but its origin is from LDAP and it is is originally added using ldapadd -c -x -D cn=admin,dc=testdomain,dc=net -W -f user100.ldif ldappasswd -x -D cn=admin,dc=testdomain,dc=net -W -S uid=user100,ou=people,dc=testdomain,dc=net I can change password for user "user100" once logged over ssh using "passwd" and this new password apply only on LDAP part, while password for samba is one set up using smbpasswd ( as root on system ) In smb.conf I addedd part passdb backend = ldapsam:ldap://192.168.1.199 ldap admin dn = cn =admin,dc=testdomain,dc=net ldap suffix = dc=testdomain,dc=net ldap user suffix = ou=People ldap group suffix = ou= Group ldap machine suffix = ou= Computers ldap password sync = yes and in case I change password for user "user100" using smbpasswd ( logged as root ), it's password is propagated to LDAP and I can use new password obtained with smbpasswd to log in over ssh---as I expect When logged over ssh to LDAM-SAMBA server as user "user100" and want to change password using smbpasswd I am getting error like smbpasswd Old SMB password: New SMB password: Retype new SMB password: Unable to connect to SMB server on machine 127.0.0.1. Error was : NT_STATUS_CONNECTION_REFUSED. Failed to change password for user100 I do not have address 127.0.0.1 set anywhere in samba configuration output of testparm is bellow Question is how can I make it reversible, so when I change password connected via ssh to be propagated to samba system and to use that new password for accessing samba shares. LDAP and SAMBA servers works ok indenpendently, I can log as LDAP user, home directory is created upon login, connection to samba shares works ok only is question how to set up them to undersdand password of each other. OS is debian stable and all packages are debian's ones If someone know some hint I would be very thankful for any suggestions Thank you and nice regards, testparm Load smb config files from /etc/samba/smb.conf Processing section "[home]" Loaded services file OK. Server role: ROLE_DOMAIN_PDC Press enter to see a dump of your service definitions [global] workgroup = TESTDOMAIN interfaces = 192.168.1.199/24, eth2 bind interfaces only = Yes obey pam restrictions = Yes passdb backend = ldapsam:ldap://192.168.1.199 pam password change = Yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . log level = 3 syslog = 0 log file = /var/log/samba/log.%m max log size = 3000 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 domain logons = Yes dns proxy = No ldap admin dn = cn =admin,dc=testdomain,dc=net ldap group suffix = ou= Group ldap machine suffix = ou= Computers ldap passwd sync = Yes ldap suffix = dc=testdomain,dc=net ldap user suffix = ou=People panic action = /usr/share/samba/panic-action %d valid users = %S create mask = 0700 directory mask = 0700 [home] comment = Users' home dir path = /home valid users = user100 write list = user100

3 3

LDap Search query returning null value
by Vinay Jain 03 Nov '09

03 Nov '09

Hi I m using following piece of code for fetching the subscriber information from the base of about 85 million. After deployment it is returning proper response from LDap for some time. but as hit increases it is returning null value for the same search. And after redeploying the project it again starts working fine. Any help in this regards will be appreciated. Thanks in advance!! public Subscriber findSubscriberByMdn(String mdn) { logger.info("Entered method findSubscriberByMdn with mdn "+mdn); Subscriber subscriber=null; AndFilter filter = new AndFilter(); filter.and(new EqualsFilter("objectclass", subscriberObjectClass)); filter.and(new EqualsFilter("mdn", mdn)); List list=ldapTemplate.search( "", filter.encode(), new SubscriberAttributeMapper() ); if(list!=null && !list.isEmpty()){ subscriber=(Subscriber)list.get(0); } logger.info("The subscriber found is "+subscriber); return subscriber; } Regards Vinay Jain

2 1

pam_groupdn login restriction
by Paul 02 Nov '09

02 Nov '09

I'm currently trying to get group based login working with little success using pam_groupdn on CentOS. Currently, any existing LDAP user is allowed to login to the system, but it does throw the error: "You must be a member of cn=login,ou=Group,dc=mydomain,dc=com to login." I would like to deny logins for any ldap users unless they exist in the specified group (in this case, cn=login,ou=Group,dc=mydomain,dc=com). Can anyone tell me what I'm doing wrong or point me toward some documentation? /etc/ldap.conf: uri ldaps://ldap.mydomain.com base dc=mydomain,dc=com binddn cn=user,ou=People,dc=mydomain,dc=com bindpw password bind_policy soft pam_password md5 pam_login_attribute userID pam_groupdn cn=login,ou=Groups,dc=mydomain,dc=com pam_member_attribute member pam_lookup_policy yes tls_checkpeer no ssl on LDAP login group: dn: cn=login,ou=Group,dc=mydomain,dc=com objectClass: top objectClass: posixGroup cn: login description: login group gidNumber: 100 memberUid: user1 memberUid: user2

3 2

nonpresent_callback in syncrepl
by Volker Wetzelaer 29 Oct '09

29 Oct '09

> Hi there, > > i got a problem with syncrepl, o at least i think it is a problem. > The consumer runs totally normal for a time and the the logfile shows messages > like tge following one. > In fact there are such messages for the whole ldap-entries and the consumer > does no replication while > it is "walking" through the database. > > Can anyone help me with that and tell me how to avoid ? > Or is it not a problem at all ? > > I got 2 other consumers using exactly the same configuration (apart from the > rid) ant those servers > do not show the same problem. > > Oct 28 14:22:29 dusradius02-pluto-voip slapd[31908]: nonpresent_callback: > rid=003 got UUID cf8e7434-574b-102e-9935-cd4b3be449f8, dn > qscId=616351,dc=radius,dc=123 > > thanks, volker >

2 1

Which overlays are present in my openldap server ?
by vishesh kumar 29 Oct '09

29 Oct '09

Dear members Is there any way to know which overlays are present in my openldap servers? Can overrlays can be introduced in precompiled slapd ? Thanks

4 6

Re: samba ldap
by Brett Maxfield 28 Oct '09

28 Oct '09

The log from samba says ldap: where's your test command says ldaps: maybe try ldap: from test command in case you only listen for ssl? On 27/10/2009, at 7:28 PM, Kaushal Shriyan <kaushalshriyan(a)gmail.com> wrote: > Hi, > > I am following https://help.ubuntu.com/8.10/serverguide/C/samba-ldap.html > and ldap works perfectly fine. > I have issues with connecting to ldap from samba. > > I get > > [2009/10/27 12:37:28, 1] lib/smbldap.c:another_ldap_try(1153) > Connection to LDAP server failed for the 9 try! > [2009/10/27 12:37:29, 2] lib/smbldap.c:smbldap_open_connection(786) > smbldap_open_connection: connection opened > [2009/10/27 12:37:29, 2] lib/smbldap.c:smbldap_connect_system(982) > failed to bind to server ldap://localhost/ with > dn="cn=admin,dc=mt,dc=webaroo,dc=com" Error: Can't contact LDAP server > (unknown) > > I have ldapserver running on the same server as samba server is > running. when i run ldapsearch -x -H ldaps://localhost. I am able to > see the user details. > Please let me know if anyone needs configs and additional information. > Also when i run smbldap-populate, i get > http://paste.ubuntu.com/302630/ > > Thanks, > > Kaushal

4 7

defining own attributes/class
by Zdenek Styblik 27 Oct '09

27 Oct '09

Hello, I would like to ask, if somebody knows a really good how-to about $subj. I've read couple books, let's say I'm able to define my own attribute, even extend some existing object - I think these are no problem, as they are based on trying right-wrong. My biggest concern is about numbering [OID/PEN ?]. I've requested PEN from IANA, no problem here. But how should I divide numbers to attributes? Does it matter? Can I run out of space? Do something [utterly] wrong? I just haven't seen this [numbering] explained to the last bit anywhere. Or may be, I've just read wrong. I mean, should it be like tree structure and eg. class1 = prefix.PEN.1.X; class2 = prefix.PEN.2.X; ...; classN = prefix.PEN.N.X; ? But may be there is no "bigger" sense I'm looking for and incremental numbering (+1 per attribute) is just enough. PS: for example, I would like to add JID [jabber ID]/IM [which would hold whatever Instant Messaging string] attribute and extend InetOrgPerson with this attribute. Thanks in advance for explanation/pointing me to the right direction. Regards, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 1

samba ldap
by Kaushal Shriyan 27 Oct '09

27 Oct '09

Hi, I am following https://help.ubuntu.com/8.10/serverguide/C/samba-ldap.html and ldap works perfectly fine. I have issues with connecting to ldap from samba. I get [2009/10/27 12:37:28, 1] lib/smbldap.c:another_ldap_try(1153) Connection to LDAP server failed for the 9 try! [2009/10/27 12:37:29, 2] lib/smbldap.c:smbldap_open_connection(786) smbldap_open_connection: connection opened [2009/10/27 12:37:29, 2] lib/smbldap.c:smbldap_connect_system(982) failed to bind to server ldap://localhost/ with dn="cn=admin,dc=mt,dc=webaroo,dc=com" Error: Can't contact LDAP server (unknown) I have ldapserver running on the same server as samba server is running. when i run ldapsearch -x -H ldaps://localhost. I am able to see the user details. Please let me know if anyone needs configs and additional information. Also when i run smbldap-populate, i get http://paste.ubuntu.com/302630/ Thanks, Kaushal

2 1

Openldap + GroupOffice
by Bruno Steven 27 Oct '09

27 Oct '09

Hi I trying integrate openldap more group-office, somebody have documentation or how to for this ? Thanks.... -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

1 0

Making copies of attribute values
by Ravi Verma 27 Oct '09

27 Oct '09

Dear Friends, I have a need to extend an LDAP schema by adding an attribute and copy the value from an existing attribute to it. We need to keep the two copies of the attribute values in synch. It is a kind of replication where it is replicating one attribute into another in the same record. I appreciate your help. -- Kind regards. Ravi Verma Chief Executive Officer Telecommand Software and Services 3175 Sunset Blvd, Suite 104-B Rocklin, CA 95677 Phone:9167053261 Fax:9169142008 www.telecommand.com

3 3

RE: ppolicy and Red Hat Linux
by Joe Friedeggs 26 Oct '09

26 Oct '09

Re-posting minus the garbage.... >> Debugging this issue has caused me a bit of confusion. In the LDAP logs, when logging into other equipment that 'binds as user', I see warnings, etc. returned: >> >> ppolicy_bind: Setting warning for password expiry for uid=test_user,ou=people,o=theorg,dc=example,dc=net = 1251 secds >> >> BUT, since the Linux LDAP client has a separate 'binddn', I don't see these warnings when the Linux LDAP client does the ldapsearch to validate the user. How does the policy work in this situation? >> >> Am I missing something here? >> > > Hello, > > have a look at 'man pam_ldap': > > <snip> >> pam_lookup_policy <yes|no> >> Specifies whether to search the root DSE for password policy. The default is "no". > <snap> > > Did you set that to yes on your clients in /etc/ldap.conf or what ever > it is called on RHEL5? > > > Regards, > Christian Manal Thanks for the response, Christian. Yes, I have the following in my clients' /etc/ldap.conf: host ldap_svc binddn cn=simpleBind,o=theorg,dc=example,dc=net bindpw simpleBind bind_timelimit 3 base o=theorg,dc=example,dc=net sudoers_base ou=sudoers,o=theorg,dc=example,dc=net timelimit 7 idle_timelimit 3600 nss_base_passwd ou=people,o=theorg,dc=example,dc=net?one nss_base_shadow ou=people,o=theorg,dc=example,dc=net?one nss_base_group ou=groups,o=theorg,dc=example,dc=net?one nss_reconnect_tries 3 nss_initgroups_ignoreusers root,ldap,named,haldaemon,radiusd,linux_admin pam_password md5 pam_groupdn cn=level_3,ou=host_ssh_access,o=theorg,dc=example,dc=net pam_member_attribute uniqueMember pam_lookup_policy yes Thanks, Joe  _________________________________________________________________ Windows 7: Simplify your PC. Learn more. http://www.microsoft.com/Windows/windows-7/default.aspx?ocid=PID24727::T:WL…

1 0

ppolicy and Red Hat Linux
by Joe Friedeggs 26 Oct '09

26 Oct '09

I need help/advise on ppolicy against Linux servers. I am running OpenLDAP 2.3.43-3.el5 (Red Hat rpm) on RHEL5. I am using the ppolicy overlay. The overlay seems to work to all of the tools, etc., that use this LDAP, except for the Linux servers. With these servers, we get no expiry warning, and users can log in after the password has expired (unlimited). We are using PAM/LDAP on these servers. Debugging this issue has caused me a bit of confusion. In the LDAP logs, when logging into other equipment that 'binds as user', I see warnings, etc. returned: ppolicy_bind: Setting warning for password expiry for uid=test_user,ou=people,o=theorg,dc=example,dc=net = 1251 secds BUT, since the Linux LDAP client has a separate 'binddn', I don't see these warnings when the Linux LDAP client does the ldapsearch to validate the user. How does the policy work in this situation? Am I missing something here? Here's what I see when I log in as a users (second login, pwdGraceAuthNLimit=2): login as: test_user test_user@linux_box's password: Last login: Fri Oct 23 19:39:03 2009 from 10.50.1.135 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapwhoami -x -D "uid=test_user,ou=people,o=theorg,dc=example,dc=net" -W -e ppolicy Enter LDAP Password: ldap_bind: Success (0) (Password expired, 1 grace logins remain) dn:uid=test_user,ou=people,o=theorg,dc=example,dc=net Result: Success (0) [test_user@linux_box ~]$ [test_user@linux_box ~]$exit Then on the next login: login as: test_user test_user@linux_box's password: Last login: Fri Oct 23 19:39:26 2009 from 10.50.1.135 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapwhoami -x -D "uid=test_user,ou=people,o=theorg,dc=example,dc=net" -W -e ppolicy Enter LDAP Password: ldap_bind: Invalid credentials (49); Password expired [test_user@linux_box ~]$ [test_user@linux_box ~]$exit Yet again: login as: test_user test_user@linux_box's password: Last login: Fri Oct 23 19:40:12 2009 from 10.50.1.135 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapwhoami -x -D "uid=test_user,ou=people,o=theorg,dc=example,dc=net" -W -e ppolicy Enter LDAP Password: ldap_bind: Invalid credentials (49); Password expired [test_user@linux_box ~]$ [test_user@linux_box ~]$ [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapsearch -x -D 'cn=ldapmanager,o=theorg,dc=example,dc=net' -b 'uid=test_user,ou=people,o=theorg,dc=example,dc=net' -w ldapspwd + # extended LDIF # # LDAPv3 # base <uid=test_user,ou=people,o=theorg,dc=example,dc=net> with scope subtree # filter: (objectclass=*) # requesting: + # # test_user, people, theorg, example.net dn: uid=test_user,ou=people,o=theorg,dc=example,dc=net structuralObjectClass: person entryUUID: d45aa296-a3e4-102d-8c8e-0b16af70e85f creatorsName: cn=ldapmanager,o=theorg,dc=example,dc=net createTimestamp: 20090313063503Z pwdHistory: 20091023185344Z#1.3.6.1.4.1.1466.115.121.1.40#41#{crypt}$1$RCW90SL v$8PfQ99gzlJd.7TH2HnhOS0 pwdHistory: 20091023190836Z#1.3.6.1.4.1.1466.115.121.1.40#41#{crypt}$1$RM6V/En e$0oGsI47SUaIDFap9Nft3z1 pwdHistory: 20091023191529Z#1.3.6.1.4.1.1466.115.121.1.40#41#{crypt}$1$18vC.s9 3$cT38cSrrF/PXMhWqV.P.r/ pwdPolicySubentry: cn=ppdefault_test,ou=policies,o=theorg,dc=example, dc=net pwdChangedTime: 20091023191529Z pwdGraceUseTime: 20091023193816Z pwdGraceUseTime: 20091023193905Z entryCSN: 20091023193905Z#000000#00#000000 modifiersName: cn=ldapmanager,o=theorg,dc=example,dc=net modifyTimestamp: 20091023193905Z entryDN: uid=test_user,ou=people,o=theorg,dc=example,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapsearch -x -D 'cn=ldapmanager,o=theorg,dc=example,dc=net' -b 'cn=ppdefault_test,ou=policies,o=theorg,dc=example,dc=net' -w ldapspwd # extended LDIF # # LDAPv3 # base <cn=ppdefault_test,ou=policies,o=theorg,dc=example,dc=net> with scope subtree # filter: (objectclass=*) # requesting: ALL # # ppdefault_test, policies, theorg, example.net dn: cn=ppdefault_test,ou=policies,o=theorg,dc=example,dc=net cn: ppdefault_test objectClass: person objectClass: pwdPolicy objectClass: pwdPolicyChecker pwdAttribute: userPassword pwdLockout: TRUE pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdGraceAuthNLimit: 2 pwdCheckQuality: 1 pwdInHistory: 3 pwdLockoutDuration: 60 pwdMaxFailure: 5 pwdFailureCountInterval: 603 sn: ppdefault_test pwdMaxAge: 120 pwdExpireWarning: 100 description: test pwdMinAge: 1 pwdSafeModify: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [test_user@linux_box ~]$ [test_user@linux_box ~]$ cat /etc/pam.d/passwd #%PAM-1.0 auth include system-auth account include system-auth password include system-auth [test_user@linux_box ~]$ [test_user@linux_box ~]$ cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so broken_shadow account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 type=LDAP password sufficient /lib/security/$ISA/pam_unix.so nullok md5 use_authtok shadow password sufficient /lib/security/$ISA/pam_ldap.so use_authtok password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session optional /lib/security/$ISA/pam_ldap.so Any advise would be much appreciated (I swear this worked when I tested it last March). Thanks, Joe _________________________________________________________________ Windows 7: Simplify your PC. Learn more. http://www.microsoft.com/Windows/windows-7/default.aspx?ocid=PID24727::T:WL…

2 2

Using Arbitrary X509 certificates for LDAPS authentication
by Stephen Cartwright 24 Oct '09

24 Oct '09

Hi there, Are there any restrictions on the DN or other attributes of credentials used for LDAP authentication? We are using grid credentials (X509 format) with DNs like this: issuer= /C=CA/O=Grid/CN=Grid Canada Certificate Authority subject= /C=CA/O=Grid/CN=host/somehost.somedomain.ca When I use some grid certs (X509 format) I see this message in the debug output from slapd: connection_read(10): unable to get TLS client DN error=49 id=3 When I try to connect, I get this: ldap_initialize( ldaps://somehost.somedomain.ca ) ldap_bind: Can't contact LDAP server The openssl command to create a connection works OK: CONNECTED(00000003) --- Certificate chain 0 s:/C=CA/O=Grid/CN=host/somehost.somedomain.ca i:/C=CA/O=Grid/CN=Grid Canada Certificate Authority 1 s:/C=CA/O=Grid/CN=Grid Canada Certificate Authority i:/C=CA/O=Grid/CN=Grid Canada Certificate Authority --- Server certificate -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- subject=/C=CA/O=Grid/CN=host/somehost.somedomain.ca issuer=/C=CA/O=Grid/CN=Grid Canada Certificate Authority --- No client certificate CA names sent --- SSL handshake has read 2083 bytes and written 320 bytes --- New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : DES-CBC3-SHA Session-ID: 43B46528E848663E7C8E9CAAEA4E6DB5E4A9675C05C3066DBD826CD1CF59A566 Session-ID-ctx: Master-Key: A8245A0731BA98F0D88821346432868C392FEE3F23EAFB9F356A34CB6BB663FC0892374118F280D6284C8E2ACAC3 Key-Arg : None Start Time: 1251330160 Timeout : 300 (sec) Verify return code: 0 (ok) When I use certs created by us with another DN format such as this: subject= /C=CA/ST=Province/L=Town/O=Organization/OU=Unit/CN=somehost.somedomain.ca/emailAddress=email(a)somewhere.ca issuer= /C=CA/ST=Province/O=Organization/OU=Town/CN=Our CA/emailAddress=email(a)somewhere.ca And then make no other changes to the config other than pointing everything to the new commands I can make a connection. Any suggestions? Please advise. Steve

3 6

ldapsearch vs AD output
by Cherubini Enrico 24 Oct '09

24 Oct '09

Good day, hope to be not OT. I have to get members of a group in AD, so here is what I do and what I get: ldapsearch -x -D "pippo(a)dominio.com" -w pippopw "cn=groupname" member:: W049X1MgVmlhPPAaXTDoCxPVT1fQSBNYW51dGOOOemlvbmUgZSBHZXN0aW9uZSBQYX= Rya W1vbmlvLERDPXByb3ZpbmNpYSxEQz12cixEQz1pdA=3D=3D member: CN=_SubGroup2,OU=_SubGroupArea,DC=dominio,DC=com If I do a search whith phpldapadmin I get both name (_SubGroup1 and _SubGroup2), so I guess the problem is how ldapsearch handles the output from AD server or in config file, but can't find a solution. Any hint ? TIA

2 1

2.3.43 master to 2.4.18 slave problem
by Bill MacAllister 23 Oct '09

23 Oct '09

I have hit a replication problem that I am scratching my head over. We are in the midst of migrating from OpenLDAP from 2.3 to 2.4. In our test environment we have a 2.3.43 master with 2.4.18 and 2.3.35 slaves. Replication to the 2.4 slave stopped this morning. When I look at the log I see: Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000000#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000000#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000001#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000001#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000002#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000002#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000003#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000003#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000004#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000004#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000005#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: slap_queue_csn: queing 0x7f09c283b075 20091022031949Z#000005#00#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: syncrepl_message_to_op: rid=000 mods check (homePostalAddress: value #0 invalid per syntax) Oct 22 09:38:28 ldap-uat1 slapd[15032]: slap_graduate_commit_csn: removing 0x7f09c1621438 20091022031949Z#000005#00#000000 So, I slapcat'ed the master's database and looked for that contextCSN. The entry that appears to be the problem has a homePostalAddress of: homePostalAddress: c\o Bain & Company, Two Copley Place, Boston, Massachusetts We had hit this problem before when loading a 2.4 server using slapcat output from a 2.3 server and wrote a simple filter to correctly quote the backslash. This is a problem for us because we expect to have a mixed 2.3/2.4 during the transistion to 2.4 on our production servers. The really nasty bit is that the only way I know for sure to fix this problem is to reload the slave. Is there an alterntive way? Bill -- Bill MacAllister, System Software Programmer Unix Systems Group, Stanford University

3 2

shadow context; no update referral
by Venish Khant 23 Oct '09

23 Oct '09

I had configured openldap in master/slave for replication. It's work perfectly. It's replicated entries but one entry not replicated. I try to add that entry using ldapadd command in my slave server. That time I got the below error. adding new entry "uid=test,ou=people,dc=example,dc=com" ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral -- Venish Khant www.deeproot.co.in

3 2

LDAP Monitoring CN=Monitor
by Andreas Andersson 23 Oct '09

23 Oct '09

Hi! My name is Andreas and I want to inform you about a little project I've been working on called CN=Monitor. It's about monitoring and verifying directory servers with focus on open source LDAP servers. From single installed servers to large scaled deployments. Its a webbased application where you can: * Verify availability, compare load and performance between servers * Collect historical events for long term analysis (and get weekly reports by mail) * Verify cluster and load balancing functionality * Query several directories at the same time for data consistancy verification ... and a lot more. Why the name CN=Monitor. Well.. a lot of the information collected and analyzed is gathered from the CN=Monitor base DN. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor I appreciate all feedback I can get so let me know if there are any features you are missing or other things that can improve the application. Replication and cache monitoring is currently only available for 389 DS. Hopefully this can be added for OpenLDAP in the future. Best regards - Andreas Andersson

2 1

OpenLDAP/TLS+SASL (mech: EXTERNAL) with JNDI
by Stefan Jurisch 22 Oct '09

22 Oct '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I am implementing a custom Java LDAP library for our custom needs, and now I am at the point where I have to write the methods for a TLS authentication. I am searching for a solution since yesterday in the morning, but nothing matched. All found standard examples break with more or less heavy exceptions. I must connect to an OpenLDAP 2.4.x with complete TLS/SASL authentication, meaning the same thing like ldapsearch -T EXTERNAL -ZZ [...] It works well with my certs on CLI, but all tested Java implementations did not work properly yet. The best result I get at the moment, where I receive *only* one exception: [...] LDAP server connection URL: ldap://kungfu.in.siegnetz.de:389/dc=kungfu-local,dc=net javax.naming.AuthenticationNotSupportedException: [LDAP: error code 7 - SASL(-4): no mechanism available: ] at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3032) at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987) at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789) at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703) at com.sun.jndi.ldap.LdapCtx.ensureOpen(LdapCtx.java:2602) at com.sun.jndi.ldap.LdapCtx.extendedOperation(LdapCtx.java:3156) at javax.naming.ldap.InitialLdapContext.extendedOperation(InitialLdapContext.java:164) at de.siegnetz.ldaptools.connection.LDAPServerConnection.open(LDAPServerConnection.java:295) at de.siegnetz.test.SomeLdapTests.ldap_test1(SomeLdapTests.java:29) at de.siegnetz.test.SomeLdapTests.main(SomeLdapTests.java:13) dn: uid=dkent,ou=users,ou=Siegen,dc=kungfu-local,dc=net sambaPrimaryGroupSID: S-1-5-21-3205579064-1077270308-3928157200-513 sambaDomainName: KUNGFU-NET displayName: Kent, Dark (the sincerly unknown evil twin) givenName: Dark [...] where the interesting thing is, that, as you can see, the searchresult of the JNDI request is printed out, broke by the exception. TLS section in slapd.conf looks like this: TLSCertificateFile /etc/openldap/certs/kungfu-cert.pem TLSCertificateKeyFile /etc/openldap/certs/kungfu-key.pem TLSCACertificateFile /etc/openldap/certs/kungfu_ca.pem TLSVerifyClient demand I try to use it with a TinyCA2 created cert with 4096Bit RSA, exported as [...].pem cert and key files for the client + the ca.cert and the server cert and key. Is there perhaps a special X509 format that has to be used? Or are there other traps when using Java and OpenLDAP? I first used the library found here on the page, but I thought it would not fit my needs, because it did neither not work properly. Is there anyone out there who can help me on that issue? Thanks in advance and best regards Stefan - -- S T E F A N J U R I S C H - -------------------------------- System Engineer - VMware Support SIEGNETZ.IT GmbH Schneppenkauten 1a D-57076 Siegen Tel. +49 271 68193- 0 Fax: +49 271 68193-28 http://www.siegnetz.de Amtsgericht Siegen HRB4838 Geschäftsführer: Oliver Seitz Sitz der Gesellschaft ist Siegen - -------------------------------- Das Wort "WINDOWS" stammt aus einem alten Sioux-Dialekt und bedeutet: "Weißer Mann starrt durch Glasscheibe auf Sanduhr." - -------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iEYEARECAAYFAkrgD8AACgkQqdb99cbyCz4fMACdEG25Vo2LCTN+jZbX4dDIEtYs qGkAn2iDEQ7j9fO1oEb4RrXaOVpXLJPz =Jks5 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

why didn't ldap client validate ssl certificate?
by leilei175＠gmail.com 21 Oct '09

21 Oct '09

hi, I have a question on using tls on ldap. Hopefully anybody could give a hint on this. On the client side,I have set the TLS_REQCERT as demand. The TLS_CACERTDIR is also set, but I didn't put any certificate in the directory. To my surprise, even though no certificate is provided, ldapsearch could still succeed returning the data. Is this a bug? the openldap is running on redhat enterprise linux 4, openldap version is openldap-servers-sql-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-clients-2.2.13-12.el4 Any idea is appreciated! Thanks lei

3 2

bug report "ldap_simple_bind_s"
by cress 21 Oct '09

21 Oct '09

A backend daemon using openldap was frequently halted, The problem was finally located at an openldap function ldap_simple_bind_s. Below is a trace back of the running system: #0 0x00a0c7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x004e0b24 in poll () from /lib/tls/libc.so.6 #2 0x00ab8128 in ldap_int_select (ld=0x1, timeout=0x0) at os-ip.c:983 #3 0x00aa7f5f in wait4msg (ld=0x8f0a2c0, msgid=21, all=1, timeout=0x0, result=0x36fc1c4) at result.c:355 #4 0x00aa7b32 in ldap_result (ld=0x8f0a2c0, msgid=21, all=1, timeout=0x0, result=0x36fc1c4) at result.c:127 #5 0x00aad5d2 in ldap_sasl_bind_s (ld=0x8f0a2c0, dn=0x36fc260 "uid=chenming,domain=vip.eyou.net,o=vip.eyou.net", mechanism=0x0, cred=0x36fc208, sctrls=0x0, cctrls=0x0, servercredp=0x0) at sasl.c:194 #6 0x00aadc74 in ldap_simple_bind_s (ld=0x8f0a2c0, dn=0x36fc260 "uid=chenming,domain=vip.eyou.net,o=vip.eyou.net", passwd=0x36fca4a "") at sbind.c:113 #7 0x003ab2b0 in eyou_db_alias_auth (pdbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", alias=0x36fc5c0 "") at ldap/eyou_db.c:153 #8 0x003ab1ae in eyou_db_real_auth (dh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", realuid=0x36fc5c0 "", realdomain=0x36fc570 "") at ldap/eyou_db.c:123 #9 0x003c7669 in get_user_info_by_ldap (uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", userinfo=0x8efbd18, edbh=0x36fd3a8, password=0x36fca40 "xxxxxxxxx") at utils/user_info.c:559 #10 0x003c5cd9 in get_user_info (edbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", userinfo=0x8efbd18) at utils/user_info.c:160 #11 0x003a18da in user_validate (edbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", pass=0x36fca40 "chenkane1", userinfo=0x8efbd18) at utils/user_validate.c:61 #12 0x0804b6f2 in pop3_pass (arg=0x36fce80 "xxxxxxxxx", fun_arg=0x8efd8a0) at pop3_protocol.c:363 #13 0x0804d41a in new_commands (eio_fp=0x8f15cb8, tls_start=0, ssl=0x0, c=0x36fd2e0, fun_arg=0x8efd8a0) at commands.c:63 #14 0x0804ad94 in eyou_pop3 (eyou_db_hander=0x36fd3a8, eyou_socket_hander=0x8eff7e8) at pop3d.c:138 #15 0x08050470 in net_deliver (arg=0x8eef300) at gaea/deliver.c:219 #16 0x00b873cc in start_thread () from /lib/tls/libpthread.so.0 #17 0x004ea96e in clone () from /lib/tls/libc.so.6 The problem may be in the lines with red marked, However, this should not cause the program be halted。 Can i resolve the problem by set a timeout with openldap ？And how to do ?

1 0

Map attributes to access LDAP addressbook with thunderbird too
by Matthias Fechner 19 Oct '09

19 Oct '09

Hi, I have written a small web application some time ago which stores all information inside a openldap directory. When I access now information via thunderbird it displays some value, but some values are not shown. I searched now a little why and it seems that thunderbird asks his own fields like mozillaHomeStreet, mozillaHomeUrl and so on. But i stored my information in homepostaladdress and some other field the schema file give you. My question now is: Is it possible that when tunderbird ask for the field mozillaHomeStreet return there the field homepostaladdress? Thanks a lot for answers Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

2 2

how difference x509 attribute and extensions
by owen nirvana 19 Oct '09

19 Oct '09

sorry , I am a newbie. I could not know how to use x509 attribute, maybe do not. in x509.h, all functions about x509 attribute are not related with other parts. and if I might add an unstandard attribute to x509 certificate, so , why I need x509 extentions gtalk:freeespeech@gmail.com

2 1

ldap_bind error
by Mburu, Patrick 19 Oct '09

19 Oct '09

When i use this command; /usr/bin/ldapadd -x -D 'uid=root,dc=fedora,dc=directory,dc=server' -W -f /tmp/domain.ldif after entering the LDAP password i get this error: ldap_bind cannot contact ldap server. Any help or guideline will be appreciated. Regards, -- Patrick Mburu | Systems Engineer OPENWORLD LTD | Kenindia House |2nd Floor | P.O. Box 10918 00100 GPO NAIROBI Tel: 020 6750212, 2210772/3 | Fax: 020 2210772 Cell: 0725 550 906 - 0770 078 804 Email: pmburu(a)openworld.co.ke Web: www.openworld.co.ke Awards: CSK ' Open Source Solution Provider of the Year 2006 Award'

3 2

sasl binding with ssl encryption
by Xu, Qiang (FXSGSC) 19 Oct '09

19 Oct '09

Hi, all: My LDAP SASL binding is successful, but when I want to channel the traffic over SSL, it fails: ===================================================================== qxu@durian(pts/0):/etc[201]$ kinit XCTEST100(a)XCIPV6.COM Password for XCTEST100(a)XCIPV6.COM: ... qxu@durian(pts/0):/etc[203]$ klist Ticket cache: FILE:/tmp/krb5cc_20153 Default principal: XCTEST100(a)XCIPV6.COM Valid starting Expires Service principal 10/19/09 10:31:28 10/19/09 20:28:25 krbtgt/XCIPV6.COM(a)XCIPV6.COM renew until 10/20/09 10:31:28 ... qxu@durian(pts/0):/etc[204]$ ldapsearch -Y GSSAPI -H ldap://13.198.97.42:389 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started SASL username: XCTEST100(a)XCIPV6.COM SASL SSF: 56 SASL installing layers dn: CN=XCTEST100,CN=Users,DC=XCIPV6,DC=COM mail: XCTEST100(a)xcipv6.com # refldap://ForestDnsZones.XCIPV6.COM/DC=ForestDnsZones,DC=XCIPV6,DC=COM # refldap://DomainDnsZones.XCIPV6.COM/DC=DomainDnsZones,DC=XCIPV6,DC=COM # refldap://XCIPV6.COM/CN=Configuration,DC=XCIPV6,DC=COM ... qxu@durian(pts/0):/etc[205]$ ldapsearch -Y GSSAPI -H ldaps://13.198.97.42:636 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Server is unwilling to perform (53) additional info: 00002029: LdapErr: DSID-0C09048A, comment: Cannot bind using sign/seal on a connection on which TLS or SSL is in effect, data 0, v1771 ... qxu@durian(pts/0):/etc[206]$ ldapsearch -Y GSSAPI -O maxssf=0 -H ldaps://13.198.97.42:636 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Server is unwilling to perform (53) additional info: 00002029: LdapErr: DSID-0C09048A, comment: Cannot bind using sign/seal on a connection on which TLS or SSL is in effect, data 0, v1771 ===================================================================== Someone has mentioned that in order to do sasl binding over ssl, the security property " -O maxssf=0" must be set. However, this still fails. Any suggestions? Thanks, Xu Qiang

1 1

Database corruption revisited.
by Cliff Pratt 18 Oct '09

18 Oct '09

In an email of 5 August 2009 Howard Chu says "If your disks are working and haven't run out of space, database corruption pretty much never happens. You probably should describe the situation that leads you to believe there was a corruption. You should also list the versions of software in use." We have been plagued over the years with instances where the database appears to have been corrupted. I'm quite happy to be proved wrong, and would be pleased, very pleased to find a solution. As I said this has happened over the years, on ancient Debian systems, through RedHat's RHEL3, RHEL4, and maybe RHEL5. I'm not sure of the last. Every three or four months the application that uses OpenLDAP stops responding. We then run 'slapcat' against the LDAP datastore and if it hangs we stop slapd, run a recovery on the BDB and start everything up again. Now and then slapd refuses to start and we have to restore from a backup (also taken by slapcat). As I said, this has happened on many versions of OpenLDAP and on different operating systems. The latest version that I am sure it has happened on is RHEL 4.2 and OpenLDAP 2.2.13-4 (I think that is the version - I'm not able to access the servers at present so I'm going by memory). I'd be very pleased, ecstatic even, to find a solution to this. It's been a thorn in my side for many years. What information would be useful in pointing me at a solution? I'd only add that I am not an LDAP or OpenLDAP expert - the systems only get touched when an upgrade is necessary. Any advice would be appreciated. Cheers, hoping for a solution, or at least pointers to one. Cliff

4 6

2.4.18 refint getting "no such attribute" in bdb_modify_internal with removal; works with rename
by Andreas Hasenack 17 Oct '09

17 Oct '09

Hi, I'm using the refint overlay with a few attributes, but I can't get it to work with krbPwdPolicyReference from MIT kerberos 1.7. I get the error from the subject when deleting the entry this attribute references. If, however, I *rename* the entry, the krbPwdPolicyReference attribute gets updated correctly. It seems to fail only when I remove the entry. This is the config: dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config objectClass: olcRefintConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: krbObjectReferences olcRefintAttribute: member olcRefintAttribute: krbPwdPolicyReference olcRefintNothing: cn=localroot,cn=config This is the entry which has the attribute pointing to the entry I will remove (some attributes omitted for brevity): dn: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc= example,dc=com krbPrincipalName: andreas(a)EXAMPLE.COM objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux krbObjectReferences: uid=andreas,ou=people,dc=example,dc=com krbPwdPolicyReference: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example ,dc=com This is the entry I'm deleting. I would expect the krbPwdPolicyReference attribute from my entry above to be deleted. If I rename this cn=default, then krbPwdPolicyReference gets updated correctly. dn: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com cn: default objectClass: krbPwdPolicy krbMaxPwdLife: 36000 krbMinPwdLife: 0 krbPwdMinDiffChars: 1 krbPwdMinLength: 1 krbPwdHistoryLength: 1 These are the relevant logs (level 16383): Oct 7 16:55:33 maestro slapd[6381]: refint_search_cb <NOTHING> Oct 7 16:55:33 maestro slapd[6381]: ==> unique_modify <krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com> Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("cn=default,ou=password policies,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 0x00000042: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: <= acl_access_allowed: granted to database root Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: dnMatch 0#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com"#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: replace modifiersName Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 16 modify/delete: krbPwdPolicyReference: no such attribute Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: modify failed (16) Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: conn=-1 op=0 p=0 Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: err=16 matched="" text="modify/delete: krbPwdPolicyReference: no such attribute" Oct 7 16:55:33 maestro slapd[6381]: refint_repair: dependent modify failed: 16 Any hints?

2 1

ldap_search: LDAP Adminstration Limit Error
by Parag Kalra 17 Oct '09

17 Oct '09

Hello Friends, I am using a 'ldapsearch' command from Ubuntu machine to fetch entries from SunOne directory server hosted on Windows machine. I am able to retrieve the records but not all. At one stage it aborts abruptly and throws following error - ldap_search: LDAP Adminstration Limit Error Any pointers on what this error is all about and how can I get rid of it? Cheers, Parag

5 7

OpenLDAP 2.4.16: LDAP entry deletions not propaged in certain syncrepl multimaster scenario
by Alvin Wong 16 Oct '09

16 Oct '09

Hi I've encounter a problem in OpenLDAP 2.4.16 on 2 LDAP servers system setup with syncrepl multimaster and all data are synchronized. If server A is down and LDAP entries (leaf or subtree) are deleted on server B, when server A comes up, those LDAP entries are not removed from server A by syncrepl. If LDAP operations are done on either servers while both are up, syncrepl correctly propagates them to the other server. Below are the slapd.conf files for both server A and B. Is there something wrong with the way they are configured or is this a known issue? Thanks in advance. ========= SERVER A SLAPD.CONF ============== ucdata-path "C:/Program Files/MyApp/database" include "C:/Program Files/MyApp/schemaconf/core.schema" include "C:/Program Files/MyApp/schemaconf/corba.schema" include "C:/Program Files/MyApp/schemaconf/cosine.schema" include "C:/Program Files/MyApp/schemaconf/inetorgperson.schema" include "C:/Program Files/MyApp/schemaconf/nis.schema" include "C:/Program Files/MyApp/schemaconf/spanlink.schema" pidfile "C:/Program Files/MyApp/bin/slapd.pid" argsfile "C:/Program Files/MyApp/bin/slapd.args" idletimeout 300 sizelimit unlimited allow bind_v2 conn_max_pending_auth 2000 access to dn.subtree="ou=People,o=Spanlink Communications" by dn="cn=user,ou=People,o=Spanlink Communications" read by * read access to * by dn="cn=user,ou=People,o=Spanlink Communications" write by dn="cn=replication1,ou=People,o=Spanlink Communications" write by dn="cn=replication2,ou=People,o=Spanlink Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=Spanlink Communications" rootdn "cn=super,ou=People,o=Spanlink Communications" checkpoint 10 1 cachesize 50000 searchstack 8 rootpw secret directory "C:/Program Files/MyApp/database" # Indices to maintain index objectClass eq index entryCSN eq # for sync repl serverID 1 syncrepl rid=123 searchbase="o=Spanlink Communications" provider=ldap://10.10.10.75:38983 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=replication1,ou=People,o=Spanlink Communications" credentials=secret mirrormode true overlay syncprov syncprov-checkpoint 100 1 ========= SERVER B SLAPD.CONF ============== ucdata-path "C:/Program Files/MyApp/database" include "C:/Program Files/MyApp/schemaconf/core.schema" include "C:/Program Files/MyApp/schemaconf/corba.schema" include "C:/Program Files/MyApp/schemaconf/cosine.schema" include "C:/Program Files/MyApp/schemaconf/inetorgperson.schema" include "C:/Program Files/MyApp/schemaconf/nis.schema" include "C:/Program Files/MyApp/schemaconf/spanlink.schema" pidfile "C:/Program Files/MyApp/bin/slapd.pid" argsfile "C:/Program Files/MyApp/bin/slapd.args" idletimeout 300 sizelimit unlimited allow bind_v2 conn_max_pending_auth 2000 access to dn.subtree="ou=People,o=Spanlink Communications" by dn="cn=user,ou=People,o=Spanlink Communications" read by * read access to * by dn="cn=user,ou=People,o=Spanlink Communications" write by dn="cn=replication1,ou=People,o=Spanlink Communications" write by dn="cn=replication2,ou=People,o=Spanlink Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=Spanlink Communications" rootdn "cn=super,ou=People,o=Spanlink Communications" checkpoint 10 1 cachesize 50000 searchstack 8 rootpw secret directory "C:/Program Files/MyApp/database" # Indices to maintain index objectClass eq index entryCSN eq # for sync repl serverID 2 syncrepl rid=123 searchbase="o=Spanlink Communications" provider=ldap://10.10.10.196:38983 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=replication2,ou=People,o=Spanlink Communications" credentials=secret mirrormode true overlay syncprov syncprov-checkpoint 100 1 [cid:image001.gif@01CA4E62.2F0CA5C0] ALVIN WONG SENIOR SOFTWARE ENGINEER DIRECT +1 (763).795.7752 alvin.wong(a)calabrio.com<mailto:alvin.wong@calabrio.com> Download vCard File Products<http://www.calabrio.com/products.asp> | Partners<http://www.calabrio.com/partners.asp> | Contact Us<http://www.calabrio.com/contact.asp> This message is confidential, and any unauthorized disclosure, use or dissemination (either whole or in part) is prohibited. If you are not the intended recipient of the message please notify the sender immediately and delete the message from your system.

1 0

ipv6 support in openldap
by Bad Guy 16 Oct '09

16 Oct '09

Dear sir, I want to ask whether openldap support ipv6, if yes, which version of openldap support it ? Thanks _________________________________________________________________ 隨身的 Windows Live Messenger 和 Hotmail，不限時地掌握資訊盡在指間 — Windows Live for Mobile http://3c.msn.com.tw/mobile/

3 2

Replication
by Márcio Luciano Donada 15 Oct '09

15 Oct '09

Hi People My LDAP server (master) is debian Lenny with 2.4.11-1 version, I am implementing a server that will be in a unit of the company, I need to replicate the LDAP, but because of the hardware I am using CentOS 5.3 with ldap version openldap-servers-2.3.43-3.el5. This will be a problem for replication or can do do otherwise? -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

3 3

Change user Password from an AIX on openLDAP server
by CASEIRO Philippe 15 Oct '09

15 Oct '09

Hello I'm running openldap-2.3.43 on an RHEL 5.3 All works fine (like usual) with the linux clients but I have some troubles with AIX I have done this tests with An AIX 5.3 TL9 host. When I change my password with AIX it runs like that [user@host] $ passwd Changing password for "user" user's Old password: user's New password: Enter the new password again: And it's done, over. When I check the modification on openLDAP server the password is in clear in the field < userPassword >. On my linux clients it ask the new password 2 times (normal ?) and is not in clear in userPassword filed. [user@host] $ passwd Changing password for user user. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: New password: Re-enter new password: LDAP password information changed for user passwd: all authentication tokens updated successfully. An extract of logs : >From an Aix : Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=0 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" method=128 Sep 17 14:51:19 srvldap slapd[8270]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=0 BIND dn="uid=user,ou=users,dc= xxx,dc=xx" mech=SIMPLE ssf=0 Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=0 RESULT tag=97 err=0 text= Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=1 MOD dn="uid=user,ou=users,dc= xxx,dc=xx" Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=1 MOD attr=userpassword userpassword Sep 17 14:51:19 srvldap slapd[8270]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=1 RESULT tag=103 err=0 text= Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=2 UNBIND Sep 17 14:51:19 srvldap slapd[8270]: conn=9 fd=22 closed Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=6 SRCH base="ou=users,dc= xxx,dc= xx " scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=in205))" Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=7 MOD dn="uid=user,ou=users,dc= xxx,dc= xx " Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=7 MOD attr=shadowlastchange Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=7 RESULT tag=103 err=8 text=modifications require authentication ... some troubles .... >From Linux : Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 fd=34 ACCEPT from IP=192.168.3.30:51023 (IP=0.0.0.0:636) Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 fd=34 TLS established tls_ssf=256 ssf=256 Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=0 BIND dn="" method=128 Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=0 RESULT tag=97 err=0 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=1 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=1001))" Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=2 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=user))" Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 fd=38 ACCEPT from IP=192.168.3.30:51024 (IP=0.0.0.0:636) Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 fd=38 TLS established tls_ssf=256 ssf=256 Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=0 BIND dn="" method=128 Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=0 RESULT tag=97 err=0 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=1 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(|(&(accessTo=host22)(trustModel=byhost))(trustModel=fullaccess))(uid=user))" Oct 6 15:37:40 srvldap slapd[2420]: <= bdb_equality_candidates: (accessTo) not indexed Oct 6 15:37:40 srvldap slapd[2420]: <= bdb_equality_candidates: (trustModel) not indexed Oct 6 15:37:40 srvldap slapd[2420]: <= bdb_equality_candidates: (trustModel) not indexed Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=2 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" method=128 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=2 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" mech=SIMPLE ssf=0 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=2 RESULT tag=97 err=0 text= Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=3 BIND anonymous mech=implicit ssf=0 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=3 BIND dn="" method=128 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=3 RESULT tag=97 err=0 text= Oct 6 15:37:46 srvldap slapd[2420]: conn=5764 op=3 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=1001))" Oct 6 15:37:46 srvldap slapd[2420]: conn=5764 op=3 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 6 15:37:46 srvldap slapd[2420]: conn=5764 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=4 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" method=128 Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=4 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" mech=SIMPLE ssf=0 Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=4 RESULT tag=97 err=0 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=5 PASSMOD id="uid=user,ou=users,dc=xxx,dc=xx" new Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=5 RESULT oid= err=0 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=6 MOD dn="uid=user,ou=users,dc=xxx,dc=xx" Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=6 MOD attr=shadowLastChange Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=6 RESULT tag=103 err=0 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5764 fd=34 closed (connection lost) Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=7 UNBIND Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 fd=38 closed Thanks for your help. -- Philippe Caseiro

2 2

ppolicy password warnings
by Gustavo Schroeder 15 Oct '09

15 Oct '09

Hi, I'm planning to implement the ppolicy overlay in our repository and a major doubt came out. Suppose I got ppolicy overlay up and running and pwdMaxAge=10368000 (120 days) and as I've been googling around pam_ldap has the ability to provide user warnings about password expiration. My question is, will the userland apps like Thunderbird, Horde IMP (via passwd module), Samba provide password warnings to the end user? How will the user get warned when his/her password is about to expire? Is this something that the directory server will provide? Regards -Gustavo

4 3

ldap-back usage
by John Kane 14 Oct '09

14 Oct '09

I have a new requirement to proxy requests to a partner's LDAP (3rd party), based on organization. These request come into my slave servers. The slaves are chaining referrals to a single master (for my company's users). I have set up the proxy using back-ldap, along with the rewrite/map overlay (to massage the domain and map attrs). All requests to the partner's LDAP will be read-only. First question: Is back-ldap the correct approach for this? Is there a better way? This set-up is fairly simple and it 'seems' to be working. Second question: If this is the way, are there any rules that apply as far as where the chain overlay (order) should appear in slapd.conf? Here's a portion my slave slapd.conf (with openldap 2.3.43): modulepath /usr/lib/openldap moduleload ppolicy.la moduleload rwm.la #=================================================================== # chain to master for updates overlay chain chain-uri ldap://172.1.1.1 chain-idassert-bind bindmethod="simple" binddn="cn=ldapChain,o=myorg,dc=mycompany,dc=net" credentials="chainsecret" mode="self" chain-max-depth 2 chain-return-error TRUE chain-rebind-as-user TRUE #=================================================================== # back-ldap (partner database) database ldap uri "ldap://172.2.2.2" suffix "o=partnerorg,dc=mycompany,dc=net" lastmod off #=================================================================== # Rewrite/map overlay overlay rwm rwm-suffixmassage "o=partnerorg,dc=mycompany,dc=net" "o=partnerorg,dc=partner,dc=net" rwm-map objectclass top top rwm-map objectclass person person rwm-map objectclass posixAccount posixAccount rwm-map attribute DiagAccessLevel gecos rwm-map attribute DiagGroup description <etc, snip> #=================================================================== # Local database definitions database bdb suffix "dc=mycompany,dc=net" rootdn "cn=ldaproot,dc=mycompany,dc=net" rootpw bigsecret lastmod on directory /var/lib/ldap mode 0660 checkpoint 100 30 # Indices to maintain for this database index objectclass,entryCSN,entryUUID eq,pres <etc> #------------------------------------------------------------------- # ACLs for this database access to attrs=userPassword by self write by group.exact="cn=administrators,o=myorg,dc=mycompany,dc=net" write by dn.sub="o=partnerorg,dc=partner,dc=net" none by anonymous auth by * none access to * by group.exact="cn=administrators,o=myorg,dc=mycompany,dc=net" write by dn.sub="o=partnerorg,dc=partner,dc=net" none by anonymous none by * read #=================================================================== syncrepl rid=004 type=refreshAndPersist provider=ldap://172.1.1.1 retry="30 10 300 3" searchbase="dc=mycompany,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=myorg,dc=mycompany,dc=net" credentials="secretsync" updateref ldap://172.1.1.1 Thanks in advance, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

LDAP password information update failed: Insufficient access
by Roberto Gherardi de Candei 14 Oct '09

14 Oct '09

Hi i'm a newbie doesn't succeed has change the password of the on maturity consumer of the password help where is my error # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/certs/slapdcert.pem TLSCertificateKeyFile /etc/openldap/certs/slapdkey.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! #access to dn.subtree="ou=Utenti,dc=ldap=dc=inail,dc=it" # by dn="cn=adminU,ou=Utenti,dc=ldap=dc=inail,dc=it" # by dn="cn=anonymous,dc=ldap,dc=inail.dc=it" read # by self write # by anonymous auth ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=ldap,dc=inail,dc=it" rootdn "cn=admin,dc=ldap,dc=inail,dc=it" #rootpw {SSHA}PU4cboMpOsn7YBWDaP9xwRdP82k5O7gV rootpw {SSHA}mcFkKPNevo77jAq0+MdWNmX7F7roGk+v # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM thank's -- RGdC -- RGdC

2 1

OpenLDAP Scaling
by Brian Zuromski 14 Oct '09

14 Oct '09

HI, I'm trying to scale out a openldap server deployment to serve around 100K users. I plan on having a master server and using syncrepl to create slaves that sit behind a load-balancer. Is there a good rule of thumb to abide by when creating a scenario like this? How many authentications/sec can a server typically handle? I've seen the benchmark comparisons ( http://www.usenix.org/event/lisa07/htgr_files/chu.pdf) that have been posted by Howard, but it doesn't say what the system specs were that the tests were performed on? I will have pretty beefy systems to use (lots of RAM and CPU)... Thanks!!

2 4

Question about using openLDAP with TLS
by Bryan Boone 14 Oct '09

14 Oct '09

Hi everyone, I had a question about the TLS/SSL side of openLDAP. I would like to create a C program that runs on a computer that uses LDAP as one of its login methods. Of course I would need to use SSL or Kerberos for secure login. My knowledge of SSL is small so forgive me. My question is, when I have an administrator login to this program just after installation and he/she sets up the LDAP parameters along with the option for TLS LDAP, he/she should obtain an SSL ticket from the LDAP server right? The admin should be prompted by the program once to accept or reject the SSL ticket right? Where is this ticket stored on the client computer? Can I keep this ticket so that the user logging in doesn't have to accept the ticket every single time they log in? Only when the administrator changes LDAP servers is when he/she would need to accept a new SSL ticket. Am I on the right track? Or do I completely have the wrong idea on how LDAP with TLS works? thanks

1 0

posible problema pam_group openldap pendrive -flash USB-
by Guillermo Lengemann 13 Oct '09

13 Oct '09

Greetings Comrades, I installed an environment where customers (Debian GNU/Linux lenny) authenticate against a data directory (openldap 2.4.x on Debian GNU/Linux lenny). But there is a problem trying to mount the pendrive It configure the /etc/pam.d/common-auth as follows: auth required pam_group.so auth sufficient pam_unix.so nullok_secure auth required pam_ldap.so try_first_pass and the configuration file /etc/security/group.conf: *;*;*;Al0000-2359;netdev,plugdev,powerdev,scanner,video,audio,floppy,cdrom,dialout The problem is when you try to mount a pendrive from the graphical environment (gnome) and results in the following error. /***************** No se Puede montar el volumen Error org.freedesktop.DBus.Error.AccessDenied Rejected send message, 3 matched rules; type="method_call", sender=":1.33"(uid=100055 pid=3578) comm="/usr/bin/gnome-mount --hal-udi=/org/freedesktop/Ha" interface="org.freedesktop.Hal.Device.Volume" menber="Mount" error name"(unset)" requested_reply=0 destination="org.freedesktop.Hal" (uid=0 pid=3044 comm="/usr/sbin/hald")) ***********************/ I checked the log and not succeeded in finding the error, pam_group may be causing the problem?. Thanks for your help. -- -------------------- Guillermo Lengemann FSF miembro # 7510 --------------------

1 0

Re: TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Brett @Google schrieb: > Have a look at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517188 > Openldap in Lenny is linked against GNUtls instead of openssl. GNUtls doesn't support the > > TLS_CACERTDIR configuration option, so we have to use TLS_CACERT to specify a file with > trusted CA certificates. > > GNUtls is not the same as openssl, if you are affected by this bug > then it will only load the first cert. > > Cheers > Brett I just noticed that I can remove the CA related directives and copy alle required intermediate certificates and the root certificate directly into the key file to build the trust chain. Problem solved. Thanks for pushing my research into the right direction!

1 0

Re: TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Brett @Google schrieb: > Have a look at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517188 > Openldap in Lenny is linked against GNUtls instead of openssl. GNUtls doesn't support the > > TLS_CACERTDIR configuration option, so we have to use TLS_CACERT to specify a file with > trusted CA certificates. > > GNUtls is not the same as openssl, if you are affected by this bug > then it will only load the first cert. > > Cheers > Brett Yes this seems to affect me too. So I'll have to recompile against openssl I guess. I can live with that. Thanks!

1 0

Re: TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Brett Maxfield schrieb: > >> I just got an SSL certificate issued by Comodo which doesn't work as >> expected with slapd. >> Which means I get an untrusted certificate warning in Thunderbird. >> Probably I just missed something. > > I'll ask the question, why would the trust chain in slapd affect > thunderbird? > > What thunderbird considers trusted will be up to thunderbird itself, > or the underlying OS. > > Cheers > Brett Isn't that what the certificate chain in TLSCACertificateFile (or the corresponding directives in Apache, Postfix and so on) is good for? To build the trust chain from the issued certificate up to the trusted root certificate via intermediate certificates? If it was a problem of the underlying OS, shouldn't openssl s_client -connect localhost:<port> show exactly the same results for all services?

1 0

TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Hello, I just got an SSL certificate issued by Comodo which doesn't work as expected with slapd. Which means I get an untrusted certificate warning in Thunderbird. Probably I just missed something. For Apache2 for example, I just configured SSLCACertificateFile mycert.ca-bundle SSLCertificateFile mycert.crt SSLCertificateKeyFile mycert.key and I don't get any warnings in Firefox. Also if I test the connection using openssl s_client it looks fine: office:~# openssl s_client -connect localhost:443 CONNECTED(00000003) depth=3 /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de i:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=PositiveSSL CA 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=PositiveSSL CA i:/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware 2 s:/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root To achieve the same with OpenLDAP, I tried: TLSCACertificateFile mycert.ca-bundle TLSCertificateFile mycert.crt TLSCertificateKeyFile mycert.key But the result is different, Thunderbird doesn't trust the certificate and throws a corresponding warning and the output of openssl s_client looks like this: office:~# openssl s_client -connect localhost:636 CONNECTED(00000003) depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de verify error:num=27:certificate not trusted verify return:1 depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de i:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=PositiveSSL CA Seems like the ca-bundle wouldn't be used at all, does slapd expect a different format or something? Maybe someone could shed some light on this for me, thanks a lot in advance. Regards, Iruwen

3 6

ACL construction : by group
by Florian Götz 08 Oct '09

08 Oct '09

Hi everybody, I´m trying to write some admintool for my ldap in php. Changes to entries of other people should only be possible by members of the group "Domain Admins" So I wrote some phpcode which checks if the provided username (via Webbrowser) is a member of "Domain Admins" "Domain Admins" is created by samba and a normal posixGroup/sambaGroupMapping. All members of the group are listed via "memberUid". But at the same time there is a LDAP ACL used like this: access to dn.subtree="ou=Groups,dc=example,dc=de" by group="cn=Domain Admins,ou=groups,dc=example,dc=de" write by dn="uid=backup,ou=users,dc=example,dc=de" read by users none by * none A internal policy prohibits normal users access to the Groups subtree. I added the "by group" line, but then realised that it can not work this way. A usersearch like "search if memberUid=x is member of "Domain Admins" needs the rights for a search in ou=groups. But the only stored attribute per users is the memberUid, not the complete DN. The DN of a possible user is something like "uid=x,ou=users,dc=example,dc=de" Is there a possibility to use the existing "Domain Admins" group for user authentication, even if there are only memberUids stored and not complete dn? I don´t want to add all Domain Admins to the ACL above one by one. A change in the members would also lead to a change in the ACl if it would be done this way. Best regards, Florian Götz ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Validation of data in OpenLDAP
by David Horat 07 Oct '09

07 Oct '09

Dear OpenLDAP experts, I would like to know if there is any possibility of plug in a script before any transaction is commited into LDAP in order to validate and sanitise the input, giving an error and not letting the data get into OpenLDAP if the scripts decides the data is not valid. I have already taking a look at the Overlays presented in the documentation, but they won't solve what I am looking for exactly. Best Regards, David Horat -- David Horat Software Engineer – IT/GD – Grid Deployment Group CERN – European Organization for Nuclear Research » Where the web was born Address: 1211 Geneva - Switzerland, Office: 28/R-003 Phone +41 22 76 77996 Fax +41 22 76 68178 (fax to email service) Web: http://cern.ch/horat Web: http://davidhorat.com/ Profile: http://linkedin.com/in/davidhorat

2 1

Re: Importing user defined Object Classes from a file
by Parag Kalra 06 Oct '09

06 Oct '09

Hi Bharath, Thanks for the info you shared. Using that I have successfully imported the user defined object classes from a ldif file. Thanks once again... Cheers, Parag On Mon, Oct 5, 2009 at 5:20 PM, Kantrapati, Bharath < bharath.kantrapati(a)gs.com> wrote: > Hi Parag, > > > > You can import user defined object class using ldif file. > > The below link might be helpful > > > > http://docs.sun.com/source/816-6699-10/schemaov.html > > > > if you check the 99user.ldif it will show you how the current schema is > holding the object class. You can build the ldif file the same way and > import into sun one directory server. > > > > Note : I have taken off the open ldap mailing list, not sure if they would > be OK . > > > > Regards > > Bharath > > > > > > *From:* openldap-technical-bounces+bharath.kantrapati=gs.com(a)OpenLDAP.org > [mailto:openldap-technical-bounces+bharath.kantrapati<openldap-technical-bounces%2Bbharath.kantrapati> > =gs.com(a)OpenLDAP.org] *On Behalf Of *Parag Kalra > *Sent:* Monday, October 05, 2009 5:13 PM > *To:* openldap-technical(a)openldap.org > *Subject:* Importing user defined Object Classes from a file > > > > Hello Folks, > > Note: This question is on SunOne LDAP server. I apologize for posting it > here but I thought someone might know the solution hence sharing with you > all. > > I have a file which contains the schema related settings where in user > defined object classes are defined. > > I know SunOne directory server provides a way to create user defined object > classes but is there a way where I can import my entire file which will > create & define all the user defined settings mentioned in that file. > > I am using Sun One Server Console 5.2 > > Thanks in advance. > > Cheers, > Parag > >

1 0

Openldap ACL's (first timer)
by Craig T 06 Oct '09

06 Oct '09

Hi Openldap Experts, I'm designing a fairly simple openldap setup for our Melbourne office, but it's my first LDAP site, so I'm kinda guessing.... LdapServer1: Centos 5.3x64 with db-4.7.25 and openldap-2.4.16 and the clients are Linux Centos 5.2. I've already got everything working with the basic acl setup of 'access to * by * read', the challenge now is how to best secure the LDAP environment with the right acls? Scenario 1) We'd like to restrict members to only be able to logon at certain machines. The concept I'm missing is, how does the LDAP protocol link the user authenticated to a hostname (machine user is sitting at)? For example, user "cn=craig,ou=users,dc=example,dc=com" would like to log onto pc "craigpc.example.com ip:192.168.0.100". >From my study the following acls may work? access to dn.base="cn=craig,ou=users,dc=example,dc=com" attrs=userPassword by peername.regex=IP:192\.168\.0\.100 & self read by * none Scenario 2) How to setup groups (or "sets" I believe they are called) in a way where user "Craig" can be added to the "sysadmin" group and in turn get full access to all our servers. LDIF ENTRY: # sysadmin, groups, teratext.saic.com.au dn: cn=sysadmin,ou=groups,dc=example,dc=com objectClass: top objectClass: groupOfNames cn: teratext member: cn=cht,ou=users,dc=example,dc=com member: cn=ajg,ou=users,dc=example,dc=com ACCESS ENTRY: access to dn.subtree="ou=servers,dc=example,dc=com" by set="[cn=sysadmin,ou=groups,dc=example,dc=com]/member* & peername.regex=IP:192\.168\.0\.*" auth by * none cya Craig

2 1

smbk5pwd does not properly update sambaNTPassword and sambaLMPassword
by Scott Classen 05 Oct '09

05 Oct '09

Hello I am running openldap 2.4.18 (BDB 4.8.24). Both of which I compiled from source. I compiled smbk5pwd with support ONLY for samba. I am using the samba that is distributed with CentOS 5.3 (3.0.33) openldap does not crash or complain when it launches so I assume that: moduleload /usr/local/libexec/smbk5pwd.la is at least loading up the module correctly. I have a user with the sambaSamAccount objectclass. I have configured PAM to change the LDAP userPassword when invoked from the command line with /usr/bin/passwd The userPassword hash gets successfully updated and the values of the sambaNTPassword and sambaLMPassword hashes are changed, but I am unable to authenticate as a samba user against these hashes... and they look sorta weird: 010000000000000090c9c94100000000 when I would expect them to look more "complicated" like: 552902031BEDE9EFAAD3B435B51404EE Does this smell of a smbk5pwd bug/problem/misconfiguration or a samba/ PAM one? Thanks, Scott

4 5

help with indices - what to index depending on server role
by vgrig_us＠hotmail.com 05 Oct '09

05 Oct '09

Hello We're switching our college to openldap and I'm struggling a bit with decisions on indexing (all other parts - base functionality, replication, ACLs - are setup and working fine) . Maybe this list will help? What to index and why? Our setup is as follows: ----------------------------------------- a) 4 incoming MX servers running portfix. /etc/postfix/ldap-aliases.cf file is as follows: server_host = ldap://localhost ldap://mailhub3 bind = no search_base = dc=college, dc=edu query_filter = mail=%s(a)college.edu result_attribute = maildrop ----------------------------------------- b) 2 outgoing smtp servers purring postfix and sasl. /etc/saslauthd.conf: ldap_servers: ldaps://localhost/ ldap_auth_method: fastbind ldap_filter: uid=%u,dc=college,dc=edu ldap_tls_check_peer: no ------------------------------------------- c) 2 radius servers for wifi authentication: basedn = "dc=college,dc=edu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" password_attribute = userPassword ------------------------------------------- d) IMAP servers - real unix users, using LDAP for system authentication - pretty standard setup. pam_filter objectclass=posixAccount --------------------------------------------- On all of these I have following indices: index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub I suspect I don't need some (or most) of them. Thank you - Vadim

1 0

Importing user defined Object Classes from a file
by Parag Kalra 05 Oct '09

05 Oct '09

Hello Folks, Note: This question is on SunOne LDAP server. I apologize for posting it here but I thought someone might know the solution hence sharing with you all. I have a file which contains the schema related settings where in user defined object classes are defined. I know SunOne directory server provides a way to create user defined object classes but is there a way where I can import my entire file which will create & define all the user defined settings mentioned in that file. I am using Sun One Server Console 5.2 Thanks in advance. Cheers, Parag

1 0

syncrepl between 2.3.30 and 2.4.11
by Marc Cuypers 05 Oct '09

05 Oct '09

Hi, I'm using debian etch with slapd 2.3.30 as the master and debian lenny with slapd 2.4.11 as a consumer. I also have a debian etch consumer (slapd 2.3.30). When doing syncrepl with 2.3.30 consumer everything works fine. When syncrepl with 2.4.11 i get an error: slapd[19567]: slap_client_connect: URI=ldaps://xxx.xxx.xxx.xxx:8636 DN="cn=xxxxxxx,dc=xxxxxxx,dc=xxx" ldap_sasl_bind_s failed (-1) Is there a compatibility issue between 2.3.30 and 2.4.11? -- best regards, marc

3 2

Search Filter ...
by Remi Ferrand 05 Oct '09

05 Oct '09

Hi, I've the following configuration in my OpenLDAP : 1. dn: cn=stats.mysite.fr,ou=Group,dc=mysite,dc=fr 2. cn: stats.mysite.fr 3. objectClass: top 4. objectClass: groupOfNames 5. description: VirtualHost stats.mysite.fr 6. member: uid=user_authorized,ou=People,dc=mysite,dc=fr 7. member: uid=USER,ou=People,dc=mysite,dc=fr 8. 9. 10. dn: uid=USER,ou=People,dc=mysite,dc=fr 11. objectClass: top 12. objectClass: person 13. objectClass: inetOrgPerson 14. objectClass: organizationalPerson 15. objectClass: posixAccount 16. objectClass: shadowAccount 17. uid: USER 18. cn: USER P. 19. sn: USER P. 20. shadowMax: 99999 21. shadowWarning: 7 22. mail: USER(a)google.eu 23. loginShell: /bin/bash 24. uidNumber: 10007 25. gidNumber: 10007 26. homeDirectory: /home/ldap_users/USER 27. gecos: ,,, and I'm wondering how to create a filter to match only members of a given Group in order to use it with Apache2 or others ... The difficulty for me is to obtain the posixAccount object and not the Group one. Thanks in advance Rémi

5 8

Account Usable Request Control (1.3.6.1.4.1.42.2.27.9.5.8)
by Charls 02 Oct '09

02 Oct '09

Hello, At the moment I'm working with the Sun Java System Directory Server. I would like to migrate to Openldap but of course without losing functionality. I enabled pam_ldap account management on all my Linux and Solaris computers and everything worked fine. Everyone could do nonpassword-based logins using tools such as rsh or ssh. This feature was provided by the "Account Usable Request Control" (1.3.6.1.4.1.42.2.27.9.5.8) from the Directory Server which is needed by the ldap_pam module from Solaris. After the installation from openldap on my Solaris server I recognized that nonpassword-based logins on the Solaris computers are not possible anymore. This problem [1] was discussed 2 years ago on "openldap-software(a)openldap.org" but there was no solution described. I would like to know if there is a way to get this feature enabled with openldap? If not what can i do else? More technically: If a ssh client connects with public key authentication to a Solaris computer the pam module is sending a query to the ldap server if the account policies are handled by ldap to get all supportedControls and to check if the "Account Usable Request Control" exists to retrieve the policy data without the explicit login from the user. Thanks in advance! Charls [1] http://www.openldap.org/lists/openldap-software/200710/msg00041.html

2 1

Fwd: syncrepl inseard of back-perl ?
by Brett ＠Google 02 Oct '09

02 Oct '09

Hello, I was wondering if there are any concrete examples of using syncrepl to monitor a slapd for changes, and perform some scripted operation if the monitored data changes. I can think of several cases where this might be very handy, where you want to run a script or custom business logic, on receipt of some data being changed. I have seen some examples in the 2.3.x days, where slurpd was used to push changes to a back-perl script, which then did some custom business logic and it did fill an very useful niche. I imagine these post-slurp syncrepl days you could use the syncrepl protocol in a push mode via a proxy to push changes at a back-perl instance to the same sort of thing. But perhaps using syncrepl directly might seem like a better option, as this has been touted as a benefit of syncrepl, although i have not seen any specific examples.. To this end, i am wondering are the syncrepl client parts of slapd usable outside the context of the slapd binary? Has anyone tried this and has any examle code they are willing to share ? Cheers Brett

5 7

Segmentation fault using logpurge option in slapd.conf
by Julian Thomé 01 Oct '09

01 Oct '09

Hello mailing list, We have a problem using OpenLdap V. 2.4.11 with Debian Lenny. If we use the option logpurge in our slapd.conf, slapd can't start anymore. Our slapd.conf: >8-----------------------------------------------/etc/ldap/slapd.conf # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/hdb.schema include /etc/ldap/schema/nis.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 4 #sasl-secprops minssf=0 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload smbk5pwd moduleload accesslog # The maximum number of entries that is returned for a search operation sizelimit unlimited # TLS Stuff TLSCACertificateFile /etc/ssl/certs/ca.pem TLSCertificateKeyFile /etc/ldap/openldap.key TLSCertificateFile /etc/ldap/openldap.crt # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 2 # Specific Backend Directives for hdb: backend hdb # Specific Directives for database: accesslog database hdb directory "/var/lib/accesslog" suffix "cn=accesslog" checkpoint 512 30 rootdn "cn=accesslog" rootpw ... index default eq index reqStart eq index reqType eq dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 # Specific Directives for database: data database hdb directory "/var/lib/ldap" overlay smbk5pwd overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logold (objectClass=posixAccount) logpurge 07+00:00 01+00:00 suffix ... rootdn ... rootpw ... dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index default eq index objectClass eq index uidNumber pres,eq index uid eq smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} # lastmod on # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange filter="(memberOf=Archiv)" by peername.ip=192.168.222.17 auth stop by peername.regex=.* none break access to dn.base="..." by * read access to attrs=userPassword,shadowLastChange filter="(!(memberOf=Archiv))" by peername.ip=192.168.222.17 none stop by peername.regex=.* none break # this rule is more specific than the admin rule below access to attrs=userPassword,shadowLastChange by set="user/memberOf & [Administratoren]" write by dn="cn=admin,..." write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. # be sure to include the admins in the previous, more specific rule access to * by set="user/memberOf & [Administratoren]" write by dn="cn=admin,..." write by * read access to dn.subtree="ou=Benutzer,..." by sockurl="ldapi:///" write authz-regexp "gidNumber=0\\\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=admin,..." ----------------------------------------------------8< Starting slapd with the command: slapd -d 16383 produces the following output: >8--------------------------------------------------- ... ... >>> dnPrettyNormal: <cn=accesslog> => ldap_bv2dn(cn=accesslog,0) <= ldap_bv2dn(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 <<< dnPrettyNormal: <cn=accesslog>, <cn=accesslog> line 65 (rootpw ***) line 66 (index default eq) line 67 (index reqStart eq) index reqStart 0x0004 line 68 (index reqType eq) index reqType 0x0004 line 69 (dbconfig set_cachesize 0 2097152 0) line 70 (dbconfig set_lk_max_objects 1500) line 71 (dbconfig set_lk_max_locks 1500) line 72 (dbconfig set_lk_max_lockers 1500) line 75 (database hdb) hdb_db_init: Initializing HDB database line 76 (directory "/var/lib/ldap") line 78 (overlay smbk5pwd) line 80 (overlay accesslog) line 81 (logdb cn=accesslog) >>> dnPrettyNormal: <cn=accesslog> => ldap_bv2dn(cn=accesslog,0) <= ldap_bv2dn(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 <<< dnPrettyNormal: <cn=accesslog>, <cn=accesslog> line 82 (logops writes) line 83 (logsuccess TRUE) line 85 (logpurge 07+00:00 01+00:00) Speicherzugriffsfehler ----------------------------------------------------8< If the logpurge-option is uncommented, slapd starts without any problems. It would be very nice if someone could help us ! Greetings Julian ___________________________________________________________ Telefonate ohne weitere Kosten vom PC zum PC: http://messenger.yahoo.de

3 3

Kerberos and LDAP
by Howard Chu 30 Sep '09

30 Sep '09

For those interested, I've been invited to speak at the Kerberos Conference at MIT on October 21. I'll be giving a talk on using Kerberos with LDAP, showing walkthroughs of the schema and using an LDAP backend for the KDC. http://www.kerberos.org/events/2009conf/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

PHP: issues managing the password, what is wrong?
by Alberto Moreno 30 Sep '09

30 Sep '09

Hi people, I doing a web interface that will request a username + password, like squirrelmail i will contact my ldap server, this app will run on Centos 5.3, php 5.3, this will be where my web pages will be, the ldap server is running on Gentoo with ldap 2.3.43. My current problem is with the password, I have found small app that wants to compare the input of the password vs the ldap password this will let us identify the user. Well searching aroun, I found the crypt function but there is a thing that I don't like it: "The standard DES-based encryption crypt() returns the salt as the first two characters of the output. It also only uses the first eight characters of str , so longer strings that start with the same eight characters will generate the same result (when the same salt is used)" How can I deal with this note: 8 characters only? Some users have more than that, this is my code: $cryptedpassword='{crypt}74boAULE9gF5.'; if( preg_match( "/{([^}]+)}(.*)/", $cryptedpassword, $cypher ) ) { $cryptedpassword = $cypher[2]; $_cypher = strtolower($cypher[1]); } else { $_cypher = NULL; } if( preg_match("/^\\$2+/",$cryptedpassword ) ) { // make sure that web server supports blowfish crypt if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 ) pla_error( _('Your system crypt library does not support blowfish encryption.') ); list(,$version,$rounds,$salt_hash) = explode('$',$cryptedpassword); if( crypt( $plainpassword, '$'. $version . '$' . $rounds . '$' .$salt_hash ) == $cryptedpassword ) return true; else return false; } elseif( strstr( $cryptedpassword, '$1$' ) ) { if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 ) pla_error( _('Your system crypt library does not support md5crypt encryption.') ); list(,$type,$salt,$hash) = explode('$',$cryptedpassword); if( crypt( $plainpassword, '$1$' .$salt ) == $cryptedpassword ) return true; else return false; } elseif (strstr( $cryptedpassword, '_' ) ) { if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 ) pla_error( _('Your system crypt library does not support extended DES encryption.') ); echo crypt($plainpassword, $cryptedpassword ); if( crypt($plainpassword, $cryptedpassword ) == $cryptedpassword ) return true; else return false; } else { if( crypt($plainpassword $cryptedpassword ) == $cryptedpassword) return true; else return false; } The issue is the 8 character limitation, even If i have a password of 10 characters, the function will just take 8, how can I deal with this issue? Thanks for your time my firiends!!! -- LIving the dream...

6 10

Transfer LDAP Database to an other Server
by Manfred werner 30 Sep '09

30 Sep '09

Hello List, I must transfer my Ldap Dirtetory to a new Server with an oher Main Domanin. At first I save LDAP at my Old-server with slapcat -l originaldata.ldif then I´ve copy the *.ldif to my new server next I edit the *.ldif an change all entres "OldDomain" to "NewDomain". alt last I want to restore the *.ldif with slapadd -l newdata.ldif now I get foe following Errorcode: Testserver:/dasi # slapadd -l newdatea.ldif bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=NewDomain,dc=de. the line 245 is an emty line ?? Thank you for your help Manfred

2 1

can i bind real entry by alias ?
by 何萍 30 Sep '09

30 Sep '09

i create two entry:dn: uid=real,o=test.com userPassword=xxxx .... dn:uid=alias,o=test.com objectClass: alias objectClass: extensibleObject aliasedObjectName: uid=real,o=test.com can i bind real entry by alias and real's userPassword ? if so, how to do?

4 4

Search filter for numbers
by Florian Götz 30 Sep '09

30 Sep '09

Hi everbody, I tried to create a dynamic group with dynlist and got a problem with a search filter. I searched the net for a solution, but found nothing that fits. I want to collect all people thet have a common attribute (attributA=X), but only people that have a uid that isn´t a number. We got people with uids similar to their last name (Meier, Müller, Schmidt) and Users that got a number as uid (123456). I tried a filter like: ldap:///ou=users,dc=example,dc=de?uid?sub?(&(attributeA=X)(!(uid=[0-9]*))) but that doesn´t work. A solution like: ldap:///ou=users,dc=example,dc=de?uid?sub?(&(attributeA=X)(!(uid=0*))(! (uid=1*))(!(uid=2*))(!(uid=3*)).....) works, but there must be a more elegant way to do this....right? Best regards, Florian Götz ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Unable to bind to active directory using TLS
by Harish Chakravarthy 29 Sep '09

29 Sep '09

Hello Everyone, Greetings. I am unable to bind to active directory using TLS. I get the following error while executing my script via the browser *PHP Warning: ldap_start_tls() [<a href='function.ldap-start-tls'>function.ldap-start-tls</a>]: Unable to start TLS: Connect error* The same script when executed from the command line works!. I have compiled PHP with flags --with-ldap --with-ldap-sasl --with-openssl . Can you help me further trouble shoot this problem?. Thanks Harish

2 6

slapo-rwm segfault
by Ralf Zimmermann 28 Sep '09

28 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I have a problem with the slapo-rwm overlay. Here is my config: sizelimit=unlimited ... overlay rwm rwm-rewriteEngine on rwm-rewriteMap LDAP attr2dn "ldaps:///dc=domain,dc=local?dn?sub" rwm-rewriteContext bindDN rwm-rewriteRule "^(uid=(.*)+),(dc=dummy,dc=domain,dc=local)" "${attr2dn($1)}" ":@I" ... When I configure a fixed sizelimit < 9500 all runs fine. With a sizelimit=unlimited slapd crash with a segfault: Sep 28 14:31:44 ldap kernel: slapd[3734]: segfault at 0 ip b79a118a sp a1176d5c error 4 in libc-2.9.so[b792e000+155000] Is there a Problem with slapo-rwm and the number of fetched entries? The problem is replicable under SLES11 openldap 2.4.12 or a self compiled openldap 2.4.18 under Debian squeeze. Greets Ralf Zimmermann - -- .''`. Ralf Zimmermann : :' : Siegnetz.IT http://www.siegnetz.de `. `' Schneppenkauten 1a http://boardfreunde.de `- 57076 Siegen send no mail to garbage(a)siegnetz.de send no mail to garbage(a)boardfreunde.de Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkrAr4YACgkQqTAMJBAFqji9vQCfQWngaiz5L509wGwp+ftUcSzI RC4An2vBRqnm5JX/h7h7UmYc7XR0bcfZ =1Fdp -----END PGP SIGNATURE-----

1 0

Re: Unable to bind to active directory using TLS
by Zdenek Styblik 27 Sep '09

27 Sep '09

Harish Chakravarthy wrote: > Hello, > > Thanks for your response. > > "Can you please code I've attached?" - I don't see one in the email. > Secondly, my test script (command line & web) is not looking for ldap.conf. > > -Harish > Morning, I've checked the sent mail and it's there as an attachment. Well, here we go: --- SNIP --- <?php /* * [PHP] Code to test LDAP connection */ define('MYLDAP_HOST', 'ldap://localhost'); define('MYLDAP_PORT', 389); define('MYLDAP_BINDDN', 'cn=LDAPuser,dc=domain,dc=tld'); define('MYLDAP_PSWD', 'myPass'); define('MYLDAP_TLS', true); # buggy - don't use? # !-- some input var checks here --! $ldapConn = ldap_connect(MYLDAP_HOST, MYLDAP_PORT); if (!$ldapConn) { exit("Unable to connect to LDAP server"); } if (!ldap_set_option($ldapConn, LDAP_OPT_PROTOCOL_VERSION, 3)) { exit("Unable to set protocol version to v3"); } # buggy - don't use ? if (MYLDAP_TLS) { ldap_start_tls($ldapConn) or die("Can't start TLS"); } $ldapBind = ldap_bind($ldapConn, MYLDAP_BINDDN, MYLDAP_PSWD); if (!$ldapBind) { exit("LDAP Bind failed"); } echo "OK"; ldap_unbind($ldapConn); # aka ldap_close return 0; ?> --- SNIP --- Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net > On Sat, Sep 26, 2009 at 12:33 AM, Zdenek Styblik <stybla(a)turnovfree.net > <mailto:stybla@turnovfree.net>> wrote: > > Harish Chakravarthy wrote: >> Here is more information >> 1. I am binding to Active Directory from Solaris 10 >> 2. My php_info gives configure options as './configure' >> '--prefix=/home/local/php-5.2.9' '--with-apxs2=/path/apache2/bin/apxs' >> '--with-ldap' '--with-ldap-sasl' '--with-openssl=/usr/local/ssl' >> '--with-mysql=/usr/local/mysql/' '--with-gd' >> 3. The PATH & LD_LIBRARY_PATH listed via php_info on the browser has >> exactly the same settings as my user account (that executes the script >> from command line) >> 4. I have a ldap.conf file inside /opt/csw/etc/openldap . However this >> file is not being used by the script (command line or web). I > rename the >> file and nothing changes!. >> 5. I have apache compiled for mod_ssl > >> Should I recompile Apache with mod_ldap or any additional modules - I >> using a PHP script on my webserver to gather login & password to >> authenticated against Active Directory?. > >> Thanks again for your time. > >> -Harish > > > > Hello, > > I'm sorry, I should have read better. I replied in haste and- > Can you please code I've attached? It should be sufficient just to > supply credentials. I've tested it and, although I can't make an LDAP > connection from console [I've messed something in PHP; ignore], it works > for me via WEB [I can see 'OK']. I'm not sure why I've put comments > about TLS being buggy [probably something in PHP documentation?], but > the code [PHP] works with LDAP TLS just fine. > > I don't think you need mod_ldap in Apache, as this one should serve for > direct interaction of httpd<-->LDAP [imao]. > > Let me know, > Zdenek >

1 0

Memberof overlay
by Kristian Berg 25 Sep '09

25 Sep '09

Hi I've shifted through the mailinglist archive in search of an answear to how one combines posixAccount with posixGroup for filtering, with the memberof overlay. The only answear I found, was that it wasn't possible. What I've tried was adding: overlay memberof memberof-group-oc posixGroup memberof-member-ad memberUid Which doesn't work. I get the following error message: /etc/openldap2.4/slapd.conf: line 173: member attribute="memberUid" must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax. According to earlier mailinglist posts, memberUid can't be used with memberof. The other solution that crossed my mind was adding a member-attribute in the posixGroup which is linked with the posixAccount dn, whenever I add a memberUid to the group. Although I haven't tested it yet, as my schema-fu is limited. This seems like the wrong approach though. What I want to do is using a ldap query filter to check if a posixAccount is member of a group with the same name as the server. Ie: retreiving all valid accounts for that particular server with (&(objectClass=posixAccount)(memberof=cn=servername,ou=group,dc=base)). This is with standard ldap on AIX as the client and openldap 2.4.18 as the server. Linux clients and hp-ux clients also connect to this ldap-server though, so the options regarding layout of the tree is limited. So may questions to you, dear internett mailinglist heroes, is: * Is there an easy way to combine posixAccount with posixGroup? * Is the hard way feasiable if not? * Are some of you using some better way of managing logins on aix with a ldap-server shared with operating system logins? -- Kristian Berg

1 0

Limiting finger lookup access on Linux
by Rex Roof 24 Sep '09

24 Sep '09

I have some linux machines that I have configured for student access. We are authenticating against our OpenLDAP tree and limiting which users have access via an LDAP groupOfNames. This is all working perfectly. This is the problem I am having. Any user with access to the system can run the /usr/bin/finger command and do a name search against our entire LDAP tree. I would like to limit the info available via finger to just the users that have access to any particular machine. How can this be controlled? -Rex

8 14

RE: LDAPCon slides
by Morteza Ansari 24 Sep '09

24 Sep '09

It indeed was a great conference, thanks for organizing it. On the embedded directory front, I will be even more impressed once you get your G1 to generate certs ;-) Cheers, Morteza -----Original Message----- From: openldap-technical-bounces+mansari=postpath.com(a)openldap.org [mailto:openldap-technical-bounces+mansari=postpath.com@openldap.org] On Behalf Of Howard Chu Sent: Wednesday, September 23, 2009 12:59 PM To: openldap-technical(a)openldap.org Subject: LDAPCon slides For those of you who weren't able to attend the conference, most of the submitted talks now have their slides/papers online on the web site. http://www.symas.com/ldapcon2009/papers.shtml You missed a lot of great discussions, and a live demo of probably the world's smallest LDAP server installation - OpenLDAP 2.4.18 running on my G1 phone, serving queries from Ludovic Poitou's iPhone address book. OpenLDAP doesn't just scale up to massive multi-processor deployments, it also works well at the smallest of scales. Even the "embedded directory" guys haven't gotten here yet... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Advice/comments on deploying openLDAP in a VirtualBox
by Arun Khan 24 Sep '09

24 Sep '09

> Date: Tue, 22 Sep 2009 16:59:30 -0400 > From: Adam Tauno Williams <awilliam(a)opengroupware.us> > Subject: Re: Advice/comments on deploying openLDAP in a VirtualBox > appliance. > To: openldap-technical(a)openldap.org > Message-ID: <1253653170.5317.24.camel@linux-m3mt> > Content-Type: text/plain > > On Wed, 2009-09-23 at 00:23 +0530, Arun Khan wrote: >> I have completed the prototyping of openldap, samba/pdc, on a >> VirtualBox appliance. The setup works fine with 4-5 different >> desktop clients connecting to >> the services. >> Appliance details: VirtualBox 3.0.6 - 512MB RAM, 8MB Video RAM, 9GB >> VDI with 1GB Swap and CentOS 5.3 64bit). >> I am considering deploying this appliance into production with 1GB >> RAM. The no. of clients connecting to the server will be approx. 150. >> Has anyone deployed openLDAP + Samba/PDC in a VirtualBox appliance? > > I don't know anything about Virtual Box but I operate an OpenLDAP + > Samba/PDC for 300+ used on an ESX VM with roughly the allocated > resources you specify [although I have no idea about "Video RAM" or > "VDI"]. I imagine the performance of the underlying host may matter > more than your specific allocations so long as process fit into the > allocated memory. Much thanks for sharing your experience and validating the deployment openLDAP+Samba/PDC in a virtual environment. The VirtualBox VideoRam is applicable only for graphical display and VDI == VirtualDiskImage (it is the file that contains the VM). -- Arun Khan

1 0

bdb checkpoints
by Oliver Henriot 24 Sep '09

24 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list users, I'm trying to get my DB_CONFIG file sorted out and I'm getting confused. If I follow the documentation available on zytrax.com (http://www.zytrax.com/books/ldap/ch6/bdb.html#db-config), if I have a DB_CONFIG file it should contain a txn_checkpoint directive instead of the checkpoint directive in slapd.conf file which indeed does nothing no matter if I change it or not. But if I put a txn_checkpoint in the DB_CONFIG file I get a "unrecognized name-value pair: txn_checkpoint" error and everything dies miserably. So, as Howard suggests (http://www.openldap.org/lists/openldap-software/200605/msg00091.html), I set off on a quest to read the BerkeleyDB documentation. I'm finding reading it not very useful for several reasons. Firstly txn_checkpoint directive sometimes occurs (http://www.oracle.com/technology/documentation/berkeley-db/db/programmer_re… so at least version 3.1, and up?, should understand txn_checkpoint) and sometimes not (http://www.oracle.com/technology/documentation/berkeley-db/db/api_reference…). Secondly, there is scarce, if any, reference to the versions of BDB concerned in the documentation I have found and now I have spent an awful amount time (well, ten minutes maybe) trying to find out exactly which version of BDB I have I'd like to make some intelligent use of that information if at all possible. Well, I'm lost. The only thing I've found is a gigabyte of bdb logs created when I populate my directory wich are not removed by dbconfig set_flags DB_LOG_AUTOREMOVE, and even more as my directory lives it life (several gigabytes after a week or two). So I'd like to reduce their volume if at all possible rather than having to regularly remove them using slapd_db_archive manually. So, what's the story with BDB transaction checkpoint logs? How can I get this mess sorted out? I'm using Openldap 2.3.43-3.el5 with BDB 4.3.29 on CentOS 5.3. Thanks. Best regards, Oliver -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkq5+hoACgkQSWuBJnHIHdIZxACg1kcPx90oHYn8G/D33HWf+dzE 0OAAnRgckB9Nbre0Z7azx15YFLOMOCR4 =OYos -----END PGP SIGNATURE-----

3 4

LDAPCon slides
by Howard Chu 23 Sep '09

23 Sep '09

For those of you who weren't able to attend the conference, most of the submitted talks now have their slides/papers online on the web site. http://www.symas.com/ldapcon2009/papers.shtml You missed a lot of great discussions, and a live demo of probably the world's smallest LDAP server installation - OpenLDAP 2.4.18 running on my G1 phone, serving queries from Ludovic Poitou's iPhone address book. OpenLDAP doesn't just scale up to massive multi-processor deployments, it also works well at the smallest of scales. Even the "embedded directory" guys haven't gotten here yet... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Advice/comments on deploying openLDAP in a VirtualBox appliance.
by Arun Khan 23 Sep '09

23 Sep '09

I have completed the prototyping of openldap, samba/pdc, on a VirtualBox appliance. The setup works fine with 4-5 different desktop clients connecting to the services. Appliance details: VirtualBox 3.0.6 - 512MB RAM, 8MB Video RAM, 9GB VDI with 1GB Swap and CentOS 5.3 64bit). I am considering deploying this appliance into production with 1GB RAM. The no. of clients connecting to the server will be approx. 150. Has anyone deployed openLDAP + Samba/PDC in a VirtualBox appliance? I'd appreciate if you could share your experience, gotchas etc with respect to an appliance environment as well as resources allocated to the appliance e.g. amount of RAM. TIA Regards, -- Arun Khan

3 2

rwm-overlay, adding attributes
by Jeroen Berning 23 Sep '09

23 Sep '09

Hi, Can I with the rwm-overlay also introduce new static attribute? (Or change the content of an existing attribute and its name to use it for something new). Or do I need to combine it with the translucent overlay to gets things added? If it can be done and somebody has an example it would be appreciated. Jeroen

1 0

LDAP authentication + replication
by Maxime Gaudreault 22 Sep '09

22 Sep '09

Hi list I configured my 2 tests server to replicate with syncrepl using this website: https://help.ubuntu.com/9.04/serverguide/C/openldap-server.html It works well. If I create a new user on any servers it's immediately replicated to the other. However I have some error in the log files: (these 2 messages appears every 10 seconds on the first server (vmlinux01)) Sep 22 11:53:56 vmlinux01 slapd[12072]: <= bdb_equality_candidates: (entryCSN) not indexed Sep 22 11:53:56 vmlinux01 slapd[12072]: <= bdb_inequality_candidates: (entryCSN) not indexed Sep 22 11:24:51 vmlinux02 slapd[10596]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 22 11:24:51 vmlinux02 slapd[10596]: do_syncrepl: rid=001 retrying (4 retries left) Also, when I configure the server to authenticate using LDAP (pam-auth-update) I can connect to the system using an LDAP account (say maxime) but look at the prompt and whoami result : administrator@vmlinux01:~$ whoami administrator Do I need to create the users on both LDAP and Linux ? Max

2 1

Reg OpenLdap on Ubuntu
by Asimananda Mohanty 22 Sep '09

22 Sep '09

Hi All, I am currently busy configuring OpenLdap on my newly installed Ubuntu 9.04. Here is what I have done till now. I followed the steps defined in https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html and installation was successful. I installed PhpLdapAdmin also. After I created certificate, key etc, I created a .ldif file (enable-ca.ldif) with the following content : *dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/server.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/server.key* Then I executed the command : *ldapmodify -D "cn=admin,cn=config" -x -w 12345678 -f enable-ca.ldif* and it was a success. But after this, when I tried to restart slapd, I got errors like the following : *main: TLS init def ctx failed: -1* I noticed that after I executed "ldapmodify -D "cn=admin,cn=config" -x -w 12345678 -f enable-ca.ldif", 3 lines are added to /etc/ldap/slapd.d/cn=config.ldif and when I commented the last two lines like the following, slapd started successfully. *olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem #olcTLSCertificateFile: /etc/ssl/certs/server.crt #olcTLSCertificateKeyFile: /etc/ssl/private/server.key* This looks quite strange. Please help me resolving the same. -Asimananda

6 48

Syncrepl choking on case sensitive DN ?
by Emmanuel Kasper 22 Sep '09

22 Sep '09

Hello I noticed today that my syncrepl consumer was not up to date with the last change contained in the provider. (I am using slapd 2.4.11-1 from debian ) Looking at /var/log/syslog I see Sep 16 13:49:37 ur slapd[8172]: syncrepl_entry: rid=100 be_search (0) Sep 16 13:49:37 ur slapd[8172]: syncrepl_entry: rid=100 dc=webmail,ou=friends.openforce.com,ou=CNAME,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com Sep 16 13:49:37 ur slapd[8172]: syncrepl_entry: rid=100 be_modrdn (32) Sep 16 13:49:37 ur slapd[8172]: do_syncrepl: rid=100 quitting and in debug mode bdb_modrdn: new parent "ou=friends.openforce.com,ou=CNAME,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com" requested... bdb_dn2entry("ou=friends.openforce.com,ou=cname,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com") => bdb_dn2id("ou=friends.openforce.com,ou=cname,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_modrdn: newSup(ndn=ou=friends.openforce.com,ou=cname,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com) not here! see the cname/CNAME case difference ? the provider dn is indeed written CNAME. EK -- openForce Information Technology GesmbH http://www.openforce.com/ It is a book about a Spanish guy called Manual. You should read it. -- Dilbert

2 2

can't bind in subtree
by mkappe 21 Sep '09

21 Sep '09

Hi all, i'm having a problem that i can't understand: i create an openldap tree with a subtree called studenti. when i add an entry in the main tree i can bind correctly. when i insert an entry in the studenti subtree i can't bind. In attachment you will find the log files. What can i do? Thanks Marco

2 1

Proxy from Active Directory to OpenLdap
by Giacomo Calisse 21 Sep '09

21 Sep '09

Hello to everybody, I need an help... I have an Antivirus Server (Appliance) that performs requests to Active Directory. I don't have installed Active Directory but I have installed Open Ldap 2.3, so I have to convert the request from Active Directory format to Open Ldap format. In other words I have to create a Proxy. E.g. The structure where to take the data has this form: # extended LDIF # # LDAPv3 # base <dc=unina,dc=it> with scope subtree # filter: uid=rciotola # requesting: ALL # # xxxx yyyy (xxxx.yyyy(a)unina.it), CSI - CENTRO DI ATENEO PER I SERVIZI INFORMATIVI (295550), ALTRA STRUTTURA (100000), PersonaleT.A., istituzionali , unina.it dn: cn=xxxy yyyy (xxxx.yyyy(a)unina.it),ou=CSI - CENTRO DI ATENEO PER I SE RVIZI INFORMATIVI (295550),ou=ALTRA STRUTTURA (100000),ou=PersonaleT.A.,ou=is tituzionali,dc=unina,dc=it businessCategory: N employeeType: PersonaleTA mailLocalAddress: xxxx.yyyy(a)unina.it givenName: xxxx objectClass: inetOrgPerson objectClass: inetLocalMailRecipient objectClass: posixAccount objectClass: shadowAccount mailRoutingAddress: xxxx.yyyy(a)unina.it ou:: Y2lvdG9sYSByYWZmYWVsZSAocmNpb3RvbGFAdW5pbmEuaXQpIA== departmentNumber: CODICEFISCALE uid: xxxx.yyyy mail: xxxx.yyyy(a)unina.it mail: matzzzzz(a)unina.it mail: otheralias(a)unina.it mail: otheralias2(a)unina.it uidNumber: nnnnn cn:: Y2lvdG9sYSByYWZmYWVsZSAocmNpb3RvbGFAdW5pbmEuaXQpIA== physicalDeliveryOfficeName: 295550 physicalDeliveryOfficeName: CSI - CENTRO DI ATENEO PER I SERVIZI INFORMATIVI loginShell: /bin/false gidNumber: 100 employeeNumber: zzzzzz homeDirectory: /home/xxxx.yyyy sn: yyyy title: Personale tecnico amm.vo # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 These data should be tranformed in Active Directory format and should have the fields sAMAccountName, mail, group and ProxyAddresses; both that concerns data and authentication. I hope that you can help me... cheers Giacomo

2 1

attribute writing: can an overlay do this?
by Stefano Zanmarchi 21 Sep '09

21 Sep '09

Hallo, I hope someone can give me a hand on this issue. I'd like my ldap server to automaitcally set the value of an attribute, based on the value of another. In the simplest version I'd like it to copy the value of an attribute into another attribute, whenever the first one gets modified. Example: my example entry would be: dn: uid=jsmith,ou=people,dc=myorg,dc=com objectClass: myobjectclass 1st_attrib: 18_06_2009 2nd_attrib: 18_06_2009 now with ldapmodify I change *ONLY* 1st_attrib to 24_07_2009 and I'd like the result to be: dn: uid=jsmith,ou=people,dc=myorg,dc=com objectClass: myobjectclass 1st_attrib: 24_07_2009 2nd_attrib: 24_07_2009 with both attributes changed. Even better would be if the second attribute could be written to a value based on the firs one (e.g. automatically adding 7 days to the date). Any help would be gratly appreciated, Stefano

4 5

Configuring OpenLDAP on Ubuntu 8.10
by Parag Kalra 21 Sep '09

21 Sep '09

Hello Folks, I just installed OpenLDAP ('slapd-2.4.11') and 'ldap-utils' on my Ubuntu 8.10 using Synaptic Manager. I have following queries related to configuring LDAP on Ubuntu. First & Foremost I am completely new to LDAP so please don't mind if my questions are really funny 1. After installation the file '/etc/ldap/ldap.conf' doesn't seem to contain the parameters like 'rootpw' & 'rootdn'. Am I seeing the wrong file or is there any other ldap configuration file on Ubuntu? 2. What is my default root node address and how to change it? 3. My machine doesn't have any FQDN. Its name is - 'station3' and I don't intend to give it a FQDN. Now my question can I have my root node address set to 'dc=station3,dc=home'? If yes, then I guess it has to be through 'ldapmodify' but can someone please share the exact syntax? Thanks in Advance.... Cheers, Parag

5 7

Configuring Active Directory to use External LDAP Server for Authentication
by Kamal Pandey 21 Sep '09

21 Sep '09

Hi, Can anybody help in this matter.I want to integrate Active Directory with External LDAP Directory. Means if a user login then user request goes to AD Server if not found it searches from external LDAP Server which might any LDAP Server and gives the user login. Now, send attachments up to 25MB with Yahoo! India Mail. Learn how. http://in.overview.mail.yahoo.com/photos

2 1

Forced password change not allowed
by mlb＠imparisystems.com 20 Sep '09

20 Sep '09

I've got openLDAP running and installed the pam and nss libraries so it would also control the Linux passwords. I'm trying to sign onto my server using ssh - but once I enter my username and password, I get WARNING: Your password has expired. You must change your password now and login again! Enter login(LDAP) password: Now being a bad security person, I always use the exact same username / password combination and they don't work. If a use either nothing (just hit Enter) or if I put in the standard password I get passwd: Authentication information cannot be recovered passwd: password unchanged Connection to ubuntu closed. If I enter in some nonsensical string I get LDAP Password incorrect: try again Enter login(LDAP) password: However, that is the only root level user on the machine and I have TONS of stuff on it. How do I fix? Is this an openLDAP issue or something else? Thanks

3 2

userCertificate question
by Michael Luich 18 Sep '09

18 Sep '09

Does userCertificate, userSMIMECertificate, and userPKCS12 store the users public or private key? -- Michael Luich Stone's Rose mluich(a)stonesrose.com P: (207) 956-0003 THE MESSAGES AND DOCUMENTS TRANSMITTED WITH THIS NOTICE CONTAIN CONFIDENTIAL INFORMATION BELONGING TO THE SENDER. IF YOU ARE NOT THE INTENDED RECIPIENT OF THIS INFORMATION YOU ARE HEREBY NOTIFIED THAT ANY DISCLOSURE, COPYING, DISTRIBUTION, OR USE OF THE INFORMATION IS STRICTLY PROHIBITED. IF YOU HAVE RECIEVED THIS TRANSMISSION IN ERROR PLEASE NOTIFY THE SENDER IMMEDIATELY.

2 1

Re: ldapsearch hangs
by Tihomir Culjaga 18 Sep '09

18 Sep '09

the search: ldapsearch -h localhost -x -b ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w passwd objectClass=originatorPrefixID slapd.conf: # Indices to maintain index objectClass eq index uniqueID eq index bestMatchPrefix eq index originatorPrefixID eq according to schema i have ou=ou=sipDirektor | --------- ou=bestMatchPrefixList | ----------- bestMatchPrefix=<PREFIX> | ------------------carrierPrefixID=<CARRIER_ID> | ----------------originatorPrefixID=<ORIGIN_CARRIER_PREFIX> here is an example of returned data: # 041020, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=041020,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 041020 priority: 100 originator: 041020 originatorPrefixID: 041020 objectClass: top objectClass: originatorPrefixID # 049010, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=049010,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 049010 priority: 100 originator: 049010 originatorPrefixID: 049010 objectClass: top objectClass: originatorPrefixID # 046010, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=046010,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 046010 priority: 100 originator: 046010 originatorPrefixID: 046010 objectClass: top objectClass: originatorPrefixID # 049020, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=049020,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 049020 priority: 100 originator: 049020 originatorPrefixID: 049020 objectClass: top objectClass: originatorPrefixID # 078120, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=078120,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 078120 priority: 100 originator: 078120 originatorPrefixID: 078120 objectClass: top objectClass: originatorPrefixID # 043010, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=043010,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 043010 priority: 100 originator: 043010 originatorPrefixID: 043010 objectClass: top objectClass: originatorPrefixID Tihomir. On Fri, Sep 18, 2009 at 12:33 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 17, 2009 12:26 PM -0700 Quanah Gibson-Mount < > quanah(a)zimbra.com> wrote: > > --On Thursday, September 17, 2009 9:23 PM +0200 Tihomir Culjaga >> <tculjaga(a)gmail.com> wrote: >> >> so, can anyone help here ? >>> >>> >>> On Tue, Sep 15, 2009 at 8:34 PM, Tihomir Culjaga <tculjaga(a)gmail.com> >>> wrote: >>> >>> ok .. but the basic issue is still there ... >>> >>> i do a complete search and it hangs right on the 1st entry i added with >>> LDAP search ... it watis for 1 minute ...and at the end returns all 4 >>> remaining entries... >>> >> > > Can you better define the search you are running? Is it a search for > particular attr=value string? If so, is that attribute indexed? > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

Re: ldapsearch hangs
by Tihomir Culjaga 18 Sep '09

18 Sep '09

ok .. but the basic issue is still there ... i do a complete search and it hangs right on the 1st entry i added with LDAP search ... it watids for 1 minute ...and at the end returns all 4 remaining entries... Well this is not sometihg very nice. I playes with cache as ell .. and i used 5 GB jus to be sure ... and it is the same ... search hangs fro a while ... and after a minute it pops the remaining 4 entries. these 4 entries i've aded after the DB was recreated from ldiff ... this cannot be normal what do you think ? On Tue, Sep 15, 2009 at 8:13 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > > --On Tuesday, September 15, 2009 5:22 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > can anyone help ? >> >> > Since you reduced the number of your entries to where you DB is only 3.4 GB > in size, there is no need to use a 7GB DB cache in DB_CONFIG anymore. I'd > suggest you drop it to 4GB, use the unlimited dncachesize setting > (dncachesize 0), and then add back in some tuning for cachesize and > idlcachesize settings. > > You need to run one ldapsearch through the entire database to let it seed > the dncache and entry cache, and to pull the data into the BDB DB cache. > > Once that is done, do your test. > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 3

LTSP + LDAP Failover
by Maxime Gaudreault 17 Sep '09

17 Sep '09

Hi Lists I have 2 LTSP servers (failover) running Ubuntu. I have to setup a highly available LDAP authentication system. LTSP's users must authenticate using a LDAP server. Both LDAP servers must replicate between them. I don't really know where to start.. I found those websites: http://www.linuxjournal.com/article/5505 http://www.ltsp.org/twiki/bin/view/Ltsp/LDAP Can you give me some hint or others websites that could help me. Thanks (and sorry for my bad English)

2 1

Re: connections falling short
by Amol Kulkarni 17 Sep '09

17 Sep '09

2 1

Back-perl errors
by Buschman, Marshall 17 Sep '09

17 Sep '09

Hello All: I'm trying to implement back-perl in OpenLDAP 2.3.43 on Debian Lenny. I compiled my own perl due to difficulties with Perl 5.10.x as provided by Debian. Perl is version 5.8.9, lives in /cnu/opt/openldap-perl, and was compiled with "-des -Dprefix=/cnu/opt/openldap-perl -Dusesitecustomize -Dusethreads -Duseshrplib". On starting openldap I get the following error: #slapd -h 'ldap:/// ldaps:/// ldapi:///' -f /etc/openldap/slapd.conf Error Can't load '/cnu/opt/openldap-perl/lib/5.8.9/i686-linux/auto/Fcntl/Fcntl.so' for module Fcntl: /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/auto/Fcntl/Fcntl.so: undefined symbol: PL_curpad at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/XSLoader.pm line 70. at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/Fcntl.pm line 215 BEGIN failed--compilation aborted at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/Fcntl.pm line 216. Compilation failed in require at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/POSIX.pm line 21. BEGIN failed--compilation aborted at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/POSIX.pm line 21. Compilation failed in require at /etc/openldap/SampleLDAP.pm line 28. BEGIN failed--compilation aborted at /etc/openldap/SampleLDAP.pm line 28. Compilation failed in require at (eval 6) line 1. BEGIN failed--compilation aborted at (eval 6) line 1. Back-perl configuration is as follows: database perl suffix "dc=virtualcnu,dc=com" perlModulePath /etc/openldap perlModule SampleLDAP Adding more perlModulePath lines such as: perlModulePath /cnu/opt/openldap-perl/lib/5.8.9/i686-linux perlModulePath /cnu/opt/openldap-perl/lib/5.8.9 perlModulePath /cnu/opt/openldap-perl/lib/site_perl/5.8.9/i686-linux perlModulePath /cnu/opt/openldap-perl/lib/site_perl/5.8.9 Has no effect. I have verified that the files in question do exist. I've also tried compiling perl with only "-des -Dprefix=/cnu/opt/openldap-perl" I'm running the unmodified SampleLDAP.pm from the source distribution. The perl binary (/cnu/opt/openldap-perl/bin/perl) runs normally otherwise. Help? Thank you! -Marshall Buschman

1 0

Windwos 2003 Active Directory CentOS 5.3 OpenLDAP Server Sync
by MMoj＠timocom.com 16 Sep '09

16 Sep '09

Hello everyone, I´m having a hard time. I should enable the sync of an AD (W2K3) and an LDAP (CentOS 5.3) server based on the mentioned System. I realy don´t know how to establish a sync of user Account, Groups, etc. I have a test envirometn running with W2K3 AD and CentOS 5.3 LDAP witch Kerberos for SSO (Single-Sign-ON) but the Information are still located in the AD not in the LDAP and I want to Authenticate against the LDAP server. I realy don´t know how to configure the AD / LDAP so sync, or to replicate the AD into LDAP. Can someone help me out with a good "How-To" or maybe some config files, etc. Many thanks in advance. Mit freundlichen Grüßen / Kind regards Markus Moj IT Infrastructure & Services TimoCom Soft- und Hardware GmbH In der Steele 2 D-40599 Düsseldorf Tel: +49 211 88 26 80 14 Fax: +49 211 88 26 70 14 eMail: MMoj(a)TimoCom.com www.TimoCom.com Geschäftsführer: Jens Thiermann, Gunther Matzaitis Amtsgericht Düsseldorf, HRB 34489

6 5

Re: ldapsearch hangs
by Tihomir Culjaga 15 Sep '09

15 Sep '09

performing the search ... it returned everything (all data from the initial ldi) in very short time and stopped on the same place as before. After that it took ~10 minutes to finish... now, the process is taking 39.5% of memory and 15 - 20 % CPU when doing nothing.. USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND ldap 10597 15.6 39.5 8500816 4046688 ? Ssl 22:05 2:03 /usr/local/libexec/slapd -h ldap:/// -u ldap T. ldap 10597 21.9 39.5 8500816 4046688 ? Ssl 22:05 2:03 /usr/local/libexec/slapd -h ldap:/// -u ldap On Fri, Sep 11, 2009 at 10:09 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 11, 2009 10:04 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > >> What do you mean by: "And setting no cache or idlcachesize" >> >> >> you want me to comment this out ? >> >> >> # cachesize 2500000 >> # idlcachesize 7500000 >> cachefree 1000 >> dncachesize 0 >> > > For the moment, yes. See what size the slapd process is in real memory > with that setting first, after doing a query across the entire database. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 4

Re: connections falling short
by Amol Kulkarni 15 Sep '09

15 Sep '09

3 2

translucent ldap, local search timeouts
by theod＠physics.auth.gr 15 Sep '09

15 Sep '09

Hi to all, I'm a newbie with openldap, but I've spent some time reading the online docs/mailing list archives and testing various configurations with no success. I'm trying to configure a translucent ldap server (v2.4.12) in a Fedora core 10 vhost with the following configuration: (local-server, URI:local.xxx.yyy.zzz) -------------- moduleload translucent.la overlay translucent translucent_local uid #also tried _remote uri ldap://remote.xxx.yyy.zzz:389 lastmod off acl-bind bindmethod=simple #idassert-bind bindmethod=simple mode=none #(also tried this) loglevel 4095 access to dn.base="" by * read access to * by * read database bdb suffix "dc=xxx,dc=yyy,dc=zzz" checkpoint 1024 15 rootdn "uid=me,ou=people,dc=xxx,dc=yyy,dc=zzz" rootpw secret directory /var/lib/ldap-proxy index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub *I have full permissions in my local server but only read permission in the remote ldap (hence the anonymous bind)*. I only want to override the already existing remote entries (but not add new ones). Both servers have very similar structure, and the SAME suffix, as suggested in the manuals. I've created a test user (uid=test,ou=people,dc=xxx,dc=yyy,dc=zzz) in the local server that exists also in the remote one. What happens is: when translucent is disabled i get proper results in both servers with the same ldapsearch command. When translucent is enabled, when i search the local server, the SEARCH HANGS (timeouts)! (remote still works, of course) The LOCAL logs are: (I've included only the suspicious entries) [...] Sep 15 00:43:46 ldap slapd[5029]: slapd startup: initiated. Sep 15 00:43:46 ldap slapd[5029]: ==> translucent_db_open Sep 15 00:43:46 ldap slapd[5029]: backend_startup_one: starting "cn=config" Sep 15 00:43:46 ldap slapd[5029]: config_back_db_open Sep 15 00:43:46 ldap slapd[5029]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context [...] Sep 15 00:43:46 ldap slapd[5029]: backend_startup_one: starting "dc=xxx,dc=yyy,dc=zzz" Sep 15 00:43:46 ldap slapd[5029]: bdb_db_open: "dc=xxx,dc=yyy,dc=zzz" Sep 15 00:43:46 ldap slapd[5029]: bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap-proxy: (2).#012Expect poor performance for suffix "dc=xxx,dc=yyy,dc=zzz". Sep 15 00:43:46 ldap slapd[5029]: bdb_db_open: database "dc=xxx,dc=yyy,dc=zzz": dbenv_open(/var/lib/ldap-proxy). [...] Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on 1 descriptor Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on: Sep 15 00:43:54 ldap slapd[5029]: Sep 15 00:43:54 ldap slapd[5029]: slap_listener_activate(7): Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=7 busy Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: >>> slap_listener(ldap:///) Sep 15 00:43:54 ldap slapd[5029]: daemon: listen=7, new connection on 14 Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on 1 descriptor Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on: Sep 15 00:43:54 ldap slapd[5029]: Sep 15 00:43:54 ldap slapd[5029]: daemon: added 14r (active) listener=(nil) Sep 15 00:43:54 ldap slapd[5029]: conn=0 fd=14 ACCEPT from IP=127.0.0.1:48453 (IP=0.0.0.0:389) Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on 2 descriptors Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on: Sep 15 00:43:54 ldap slapd[5029]: 14r Sep 15 00:43:54 ldap slapd[5029]: Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on 1 descriptor Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on: Sep 15 00:43:54 ldap slapd[5029]: 14r Sep 15 00:43:54 ldap slapd[5029]: Sep 15 00:43:54 ldap slapd[5029]: daemon: read active on 14 Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: connection_get(14) Sep 15 00:43:54 ldap slapd[5029]: connection_get(14): got connid=0 Sep 15 00:43:54 ldap slapd[5029]: connection_read(14): checking for input on id=0 Sep 15 00:43:54 ldap slapd[5029]: conn=0 op=0 do_bind Sep 15 00:43:54 ldap slapd[5029]: >>> dnPrettyNormal: <> Sep 15 00:43:54 ldap slapd[5029]: <<< dnPrettyNormal: <>, <> Sep 15 00:43:54 ldap slapd[5029]: conn=0 op=0 BIND dn="" method=128 Sep 15 00:43:54 ldap slapd[5029]: do_bind: version=3 dn="" method=128 Sep 15 00:43:54 ldap slapd[5029]: translucent_bind: <> method 128 Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on 1 descriptor Sep 15 00:43:54 ldap slapd[5029]: daemon: activity on: Sep 15 00:43:54 ldap slapd[5029]: Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:43:54 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero [...here i pressed control-c on the ldapsearch...] Sep 15 00:44:00 ldap slapd[5029]: daemon: activity on 1 descriptor Sep 15 00:44:00 ldap slapd[5029]: daemon: activity on: Sep 15 00:44:00 ldap slapd[5029]: 14r Sep 15 00:44:00 ldap slapd[5029]: Sep 15 00:44:00 ldap slapd[5029]: daemon: read active on 14 Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: connection_get(14) Sep 15 00:44:00 ldap slapd[5029]: connection_get(14): got connid=0 Sep 15 00:44:00 ldap slapd[5029]: connection_read(14): checking for input on id=0 Sep 15 00:44:00 ldap slapd[5029]: ber_get_next on fd 14 failed errno=0 (Success) Sep 15 00:44:00 ldap slapd[5029]: connection_read(14): input error=-2 id=0, closing. Sep 15 00:44:00 ldap slapd[5029]: connection_closing: readying conn=0 sd=14 for close Sep 15 00:44:00 ldap slapd[5029]: connection_close: conn=0 sd=14 Sep 15 00:44:00 ldap slapd[5029]: daemon: removing 14 Sep 15 00:44:00 ldap slapd[5029]: conn=0 fd=14 closed (connection lost) Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: daemon: activity on 1 descriptor Sep 15 00:44:00 ldap slapd[5029]: daemon: activity on: Sep 15 00:44:00 ldap slapd[5029]: Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 15 00:44:00 ldap slapd[5029]: daemon: epoll: listen=10 active_threads=0 tvp=zero The REMOTE logs (from a yesterday's search though...) are the following: Sep 14 12:18:32 srv004 slapd[2080]: conn=46075 fd=59 ACCEPT from IP=local.xxx.yyy.zzz:45311 (IP=0.0.0.0:389) Sep 14 12:18:32 srv004 slapd[2080]: conn=46075 op=0 BIND dn="" method=128 Sep 14 12:18:32 srv004 slapd[2080]: conn=46075 op=0 RESULT tag=97 err=0 text= Sep 14 12:18:32 srv004 slapd[2080]: conn=46075 op=1 UNBIND Sep 14 12:18:32 srv004 slapd[2080]: conn=46075 fd=59 closed [why there is NO SRCH command?? this is why it timeouts...] Please help! I've spent several hours on this problem, and no matter what options I've tried, it is always the same behavior... Best regards, Theodoros

1 0

Re: connections falling short
by Amol Kulkarni 15 Sep '09

15 Sep '09

1 0

connections falling short
by Amol Kulkarni 14 Sep '09

14 Sep '09

2 1

Re: ldapsearch hangs
by Tihomir Culjaga 11 Sep '09

11 Sep '09

What do you mean by: "And setting no cache or idlcachesize" you want me to comment this out ? #cachesize 2500000 #idlcachesize 7500000 cachefree 1000 dncachesize 0 T. On Fri, Sep 11, 2009 at 6:12 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 11, 2009 5:25 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > >> I just sow what is going on... >> > > > Please stop top-posting. > > Since you didn't change slapd.conf, you never implemented the dncachesize 0 > setting, which I noted was important to do. Go do that. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: ldapsearch hangs
by Tihomir Culjaga 11 Sep '09

11 Sep '09

Hi Quanah, I moved to OpenLDAP 2.4.18 and patched B DB 4.7.25 with all 4 patches from oracle. I DIDN't change slapd.config at all i reduced the number of entries to a total of 3437278. [root@l01lnp2 ~]# du -c -h /var/lib/ldap/*.bdb 200K /var/lib/ldap/bestMatchPrefix.bdb 982M /var/lib/ldap/dn2id.bdb 2.4G /var/lib/ldap/id2entry.bdb 1.8M /var/lib/ldap/objectClass.bdb 1.2M /var/lib/ldap/originatorPrefixID.bdb 48M /var/lib/ldap/uniqueID.bdb 3.4G total <= interesting ... almost the same as number of entries :) changed DB_CONFIG to cache 7 GB: set_cachesize 7 0 1 set_lg_regionmax 262144 set_lg_bsize 2097152 my system has 10 GB of RAM and the situation now is: [root@l01lnp2 ~]# free total used free shared buffers cached Mem: 10234924 10176544 58380 0 2144 3786596 -/+ buffers/cache: 6387804 3847120 Swap: 4096564 753572 3342992 [root@l01lnp2 ~]# When i'm doing ldapsearch (time ldapsearch -h localhost -x -b ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w pero99) before i actuall add anything with ldapadd, the search completes within 40 seconds. slapd process takes 24 - 26% memory. After I add new entries (just 2 more) and perform the same search, it hangs after a while. When it ldapsearch finishes returning entries, i see slapd process memory starts growing .... it is taking almost everything.... reaching 97% ?!?! It is always like this.... the search throws all entries and then waits for some time .. it is almost random 60 seconds - 6 minutes to actually exit. Please can you take a loot to strace logs i've attached in my previous e-mail... as asoon as the ldapsearch stops returning entries i see a lot of jubrish there... Here is slapd process memory growth: *top - 16:42:22 up* 4 days, 1:02, 2 users, load average: 2.13, 0.67, 0.23 Tasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie Cpu(s): 0.8%us, 0.2%sy, 0.0%ni, 70.0%id, 28.8%wa, 0.0%hi, 0.2%si, 0.0%st Mem: 10234924k total, 10177568k used, 57356k free, 6676k buffers Swap: 4096564k total, 36516k used, 4060048k free, 3603688k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 9404 ldap 25 0 13.3g 8.8g 2.8g S 4.0 *89.7 * 1:13.49 slapd * * 1 root 15 0 10344 372 344 S 0.0 0.0 0:01.69 init 2 root RT -5 0 0 0 S 0.0 0.0 0:00.06 migration/0 Tasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie Cpu(s): 7.2%us, 0.7%sy, 0.0%ni, 67.5%id, 24.3%wa, 0.0%hi, 0.3%si, 0.0%st Mem: 10234924k total, 10177968k used, 56956k free, 6656k buffers Swap: 4096564k total, 36516k used, 4060048k free, 3580356k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 9404 ldap 25 0 13.3g 8.9g 2.9g S 30.3 *90.9* 1:16.76 slapd 325 root 10 -5 0 0 0 S 0.7 0.0 5:37.11 kswapd0 8458 root 15 0 0 0 0 D 0.3 0.0 0:02.02 pdflush Tasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie Cpu(s): 1.0%us, 0.3%sy, 0.0%ni, 72.3%id, 26.1%wa, 0.0%hi, 0.3%si, 0.0%st Mem: 10234924k total, 10180560k used, 54364k free, 6140k buffers Swap: 4096564k total, 36516k used, 4060048k free, 3488164k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 9404 ldap 25 0 13.4g 9.3g 3.2g S 4.7 *95.5* 1:28.86 slapd 8458 root 15 0 0 0 0 D 0.7 0.0 0:02.20 pdflush Tasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie Cpu(s): 0.9%us, 0.4%sy, 0.0%ni, 70.5%id, 28.0%wa, 0.0%hi, 0.2%si, 0.0%st Mem: 10234924k total, 10177812k used, 57112k free, 3492k buffers Swap: 4096564k total, 36516k used, 4060048k free, 3481476k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 9404 ldap 25 0 13.4g 9.4g 3.2g S 4.3* 95.9* 1:30.39 slapd * * 325 root 10 -5 0 0 0 S 0.7 0.0 5:38.08 kswapd0 *top - 16:45:01 up *4 days, 1:05, 2 users, load average: 1.91, 1.40, 0.59 Tasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie Cpu(s): 3.2%us, 0.2%sy, 0.0%ni, 75.0%id, 21.4%wa, 0.0%hi, 0.1%si, 0.0%st Mem: 10234924k total, 10179744k used, 55180k free, 396k buffers Swap: 4096564k total, 42328k used, 4054236k free, 3473624k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 9404 ldap 25 0 13.5g 9.4g 3.3g S 13.6 *96.7* 1:33.44 slapd 9490 root 15 0 0 0 0 S 0.3 0.0 0:00.31 pdflush *top - 16:45:33 up *4 days, 1:05, 2 users, load average: 1.55, 1.36, 0.60 Tasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie Cpu(s): 2.7%us, 0.2%sy, 0.0%ni, 74.7%id, 22.3%wa, 0.0%hi, 0.1%si, 0.0%st Mem: 10234924k total, 10180100k used, 54824k free, 652k buffers Swap: 4096564k total, 118616k used, 3977948k free, 3521232k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 9404 ldap 25 0 13.5g 9.4g 3.3g S 10.6 *96.6* 1:37.36 slapd 325 root 10 -5 0 0 0 S 0.3 0.0 5:38.63 kswapd0 This looks to me as a memory leak bug to me. Tihomir. On Thu, Sep 10, 2009 at 9:37 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 10, 2009 8:56 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > So, the situation is that i have 2 ldif files i'm recreating the database >> from. >> >> /usr/local/libexec/slapadd -l /home/tculjaga/file2.ldif -f >> /usr/local/etc/openldap/slapd.conf >> /usr/local/libexec/slapadd -l /home/tculjaga/file2.ldif -f >> /usr/local/etc/openldap/slapd.conf >> > > I would suggest you just make these a single file, so all the work can be > done at one time. > > I tried to re-index with /usr/local/libexec/slapindex -f >> /usr/local/etc/openldap/slapd.conf -v >> restart slapd process, restart the machine ... it is always the same >> issue. >> > > Nothing here indicates a problem with your indices. Running slapindex > repeatedly is a waste of your time. > > [root@l01lnp2 traces]# /usr/local/libexec/slapd -V >> @(#) $OpenLDAP: slapd 2.4.16 (Sep 9 2009 14:39:44) $ >> root@l01lnp2:/home/tculjaga/openldap-2.4.16/servers/slapd >> > > I would strongly urge you to upgrade to 2.4.18 (for reasons I will note > further down) > > > [root@l01lnp2 traces]# /usr/local/BerkeleyDB.4.7/bin/db_stat -V >> Berkeley DB 4.7.25: (May 15, 2008) - unpached! >> > > You need to rebuild BDB 4.7.25 with the 4 patches from Oracle. There are > known issues when running BDB 4.7 without them. > > [root@l01lnp2 traces]# du -c -h /var/lib/ldap/*.bdb >> 200K /var/lib/ldap/bestMatchPrefix.bdb >> 3.8G /var/lib/ldap/dn2id.bdb >> 6.2G /var/lib/ldap/id2entry.bdb >> 1.8M /var/lib/ldap/objectClass.bdb >> 1.2M /var/lib/ldap/originatorPrefixID.bdb >> 48M /var/lib/ldap/uniqueID.bdb >> 10G total >> > > Since your database is a total of 10 GB in size, for slapadd to work at > optimum efficiency, you need at least 10GB of cache for your DB_CONFIG file. > Unfortunately, you only have 10GB of RAM. Essentially, your system is > under powered for your database size. > > > > [tculjaga@l01lnp2 ~]$ cat ot.ldif | grep -c "dn: " >> 101588 >> [tculjaga@l01lnp2 ~]$ cat l01sipdir1.ldif | grep -c "dn: " >> 9994864 >> [tculjaga@l01lnp2 ~]$ >> > > So you have 10,096,452 entries total. > > [root@l01lnp2 traces]# cat /var/lib/ldap/DB_CONFIG | grep -v "#" >> >> set_cachesize 0 3221225472 1 >> set_lg_regionmax 262144 >> set_lg_bsize 2097152 >> > > You only have a 3GB DB cachesize configured here. Expect things to perform > sub optimally. It would have been easier to set this by going > > set_cachesize 3 0 1 > > Which would have the same effect, since the first number is the number of > gigabytes to allocate. > > Please find attached slapd.conf >> > > Ok, so the relevant bits from here are: > > cachesize 2500000 > idlcachesize 7500000 > cachefree 1000 > > Which means you have a cachesize of 2.5 million, an idlcachesize of 7.5 > million, and (with OL 2.4.16) a dncachesize of 5 million. > > I would highly advise you upgrade to OpenLDAP 2.4.18, and change the > slapd.conf settings to: > > dncachesize 0 (which means unlimited). > > And setting no cache or idlcachesize, and fixing your DB_CONFIG. But you > also need to buy a substantial amount of RAM for a DB of this size. :P I > would advise you upgrade to at least 32GB total. Then you can more > optimally tune the system. > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

What could cause a ber_flush errno=11?
by Oliver Henriot 11 Sep '09

11 Sep '09

Dear list users, I am getting the following errors on my Openldap servers : ber_flush failed errno=11 reason="Resource temporarily unavailable" The same error occurs indifferently on master and replica servers. I'm trying to work out what might be causing this. I presume it's a network issue. What I'm not sure of is if it is when then servers try to communicate or if it is something else. One possible other cause is when the server tries to write the data to its database, as the filesystem is hosted on an iscsi NAS, but then the error would presumably be with iscsi and not openldap. My servers are all Openldap 2.3.43-3.el5 on CentOS 5.3, using bdb for the database and syncrepl for replication. I tried to find info about ber_flush and its various error codes but I haven't been very successful so far. Do you have any clues? Thanks. Oliver

3 4

Re: Reg Adding New Attributes
by Asimananda Mohanty 11 Sep '09

11 Sep '09

Hi, Thanks for the reply. I have to define my own schema so as to use the new attribute and it should be *similar* to the schema which is used to create new user like the one I mentioned in my first mail. Also the methods that I found through google suggest to do some modification to the file slapd.conf where as in my case, I don't have any slapd.conf file at all. Please comment. Regards Asimananda On Thu, Sep 10, 2009 at 10:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 10, 2009 9:33 AM -0700 Quanah Gibson-Mount < > quanah(a)zimbra.com> wrote: > > --On Thursday, September 10, 2009 3:20 PM +0530 Asimananda Mohanty >> <asimananda.mohanty(a)gmail.com> wrote: >> >> Hi All, >>> >>> >>> I have installed OpenLdap and PHPLdapAdmin. >>> >>> >>> I have added a user which objectclass is : >>> >>> >>> objectClass inetOrgPerson posixAccount shadowAccount >>> >>> >>> I need to add a new attribute which will be application specific >>> (application which will need LDAP authentication and based on the >>> attribute value, it will provide service to the user). >>> >>> >>> When I tried to do the same by adding attribute and value to ldif files >>> and then adding the ldif file, it showed error: >>> >>> >>> ldap_add: Undefined attribute type (17) additional info: AppAttribute1: >>> attribute type undefined. >>> >> >> >> What is AppAttribute1? It's not a part of any of those schema. >> > > Or more to the point -- Have you defined your own custom schema, with that > attribute and whatever other custom attributes you need, with an objectClass > holding them? > > I suggest reading over <http://www.openldap.org/faq/data/cache/219.html> > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 2

Problem with bdb_dn2id
by koitoer 11 Sep '09

11 Sep '09

Hello everybody, I have the next problem. When I tried to add new records to my ldap server , this take a long time, and never do it. First of all I install openldap from sources with those commands env CPPFLAGS="-I/usr/local/include -I/usr/local/BerkeleyDB.4.7/include -I/usr/local/ssl/include/openssl" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.4.7/lib -L/usr/local/ssl/lib -R/usr/local/lib -R/usr/local/BerkeleyDB.4.7/lib -R/usr/local/ssl/lib" LD_LIBRARY_PATH="/usr/local/BerkeleyDB.4.7/lib" ./configure --with-tls --enable-slurpd --enable-crypt --enable-syslog --enable-ldap --enable-ppolicy --enable-sql --enable-dynamic --enable-modules --enable-backends=mod --enable-overlays=mod --prefix=/etc make depend make make test make install And no error appears. So then when I run this command, openldap takes long time, and never response or do something koitoerlp:/etc/etc/openldap# ldapadd -a -x -W -D "cn=manager,dc=koitoerldap,dc=com" -f koitoerldap.ldif Enter LDAP Password: < = LDAP dont send any message or error only wait for the answer but it never comes. The koitoerldap.ldif is : dn: ou=Mounts,dc=koitoerldap,dc=com ou: Mounts objectClass: top objectClass: organizationalUnit dn: ou=Networks,dc=koitoerldap,dc=com ou: Networks objectClass: top objectClass: organizationalUnit dn: ou=People,dc=koitoerldap,dc=com ou: People objectClass: top objectClass: organizationalUnit In the debug mode of ldap I see this before the ldapadd command when i run this command /etc/libexec/slapd -d 1 start @(#) $OpenLDAP: slapd 2.4.16 (Sep 7 2009 16:27:31) $ root@koitoerlp:/usr/src/openldap-2.4.16/servers/slapd ldap_pvt_gethostbyname_a: host=koitoerlp, r=0 daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.7.25: (May 15, 2008) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.7.25: (May 15, 2008) ==>sql_back_initialize() <==sql_back_initialize() bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=koitoerldap,dc=com> <<< dnPrettyNormal: <dc=koitoerldap,dc=com>, <dc=koitoerldap,dc=com> >>> dnPrettyNormal: <cn=Manager,dc=koitoerldap,dc=com> <<< dnPrettyNormal: <cn=Manager,dc=koitoerldap,dc=com>, <cn=manager,dc=koitoerldap,dc=com> >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init ??????????????? Ommited some lines slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}nis" config_build_entry: "cn={3}inetorgperson" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=koitoerldap,dc=com" bdb_db_open: database "dc=koitoerldap,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "dc=koitoerldap,dc=com": dbenv_open(/etc/var/openldap-data). bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting When I launch the ldapadd command my debug mode ldap shows slapd starting slap_listener_activate(8): >>> slap_listener(ldap:///) connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 51 contents: ber_get_next conn=0 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com> <<< dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com>, <cn=manager,dc=koitoerldap,dc=com> do_bind: version=3 dn="cn=manager,dc=koitoerldap,dc=com" method=128 do_bind: v3 bind: "cn=manager,dc=koitoerldap,dc=com" to "cn=manager,dc=koitoerldap,dc=com" send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 98 contents: ber_get_next conn=0 op=1 do_add ber_scanf fmt ({m) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: >>> dnPrettyNormal: <ou=Mounts,dc=koitoerldap,dc=com> <<< dnPrettyNormal: <ou=Mounts,dc=koitoerldap,dc=com>, <ou=mounts,dc=koitoerldap,dc=com> bdb_dn2entry("ou=mounts,dc=koitoerldap,dc=com") => bdb_dn2id("dc=koitoerldap,dc=com") <= bdb_dn2id: got id=0x1 => bdb_dn2id("ou=mounts,dc=koitoerldap,dc=com") And never past this command, to finish I have to kill openldap process, I think is a problem maybe in db but im not sure. Maybe in my installation, I tried to change some parameters in the slapd.conf but it doesnt work. In some case openldap insert the first record in the ldif file, but in the second this actions comes again, and no more record will be insert. My ldap.conf , slapd.conf and DB.CONFIG HOST 127.0.0.1 BASE dc=koitoerldap,dc=com koitoerlp:/etc/etc/openldap# cat slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/etc/openldap/schema/core.schema include /etc/etc/openldap/schema/cosine.schema include /etc/etc/openldap/schema/nis.schema include /etc/etc/openldap/schema/inetorgperson.schema pidfile /etc/var/run/slapd.pid argsfile /etc/var/run/slapd.args # Load dynamic backend modules: # modulepath /etc/libexec/openldap moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=koitoerldap,dc=com" rootdn "cn=Manager,dc=koitoerldap,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}HO3g6J/KgbIUQGsanP8ld9hrEyPNhfKs # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /etc/var/openldap-data # Indices to maintain index objectClass eq cat /etc/var/openldap-data/DB_CONFIG # one 0.25 GB cache set_cachesize 0 268435456 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs finally when I tried to login in phpopenldapadmin, I have the same trouble when I click in the login button, this message appears in the openldap debug mode slapd starting slap_listener_activate(8): >>> slap_listener(ldap:///) connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 51 contents: ber_get_next conn=0 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com> <<< dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com>, <cn=manager,dc=koitoerldap,dc=com> do_bind: version=3 dn="cn=manager,dc=koitoerldap,dc=com" method=128 do_bind: v3 bind: "cn=manager,dc=koitoerldap,dc=com" to "cn=manager,dc=koitoerldap,dc=com" send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next conn=0 op=1 do_unbind connection_close: conn=0 sd=12 slap_listener_activate(8): >>> slap_listener(ldap:///) connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next: tag 0x30 len 51 contents: ber_get_next conn=1 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com> <<< dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com>, <cn=manager,dc=koitoerldap,dc=com> do_bind: version=3 dn="cn=manager,dc=koitoerldap,dc=com" method=128 do_bind: v3 bind: "cn=manager,dc=koitoerldap,dc=com" to "cn=manager,dc=koitoerldap,dc=com" send_ldap_result: conn=1 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next: tag 0x30 len 67 contents: ber_get_next conn=1 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <dc=koitoerldap,dc=com> <<< dnPrettyNormal: <dc=koitoerldap,dc=com>, <dc=koitoerldap,dc=com> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => bdb_search bdb_dn2entry("dc=koitoerldap,dc=com") => bdb_dn2id("dc=koitoerldap,dc=com") <= bdb_dn2id: got id=0x1 entry_decode: "dc=koitoerldap,dc=com" <= entry_decode(dc=koitoerldap,dc=com) => bdb_dn2id_children("dc=koitoerldap,dc=com") <= bdb_dn2id_children("dc=koitoerldap,dc=com"): (0) => send_search_entry: conn 1 dn="dc=koitoerldap,dc=com" ber_flush2: 514 bytes to sd 12 <= send_search_entry: conn 1 exit. send_ldap_result: conn=1 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next: tag 0x30 len 538 contents: ber_get_next conn=1 op=2 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => send_search_entry: conn 1 dn="" ber_flush2: 778 bytes to sd 12 <= send_search_entry: conn 1 exit. send_ldap_result: conn=1 op=2 p=3 send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next: tag 0x30 len 78 contents: ber_get_next conn=1 op=3 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com> <<< dnPrettyNormal: <cn=manager,dc=koitoerldap,dc=com>, <cn=manager,dc=koitoerldap,dc=com> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => bdb_search bdb_dn2entry("cn=manager,dc=koitoerldap,dc=com") => bdb_dn2id("cn=manager,dc=koitoerldap,dc=com") And again neves past this point, I dont know why, maybe I install bad openldap and need more parameters. Please dont say me install with apt-get , I want to make this from source, but a few time ago I install with apt and this error not appear, but in this case I want to make without apt. Any suggestion, opinion or help will be useful and graceful. In advance thanks a lot.

2 4

Re: ldapsearch hangs
by Tihomir Culjaga 10 Sep '09

10 Sep '09

nice link... thnaks! Will let you know the results. T. On Thu, Sep 10, 2009 at 10:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 10, 2009 10:07 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > wow, Quanah, >> >> that's the best answer i ever got... >> >> I'm gong to move to 2.4.18 and try to tune up the machine... regarding >> more RAM ... i can get it but not tha fast. >> >> what can i expect with a total of 10 GB ?... >> >> I plan to set set_cachesize 7 0 1 >> >> what is the relation between cachesize (in slapd.conf) and set_cachesize >> (in DB_CONFIG)? >> > > They aren't related. cachesize (in slapd.conf) is for the entry cache. > set_cachesize is for the BDB backing cache. > > set_cachesize =>how much memory i wiill cache >> cachesize => number of entries i will keep within the cache >> >> how much one entry take ? >> >> Lets say if i use 7 GB of cache, what cachesize should i put? >> > > Hard to say. ;) A bit of the BDB cache will likely be swapped out. > > You may also want to read: > > <http://wiki.zimbra.com/index.php?title=OpenLDAP_Performance_Tuning_6.0> > > It has some zimbra specific commands in it, but it should be fairly trivial > to see how it maps to your openldap install. I'd also particularly read > over the bit about using a shared memory key for the BDB cache once you go > beyond 8GB cachesize (which you will do after you get more RAM. ;) ). > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: ldapsearch hangs
by Tihomir Culjaga 10 Sep '09

10 Sep '09

wow, Quanah, thats the best answer i ever got... I'm gong to move to 2.4.18 and try to tune up the machine... regarding more RAM ... i can get it but not tha fast. what can i expect with a total of 10 GB ?... I plan to set set_cachesize 7 0 1 what is the relation between cachesize (in slapd.conf) and set_cachesize (in DB_CONFIG)? set_cachesize =>how much memory i wiill cache cachesize => number of entries i will keep within the cache how much one entry take ? Lets say if i use 7 GB of cache, what cachesize should i put? T. On Thu, Sep 10, 2009 at 9:37 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 10, 2009 8:56 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > So, the situation is that i have 2 ldif files i'm recreating the database >> from. >> >> /usr/local/libexec/slapadd -l /home/tculjaga/file2.ldif -f >> /usr/local/etc/openldap/slapd.conf >> /usr/local/libexec/slapadd -l /home/tculjaga/file2.ldif -f >> /usr/local/etc/openldap/slapd.conf >> > > I would suggest you just make these a single file, so all the work can be > done at one time. > > I tried to re-index with /usr/local/libexec/slapindex -f >> /usr/local/etc/openldap/slapd.conf -v >> restart slapd process, restart the machine ... it is always the same >> issue. >> > > Nothing here indicates a problem with your indices. Running slapindex > repeatedly is a waste of your time. > > [root@l01lnp2 traces]# /usr/local/libexec/slapd -V >> @(#) $OpenLDAP: slapd 2.4.16 (Sep 9 2009 14:39:44) $ >> root@l01lnp2:/home/tculjaga/openldap-2.4.16/servers/slapd >> > > I would strongly urge you to upgrade to 2.4.18 (for reasons I will note > further down) > > > [root@l01lnp2 traces]# /usr/local/BerkeleyDB.4.7/bin/db_stat -V >> Berkeley DB 4.7.25: (May 15, 2008) - unpached! >> > > You need to rebuild BDB 4.7.25 with the 4 patches from Oracle. There are > known issues when running BDB 4.7 without them. > > [root@l01lnp2 traces]# du -c -h /var/lib/ldap/*.bdb >> 200K /var/lib/ldap/bestMatchPrefix.bdb >> 3.8G /var/lib/ldap/dn2id.bdb >> 6.2G /var/lib/ldap/id2entry.bdb >> 1.8M /var/lib/ldap/objectClass.bdb >> 1.2M /var/lib/ldap/originatorPrefixID.bdb >> 48M /var/lib/ldap/uniqueID.bdb >> 10G total >> > > Since your database is a total of 10 GB in size, for slapadd to work at > optimum efficiency, you need at least 10GB of cache for your DB_CONFIG file. > Unfortunately, you only have 10GB of RAM. Essentially, your system is > under powered for your database size. > > > > [tculjaga@l01lnp2 ~]$ cat ot.ldif | grep -c "dn: " >> 101588 >> [tculjaga@l01lnp2 ~]$ cat l01sipdir1.ldif | grep -c "dn: " >> 9994864 >> [tculjaga@l01lnp2 ~]$ >> > > So you have 10,096,452 entries total. > > [root@l01lnp2 traces]# cat /var/lib/ldap/DB_CONFIG | grep -v "#" >> >> set_cachesize 0 3221225472 1 >> set_lg_regionmax 262144 >> set_lg_bsize 2097152 >> > > You only have a 3GB DB cachesize configured here. Expect things to perform > sub optimally. It would have been easier to set this by going > > set_cachesize 3 0 1 > > Which would have the same effect, since the first number is the number of > gigabytes to allocate. > > Please find attached slapd.conf >> > > Ok, so the relevant bits from here are: > > cachesize 2500000 > idlcachesize 7500000 > cachefree 1000 > > Which means you have a cachesize of 2.5 million, an idlcachesize of 7.5 > million, and (with OL 2.4.16) a dncachesize of 5 million. > > I would highly advise you upgrade to OpenLDAP 2.4.18, and change the > slapd.conf settings to: > > dncachesize 0 (which means unlimited). > > And setting no cache or idlcachesize, and fixing your DB_CONFIG. But you > also need to buy a substantial amount of RAM for a DB of this size. :P I > would advise you upgrade to at least 32GB total. Then you can more > optimally tune the system. > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: ldapsearch hangs
by Quanah Gibson-Mount 10 Sep '09

10 Sep '09

--On Thursday, September 10, 2009 8:56 PM +0200 Tihomir Culjaga <tculjaga(a)gmail.com> wrote: > So, the situation is that i have 2 ldif files i'm recreating the database > from. > > /usr/local/libexec/slapadd -l /home/tculjaga/file2.ldif -f > /usr/local/etc/openldap/slapd.conf > /usr/local/libexec/slapadd -l /home/tculjaga/file2.ldif -f > /usr/local/etc/openldap/slapd.conf I would suggest you just make these a single file, so all the work can be done at one time. > I tried to re-index with /usr/local/libexec/slapindex -f > /usr/local/etc/openldap/slapd.conf -v > restart slapd process, restart the machine ... it is always the same > issue. Nothing here indicates a problem with your indices. Running slapindex repeatedly is a waste of your time. > [root@l01lnp2 traces]# /usr/local/libexec/slapd -V > @(#) $OpenLDAP: slapd 2.4.16 (Sep 9 2009 14:39:44) $ > root@l01lnp2:/home/tculjaga/openldap-2.4.16/servers/slapd I would strongly urge you to upgrade to 2.4.18 (for reasons I will note further down) > [root@l01lnp2 traces]# /usr/local/BerkeleyDB.4.7/bin/db_stat -V > Berkeley DB 4.7.25: (May 15, 2008) - unpached! You need to rebuild BDB 4.7.25 with the 4 patches from Oracle. There are known issues when running BDB 4.7 without them. > [root@l01lnp2 traces]# du -c -h /var/lib/ldap/*.bdb > 200K /var/lib/ldap/bestMatchPrefix.bdb > 3.8G /var/lib/ldap/dn2id.bdb > 6.2G /var/lib/ldap/id2entry.bdb > 1.8M /var/lib/ldap/objectClass.bdb > 1.2M /var/lib/ldap/originatorPrefixID.bdb > 48M /var/lib/ldap/uniqueID.bdb > 10G total Since your database is a total of 10 GB in size, for slapadd to work at optimum efficiency, you need at least 10GB of cache for your DB_CONFIG file. Unfortunately, you only have 10GB of RAM. Essentially, your system is under powered for your database size. > [tculjaga@l01lnp2 ~]$ cat ot.ldif | grep -c "dn: " > 101588 > [tculjaga@l01lnp2 ~]$ cat l01sipdir1.ldif | grep -c "dn: " > 9994864 > [tculjaga@l01lnp2 ~]$ So you have 10,096,452 entries total. > [root@l01lnp2 traces]# cat /var/lib/ldap/DB_CONFIG | grep -v "#" > > set_cachesize 0 3221225472 1 > set_lg_regionmax 262144 > set_lg_bsize 2097152 You only have a 3GB DB cachesize configured here. Expect things to perform sub optimally. It would have been easier to set this by going set_cachesize 3 0 1 Which would have the same effect, since the first number is the number of gigabytes to allocate. > Please find attached slapd.conf Ok, so the relevant bits from here are: cachesize 2500000 idlcachesize 7500000 cachefree 1000 Which means you have a cachesize of 2.5 million, an idlcachesize of 7.5 million, and (with OL 2.4.16) a dncachesize of 5 million. I would highly advise you upgrade to OpenLDAP 2.4.18, and change the slapd.conf settings to: dncachesize 0 (which means unlimited). And setting no cache or idlcachesize, and fixing your DB_CONFIG. But you also need to buy a substantial amount of RAM for a DB of this size. :P I would advise you upgrade to at least 32GB total. Then you can more optimally tune the system. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Reg Adding New Attributes
by Asimananda Mohanty 10 Sep '09

10 Sep '09

Hi All, I have installed OpenLdap and PHPLdapAdmin. I have added a user which objectclass is : objectClass inetOrgPerson posixAccount shadowAccount I need to add a new attribute which will be application specific (application which will need LDAP authentication and based on the attribute value, it will provide service to the user). When I tried to do the same by adding attribute and value to ldif files and then adding the ldif file, it showed error: ldap_add: Undefined attribute type (17) additional info: AppAttribute1: attribute type undefined. Do I need to modify related schema for the same? Please suggest some suitable way to do the same. Is there any way that I can do it from the PhpLDAPAdmin GUI? Thanks in advance. -Asimananda

2 2

ldapsearch hangs
by Tihomir Culjaga 10 Sep '09

10 Sep '09

hello, I got an issue with OpenLDAP.... BDB 4.7 and OpenLDAP 2.4.18 is runnong on CentOS 5.3 installed on an HP DL380 G5 machine with 10 GB RAM. The database is quite big...ldif file is ~2GB. I manage to load the ldif file into the DB with ldapadd. Well, so far so good, i'm able to search entries. My application on a different server connects to LDAP and requests entire subtree (ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr) and within a minute and half, it gets everything. Now, the problem comes when you add some few more entries to the DB with ldapadd... in my case 2 entries dn: carrierPrefixID=043010.100.10000.100,bestMatchPrefix=385,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr qos: 100 priority: 10000 carrierPrefixID: 043010.100.10000.100 carrierPrefix: 043010 weight: 100 carrier: Telekom Austria objectClass: top objectClass: carrierPrefixID dn: originatorPrefixID=000010,carrierPrefixID=043010.100.10000.100,bestMatchPrefix=385,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 000010 priority: 100 originator: T-COM/HT originatorPrefixID: 000010 objectClass: top objectClass: originatorPrefixID The application doesn't get all entries ... as LDAP server stops respnding. In brief, i run ldapsearch manually and i get it stuk after a while: [root@l01lnp2 ldap]# [root@l01lnp2 ldap]# time ldapsearch -h localhost -x -b ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w password # extended LDIF # # LDAPv3 # base <ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # bestMatchPrefixList, sipDirektor, ot.hr dn: ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr ou: bestMatchPrefixList objectClass: top objectClass: organizationalUnit # 7, bestMatchPrefixList, sipDirektor, ot.hr dn: bestMatchPrefix=7,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr destination: Russian Federation bestMatchPrefix: 7 objectClass: top objectClass: bestMatchPrefix <-------------------------snip-------------------------> # 043010, 046010.100.8000.100, 99893, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=043010,carrierPrefixID=046010.100.8000.100,bestMatchPre fix=99893,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 043010 priority: 100 originator: 043010 originatorPrefixID: 043010 objectClass: top objectClass: originatorPrefixID # 039010, 046010.100.8000.100, 99893, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=039010,carrierPrefixID=046010.100.8000.100,bestMatchPre fix=99893,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 039010 priority: 100 originator: 039010 originatorPrefixID: 039010 objectClass: top objectClass: originatorPrefixID It hangs here ... and i have to stop ldapsearch (CTRL + C) real 12m2.592s user 0m2.448s sys 0m2.150s [root@l01lnp2 ldap]# I have the same issue on the BDB4.3 and OpenLDAP 2.3 that comes with CentOD 5.3 distribution as well. What m'I missing? What can i do ? I already tried to: reindex (slapindex -f slapd.conf) db_recover everytihng

2 3

crafting acls
by fmgre-liste01＠yahoo.fr 10 Sep '09

10 Sep '09

Hello, I was wondering if there is a way to let specific users access (write ) given fields : • all my users are in a single branch • all my users are inetOrgPerson + posixAccount • users are distributed in several groups according to their gidNumbers • some users are priviledged and also belong to a given posixGroup I would like to know if it is possible to write an acl so that : a priviledge user can modify some fields ( shell, homeDirectory ) of users whose gidNumber matches the gidNumber of the priviledged user Thanks Fred

2 1

ldapsearch hang on OpenLDAP 2.3
by William Jojo 10 Sep '09

10 Sep '09

Now I know that 2.4 is the recommended level, however, this system is not ready to be converted (yet). It's running 2.3.39 on AIX 5.3 (BDB 4.4.20 with all patches) and in the master in a master/slave (slurpd) environment. I could upgrade to 2.3.43 (if you think it will help), but we are planning moving it to 2.4 soon. We had an issue with an ldapsearch that would not finish - it connected, but failed to return information. When I "truss"-ed the pid, it was switching between threads but acted like The slapd daemon responded to kill -HUP and stopped successfully. db_recover was: [svc1:/ldap/db/database] # /opt/pware/bin/db_recover -v -h . Finding last valid log LSN: file: 545 offset 8672731 Recovery starting from [545][8672586] Recovery complete at Wed Sep 9 15:22:45 2009 Maximum transaction ID 8005cffa Recovery checkpoint [545][8672731] Then we ran a script that stops the DB and does an export (which looks good) and tars up the db files and log file. Shortly thereafter searching for the same entry cause a hang, but slapd stopped successfully. Then ran db_recover again: [svc1:/ldap/db/database] # db_recover -v -h . Finding last valid log LSN: file: 545 offset 8900926 Recovery starting from [545][8900781] Recovery complete at Wed Sep 9 15:29:37 2009 Maximum transaction ID 800000ad Recovery checkpoint [545][8900926] Unfortunately we had the log level set to 0, so we never saw the details in syslog. Is 256 the correct value (which logs quite a bit of stuff) for a busy server? Is this a corrupt environment? Corrupt index? Should we remove the environment and reindex the database? We are trying to avoid reloading from the export, if possible. Again, we are just trying to breathe some life into this server for the short term as moving to 2.4 right this minute has other implications we just can't change at the moment. Appreciate any ideas on this. Cheers, Bill

1 0

Sudden drop in cache efficiency
by Bjørn Ruberg 09 Sep '09

09 Sep '09

Hi list, I'm currently monitoring the cache efficiency in a BerkeleyDB backend, as examined with db_stat -m. About 24 hours after starting slapd I noticed a significant drop in several indexes, while the general activity did not change much at that time. Also, the systems using the service did not experience any reduction in availability or response. The cache efficiency in percentage remains at 99%. Its MirrorMode peer experienced a similar drop at the exact same time, though for fewer indexes. The affected nodes are in a refreshAndPersist, retry="60 +" MirrorMode setup. Backend database is configured as hdb. The binaries in use are the latest RPMs from Buchan Milne (openldap2.4-servers-2.4.17-3.rhel5, which comes packed with its own BerkeleyDB 4.7 libraries), running on a RHEL5.3 system. The graphs are available at http://www.ruberg.no/tmp/slapd.html. The drops occured just before 15:00. The nodes are in the same IP network without any routers or firewalls in-between. Replication between the nodes works flawlessly. Is this kind of drop normal behaviour? Has slapd stopped asking its backend (or peer) for data and started serving everything from its own buffer? Since the observations correlate between the active and the passive node I currently suspect this involves the replication mechanism(s). (The reason some indexes are not currently graphed is that the numbers read from db_stat are suffixed with SI units when above 10 million, and the monitoring tool doesn't account for that yet.) Thanks for any pointers and ideas, -- Bjørn

1 0

OpenLdap/Active Directory/Trusts
by tom mahy 08 Sep '09

08 Sep '09

Hi, Our current setup is 2 active directories, with one openLdap. Our applications syncs with openLdap, openLdap acts as a proxy to the active directories, meaning we can see both AD's in OpenLdap. This is great, but when we setup trusts in Active Directory, openLdap detects them as simple folders, and does not apply the trust. Therefore when we sync we only get the top folder, the trust inside it is ignored. meaning we are missing a level. Is there anyway of making openLdap detect these trusts and apply them ? Sincerely, Tom Mahy

2 1

How to get certain log messages to filter through to a user connecting to OpenLDAP via a JSP page?
by Akke Bengtsson 08 Sep '09

08 Sep '09

I realise this borders on a Java development question but I presume there is an ldap-specific side of it as well so - here we go. We use an OpenLDAP service to authenticate and authorize users of server based web applications written as JSP/EJB pages. We have a reasonably working solution to let assorted exception messages filter back to the user. Much more difficult getting the warning messages back telling for instance that the password is about to expire or that it already has expired and so and so many grace logins remain, due to ppolicy. I can see them in the ldap server application log but how to access them programmatically boggles my mind. Best Regards Akke Bengtsson Systems Developer

1 0

Mirror replication with multi databases
by KISTER RAPHAEL 07 Sep '09

07 Sep '09

Hello, I have to deploy an OpenLDAP in mirror mode and my OpenLDAP have 10 database. OpenLDAP is in 2.4.17 version and is deploy on Debian Lenny with Berkeley DB 4.6. I would like to know if my config file is correct. Indeed, when i start my OpenLDAP and if i add some entries, these entries are not replicated on the second OpenLDAP. This is my config file for the first OpenLDAP : ----------------------------------------------------------------------- # Global section serverID 1 # Inclusion des schemas include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/spr.schema # -1 ALL, 0 NODEBUG, 8 CONNECTION MANAGMT, 32 SEARCH FILTER PROCESS, 128 ACCESS CTRL, 256 STAT LOG (CON, OP, RES), 512 STAT LOG ENTRIES SENT, 16384 SYNC loglevel 0 # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 16 threads 32 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/local/lib moduleload back_hdb moduleload back_ldap moduleload back_monitor moduleload syncprov.la access to dn.base="" by * read access to * by self write by dn="cn=admin,cn=config" write by * read access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,cn=config" write by users read by * none backend hdb ####################################################################### # BDB database definitions ####################################################################### database monitor # Dynamic Config database config rootdn "cn=admin,cn=config" rootpw secret ############################################################################################ # Base Suffix 0 database hdb suffix "suffix=0,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u10/openldap cachesize 200000 cachefree 10000 shm_key 1 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 1 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u9/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=1 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=0,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 1 database hdb suffix "suffix=1,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u1/openldap cachesize 200000 cachefree 10000 shm_key 11 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 11 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u2/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=2 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=1,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 2 database hdb suffix "suffix=2,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u2/openldap cachesize 200000 cachefree 10000 shm_key 21 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 21 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u1/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=3 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=2,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 3 database hdb suffix "suffix=3,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u3/openldap cachesize 200000 cachefree 10000 shm_key 31 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 31 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u4/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=4 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=3,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 4 database hdb suffix "suffix=4,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u4/openldap cachesize 200000 cachefree 10000 shm_key 41 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 41 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u3/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=5 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=4,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 5 database hdb suffix "suffix=5,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u5/openldap cachesize 200000 cachefree 10000 shm_key 51 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 51 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u6/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=6 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=5,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 6 database hdb suffix "suffix=6,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u6/openldap cachesize 200000 cachefree 10000 shm_key 61 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 61 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u5/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=7 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=6,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 7 database hdb suffix "suffix=7,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u7/openldap cachesize 200000 cachefree 10000 shm_key 71 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 71 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u8/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=8 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=7,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 8 database hdb suffix "suffix=8,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u8/openldap cachesize 200000 cachefree 10000 shm_key 81 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 81 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u7/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=9 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=8,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base Suffix 9 database hdb suffix "suffix=9,dc=mycompany.com" rootdn "cn=admin,cn=config" subordinate directory /u9/openldap cachesize 200000 cachefree 10000 shm_key 91 dbconfig set_cachesize 0 268435456 1 dbconfig set_shm_key 91 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u10/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq # Index specifiques a la synchronisation index entryCSN eq index entryUUID eq index contextCSN eq # syncrepl directive syncrepl rid=10 type=refreshAndPersist provider=ldap://10.104.249.26 bindmethod=simple binddn="cn=admin,cn=config" credentials=secret searchbase="suffix=9,dc=mycompany.com" filter="(entryUUID=*)" sizelimit="unlimited" timelimit="unlimited" schemachecking=on retry="60 +" mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov syncprov-checkpoint 100 10 ############################################################################################ # Base racine database hdb suffix "dc=mycompany.com" rootdn "cn=admin,cn=config" directory /u0/openldap dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 52428800 dbconfig set_lg_bsize 2097152 dbconfig set_tx_max 100 dbconfig set_lg_dir /u0/db-logs dbconfig set_flags DB_LOG_AUTOREMOVE #dbconfig set_flags DB_TXN_NOSYNC index objectClass eq index msisdn eq index entryCSN eq index entryUUID eq index contextCSN eq ############################################################################################ ------------------------------------------------------------------------------------------ The second file is the same, but serverID is 2 and i invert the provider for the replication. Is this config is correct or i have to change something in order to have mirror sync to work ? Thank you for your help. Raph

3 2

slapo-memberof and RHEL/Centos..
by Michael March 07 Sep '09

07 Sep '09

I'm a happy user of the stock OpenLDAP in RHEL/CENTOS 5 which is based on OpenLDAP 2.3.27 however now I need slapo-memberof. Do I need to upgrade to OpenLDAP 2.4 to use this? Does anyone have this functioning under RHEL/CENTOS? thanks!

1 0

ppolicy and ACLs of pwdAccountLockedTime?
by chantra 06 Sep '09

06 Sep '09

Hi all, I have exactly the same issue. My repro config is within the .tgz attached to this email. admin user is cn=admin,dc=example,dc=com and test user is uid=chantra,ou=users,dc=example,dc=com password for both of them is "foobarcode". To reproduce, on Debian Lenny, * untar the archive * cd ldaps * ./install.sh (WARNING: ONLY DO THIS ON A TEST MACHINE, current setup/db will be ERASED). That will stop slapd, override the config with the repro config, erase the current database, inject the testing one with slapadd, give credential to /var/lib/ldap to openldap user, start slapd Then, run: for i in {1..10}; do ./ldapauth.sh $i; sleep 2; done; ./ldaps.sh which will perform 10 failed authentication, with a pause of 2 seconds. Finally, ldaps.sh will output the details of user uid=chantra,ou=users,dc=example,dc=com @Jiri, have you found a solution yet? In my repro, here is the result after the 10 failed auth: # chantra, users, example.com dn: uid=chantra,ou=users,dc=example,dc=com structuralObjectClass: inetOrgPerson entryUUID: 2e93af32-2d8d-102e-8fab-21ae2aafa5d0 creatorsName: createTimestamp: 20090904105519Z entryCSN: 20090904105519.875933Z#000000#000#000000 modifiersName: modifyTimestamp: 20090904105519Z pwdFailureTime: 20090904105614Z pwdFailureTime: 20090904105616Z pwdFailureTime: 20090904105618Z pwdFailureTime: 20090904105620Z entryDN: uid=chantra,ou=users,dc=example,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE Again, here, we see only 4 pwdFailureTime (the 5th should have locked user ). Output of syslog is in the attached file called: pwdaccountlockout.txt but, the main part might be: Sep 4 12:53:11 lenny32-tpl slapd[4079]: bdb_modify_internal: 0x00000004: uid=chantra,ou=users,dc=example,dc=com Sep 4 12:53:11 lenny32-tpl slapd[4079]: => access_allowed: delete access to "uid=chantra,ou=users,dc=example,dc=com" "pwdAccountLockedTime" requested Sep 4 12:53:11 lenny32-tpl slapd[4079]: => dn: [2] Sep 4 12:53:11 lenny32-tpl slapd[4079]: => acl_get: [3] attr pwdAccountLockedTime Sep 4 12:53:11 lenny32-tpl slapd[4079]: => slap_access_allowed: result not in cache (pwdAccountLockedTime) Sep 4 12:53:11 lenny32-tpl slapd[4079]: => acl_mask: access to entry "uid=chantra,ou=users,dc=example,dc=com", attr "pwdAccountLockedTime" requested Sep 4 12:53:11 lenny32-tpl slapd[4079]: => acl_mask: to all values by "", (=0) Sep 4 12:53:11 lenny32-tpl slapd[4079]: <= check a_dn_pat: cn=admin,dc=example,dc=com Sep 4 12:53:11 lenny32-tpl slapd[4079]: <= check a_dn_pat: * Sep 4 12:53:11 lenny32-tpl slapd[4079]: <= acl_mask: [2] applying read(=rscxd) (stop) Sep 4 12:53:11 lenny32-tpl slapd[4079]: <= acl_mask: [2] mask: read(=rscxd) Sep 4 12:53:11 lenny32-tpl slapd[4079]: => slap_access_allowed: delete access denied by read(=rscxd) Sep 4 12:53:11 lenny32-tpl slapd[4079]: => access_allowed: no more rules Sep 4 12:53:11 lenny32-tpl slapd[4079]: hdb_modify: modify failed (50) Same here, changing: access to * by dn="cn=admin,dc=example,dc=com" write by * read to access to * by dn="cn=admin,dc=example,dc=com" write by * write will write pwdAccountLockedtime, but then, users or even anonymous will get far too much credentials :s I also tried with the settings of openldap-2.4.17/tests/data/slapd-ppolicy.conf, e.g: access to attrs=userpassword by self write by * auth access to * by self write by * read to no avail. Michael mentioned to try 2.4.17 which as changes that might affect pwdLockout (actually, ITS#6168 was because users where locked out while pwdLockout was set to FALSE, AFAICS), to no avail Then, I tried the setting from the archive on Fedora11, and Debian Etch, same issue... There is surely something that I am missing here, but shouldn't pwdAccountLockedTime being handled by the daemon? no access rule should be set ( except the for the fact that the admin user can write/delete it). What rule am I missing here? If needed, I can provide a VMDK of the repro, let me know and I will upload it somewhere. Cheers, chantra > Hi, > > I am having troubles making the ppolicy overlay to prevent password > guessing attacks with pwdLockout with slapd-2.4.11-1 in Debian Lenny. > > I set pwdMaxFailure to 3. In the user object I am testing with, I never get > more than two entries for pwdFailureTime and pwdAccountLockedTime is never > added at all. > > I tracked the problem down to the ACL settings in slapd.conf. With my default > access to * > by dn="cn=admin,dc=example,dc=net" write > by * read > , I get the above result. When I rewrite the last line to "by * write", it works. > > The pwdFailureTime is updated, because it is defined as > NO-USER-MODIFICATION, which bypasses te ACL checks for write. > The problem happens when pwdMaxFailure failed logins are reached, > and ppolicy.c tries to update pwdFailureTime and pwdAccountLockedTime > in a single request. > > How is this supposed to work? > - Shouldn't pwdAccountLockedTime also be defined with NO-USER-MODIFICATION? > > - couldn't the update request in ppolicy.c be executed with higher > privileges? I tried to set up an non-anonymous bind in > pam_ldap but this did not help. > > - is there some recommended ACL setting to grant the necessary privileges so that > ppolicy.c can update pwdAccountLockedTime, but users can't? > I am a splapd newbie, so maybe I don't see something obvious, but in > the log below, I see: "acl_mask: to all values by "", (=0)" -- that > looks like an anonymous bind, right? Allowing write for the > pwdAccountLockedTime attribute to anyone does not seem a good idea ;-) > > > > Thanks for any insight! > > > Jiri > > > > P.S.: some detailed notes from my debugging are attached below: > > I am authenticating with pam-ldap. When I mis-type the password > of a user and do a search on the user object (with a +, to see > the operational attributes), the pwdFailureTime is created. This > is good. > > When I preform the bad login again, I get a second value for > pwdFailureTime. Still good. > > But on the next login, instead of getting a third value for > pwdFailureTime and an updated value for pwdAccountLockedTime, nothing > happens. I put some more debug info into ppolicy_bind_response() like > this: > > ----- > * We only count those failures > * which are not due to expire. > */ > Debug(LDAP_DEBUG_ANY, "xxx: counting pwdFailureTime %i/%d\n", i, fc, 0); > } > } > if ((ppb->pp.pwdMaxFailure > 0) && > (fc >= ppb->pp.pwdMaxFailure - 1)) { > Debug(LDAP_DEBUG_ANY, "xxx: trying to insert pwdAccountLockedTime\n", 0, 0, 0); > ----- > > ... in the logs (with loglevel 65535), I really see: > > ------ > Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 0/1 > Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 1/2 > Aug 8 00:05:42 localhost slapd[15416]: xxx: trying to insert pwdAccountLockedTime > [snip] > Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: delete access to "uid=j.bohac,ou=users,dc=example,dc=net" "pwdAccountLockedTime" requested > Aug 8 00:05:42 localhost slapd[15416]: => acl_get: [2] attr pwdAccountLockedTime > Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: result not in cache (pwdAccountLockedTime) > Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: access to entry "uid=j.bohac,ou=users,dc=example,dc=net", attr "pwdAccountLockedTime" requested > Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: to all values by "", (=0) > Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: cn=admin,dc=example,dc=net > Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: * > Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] applying read(=rscxd) (stop) > Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] mask: read(=rscxd) > Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: delete access denied by read(=rscxd) > Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: no more rules > ------ > !DSPAM:4aa1064790404668414040!

1 1

Bizzar Behaviour from openldap-2.4.16 on Centos
by sysadmin＠shakenbake.net 06 Sep '09

06 Sep '09

Hi, Forgive me if this is an obvious one, as i'm new to openldap. I have setup Openldap 2.4.16 from source with db-4.7.25 on Centos 5.3 x64, running on a VMWARE-ESXI Server. #Installed with following options export CPPFLAGS="-I/usr/local/db-4.7.25/include" export LDFLAGS="-L/usr/local/db-4.7.25/lib -R/usr/local/db-4.7.25/lib" export LD_LIBRARY_PATH="/data/extracted/db-4.7.25/build_unix/.libs/" ./configure --prefix=/usr/local/openldap-2.4.16 make depend make make install ### cd db-4.7.25/build_unix ../dist/configure --prefix=/usr/local/db-4.7.25 make make install ### # The behaviour is very odd, the process appears to start up but doesn't show up in netstat properly and basic ldapadd commands stall after the first entry.Firewall & selinux is turned off. I can't seem to see too many errors? ldapadd -v -W -x -D "cn=admin,dc=labs,dc=example,dc=com,dc=au" -W -f <base ldiff file here> ldap_initialize( <DEFAULT> ) Enter LDAP Password: add dc: labs add o: example add objectClass: top domain adding new entry "dc=labs,dc=example,dc=com,dc=au" ########## QUERY PAUSES HERE ###### #### #tail from syslog with loglevel -1 ### Sep 4 23:50:25 safevm-ldap slapd[2684]: slap_listener_activate(8): Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=8 busy Sep 4 23:50:25 safevm-ldap slapd[2684]: >>> slap_listener(ldap:///) Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: listen=8, new connection on 14 Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: added 14r (active) listener=(nil) Sep 4 23:50:25 safevm-ldap slapd[2684]: conn=3 fd=14 ACCEPT from IP=127.0.0.1:48114 (IP=0.0.0.0:389) Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:50:25 safevm-ldap slapd[2684]: Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:50:25 safevm-ldap slapd[2684]: 14r Sep 4 23:50:25 safevm-ldap slapd[2684]: Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: read active on 14 Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: connection_get(14) Sep 4 23:50:25 safevm-ldap slapd[2684]: connection_get(14): got connid=3 Sep 4 23:50:25 safevm-ldap slapd[2684]: connection_read(14): checking for input on id=3 Sep 4 23:50:25 safevm-ldap slapd[2684]: conn=3 op=0 do_bind Sep 4 23:50:25 safevm-ldap slapd[2684]: >>> dnPrettyNormal: <cn=admin,dc=labs,dc=example,dc=com,dc=au> Sep 4 23:50:25 safevm-ldap slapd[2684]: <<< dnPrettyNormal: <cn=admin,dc=labs,dc=example,dc=com,dc=au>, <cn=admin,dc=labs,dc=example,dc=com,dc=au> Sep 4 23:50:25 safevm-ldap slapd[2684]: conn=3 op=0 BIND dn="cn=admin,dc=labs,dc=example,dc=com,dc=au" method=128 Sep 4 23:50:25 safevm-ldap slapd[2684]: do_bind: version=3 dn="cn=admin,dc=labs,dc=example,dc=com,dc=au" method=128 Sep 4 23:50:25 safevm-ldap slapd[2684]: ==> bdb_bind: dn: cn=admin,dc=labs,dc=example,dc=com,dc=au Sep 4 23:50:25 safevm-ldap slapd[2684]: conn=3 op=0 BIND dn="cn=admin,dc=labs,dc=example,dc=com,dc=au" mech=SIMPLE ssf=0 Sep 4 23:50:25 safevm-ldap slapd[2684]: do_bind: v3 bind: "cn=admin,dc=labs,dc=example,dc=com,dc=au" to "cn=admin,dc=labs,dc=example,dc=com,dc=au" Sep 4 23:50:25 safevm-ldap slapd[2684]: send_ldap_result: conn=3 op=0 p=3 Sep 4 23:50:25 safevm-ldap slapd[2684]: send_ldap_result: err=0 matched="" text="" Sep 4 23:50:25 safevm-ldap slapd[2684]: send_ldap_response: msgid=1 tag=97 err=0 Sep 4 23:50:25 safevm-ldap slapd[2684]: conn=3 op=0 RESULT tag=97 err=0 text= Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:50:25 safevm-ldap slapd[2684]: Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:50:25 safevm-ldap slapd[2684]: 14r Sep 4 23:50:25 safevm-ldap slapd[2684]: Sep 4 23:50:25 safevm-ldap slapd[2684]: daemon: read active on 14 Sep 4 23:50:26 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:50:26 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:50:26 safevm-ldap slapd[2684]: connection_get(14) Sep 4 23:50:26 safevm-ldap slapd[2684]: connection_get(14): got connid=3 Sep 4 23:50:26 safevm-ldap slapd[2684]: connection_read(14): checking for input on id=3 Sep 4 23:50:26 safevm-ldap slapd[2684]: conn=3 op=1 do_add Sep 4 23:50:26 safevm-ldap slapd[2684]: conn=3 op=1 do_add: dn (dc=labs,dc=example,dc=com,dc=au) Sep 4 23:50:26 safevm-ldap slapd[2684]: >>> dnPrettyNormal: <dc=labs,dc=example,dc=com,dc=au> Sep 4 23:50:26 safevm-ldap slapd[2684]: <<< dnPrettyNormal: <dc=labs,dc=example,dc=com,dc=au>, <dc=labs,dc=example,dc=com,dc=au> Sep 4 23:50:26 safevm-ldap slapd[2684]: conn=3 op=1 ADD dn="dc=labs,dc=example,dc=com,dc=au" Sep 4 23:50:26 safevm-ldap slapd[2684]: bdb_dn2entry("dc=labs,dc=example,dc=com,dc=au") Sep 4 23:50:26 safevm-ldap slapd[2684]: => bdb_dn2id("dc=labs,dc=example,dc=com,dc=au") Sep 4 23:50:26 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:50:26 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:50:26 safevm-ldap slapd[2684]: Sep 4 23:50:26 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:50:26 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:51:21 safevm-ldap slapd[2684]: 14r Sep 4 23:51:21 safevm-ldap slapd[2684]: Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: read active on 14 Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:51:21 safevm-ldap slapd[2684]: connection_get(14) Sep 4 23:51:21 safevm-ldap slapd[2684]: connection_get(14): got connid=3 Sep 4 23:51:21 safevm-ldap slapd[2684]: connection_read(14): checking for input on id=3 Sep 4 23:51:21 safevm-ldap slapd[2684]: ber_get_next on fd 14 failed errno=0 (Success) Sep 4 23:51:21 safevm-ldap slapd[2684]: connection_read(14): input error=-2 id=3, closing. Sep 4 23:51:21 safevm-ldap slapd[2684]: connection_closing: readying conn=3 sd=14 for close Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: activity on 1 descriptor Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: activity on: Sep 4 23:51:21 safevm-ldap slapd[2684]: Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Sep 4 23:51:21 safevm-ldap slapd[2684]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Sep 4 23:51:21 safevm-ldap slapd[2684]: connection_close: deferring conn=3 sd=14 cya Craig

2 2

perl module to read ldif
by William Bryan 06 Sep '09

06 Sep '09

I was once told that there is an add on to perl that would allow you to read an ldif just like it was a slapd directory. I guess that calls to ldapsearch get rerouted to search the ldif. Does anyone know the package and/or details. thank you

2 1

Creating Structural Objects Under User Records
by Tim Gustafson 04 Sep '09

04 Sep '09

I'd like to be able to create "sub-objects" inside each user object. So, my account is: uid=tjg,ou=People,dc=soe,dc=ucsc,dc=edu I'd like to be able to create an object like: cn=foo,uid=tjg,ou=People,dc=soe,dc=ucsc,dc=edu This object would be of objectClass "soeDegree", which I've defined as follows: attributetype ( 1.1.2.1.32 NAME 'soeDegreeYear' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.33 NAME 'soeDegreeType' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.34 NAME 'soeDegreeDepartment' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.35 NAME 'soeDegreeThesisTitle' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.36 NAME 'soeDegreeThesisURL' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) objectclass ( 1.1.2.1.997 NAME 'soeDegree' DESC 'Jack Baskin School of Engineering Degree' SUP top STRUCTURAL MUST ( cn ) MAY ( soeDegreeYear $ soeDegreeType $ soeDegreeDepartment $ soeDegreeThesisTitle $ soeDegreeThesisURL )) However, when I attempt to add the sub-object, the server returns: 0x35 (LDAP_UNWILLING_TO_PERFORM) How can I tell OpenLDAP to allow me to create child objects inside accounts like this? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 2

syncrepl "modified by peer" question
by Robert Hanson 02 Sep '09

02 Sep '09

(verson 2.4.17) This code is in syncrepl.c /* Don't send changed entries back to the originator */ if ( sid == srs->sr_state.sid && srs->sr_state.numcsns ) { Debug( LDAP_DEBUG_SYNC, "Entry %s changed by peer, ignored\n", rs->sr_entry->e_name.bv_val, 0, 0 ); return LDAP_SUCCESS; Can someone explain to me what the intention of this code is? I can read the comment, but it looks to me like the condition for the if is broken. I think it is saying - if (the system id of the modification is "this system") and (there was a sync cookie found at startup) then discard the update The longer I look at this, the less I'm convinced that the condition check matches what the comment says it does. Any comments?

2 1

labeledURI search result objectClass restriction
by Torsten Rehn 02 Sep '09

02 Sep '09

Hi, it appears that a search triggered from a labeledURIObjects search URI can't have any results that are the same objectClass as the triggering object. I had one groupOfNames that was looking for other groups to be added as members. Debugging told me OpenLDAP came up with this when doing the internal search: put_filter: "(&(!(objectClass=groupOfNames))(objectClass=groupOfNames))" while I had of course specified only (objectClass=groupOfNames) as a filter. Can anyone please explain this behavior and/or provide a workaround? Thanks, -- Torsten Rehn

1 0

OpenLDAP client authentication against JDS 6.3.1 server
by Cannon, Andrew C 02 Sep '09

02 Sep '09

Dear list members, I've been fighting with this problem on and off for 6 months now (you can see some of my queries if you Google for me...) and I cannot for the life of me figure out what is going on. We are trying to get a Fedora 9 test box to authenticate against a Solaris 10 (SPARC) Sun Java Directory Server 6.3.1 box using anonymous binding and no SSL (we are on an internal, trusted network). The JDS is running the NIS-to-LDAP script that Sun provide and can get information from the directory. The Fedora box is running OpenLDAP client (version: openldap-clients-2.4.10-2.fc9.x86_64) and can't get any infromation from the directory after I switch to LDAP authentication from NIS authentication using system-config-authentication. NIS on the Fedora box works fine, so it isn't a network issue. An extract from the access log on the server shows the following: [01/Sep/2009:11:11:24 +0100] conn=2618 op=-1 msgId=-1 - fd=47 slot=47 LDAP connection from 172.28.1.172:46682 to 172.28.1.173 [01/Sep/2009:11:11:24 +0100] conn=2618 op=0 msgId=1 - BIND dn="" method=128 version=3 [01/Sep/2009:11:11:24 +0100] conn=2618 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="" [01/Sep/2009:11:11:24 +0100] conn=2618 op=1 msgId=2 - SRCH base="ou=people,dc=example,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=dmm))" attrs="uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass" [01/Sep/2009:11:11:24 +0100] conn=2618 op=1 msgId=2 - RESULT err=0 tag=101 nentries=0 etime=0 [01/Sep/2009:11:11:42 +0100] conn=2618 op=2 msgId=0 - RESULT err=80 tag=120 nentries=0 etime=0 [01/Sep/2009:11:11:42 +0100] conn=2618 op=-1 msgId=-1 - closing from 172.28.1.172:46682 - A1 - Client aborted connection - [01/Sep/2009:11:11:42 +0100] conn=2618 op=-1 msgId=-1 - closed. [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - SRCH base="ou=hosts,dc=example=com" scope=1 filter="(&(objectClass=ipHost)(cn=lin05))" attrs=ALL [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - SORT cn uid (1) [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - VLV 0:49999:0:0 1:1 (0) [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - RESULT err=0 tag=101 nentries=1 etime=0 notes=U [01/Sep/2009:11:12:25 +0100] conn=4 op=4167 msgId=4168 - SRCH base="automountkey=userf,automountmapname=auto_home,dc=example,dc=com" scope=0 filter="(objectClass=automount)" attrs=ALL [01/Sep/2009:11:12:25 +0100] conn=4 op=4167 msgId=4168 - RESULT err=0 tag=101 nentries=1 etime=0 [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - SRCH base="ou=people,dc=example=com" scope=1 filter="(&(objectClass=posixAccount)(uidNumber=254))" attrs=ALL [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - SORT cn uid (1) [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - VLV 0:49999:0:0 1:1 (0) [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - RESULT err=0 tag=101 nentries=1 etime=0 notes=U Connection 2618 is from the Fedora box and is unsuccessful. Connection 4 is the NIS-to-LDAP service on the Solaris box and is successful. I have a number of questions, but, chiefly, am I actually using anonymous binding? If I need to set a bind DN, what should it be? Can I modify the search base so that it looks more like the search given in msgid 4168? I'm sorry for the newbie questions (especially about a JDS server) but I am really tearing my hair out over this. I hope some of you can help. Thanks in advance. Andy -- This email contains confidential information. The contents must not be disclosed to anyone else except with the authority of the sender. Unauthorised recipients are requested to maintain this confidentiality and immediately advise the sender of any error or misdirection in transmission. The following notice applies to emails originating in the UK. E-mails sent on behalf of AMEC are sent on behalf of the relevant AMEC company below. These are registered in England and Wales with registered office at Booths Park, Chelford Road, Knutsford, Cheshire WA16 8QZ and number as shown: AMEC plc 01675285, AMEC Group Limited 04612748, AMEC Capital Projects Limited 02804109, AMEC Earth and Environmental UK Limited 04987981, AMEC Nuclear Holdings Limited 03725076, AMEC Nuclear M & O Limited 05664844, AMEC Nuclear UK Limited 01120437, AMEC Nuclear International Limited 03260477, AMEC Nuclear Projects Limited 05664962 and National Nuclear Corporation Limited 02290928 --

1 0

Sycrepl cookie question
by Robert Hanson 01 Sep '09

01 Sep '09

(2.4.17; linux, bdb 4.5 backend; two nodes in a multi-master configuration) When I start up a slapd server, it reads the contextCSN from the database. There are some synchronization issues I'm dealing with (see the email I sent yesterday to this group). The question of the day is, what are the implications if I delete this from the database before I start up? That is: Assume that in a 2-node multi-master scenario, both sides are completely in sync. One of the nodes goes down; assume that the remaining node gets some updates. The down node comes back up. If the down node does not have this synchronization cookie, will it still sync correctly with the other node?

2 1

PADL migration tools / NIS to LDAP
by Ivan De Masi 01 Sep '09

01 Sep '09

Hello, I'm fairly new to LDAP and testing for migration (NIS to LDAP). I found the PADL migration tools http://www.padl.com/OSS/MigrationTools.html which are great and now im testing the export of data-sources to *.ldif files. When exporting the passwd-file for example, I have all system-accounts like "daemon", "bin", "sys", etc. (let's say everything with the uid below 1000) in the ldif file. Do I need this all these accounts in LDAP? I see that there is "krbName" for all exported entrys/accounts. That's good for some services and kerberos, but do I really need *all* system accounts in LDAP? Thanks! Regards, Ivan

1 0

Slow LDAP
by sgmayo＠mail.bloomfield.k12.mo.us 01 Sep '09

01 Sep '09

Is there some way to speed up LDAP? I am guessing this has to do with it searching the database on ldap? This is a new server and my old one did not take that long. It is not as slow if just one or two people are logging in with ldap, but when many login, it seems to bring ldap to a bottle neck, I guess while searching the directory for all the names. There are probably about 1000 users in my LDAP. Is that too large? I assume it isn't since most of the other schools around have AD which is basically Microsoft LDAP if I understand correctly and they have no problems and have many more users than I have. Can multiple schema's in the config file cause this? I know that on my old server I had the following in slapd.conf: core cosine inetorgperson nis samba On my new one it has the above plus: corba duaconf dyngroup java misc openldap ppolicy collective Those were just in there when I installed it so I left them. Should I take them out or would that not have any affect on logins at all? I am guessing that they wont' affect anything and it is more related to some sort of configuration in my ldap configs. Is there something else I need in a config? Here are my configs. slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema loglevel -1 sizelimit -1 allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=school,dc=bloomfield.k12.mo.us" checkpoint 1024 15 rootdn "cn=Manager,dc=school,dc=bloomfield.k12.mo.us" rootpw ***** directory /var/lib/ldap index objectClass eq index cn,sn,uid,displayName eq,pres,sub index uidNumber,gidNumber eq index memberUid eq index sambaSID,sambaPrimaryGroupSID eq index sambaDomainName eq index default sub database monitor ldap.conf SIZELIMIT 200 HOST 127.0.0.1 10.0.0.5 BASE dc=school,dc=bloomfield.k12.mo.us I have a DB_CONFIG file that contains the following, but not sure if it needs anything else or not: set_cachesize 0 268435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

3 6

Samba + ldap questions
by Allgood, John 01 Sep '09

01 Sep '09

Hey All I am having a problems with using openldap and samba. We have been having issues with samba passwords expiring and I have tried several things to resolve the issues. The ldap server was setup using the smbldap-tools. When the password expires the only thing I have been able to do is to reset the password. I have tried the smbldap-usemod -B -1 &username to disable the SambaPwdMustChange. Also tried to set the SambaAcctFlags to UX. We set this ldap server up in hurry and did not have a chance to implement a proper password policy. This is using the stock version of Samba that came with RHEL5. Best Regards John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com www.ohl.com ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 1

LDAPcon 2009
by Dieter Kluenter 01 Sep '09

01 Sep '09

Hi, the 2nd. International Conference on LDAP, LDAPcon 2009 will be held on September 20th and 21st at Waterfront Marriott Hotel, Portland. Oregon, *please register now*. http://www.symas.com/ldapcon2009/ Proceedings are available at http://www.symas.com/ldapcon2009/papers.shtml The 1st LDAPcon 2007 had been helt at Cologne, Germany, proceedings can be found here http://www.guug.de/veranstaltungen/ldapcon2007/further_readings.html The Organization Committee -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

1 0

recreating DB from ldiff
by Tihomir Culjaga 31 Aug '09

31 Aug '09

Hello, I have an issue when adding entries to DB. for some reason im getting this autput: [root@ldap]# slapadd -f /etc/openldap/slapd.conf -l /home/tculjaga/export.ldif -q -c str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=38512331810,ou=redirec" and "uniqueID=38512322963,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=1727833) str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=385138" and "uniqueID=38513899170,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=10487774) str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=38514552151,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" and "uniqueID=38514558227,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=10895623) Can someone please explain whats wrong ? also, i went to lines listed above and found nothing strange at all ... any help ?

3 7

Select subtree with access filter
by Torsten Rehn 31 Aug '09

31 Aug '09

I have a number of objects scattered around my DIT that I want to dynamically "tag" for access by a certain user by giving them a memberOf attribute pointing to that user. Now here's the fun part: Is it possible to also give that user access to the subtree starting at the "tagged" object? E.g. I have an office manager who manages a random number of rooms around the building. I assign the rooms to him via memberOf, but the rooms also have people in them that he should have access to. For that I would need something like this: access to filter.subtree="(memberOf=managerguy)" by managerguy read Is there any way to do this today? Otherwise make it a feature request :) -- Torsten Rehn

1 1

the way to calculate the cache size.
by Huynhn, Nguyen Dac 31 Aug '09

31 Aug '09

Hi All, Im tuning my LDAP DB (BDB type). Im reading at http://www.openldap.org/doc/admin24/tuning.html#Berkeley%20DB%20Cache At 21.4.1.1 #(Number of hash buckets + number of overflow pages + number of duplicate pages) * page size / 2 #The objectClass index for my example database is 5.9MB and uses 3 hash buckets and 656 duplicate pages. So: # ( 3 + 656 ) * 4KB / 2 =~ 1.3MB. #With only this index enabled, I'd figure at least a 4MB cache for this backend. (Of course you're using a single cache shared among all of the database files, so the cache pages will most likely #get used for something other than what you accounted for, but this gives you a fighting chance.) I understand that: with each index ( in this case only objectclass is indexed), we must calculate their cache size individually and sum every them. (1) - I can specify Number of hash buckets & Cache Size (2)by command Shell> db_stat-4.4 -m | head -n 25 32771 Number of hash buckets used for page location Pool file: <index>.bdb <number> page size - I can specify Number of overflow pages & Number of duplicate pages by command Shell> db_stat-4.4 -d *.bdb (3) 0 Number of tree duplicate page 0 Number of tree overflow pages (1) Did I understand right? (2) Which page size will we use, some of index file use 4K page size, others use 16K page size? (3) Do must I run for each index or *.bdb is still ok? Could anyone help me? This chapter is not clearly huh? Thank for reading

1 0

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 28 Aug '09

28 Aug '09

> Well, we'd need to see the config file for the replica as > well. > > --Quanah > Was in a previous post, but here you go.

2 11

ldapadd error while adding localized users
by anish patil 27 Aug '09

27 Aug '09

Hi all, I am trying to add localized users into ldap i.e LANG=ja_JP.SJIS while creating ldif file i am converting SJIS chars into UTF-8 format. if i give value attribute "gecos:" in ldif file in localized format I am not able add the user its giving me following error <error> additional info: gecos: value #0 invalid per syntax </error> If i am giving rest of the attributes in localized format it works fine Only problem is with gecos field can anyone tell is this the desired behavior or Am i missing something? OpenLDAP version:2.4.11 O.S: RHEL 4.3 Thanks in advance -- Anish Patil

3 3

Replicate AD User and Group accounts
by James A. Cleland 25 Aug '09

25 Aug '09

Hi, I need to simulate an Active Directory server to an LDAP client application using openldap. I am only interested in retrieving users and groups from openldap, but I need to have attributes match those in AD. I have found a number of guides on how to migrate from AD to OpenLDAP, but my application is not quite this complicated. At least I don't think it is. Here's what I've got so far. My AD server is Windows Server 2008. I have dumped ldif using ldifde: ldifde -d "CN=Users,DC=[domain],DC=com" -f export.ldif This returns me an ldif of Users and Groups, which is what I want. I have set up OpenLDAP as suggested in numerous migration docs to include core, cosine, and nis schemas. I am able to access the LDAP server and browse it using a manager DN and a clear password for now. I have attempted to import my ldif using the following: Ldapadd -H ldap://<server> -f export.ldif -x -D "cn=Manager,dc=[domain],dc=com" -W The reply from the server is: ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I believe this error is due to the second (#1) record in the ldif which is the first group and has an objectClass: group. "group" does not appear to be a defined object class in any of the aforementioned schema. Can I obtain schema for this ldif? I can't find any docs on doing this or any schema files that contain this objectClass. BTW, I am a complete LDAP newbie, so please forgive any terminology misuse, etc. Thanks!

2 1

Replace Active Directory with OpenLDAP and Others
by Serge Fonville 25 Aug '09

25 Aug '09

Both, Thanks for the info > To get a drop-in replacement for AD you probably should ask in a Samba forum; AD does a lot more than just LDAP service and you need Samba to bring all the pieces together. If you only need directory service, then we can talk about it more here. But when migrating off MS, you typically need more than just LDAP to work... I will ask there then, thanks for the tip >> I was wondering if there is an uptodate guide/tutorial/howto to >> replace Active Directory. >> I found http://www.bayour.com/LDAPv3-HOWTO.html but that was last >> updated in 2005. >> >> Also I could not find any references to people actually having >> replaced Active Directory. >> In my head it should be possible, but replacing MS products does not >> always make sense in practice. ;-) >> >> I have not yet had the time to fully work through the howto. but >> either way I will give it a try (well a couple probably) >> > There is currently no drop-in replacement for Active directory in open > source world. Samba in conjunction with LDAP gets as close as replacing > NT4.0 domain controller. This is a legacy in MS world and has it's > disadvantages over Active directory. > I recommend reading the following SAMBA docs > http://us3.samba.org/samba/docs/man/Samba-HOWTO-Collection/ > http://us3.samba.org/samba/docs/man/Samba-Guide/ I've been looking at samba a couple of times in the last couple of years. But in it's current form, it is only suitable for SMB/CIFS imho Thanks for the help and the info! Regards, Serge Fonville

2 1

Replace Active Directory with OpenLDAP and Others
by Serge Fonville 25 Aug '09

25 Aug '09

Hi, I was wondering if there is an uptodate guide/tutorial/howto to replace Active Directory. I found http://www.bayour.com/LDAPv3-HOWTO.html but that was last updated in 2005. Also I could not find any references to people actually having replaced Active Directory. In my head it should be possible, but replacing MS products does not always make sense in practice. ;-) I have not yet had the time to fully work through the howto. but either way I will give it a try (well a couple probably) Has anyone have any experience or advice with this? Thanks in advance Regards, Serge Fonville

3 2

Not able to authenticate Apache against OpenLDAP
by Michael March 25 Aug '09

25 Aug '09

I'm using Centos / RHEL 5.2 using the stock LDAP.. I'm trying to get Apache to authenicate with my LDAP server... Using other client software I can bind as the user 'bob'. Here is my Apache config: <VirtualHost *:443> ServerName addressbook-stage.acme.com AllowEncodedSlashes on ProxyPass / http://domu-140.acme.com/ ProxyPassReverse / http://domu-140.acme.com/ <Proxy *> allow from all </Proxy> <Location /> AuthType Basic AuthName "Login with your Acme ID" #AuthLDAPEnabled on AuthBasicProvider ldap AuthLDAPURL ldap://192.168.150.140:389/ou=People,dc=acme,dc=com AuthLDAPBindDN uid=root,ou=People,dc=acme,dc=com AuthLDAPBindPassword passwd #require group cn=it,ou=groups,dc=acme,dc=com require valid-user bob </Location> </VirtualHost> Here is my LDAP config: access to attrs=userPassword by anonymous auth by self write by * none # private LDAP Addressbook is readable and writable for the owner only access to dn.regex="(.*,)?ou=Contacts,uid=([^,]+),ou=People,(.*)$" by dn.regex="uid=$2,ou=People,$3" write by * none # global LDAP Addressbook is writable for all authenticated users # This entry has to be _before_ any other entry that matches the contact # tree eg. the * entry access to dn.subtree="ou=Contacts,dc=acme,dc=com" by users write by users read # The admin dn has full write access access to * by users read by peername="IP=192\.168\.150\.5" read Here is the error from from OpenLDAP: Aug 24 03:57:06 localhost slapd[23856]: conn=2 fd=14 ACCEPT from IP= 192.168.150.5:59041 (IP=0.0.0.0:389) Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=0 RESULT tag=97 err=0 text= Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=1 SRCH base="ou=People,dc=acme,dc=com" scope=2 deref=3 filter="(&(objectClass=*)(uid=bob))" Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 BIND anonymous mech=implicit ssf=0 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 RESULT tag=97 err=0 text= Aug 24 03:57:37 localhost slapd[23856]: conn=3 fd=17 ACCEPT from IP= 192.168.150.5:59042 (IP=0.0.0.0:389) Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=0 RESULT tag=97 err=0 text= Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=1 SRCH base="ou=People,dc=acme,dc=com" scope=2 deref=3 filter="(&(objectClass=*)(uid=bmason))" Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 BIND anonymous mech=implicit ssf=0 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 RESULT tag=97 err=0 text= -- <admiral> Michael F. March ----- mmarch(a)gmail.com Ph: (415)462-1910 ---- Fax: (602)296-0400 P.O. Box 2254 ---- Phoenix, AZ 85002-2254 "Seriously" - HSR

5 6

Cannot dynamically delete olcOverlay configuration object
by Barry Colston 24 Aug '09

24 Aug '09

As part of an emergency failover situation, I was attempting to change a syncrepl provider to a syncrepl consumer. When I tried to delete the "olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config" object, I received a "Server is unwilling to perform (53)" error. Can this be accomplished dynamically or do I have to make the changes while slapd is not executing? Barry Colston

2 1

master-slave replication woes
by charles 24 Aug '09

24 Aug '09

{i'm sorry if this a duplicated} i've "successfully" set up replication in a master-slave orientation, with persistent replication; the consumer receives database changes as they are made to the master. i initialize the consumer database using a ldif created on the provider: *"* *slapcat -b dc=murphy,dc=bz-v -l transfer.ldif" * it has been functional for the past three weeks.for the most part it works, entries are updated immediately. however, twice the data entires within all organizational units have been deleted and about four times either the syncuser or the admin cn's have been deleted from the consumer. i'm about to start over and entirely reconfigure the consumer. i'd appreciate any feedback on anything that needs adjusting in my configuration or any gotchas. specifically - is my syncrepl directive accurate? - in initial configuration (dpkg) should i setup a different database than the one i intend to replicate? both consumer and provider are running openldap 2.4.15-1ubuntu3 thanks. provider's configuration: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=murphy,dc=bz olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" read by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" read by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: entryCSN,entryUUID eq structuralObjectClass: olcHdbConfig entryUUID: e1dbc798-0ac2-102e-9977-37c480b68b78 creatorsName: cn=admin,cn=config createTimestamp: 20090722042133Z olcLimits: {0}dn.exact="cn=syncuser,dc=murphy,dc=bz" time.soft=unlimited time. hard=unlimited size.soft=unlimited size.hard=unlimited entryCSN: 20090806001008.586987Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090806001008Z dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: e1da8df6-0ac2-102e-996f-37c480b68b78 creatorsName: cn=config createTimestamp: 20090722042133Z entryCSN: 20090805014105.909778Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090805014105Z dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: c94c1ab2-15ac-102e-8886-213db5dc8256 creatorsName: cn=admin,cn=config createTimestamp: 20090805014105Z entryCSN: 20090805014105.945605Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090805014105Z consumer's configuration: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=murphy,dc=bz olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: entryCSN,entryUUID eq structuralObjectClass: olcHdbConfig entryUUID: ac0c4eee-1c74-102e-8275-a73f90e057e6 creatorsName: cn=admin,cn=config createTimestamp: 20090813164703Z olcRootDN: cn=admin,dc=murphy,dc=bz olcSyncrepl: {0}rid=16 provider=ldaps://marcos.murphy.bzbinddn="cn=syncuser,dc=murphy,dc=bz" bindmethod=simple credentials=replication searchbase="dc=murphy,dc=bz" scope=sub type=refreshAndPersist interval=00:00:20:00 retry="10 5 3 00 5" entryCSN: 20090813183713.024346Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090813183713Z dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: ac04c368-1c74-102e-826d-a73f90e057e6 creatorsName: cn=config createTimestamp: 20090813164703Z entryCSN: 20090813183712.967024Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090813183712Z dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 10653536-1c84-102e-9258-bf448f0d99c4 creatorsName: cn=admin,cn=config createTimestamp: 20090813183714Z entryCSN: 20090813183714.001905Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090813183714Z -- Charles Belmopan, Belize "... we just love cars and we love driving them!" http://www.cardomain.com/ride/2400106

2 2

top-level data entries not replicating, 2.4.15
by Brian Neu 24 Aug '09

24 Aug '09

Even with no logfilter on the consumer, cn=replicator,dc=domain,dc=com & sambaDomainName=SRG,dc=domain,dc=com don't replicate, even after wiping the database and restarting. Everything else seems to replicate fine. How do I get top-level data entries to replicate?

2 4

Password policy
by Aravind M D 24 Aug '09

24 Aug '09

Hi All, Can anyone provide me check_password.so with cracklib. I tried to compile check_password.c but its giving me a lot of error. Regards, Aravind M D

1 0

ldap search filters and groups..
by Michael March 23 Aug '09

23 Aug '09

First, can anyone recommend a good link or book on ldap search filters? I have a few books on LDAP ("Deploying OpenLDAP" from Apress and the O'reilly LDAP book) and they devote less than a page to the topic. There doesn't seem to be a ton of info on the Google about it either. What am I overlooking? What I'm trying to do is create a search filter so when I search a certain tree for all DNs the result will return only DNs that are members of a certain "groupOfNames" group. Is that possible? thanks!

2 1

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 22 Aug '09

22 Aug '09

--- On Fri, 8/21/09, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > From: Quanah Gibson-Mount <quanah(a)zimbra.com> > Subject: Re: top-level data entries not replicating, 2.4.15, now 2.4.17 > To: "Brian Neu" <proclivity76(a)yahoo.com>, openldap-technical(a)openldap.org > Date: Friday, August 21, 2009, 12:05 PM > --On Friday, August 21, 2009 8:52 AM > -0700 Brian Neu <proclivity76(a)yahoo.com> > wrote: > > > I really only created the test2 record to find out why > the > > > > sambaDomainName=SRG,dc=srg,dc=com > > > > record wasn't replicating. > > > > This entry won't replicate either, even with a cn > attribute . . . > > dn:cn=test3,dc=srg,dc=com > > objectclass: top > > objectclass: person > > userpassword:blah > > sn:test3 > > cn:test3 > > Please don't top post. > > Your config is a little... odd. You have per-db > access rules, and yet you break them like you expect more: > > database hdb > suffix "cn=accesslog" > ... > access to * > by dn.base="cn=replicator,dc=srg,dc=com" > read > by * break > > > Not that this hurts anything, but it is a weird read. > > Also, I don't see *any* access rules on the main DB. > You have: > > database hdb > suffix > "dc=srg,dc=com" > .... > database monitor > access to * > by dn.exact="cn=Manager,dc=srg,dc=com" > write > by > dn.exact="uid=root,ou=People,dc=srg,dc=com" write > by dn.base="cn=replicator,dc=srg,dc=com" > read > by * break > > > Which means you just gave a lot of access to the *monitor* > database but not your *primary* database. I suggest go > re-read the slapd.access(5) man page. If you want > global ACLs, they need to come before any "database xyz" > line. If you want per-db ACLs, which I think is what > you're trying to do, then you need to do them > *per-db*. Not the odd acl in accesslog, none in your > main db, and some for your monitor database. > > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and > collaboration OK, my sloppy ACL is cleaned up and makes much more sense now -- but the problem remains.

2 1

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 21 Aug '09

21 Aug '09

I compiled new rpms and upgraded to 2.4.17 on both the provider and consumer. The problem persists. New entries like: dn:cn=test2,dc=srg,dc=com objectclass: top objectclass: person userpassword:blah sn:test2 don't replicate. But other entries do, like: dn: uid=user1,ou=People,dc=srg,dc=com uid: user1 cn: Advanced Open Systems objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: shadowLastChange: 14441 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5000 gidNumber: 5000 homeDirectory: /home/user1 gecos: Advanced Open Systems I've attached the slapd.conf for the master/provider. Thank you in advance for any assistance. --- On Thu, 8/20/09, Brian Neu <proclivity76(a)yahoo.com> wrote: > From: Brian Neu <proclivity76(a)yahoo.com> > Subject: Re: top-level data entries not replicating, 2.4.15 > To: "Jonathan Clarke" <jonathan(a)phillipoux.net> > Cc: openldap-technical(a)openldap.org > Date: Thursday, August 20, 2009, 8:39 AM > Forgive me if pasting here is bad > etiquette. > > > <consumer slapd.conf> > > include > /etc/openldap/schema/corba.schema > include > /etc/openldap/schema/core.schema > include > /etc/openldap/schema/cosine.schema > include > /etc/openldap/schema/duaconf.schema > include > /etc/openldap/schema/dyngroup.schema > include > /etc/openldap/schema/inetorgperson.schema > include > /etc/openldap/schema/java.schema > include > /etc/openldap/schema/misc.schema > include > /etc/openldap/schema/nis.schema > include > /etc/openldap/schema/openldap.schema > include > /etc/openldap/schema/ppolicy.schema > include > /etc/openldap/schema/collective.schema > include > /etc/openldap/schema/samba.schema > > allow bind_v2 > > pidfile > /var/run/openldap/slapd.pid > argsfile > /var/run/openldap/slapd.args > > TLSCACertificateFile /etc/openldap/cacerts/cavictory2.crt > TLSCertificateFile /etc/openldap/keys/victory3cert.pem > TLSCertificateKeyFile /etc/openldap/keys/victory3key.pem > > database hdb > suffix "dc=srg,dc=com" > checkpoint 1024 15 > rootdn > "cn=Manager,dc=srg,dc=com" > > rootpw {MD5}blah > > directory /var/lib/ldap > > index objectClass > eq,pres > index ou,cn,mail,surname,givenname > eq,pres,sub > index uidNumber,gidNumber,loginShell eq,pres > index uid,memberUid > eq,pres,sub > index nisMapName,nisMapEntry > eq,pres,sub > > syncrepl rid=0 > > provider=ldap://victory2.srg.com:389 > bindmethod=simple > starttls=critical > > binddn="cn=replicator,dc=srg,dc=com" > credentials=blah > searchbase="dc=srg,dc=com" > logbase="cn=accesslog" > schemachecking=on > type=refreshAndPersist > retry="60 +" > syncdata=accesslog > > updateref > ldaps://victory2.srg.com > > database monitor > > access to * > by > dn.exact="cn=Manager,dc=srg,dc=com" write > by * none > > </consumer slapd.conf> > > > --- On Thu, 8/20/09, Jonathan Clarke <jonathan(a)phillipoux.net> > wrote: > > > From: Jonathan Clarke <jonathan(a)phillipoux.net> > > Subject: Re: top-level data entries not replicating, > 2.4.15 > > To: "Brian Neu" <proclivity76(a)yahoo.com> > > Cc: openldap-technical(a)openldap.org > > Date: Thursday, August 20, 2009, 8:02 AM > > On 19/08/2009 19:29, Brian Neu > > wrote: > > > Even with no logfilter on the consumer, > > > > > cn=replicator,dc=domain,dc=com& > > > > > sambaDomainName=SRG,dc=domain,dc=com > > > > > > don't replicate, even after wiping the database > and > > restarting. Everything else seems to replicate > fine. > > > > > > How do I get top-level data entries to > replicate? > > > > This really depends on your syncrepl configuration on > the > > consumer. > > If you provide it here, maybe we can take a look. > > > > Aside from that, the latest version, 2.4.17, contains > a few > > fixes that > > might help with this problem. > > > > Jonathan > > >

3 3

errors when trying to modify olcAttributeTypes
by Alexander 'Leo' Bergolth 21 Aug '09

21 Aug '09

Hi! I'd like to slightly change the attribute definition of olcDbConfig by modifying olcAttributeTypes in cn=schema,cn=config with openldap-2.4.16. I tried to apply the modification using two different ways, both failing with different errors: 1) Delete the old attribute value and adding the new one: --------------------------------------------------------- $ ldapmodify -xvW -h bach-s49 -D cn=Manager,cn=config -f cn-schema-olcAttributeTypes-add-del.ldif ldap_initialize( ldap://bach-s49 ) Enter LDAP Password: delete olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONFIG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) add olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONFIG configuration directives' SYNTAX OMsIA5String EQUALITY CaseExactIA5Match X-ORDERED 'VALUES' ) modifying entry "cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: olcAttributeTypes: Duplicate attributeType: "" Apache DirectoryStudio shows a little bit more info: #!ERROR [LDAP: error code 80 - olcAttributeTypes: Duplicate attributeType: "?? 6.1.4.1.4203.1.12.2.3.2.1.3"] dn: cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONF IG configuration directives' EQUALITY caseExactIA5Match SYNTAX OMsIA5String X -ORDERED 'VALUES' ) - delete: olcAttributeTypes olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONF IG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) - 2) Replace all olcAttributeTypes-attributes: -------------------------------------------- $ ldapmodify -xvW -h bach-s49 -D cn=Manager,cn=config -f cn-schema-olcAttributeTypes-repl.ldif ldap_initialize( ldap://bach-s49 ) Enter LDAP Password: replace olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: structural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which object was last modified' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creator' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has children' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change sequence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change sequence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syncrepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the largest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512: alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RFC4512: naming contexts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC 'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC 'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' DESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC4512: features supported by the server' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'monitor context' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'config context' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of implementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version of implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: administrative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE directoryOperation ) ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtree specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE directoryOperation ) ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT structure rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.17 USAGE directoryOperation ) ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT content rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.16 USAGE directoryOperation ) ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.30 USAGE directoryOperation ) ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute types' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 USAGE directoryOperation ) ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object classes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.37 USAGE directoryOperation ) ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.35 USAGE directoryOperation ) ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching rule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.31 USAGE directoryOperation ) ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.54 USAGE directoryOperation ) ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) DESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subordinate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE distributedOperation ) ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL entry pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' ) DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFrom' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589: entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'RFC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common supertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of name attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common name(s) for which the entity is known by' SUP name ) ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'RFC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An integer uniquely identifying a user in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An integer uniquely identifying a group in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Uniform Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related object' SUP distinguishedName ) ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd configuration directives' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for slapd configuration backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs against content of Add ops' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of deprecated features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd command line options' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP attributeTypes' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBLINGS' ) ( OLcfgGlAt:10 NAME 'olcConcurrency' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:11 NAME 'olcConnMaxPending' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type for a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' ) ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP DIT content rules' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:17 NAME 'olcGentleHUP' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:0.17 NAME 'olcHidden' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:18 NAME 'olcIdleTimeout' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI ) ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:84 NAME 'olcIndexIntLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.4 NAME 'olcLastMod' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldapSyntax' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:26 NAME 'olcLocalSSF' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:27 NAME 'olcLogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.16 NAME 'olcMirrorMode' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:31 NAME 'olcModulePath' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:0.18 NAME 'olcMonitoring' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP object classes' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-VALUE X-ORDERED 'SIBLINGS' ) ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:37 NAME 'olcPidFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:39 NAME 'olcPluginLogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:40 NAME 'olcReadOnly' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-VALUE ) ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY caseIgnoreMatch X-ORDERED 'VALUES' ) ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:49 NAME 'olcReverseLookup' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedNameMatch SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:0.9 NAME 'olcRootPW' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:53 NAME 'olcSaslHost' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:54 NAME 'olcSaslRealm' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:56 NAME 'olcSaslSecProps' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedNameMatch SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:60 NAME 'olcSizeLimit' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose values will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:0.15 NAME 'olcSubordinate' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNameMatch SYNTAX OMsDN ) ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:66 NAME 'olcThreads' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:67 NAME 'olcTimeLimit' SYNTAX OMsDirectoryString ) ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:74 NAME 'olcTLSRandFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:80 NAME 'olcToolThreads' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUALITY caseIgnoreMatch ) ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for database content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'monitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'monitor managed info' SUP name ) ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'monitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DESC 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DESC 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzDN' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalAddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAddress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC 'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC 'name of overlays defined for a given database' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/write status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' DESC 'name of restricted operation for a given database' SUP managedInfo ) ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProtocol' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsReceived' DESC 'monitor number of operations received by the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsExecuting' DESC 'monitor number of operations in execution within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPending' DESC 'monitor number of pending operations within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCompleted' DESC 'monitor number of operations completed within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet' DESC 'number of times connection_get() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead' DESC 'number of times connection_read() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite' DESC 'number of times connection_write() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask' DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListener' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerDomain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStartTime' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActivityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC 'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC 'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig' DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) ( OLcfgDbAt:1.11 NAME 'olcDbCacheFree' DESC 'Number of extra entries to free when max is reached' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.1 NAME 'olcDbCacheSize' DESC 'Entry cache size in entries' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.2 NAME 'olcDbCheckpoint' DESC 'Database checkpoint interval in kbytes and minutes' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:1.16 NAME 'olcDbChecksum' DESC 'Enable database checksum validation' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.13 NAME 'olcDbCryptFile' DESC 'Pathname of file containing the DB encryption key' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:1.14 NAME 'olcDbCryptKey' DESC 'DB encryption key' SYNTAX OMsOctetString SINGLE-VALUE ) ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONFIG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) ( OLcfgDbAt:1.4 NAME 'olcDbNoSync' DESC 'Disable synchronous database writes' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.15 NAME 'olcDbPageSize' DESC 'Page size of specified DB, in Kbytes' EQUALITY caseExactMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:1.5 NAME 'olcDbDirtyRead' DESC 'Allow reads of uncommitted data' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.12 NAME 'olcDbDNcacheSize' DESC 'DN cache size' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.6 NAME 'olcDbIDLcacheSize' DESC 'IDL cache size in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.2 NAME 'olcDbIndex' DESC 'Attribute index parameters' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:1.7 NAME 'olcDbLinearIndex' DESC 'Index attributes one at a time' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.8 NAME 'olcDbLockDetect' DESC 'Deadlock detection algorithm' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:0.3 NAME 'olcDbMode' DESC 'Unix permissions of database files' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:1.9 NAME 'olcDbSearchStack' DESC 'Depth of search stack in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.10 NAME 'olcDbShmKey' DESC 'Key for shared memory region' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgOvAt:3.1 NAME 'olcChainingBehavior' DESC 'Chaining behavior control parameters (draft-sermersheim-ldap-chaining)' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgOvAt:3.2 NAME 'olcChainCacheURI' DESC 'Enables caching of URIs not present in configuration' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgOvAt:3.3 NAME 'olcChainMaxReferralDepth' DESC 'max referral depth' EQUALITY integerMatch SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgOvAt:3.4 NAME 'olcChainReturnError' DESC 'Errors are returned instead of the original referral' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:0.14 NAME 'olcDbURI' DESC 'URI (list) for remote DSA' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.1 NAME 'olcDbStartTLS' DESC 'StartTLS' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.2 NAME 'olcDbACLAuthcDn' DESC 'Remote ACL administrative identity' OBSOLETE SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:3.3 NAME 'olcDbACLPasswd' DESC 'Remote ACL administrative identity credentials' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.4 NAME 'olcDbACLBind' DESC 'Remote ACL administrative identity auth bind configuration' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.5 NAME 'olcDbIDAssertAuthcDn' DESC 'Remote Identity Assertion administrative identity' OBSOLETE SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:3.6 NAME 'olcDbIDAssertPasswd' DESC 'Remote Identity Assertion administrative identity credentials' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.7 NAME 'olcDbIDAssertBind' DESC 'Remote Identity Assertion administrative identity auth bind configuration' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.8 NAME 'olcDbIDAssertMode' DESC 'Remote Identity Assertion mode' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.9 NAME 'olcDbIDAssertAuthzFrom' DESC 'Remote Identity Assertion authz rules' SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgDbAt:3.10 NAME 'olcDbRebindAsUser' DESC 'Rebind as user' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.11 NAME 'olcDbChaseReferrals' DESC 'Chase referrals' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.12 NAME 'olcDbTFSupport' DESC 'Absolute filters support' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.13 NAME 'olcDbProxyWhoAmI' DESC 'Proxy whoAmI exop' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.14 NAME 'olcDbTimeout' DESC 'Per-operation timeouts' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.15 NAME 'olcDbIdleTimeout' DESC 'connection idle timeout' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.16 NAME 'olcDbConnTtl' DESC 'connection ttl' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.17 NAME 'olcDbNetworkTimeout' DESC 'connection network timeout' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.18 NAME 'olcDbProtocolVersion' DESC 'protocol version' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:3.19 NAME 'olcDbSingleConn' DESC 'cache a single connection per identity' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.20 NAME 'olcDbCancel' DESC 'abandon/ignore/exop operations when appropriate' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.21 NAME 'olcDbQuarantine' DESC 'Quarantine database if connection fails and retry according to rule' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.22 NAME 'olcDbUseTemporaryConn' DESC 'Use temporary connections if the cached one is busy' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.23 NAME 'olcDbConnectionPoolMax' DESC 'Max size of privileged connections pool' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:3.25 NAME 'olcDbNoRefs' DESC 'Do not return search reference responses' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.26 NAME 'olcDbNoUndefFilter' DESC 'Do not propagate undefined search filters' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:5.1 NAME 'olcRelay' DESC 'Relay DN' SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:7.1 NAME 'olcDbSocketPath' DESC 'Pathname for Unix domain socket' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:7.2 NAME 'olcDbSocketExtensions' DESC 'binddn, peername, or ssf' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( olmBDBAttributes:1 NAME 'olmBDBEntryCache' DESC 'Number of items in Entry Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( olmBDBAttributes:2 NAME 'olmBDBDNCache' DESC 'Number of items in DN Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( olmBDBAttributes:3 NAME 'olmBDBIDLCache' DESC 'Number of items in IDL Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( olmBDBAttributes:4 NAME 'olmDbDirectory' DESC 'Path name of the directory where the database environment resides' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) modifying entry "cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) The corresponding ldif-files and the original cn=schema,cn=config entry can be found at http://leo.kloburg.at/tmp/openldap-olcattributetypes/ Any hints? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 2

runtime config: adding values to olcDbConfig
by Alexander 'Leo' Bergolth 21 Aug '09

21 Aug '09

Hi! I am experiencing troubles when trying to add an additional value to the olcDbConfig attribute (openldap-2.4.16): $ ldapmodify -xvW -h bach-s49 -D cn=Manager,cn=config <<EOF > dn: olcDatabase={1}bdb,cn=config > changetype: modify > add: olcDbConfig > olcDbConfig: {19}# urxn > - > EOF ldap_initialize( ldap://bach-s49 ) Enter LDAP Password: add olcDbConfig: {19}# urxn modifying entry "olcDatabase={1}bdb,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcDbConfig: no equality matching rule replacing all attribute values with "changetype: modify" and "replace: olcDbConfig" works fine but unfortunately Apache DirectoryStudio doesn't seem to offer that way of committing changes... Unfortunately the attribute definition of olcDbConfig seems to be hardcoded, so is there any way to make the above modification work? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 1

question for some code in sasl binding
by Xu, Qiang (FXSGSC) 21 Aug '09

21 Aug '09

Hi, all: In reading OpenLDAP code related to SASL binding, I found the following snippet: ======================================== int ldap_sasl_bind( LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *mechanism, struct berval *cred, LDAPControl **sctrls, LDAPControl **cctrls, int *msgidp ) { ... if( mechanism == LDAP_SASL_SIMPLE ) { /* simple bind */ rc = ber_printf( ber, "{it{istON}" /*}*/, id, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SIMPLE, cred ); } else if ( cred == NULL || cred->bv_val == NULL ) { /* SASL bind w/o credentials */ rc = ber_printf( ber, "{it{ist{sN}N}" /*}*/, id, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SASL, mechanism ); } else { /* SASL bind w/ credentials */ rc = ber_printf( ber, "{it{ist{sON}N}" /*}*/, id, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SASL, mechanism, cred ); } ... } ======================================== Just wanna know that if I remove the condition "|| cred->bv_val == NULL" in the "else if" brance, what will happen? Anyone can tell me why this condition was added? What bug did it fix? My guess is that if it is removed, then the network trace will display some packet marked with "Malformed Packet", but the binding result should be the same. Still, I need some confirmation from your guys. P.S. Shouldn't another condtion, say, "|| cred->bv_len == 0" be added into the "else if" brance as well? Thanks, Xu Qiang

1 0

Avoid unexistent user queries
by Jordi Espasa Clofent 20 Aug '09

20 Aug '09

Hi all, I'm using OpenLDAP as account server. In the server I see a lot of queries from inexistents users in LDAP: filter="(&(objectClass=posixGroup)(|(memberUid=ivan)(uniqueMember=uid=ivan,ou=sat,ou=tecnic,dc=cdmon,dc=com)))" filter="(&(objectClass=posixAccount)(uidNumber=900))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=nobody))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=postfix))" gidNumbercn filter="(&(objectClass=posixAccount)(uidNumber=125))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=xatlantax))" gidNumbercn filter="(&(objectClass=posixAccount)(uidNumber=900))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=cetr))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uidNumber=900))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" I don't understand why because of users as '900, postfix, root, www-data' don't exists as users in LDAP server. On the other hand, the user 'ivan' exists and you can see the difference in the log record. ¿Where is the problem? Maybe in my /etc/nsswitch.conf of LDAP clients? # cat /etc/nsswitch.conf passwd: files ldap group: files ldap shadow: files ldap sudoers: ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis Taking for example the common 'www-data' user query, I see in the LDAP client the next: # cat /var/log/auth.log | grep apache Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:58 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:02 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:04 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:04 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:48 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:49 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:59 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:00 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:00 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:03 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:07 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:07 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:24 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:24 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:24 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:25 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ ¿Why Apache2 tries to connect to LDAP (192.168.10.1)? ¿How I can avoid it? -- Thanks, Jordi Espasa Clofent

1 0

using ldapsearch to get whole data
by mukim pathan 20 Aug '09

20 Aug '09

Hi, I am unable to use slapcat to get whole database into a ldif file because I have a 32 bit machine which cannot write file having size more than 2 GB. So I am looking for alternate ways to get full database into ldif file. So please tell me if there are any alternate ways to do this. I am using openldap-2.4.16 with BDB-4.5 Regards, Mukim Pathan

4 4

LDAP Multimaster Replication
by Paul bob 19 Aug '09

19 Aug '09

Hi - I have question regarding the HA, configured LDAP Multimaster Replication (Openldap 2.4.17 & BDB 4.6.21 ) I can see the Users data in both Server1 and Server2. When I turned off the server2 the users are not getting authenticated through Server1. It always getting authentication through Server2. I would appreciate your valuable suggestion! Thanks, PB

1 0

ldap_add: Already exists (68) errors when testing multi-master sync replication
by Barry Colston 19 Aug '09

19 Aug '09

While testing sync replication, I encountered a situation in which a previously deleted DN cannot be added again because the ldapadd command receives a 68 error code. If I perform an ldapsearch command for the DN, the DN is not found. If I try to add the DN, the add fails with a 68 error code. If I perform a slapcat command for that DN, slapcat displays the record. I have removed all BDB index files and rerun the slapindex command, but the DN is still not found with the ldapsearch command and fails to be added because of a 68 error code. 1 reason I can think of is that deleting a DN does not physically delete the record, but flags the DN as being logically deleted. This condition does not happen all the time, but it does happen eventually after I have been adding, modifying, and deleting records for approximately 15 minutes. I'm running openLDAP 2.4.17 with BDB 4.6.21 (and have not applied the 4 BDB patches). Running sync replication with 2 masters defined in mirror mode using refreshandpersist; issuing LDAP commands against only master slapd #1. Barry Colston

2 3

Need help migrating from Novell eDirectory to OpenLDAP
by Donal Duane 19 Aug '09

19 Aug '09

Hi all, Has anyone tried to migrate data between eDirectory and OpenLDAP? I am having a lot of trouble with invalid attributes. /D

2 1

[PROBLEM] delta-syncrepl, accesslog and filters
by mkappe 19 Aug '09

19 Aug '09

Hello, I use openldap 2.4.16. I configured 2 servers using syncrepl. I would like to sync only a DIT fragment and so i put these lines in the consumer slapd.conf file: syncrepl rid=111 provider=ldaps://mydomain.it<http://ldapstudenti.cca.unipd.it:12315/> type=refreshAndPersist searchbase="dc=mydomain,dc=it" filter="(&(objectClass=MyClass)(Email=true))" attrs="Username,UserStatus,UserExpireDate" schemachecking=off bindmethod=simple binddn="cn=reader,dc=mydomain,dc=it" credentials=xxxxxx retry="60 +" When i try to get out of the scope an entry (setting its attribute 'Email' = false) in the producer, i see that the same entry is removed from the consumer. Everything works fine if i don't activate delta syncrepl mode using accesslog overlay. If i do that, every changes in the producer is propagated to the consumer even if the entry is out of the scope defined in the consumer. How can i configure delta syncrepl (with accesslog) for sync only a DIT fragment? My producer (delta-syncrepl mode) slapd.conf is: moduleload syncprov.la ####################################################################### # ACCESSLOG database definitions ####################################################################### moduleload accesslog.la database bdb suffix "cn=accesslog" rootdn "cn=accesslog" directory /openldap/data/accesslog index default eq index entryCSN,objectClass overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE ####################################################################### # BDB database definitions ####################################################################### # RAMO LOCALE: database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxxx directory /openldap/data index objectClass,uid eq index entryCSN eq index entryUUId eq index Email pres,eq ####################################################################### # Syncrepl - Sincprov ####################################################################### overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 00+01:00 00+00:15 ####################################################################### # ACL ####################################################################### access to dn.subtree="dc=mydomain,dc=it" attrs="userPassword" by anonymous auth by self write by * search access to * by dn.base="cn=reader,dc=mydomain,dc=it" read by * break My consumer (delta-syncrepl mode) slapd.conf is: ####################################################################### # BDB database definitions ####################################################################### # RAMO LOCALE: database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxxx directory /openldap/data index objectClass,uid eq index entryUUID,entryCSN eq index Email pres,eq ####################################################################### # DELTA-SYNCREPL ####################################################################### syncrepl rid=005 provider=ldaps://mydomain.it:123 type=refreshAndPersist searchbase="dc=mydomain,dc=it" filter="(&(objectClass=myClass)(Email=true))" logbase="cn=accesslog" syncdata=accesslog schemachecking=off bindmethod=simple binddn="cn=reader,dc=mydomain,dc=it" credentials=xxxxxx retry="60 +" updateref ldaps://mydomain.it:123 ###################################################################### # ACL ###################################################################### access to dn.subtree="dc=mydomain,dc=it" attrs="userPassword" by anonymous auth by self write by * search access to * by dn.base="cn=reader,dc=mydomain,dc=it" read by * break Thank you! Marco

1 0

Missing UUID for entry being copied by syncrepl to secondary ldap
by Robert Hanson 19 Aug '09

19 Aug '09

(Openldap 2.4.17; BDB 4.5) I have a database that I have set up in non-replicated mode (no syncrepl setup). Now, I've added a second node in a multi-master configuration. When I start slapd on the second node, syncrepl starts up and tries to copy data to the second node. I've stepped through the syncrepl code on the master using a debugger, and it is clear that onespecific node (from the set of nodes in the master database is being queued up and sent to the secondary) has a UUID entry of length 1, and a value of "0". When that node is sent to the secondary, it is treated as if it has no UUID, which is caught by an assertion. This causes the slapd on the secondary to exit. Why is the node on the primary missing the UUID? Is there some code I can trace through to determine this? Is there a way to add the UUID to the entry? Or is there a way to patch the syncrepl code to avoid sending the node that is missing the UUID?

1 0

How to get some overlays?
by ulises gonzalez 18 Aug '09

18 Aug '09

Hello I'm begining to use Openldap, I'm using the version 2.4.11 which comes precompiled with Debian Lenny, the problem is that each time I try to load some overlay the logs saids... Aug 17 13:56:36 ldap slapd[4935]: @(#) $OpenLDAP: slapd 2.4.11 (Oct 12 2008 04:13:21) $#012#011buildd@ninsei:/build/buildd/openldap-2.4.11/debian/build/servers/slapd Aug 17 13:56:36 ldap slapd[4935]: overlay "syncprov" not found Aug 17 13:56:36 ldap slapd[4935]: slapd stopped. Aug 17 13:56:36 ldap slapd[4935]: connections_destroy: nothing to destroy. Aug 17 14:44:23 ldap slapd[5027]: @(#) $OpenLDAP: slapd 2.4.11 (Oct 12 2008 04:13:21) $#012#011buildd@ninsei:/build/buildd/openldap-2.4.11/debian/build/servers/slapd Aug 17 14:44:23 ldap slapd[5027]: overlay "unique" not found Aug 17 14:44:23 ldap slapd[5027]: slapd stopped. Aug 17 14:44:23 ldap slapd[5027]: connections_destroy: nothing to destroy. Aug 17 14:49:07 ldap slapd[5040]: @(#) $OpenLDAP: slapd 2.4.11 (Oct 12 2008 04:13:21) $#012#011buildd@ninsei:/build/buildd/openldap-2.4.11/debian/build/servers/slapd Aug 17 14:49:08 ldap slapd[5040]: overlay "ppolicy" not found Aug 17 14:49:08 ldap slapd[5040]: slapd stopped. Aug 17 14:49:08 ldap slapd[5040]: connections_destroy: nothing to destroy. And Openldap doesn't start, I've been searching in the Openldap website but I haven't found any link to download so my question is where I can get overlays? I need exactly unique and syncprov overlays. Thanks... -- Salu2 ________________________ Ulinx Administrador de redes Ministerio de Finanzas y Precios Linux user 366775 "En un problema con n ecuaciones siempre habrá al menos n+1 incógnitas."

2 2

OpenLDAP structural object class problems
by Henrik Dige Semark 17 Aug '09

17 Aug '09

Hey Im trying to get OpenLDAP database + SAMBA to work as a unit. But when I try to create mashine accaunts I get this error: slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed tail -200f /var/log/syslog | grep slapd Aug 16 22:43:18 hds-linux slapd[28381]: bdb_idl_insert_key: 15 [80002715] Aug 16 22:43:18 hds-linux slapd[28381]: bdb_idl_insert_key: 15 [80000203] Aug 16 22:43:18 hds-linux slapd[28381]: send_ldap_result: err=0 matched="" text="" Aug 16 22:43:22 hds-linux slapd[28381]: connection_get(17) Aug 16 22:43:22 hds-linux slapd[28381]: conn=14 op=8 do_modify: dn (uid=hds$,ou=Computers,dc=semark,dc=dk) Aug 16 22:43:22 hds-linux slapd[28381]: conn=14 op=8 modifications: Aug 16 22:43:22 hds-linux slapd[28381]: ^Ireplace: objectClass Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Imultiple values Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLogonTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 1 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLogoffTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaKickoffTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdCanChange Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 1 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdMustChange Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdLastSet Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaAcctFlags Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 13 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLMPassword Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 32 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaNTPassword Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 32 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaSID Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 47 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPrimaryGroupSID Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 45 Aug 16 22:43:22 hds-linux slapd[28381]: hdb_modify: uid=hds$,ou=Computers,dc=semark,dc=dk Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace objectClass Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLogonTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLogoffTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaKickoffTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdCanChange Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdMustChange Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdLastSet Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaAcctFlags Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLMPassword Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaNTPassword Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaSID Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPrimaryGroupSID Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace entryCSN Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace modifiersName Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace modifyTimestamp *Aug 16 22:43:22 hds-linux slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed Aug 16 22:43:22 hds-linux slapd[28381]: send_ldap_result: err=69 matched="" text="structural object class modification from 'account' to 'inetOrgPerson' not allowed"* Aug 16 22:43:22 hds-linux slapd[28381]: connection_get(17) Aug 16 22:47:37 hds-linux slapd[28381]: connection_get(25) Aug 16 22:47:37 hds-linux slapd[28381]: SRCH "sambaDomainName=SEMARK.DK,dc=semark,dc=dk" 2 0 Aug 16 22:47:37 hds-linux slapd[28381]: 0 15 0 Aug 16 22:47:37 hds-linux slapd[28381]: filter: (?objectClass=sambaTrustedDomainPassword) Aug 16 22:47:37 hds-linux slapd[28381]: attrs: Aug 16 22:47:37 hds-linux slapd[28381]: sambaDomainName Aug 16 22:47:37 hds-linux slapd[28381]: sambaSID Aug 16 22:47:37 hds-linux slapd[28381]: Aug 16 22:47:37 hds-linux slapd[28381]: bdb_idl_fetch_key: [b49d1940] Aug 16 22:47:37 hds-linux slapd[28381]: send_ldap_result: err=0 matched="" text="" What do I have to do to allow structural object changes ? Im running: Debian Lenny (5.0.2) Kernel - 2.6.26-2-xen-686 OpenLDAP: slapd 2.4.17 (Jul 29 2009 00:52:57) Samba Version 3.2.5 Winbind Version 3.2.5 Thanx for the help :) -- Med Venlig Hilsen / Best regards Henrik Dige Semark

3 4

Regarding using ldap_modif_ext_s for modifying all users globally in AD?
by Santosh Kumar 17 Aug '09

17 Aug '09

Hi Everyone, Please help us to modify all users under "users" container. could modify for individual user entry for attributes. Is the the user_dn parameter specified correct? Will the ldap_modify_ext_s supports the globally users entry modification? 1) Modify the user "tetsuser5" char *user_dn = "cn=testuser5,cn=users,dc=kpvmpdc,dc=com" if (ldap_modify_ext_s(ld, user_dn, mods,NULL,NULL) != LDAP_SUCCESS) { ldap_perror( ld, "ldap_modify_s" ); exit(EXIT_FAILURE); } ->Works 2)To modify users globally, used : char *user_dn = "cn=users,dc=kpvmpdc,dc=com" that gives error ldap_modify_s: Object class violation (65) additional info: 0000207D: UpdErr: DSID-03150F9C, problem 6002 (OBJ_CLASS_VIOLATION), data 0 Thanks in advance. Regards Santosh

1 0

Samba PDC + OpenLDAP (Debian Lenny)
by Henrik Dige Semark 15 Aug '09

15 Aug '09

Hey. I'm trying to move my existing MS-AD over to SAMBA, the place I'm working for is changing all servers from MS to Debian, but all the clients is still a mixed environment for now. We have MAC, *NIX, and Windows clients, so its imported that everything keeps running in the same or almost the same way as before the change but. When I try to join a Windows Vista Ultimate ore Windows XP Pro to the domain it takes 30 sec and then it says "The machine account dos not exist" but as I understand that is what "add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u"" has to do right ? I have pasted my config + log from OpenLDAP and SAMBA, can anybody see what I have don wrung # cat /etc/samba/smb.conf ------------------------- # Defining domain name, hostname #################################################### [global] workgroup = MY-DOMAIN netbios name = HDS-Linux - PDC server string = Debian Samba-PDC %v name resolve order = host bcast hosts allow = 192.168.1. 192.168.2. 127. wins support = yes # Network settings # #interfaces = 192.168.5.11 #username map = /etc/samba/smbusers # Security # security = ads realm = MY-DOMAIN nt acl support = Yes enable privileges = yes encrypt passwords = Yes obey pam restrictions = Yes password server = my-server.my-domain #min passwd length = 5 #pam password change = no # method 1: #unix password sync = no #ldap passwd sync = yes # method 2: unix password sync = No ldap passwd sync = Yes passwd program = /usr/sbin/smbldap-passwd -u "%u" passwd chat = "Skift kode: *\n Ny kode*" %n\n "*Gentag ny kode*" %n\n" # Log # log level = 1 syslog = 1 log file = /var/log/samba/samba_my-domain.log max log size = 100000 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 mangling method = hash2 Dos charset = 850 Unix charset = ISO8859-1 # Logon scripts # logon script = scripts/logon.bat logon path = \\%L\profile\%U logon drive = H: logon home = \\%L\%u # Server settings # time server = Yes domain logons = Yes domain master = Yes os level = 65 preferred master = Yes # Winbind settings # winbind use default domain = yes winbind separator = % winbind uid = 10000-21000 winbind gid = 10000-21000 winbind enum users = yes winbind enum groups = yes template homedir = /home/%U # LDAP settings # # passdb backend = ldapsam:"ldap://ldap1.company.com ldap://ldap2.company.com" passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=admin,dc=domain,dc=dk ldap suffix = dc=domain,dc=dk ldap group suffix = ou=groups ldap user suffix = ou=people ldap machine suffix = ou=Computers ldap idmap suffix = ou=Idmap idmap uid = 10000-21000 idmap gid = 10000-21000 ldap ssl = No ldap delete dn = Yes add user script = /usr/sbin/smbldap-useradd -a -m "%u" add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user script = /usr/sbin/smbldap-userdel "%u" delete group script = /usr/sbin/smbldap-groupdel "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%u" "%g" # printers configuration # printer admin = @"Print Operators" load printers = Yes create mask = 0640 directory mask = 0750 #force create mode = 0640 #force directory mode = 0750 printing = cups printcap name = cups deadtime = 10 guest account = nobody map to guest = Bad User dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd show add printer wizard = yes ; to maintain capital letters in shortcuts in any of the profile folders: preserve case = yes short preserve case = yes case sensitive = no [netlogon] path = /home/netlogon/ browseable = No read only = yes [profiles] comment = Roaming Profiles #path = /var/lib/samba/profiles path = /home/profiles read only = no writeable = yes create mask = 0600 directory mask = 0700 browseable = No guest ok = Yes profile acls = yes csc policy = disable # next line is a great way to secure the profiles force user = %U # next line allows administrator to access all profiles valid users = %U "Domain Admins" [printers] comment = Network Printers printer admin = @"Print Operators" guest ok = yes printable = yes path = /home/spool/ browseable = No read only = Yes printable = Yes print command = /usr/bin/lpr -P%p -r %s lpq command = /usr/bin/lpq -P%p lprm command = /usr/bin/lprm -P%p %j # print command = /usr/bin/lpr -U%U@%M -P%p -r %s # lpq command = /usr/bin/lpq -U%U@%M -P%p # lprm command = /usr/bin/lprm -U%U@%M -P%p %j # lppause command = /usr/sbin/lpc -U%U@%M hold %p %j # lpresume command = /usr/sbin/lpc -U%U@%M release %p %j # queuepause command = /usr/sbin/lpc -U%U@%M stop %p # queueresume command = /usr/sbin/lpc -U%U@%M start %p [print$] path = /home/printers guest ok = No browseable = Yes read only = Yes valid users = @"Print Operators" write list = @"Print Operators" create mask = 0664 directory mask = 0775 [public] path = /tmp guest ok = yes browseable = Yes writable = yes [homes] path = /home/%u comment = Home Directories valid users = %u read only = No browseable = Yes create mode = 0750 # tail -200f /var/log/samba/samba_domain.log -------------------------- [2009/08/14 18:22:24, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:22:24, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:22:24, 0] passdb/pdb_get_set.c:pdb_get_group_sid(210) pdb_get_group_sid: Failed to find Unix account for DomAdmin [2009/08/14 18:22:24, 1] auth/auth_util.c:make_server_info_sam(562) User DomAdmin in passdb, but getpwnam() fails! [2009/08/14 18:22:24, 0] auth/auth_sam.c:check_sam_security(355) check_sam_security: make_server_info_sam() failed with 'NT_STATUS_NO_SUCH_USER' [2009/08/14 18:22:47, 0] passdb/pdb_get_set.c:pdb_get_group_sid(210) pdb_get_group_sid: Failed to find Unix account for DomAdmin [2009/08/14 18:22:47, 1] auth/auth_util.c:make_server_info_sam(562) User DomAdmin in passdb, but getpwnam() fails! [2009/08/14 18:22:47, 0] auth/auth_sam.c:check_sam_security(355) check_sam_security: make_server_info_sam() failed with 'NT_STATUS_NO_SUCH_USER' Error: modifications require authentication at /usr/share/perl5/smbldap_tools.pm line 1083. [2009/08/14 18:22:48, 0] passdb/pdb_interface.c:pdb_default_create_user(336) _samr_create_user: Running the command `/usr/sbin/smbldap-useradd -t 0 -w -i "hds$"' gave 127 [2009/08/14 18:23:49, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:23:49, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:23:49, 1] libads/cldap.c:recv_cldap_netlogon(156) no reply received to cldap netlogon [2009/08/14 18:23:49, 0] printing/nt_printing.c:nt_printing_init(664) nt_printing_init: error checking published printers: WERR_ACCESS_DENIED [2009/08/14 18:23:49, 0] groupdb/mapping.c:pdb_create_builtin_alias(802) pdb_create_builtin_alias: Could not add group mapping entry for alias 545 (NT_STATUS_GROUP_EXISTS) tail -200f /var/log/syslog | grep slapd -------------------------- Aug 14 18:32:33 hds-linux slapd[4180]: connection_get(20) Aug 14 18:32:33 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0 Aug 14 18:32:33 hds-linux slapd[4180]: 0 15 0 Aug 14 18:32:33 hds-linux slapd[4180]: filter: (?objectClass=sambaTrustedDomainPassword) Aug 14 18:32:33 hds-linux slapd[4180]: attrs: Aug 14 18:32:33 hds-linux slapd[4180]: sambaDomainName Aug 14 18:32:33 hds-linux slapd[4180]: sambaSID Aug 14 18:32:33 hds-linux slapd[4180]: Aug 14 18:32:33 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:32:33 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="value does not conform to assertion syntax" Aug 14 18:32:46 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: ==> hdb_bind: dn: cn=admin,dc=domain,dc=dk Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "" 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: supportedControl Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (&(?objectClass=sambaTrustedDomainPassword)(sambaDomainName=MY-DOMAIN)) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=10 matched="sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" text="value does not conform to assertion syntax" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (&(uid=domadmin)(objectClass=sambaSamAccount)) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: uid Aug 14 18:33:01 hds-linux slapd[4180]: uidNumber Aug 14 18:33:01 hds-linux slapd[4180]: gidNumber Aug 14 18:33:01 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:01 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:01 hds-linux slapd[4180]: cn Aug 14 18:33:01 hds-linux slapd[4180]: sn Aug 14 18:33:01 hds-linux slapd[4180]: displayName Aug 14 18:33:01 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:01 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:01 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:01 hds-linux slapd[4180]: description Aug 14 18:33:01 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:01 hds-linux slapd[4180]: sambaSID Aug 14 18:33:01 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:01 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:01 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:01 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:01 hds-linux slapd[4180]: objectClass Aug 14 18:33:01 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:01 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:01 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:01 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:01 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:01 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:01 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:01 hds-linux slapd[4180]: uidNumber Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [08a4f228] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [f937ce0f] Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdHistoryLength Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: base_candidates: base: "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" (0x00000011) Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: sambaMaxPwdAge Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: base_candidates: base: "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" (0x00000011) Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(gidNumber=65534)) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: gidNumber Aug 14 18:33:01 hds-linux slapd[4180]: sambaSID Aug 14 18:33:01 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:01 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:01 hds-linux slapd[4180]: description Aug 14 18:33:01 hds-linux slapd[4180]: displayName Aug 14 18:33:01 hds-linux slapd[4180]: cn Aug 14 18:33:01 hds-linux slapd[4180]: objectClass Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [8000fffe] Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:02 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:02 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:02 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:02 hds-linux slapd[4180]: filter: (&(uid=hds$)(objectClass=sambaSamAccount)) Aug 14 18:33:02 hds-linux slapd[4180]: attrs: Aug 14 18:33:02 hds-linux slapd[4180]: uid Aug 14 18:33:02 hds-linux slapd[4180]: uidNumber Aug 14 18:33:02 hds-linux slapd[4180]: gidNumber Aug 14 18:33:02 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:02 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:02 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:02 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:02 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:02 hds-linux slapd[4180]: cn Aug 14 18:33:02 hds-linux slapd[4180]: sn Aug 14 18:33:02 hds-linux slapd[4180]: displayName Aug 14 18:33:02 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:02 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:02 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:02 hds-linux slapd[4180]: description Aug 14 18:33:02 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:02 hds-linux slapd[4180]: sambaSID Aug 14 18:33:02 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:02 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:02 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:02 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:02 hds-linux slapd[4180]: objectClass Aug 14 18:33:02 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:02 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:02 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:02 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:02 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:02 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:02 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:02 hds-linux slapd[4180]: uidNumber Aug 14 18:33:02 hds-linux slapd[4180]: Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [a06475a6] Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:02 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:02 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:02 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:02 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(|(displayName=hds$)(cn=hds$))) Aug 14 18:33:02 hds-linux slapd[4180]: attrs: Aug 14 18:33:02 hds-linux slapd[4180]: gidNumber Aug 14 18:33:02 hds-linux slapd[4180]: sambaSID Aug 14 18:33:02 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:02 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:02 hds-linux slapd[4180]: description Aug 14 18:33:02 hds-linux slapd[4180]: displayName Aug 14 18:33:02 hds-linux slapd[4180]: cn Aug 14 18:33:02 hds-linux slapd[4180]: objectClass Aug 14 18:33:02 hds-linux slapd[4180]: Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [9767cf87] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [4194d841] Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: ==> hdb_bind: dn: cn=admin,dc=domain,dc=dk Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "" 0 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: supportedControl Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(?objectClass=sambaTrustedDomainPassword)(sambaDomainName=MY-DOMAIN)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=10 matched="sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" text="value does not conform to assertion syntax" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(uid=domadmin)(objectClass=sambaSamAccount)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: uid Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: sn Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:24 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:24 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [08a4f228] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [f937ce0f] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(gidNumber=65534)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:24 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [8000fffe] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(uid=hds$)(objectClass=sambaSamAccount)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: uid Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: sn Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:24 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:24 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [a06475a6] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(|(displayName=hds$)(cn=hds$))) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:24 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [9767cf87] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [4194d841] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:25 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 2 Aug 14 18:33:25 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:25 hds-linux slapd[4180]: filter: (&(objectClass=posixAccount)(uid=hds$)) Aug 14 18:33:25 hds-linux slapd[4180]: attrs: Aug 14 18:33:25 hds-linux slapd[4180]: Aug 14 18:33:25 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:25 hds-linux slapd[4180]: bdb_idl_fetch_key: [5941c014] Aug 14 18:33:25 hds-linux slapd[4180]: bdb_idl_fetch_key: [a06475a6] Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:25 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 0 2 Aug 14 18:33:25 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:25 hds-linux slapd[4180]: filter: (objectClass=sambaUnixIdPool) Aug 14 18:33:25 hds-linux slapd[4180]: attrs: Aug 14 18:33:25 hds-linux slapd[4180]: Aug 14 18:33:25 hds-linux slapd[4180]: base_candidates: base: "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" (0x00000011) Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:25 hds-linux slapd[4180]: conn=44 op=2 do_modify: dn (sambaDomainName=MY-DOMAIN,dc=domain,dc=dk) Aug 14 18:33:25 hds-linux slapd[4180]: conn=44 op=2 modifications: Aug 14 18:33:25 hds-linux slapd[4180]: ^Ireplace: uidNumber Aug 14 18:33:25 hds-linux slapd[4180]: ^I^Ione value, length 5 Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=8 matched="" text="modifications require authentication" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:35 hds-linux slapd[4180]: connection_get(14) # net groupmap list -------------------------- Domain Admins (S-1-5-21-3045805106-2558287267-4023452987-512) -> 512 Domain Users (S-1-5-21-3045805106-2558287267-4023452987-513) -> 513 Domain Guests (S-1-5-21-3045805106-2558287267-4023452987-514) -> 514 Domain Computers (S-1-5-21-3045805106-2558287267-4023452987-515) -> 515 Administrators (S-1-5-32-544) -> 544 Account Operators (S-1-5-32-548) -> 548 Print Operators (S-1-5-32-550) -> 550 Backup Operators (S-1-5-32-551) -> 551 Replicators (S-1-5-32-552) -> 552 Users (S-1-5-32-545) -> 10000 System info: -------------------------- Debian Lenny 5.0.2 Kernel - 2.6.26-2-xen-686 Samba Version 3.2.5 Winbind Version 3.2.5 OpenLDAP Version 2.4.11 if there is more info you need plz just ask :)

2 1

v. 2.4.15 , set as provider giving msg: "logdb <suffix>" missing or invalid
by Brian Neu 15 Aug '09

15 Aug '09

My apologies if I'm overlooking the obvious, but I'm past deadline, late for my kid's football practice, and my brain is fried. I've done my best to follow the Admin Guide example at 18.3.2.1. When issuing a "service ldap restart" or /etc/init.d/ldap restart I get this output hdb_db_open: database "dc=accesslog": unclean shutdown detected; attempting recovery. hdb_db_open: database "dc=accesslog": recovery skipped in read-only mode. Run manual recovery if errors are encountered. hdb_db_open: database "dc=srg,dc=com": unclean shutdown detected; attempting recovery. hdb_db_open: database "dc=srg,dc=com": recovery skipped in read-only mode. Run manual recovery if errors are encountered. accesslog: "logdb <suffix>" missing or invalid. backend_startup_one: bi_db_open failed! (1) slap_startup failed (test would succeed using the -u switch) stale lock files may be present in /var/lib/ldap/accesslog [WARNING] stale lock files may be present in /var/lib/ldap [WARNING] I've tried a -s 192 and a -d 192 as an argument to slapd ---- I'm not even sure where the logs are supposed to go, as nothing ends up in /var/log/messages . Any help would be greatly appreciated. I put the attached slapd.conf up at pastebin too: http://pastebin.com/m11dc35a5 Thanks!

2 1

Multi-master configuration -- check my slapd.conf files please?
by Robert Hanson 14 Aug '09

14 Aug '09

Over the last weeks, we've been installing systems that have multi-master configurations (where there are 2 servers; each one meant to accept modifications and forward those modifications on to the other server). Occasionally, we've seen a case where a node in the tree has a structuralObjectClass of "glue" rather than the intended structuralObjectClass. Someone on this list suggested I post the slapd.conf files and logs. We don't at the moment have any logs, but I do have the slapd.conf files. Would someone take a look at these and see if anything stands out? ================================================== Server 10.192,252.64 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 1 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.65:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10 ================================================== Server 10.192,252.65 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 2 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.64:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10

2 2

FW: Multi-master configuration -- check my slapd.conf files please?
by Robert Hanson 14 Aug '09

14 Aug '09

I have not had a response yet. Would someone please check the syncrepl setup of the config files (below) to see if there are any issues? In particular, do I need the syncprov-checkpoint ? Thanks. ________________________________ From: Robert Hanson Sent: Monday, August 03, 2009 4:01 PM To: openldap-technical(a)openldap.org Subject: Multi-master configuration -- check my slapd.conf files please? Over the last weeks, we've been installing systems that have multi-master configurations (where there are 2 servers; each one meant to accept modifications and forward those modifications on to the other server). Occasionally, we've seen a case where a node in the tree has a structuralObjectClass of "glue" rather than the intended structuralObjectClass. Someone on this list suggested I post the slapd.conf files and logs. We don't at the moment have any logs, but I do have the slapd.conf files. Would someone take a look at these and see if anything stands out? ================================================== Server 10.192,252.64 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 1 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.65:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10 ================================================== Server 10.192,252.65 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 2 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.64:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10

2 1

syncrepl problem?
by Tim Tyler 14 Aug '09

14 Aug '09

Openldap experts, We are running 2.3.43 Openldap on Centos 5.3 systems. I have one provider and two consumers. I believe the consumers were working fine in terms of receiving replication data and staying synchronized until today. I have this entry in slapd.conf syncrepl rid=102 type=refreshAndPersist interval=00:01:00:00 The problem is that I had to completely restore the provider's entire ldap database from a backup ldif file after screwing up over 200 accounts. I got the provider back to the way I wanted, but now the consumers won't synchronize (replicate) any more. 1. Should syncrepl ultimately be able to replicate after a major change to the provider such as a ldif restoration? Or should I expect to have to reload the consumer entries from scratch from a provider generated ldif in situations like this? 2. I thought I read once that the interval settings was still important for when refreshandpersist missed an update. Is that true? Tim Tyler Network Engineer Beloit College

3 3

Cleaning slapcat(1) LDIF output
by Jordi Espasa Clofent 14 Aug '09

14 Aug '09

Hi all, According slapcat(1) man: "The output of slapcat is intended to be used as input to slapadd(8). The output of slapcat cannot generally be used as input to ldapadd(1) or other LDAP clients without first editing the output. This editing would normally include reordering the records into superior first order and removing no-user-modification operational attributes." So, I've done: # making normal LDIF using slapcat(1) $ slapcat -l test_backup.ldif # cleaning the LDIF and dump the results in another file $ egrep -ve '^(entryUUID|creatorsName|structuralObjectClass|createTimestamp|entryCSN|modifiersName|modifyTimestamp): ' \ test_backup.ldif > test_backup_cleaned.ldif #viewing the differences $ diff -y test_backup.ldif test_backup_cleaned.ldif | less ¿Is it a correct way to "clean" the initial LDIF you can get with slapcat(1)? And another minor question ¿Can I use the slapcat(1) tool on the fly? man pages say nothing about it. -- Thanks, Jordi Espasa Clofent

3 5

Re: Cleaning slapcat(1) LDIF output
by masarati＠aero.polimi.it 14 Aug '09

14 Aug '09

Please keep replies to the list. >> Please carefully re-read the above text: "IT IS ALWAYS SAFE TO RUN >> SLAPCAT >> WITH THE SLAPD-BDB(5) BACKEND". > > Piero, > > I think I'm missing something but the question stills here: ¿is possible > to use slapcat(8) on the fly (which means with slapd running)? > Maybe the text you've quoted means: stop the slapd service and runs > slapcat(8) directly against bdb. You see, there's a first sentence, which states that it might not be always safe to run slapcat while slapd is running, as results might be inconsistent. Then there is a second sentence, stating that it is always safe when slapcat is used for slapd-bdb. So the answer is: yes, it is safe. p.

1 0

Re: OpenLDAP + Kerberos on FreeBSD 7.2, close to working but not quite
by Allan 14 Aug '09

14 Aug '09

Thank you for the response. I ran the command and it looks like there's none supported.. This is strange. How can I allow GSSAPI? frisbee# /usr/local/bin/ldapsearch -x -H ldap://localhost -b "" -s base supportedSaslMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSaslMechanisms # # dn: # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 On Mon, Aug 10, 2009 at 9:29 AM, <cr4z3d(a)gmail.com> wrote: > I apologize for that it was early in the morning. Gmail likes to reply to > sender > ------Original Message------ > From: Dieter Kluenter > To: Allan > Subject: Re: OpenLDAP + Kerberos on FreeBSD 7.2, close to working but not > quite > Sent: Aug 10, 2009 8:46 AM > > Please no private mail, stay on the mailinglist, unless you want to > buy my professional support. > > -Dieter > > Allan <cr4z3d(a)gmail.com> writes: > > > Thank you for the response. I ran the command and it looks like there's > none > > supported.. This is strange. How can I allow GSSAPI? > > > > frisbee# /usr/local/bin/ldapsearch -x -H ldap://localhost -b "" -s base > > supportedSaslMechanisms > > # extended LDIF > > # > > # LDAPv3 > > # base <> with scope baseObject > > # filter: (objectclass=*) > > # requesting: supportedSaslMechanisms > > # > > > > # > > dn: > > > > # search result > > search: 2 > > result: 0 Success > > > > # numResponses: 2 > > # numEntries: 1 > > > -- > Dieter Klünter | Systemberatung > http://dkluenter.de > GPG Key ID:8EF7B6C6 > 53°08'09,95"N > 10°08'02,42"E > >

3 11

Re: Just organizationalUnits objects copied doing sync replication
by Yeray Gutiérrez Cedrés 13 Aug '09

13 Aug '09

On Wed, Aug 12, 2009 at 11:40 PM, Quanah Gibson-Mount<quanah(a)zimbra.com> wrote: > --On Wednesday, August 12, 2009 11:17 PM +0100 Yeray Gutiérrez Cedrés > <ycedres(a)gmail.com> wrote: > >> I'm trying to replicate an openldap database from a consumer like this: >> >> index objectClass,entryCSN,entryUUID eq >> overlay syncprov >> syncprov-checkpoint 100 10 >> syncprov-sessionlog 100 >> >> >> To a provider like this: >> >> >> index objectClass,entryCSN,entryUUID eq >> >> syncrepl rid=123 >> provider=ldap://10.140.200.3:389 >> type=refreshOnly >> interval=00:00:00:01 >> searchbase="dc=example,dc=org" >> scope=sub >> attrs="*" >> schemachecking=off >> bindmethod=simple >> binddn="cn=admin,dc=example,dc=org" >> credentials="mypassword" >> >> The provider database is completely emtpy and I want the provider to >> copy the whole database. The only objects that are copied are the >> organizationalUnit class objects. The objects that are "under" the >> organizationalUnits (like for example a 'person' objetct) are not >> being copied. What could be the reason for that? > > > I think you are confused about the differences between "provider" and > "consumer". The provider is what starts with the full database. The > consumer is what gets the database from the provider. So the provider does > *not* copy the database, the consumer does. > I'm sorry for mixing my e-mail up a little bit. I read it three times before sending but at certain hours your brain doesn't work as you expect :-). > In any case, your "attrs" line is wrong. You really shouldn't set it at all > and just use the default unless you really know what you're doing. > Well I tried first leaving those lines at their default value. According to the openldap documentation: "The scope defaults to sub, the filter defaults to (objectclass=*), attrs defaults to "*,+" to replicate all user and operational attributes, and attrsonly is unset by default." I try this in the consumer: syncrepl rid=123 provider=ldap://10.140.209.254:389 type=refreshOnly interval=00:00:00:01 searchbase="dc=example,dc=org" schemachecking=off bindmethod=simple binddn="cn=admin,dc=example,dc=org" credentials="secret" Then I check the slapd.con file: # slaptest /etc/ldap/slapd.conf: line 152: rootdn is always granted unlimited privileges. /etc/ldap/slapd.conf: line 174: rootdn is always granted unlimited privileges. config file testing succeeded Then I restart: # /etc/init.d/slapd restart I see this in the logfile slapd[22700]: slapd starting slapd[22700]: syncrepl_entry: rid=123 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) slapd[22700]: syncrepl_entry: rid=123 inserted UUID ead90d7a-c02b-102c-8c00-cb58049f9ef6 slapd[22700]: syncrepl_entry: rid=123 be_search (32) slapd[22700]: syncrepl_entry: rid=123 dc=example,dc=org slapd[22700]: syncrepl_entry: rid=123 be_add (0) If does the same for "cn=admin,dc=example,dc=org", "ou=users,dc=example,dc=org", "ou=groups,dc=groups,dc=org","ou=postfix,dc=example,dc=org", "ou=alias,ou=postfix,dc=example,dc=org","cn=vmail,ou=groups,dc=example,dc=org" and finally I get this message: slapd[22700]: syncrepl_message_to_entry: rid=123 mods check (objectClass: value #0 invalid per syntax) slapd[22700]: do_syncrepl: rid=123 quitting When I try with ldapsearch (from the consumer to the provider, the provider IP is 10.140.200.3): # ldapsearch -D "cn=admin,dc=example,dc=org" -W -x -h 10.140.200.3 objectClass=* attr=*,+ it does return all entries: # numResponses: 705 # numEntries: 704 As additional information, when I do slapcat, I get this (apart from the objects that were created before, as I said): dn: objectClass: top objectClass: dcObject objectClass: organization o: corp.example.org dn: objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin I think this objects are there as a result of starting slapd in the first moment with a wrong configuration file (for example, the suffix line was incorrectly set to corp.example.com insted of example.com). But I don't know how to delete those entries. And I also don't know if this is affecting to the correct behaviour of the replication. > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 1

Just organizationalUnits objects copied doing sync replication
by Yeray Gutiérrez Cedrés 13 Aug '09

13 Aug '09

I'm trying to replicate an openldap database from a consumer like this: index objectClass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 To a provider like this: index objectClass,entryCSN,entryUUID eq syncrepl rid=123 provider=ldap://10.140.200.3:389 type=refreshOnly interval=00:00:00:01 searchbase="dc=example,dc=org" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=admin,dc=example,dc=org" credentials="mypassword" The provider database is completely emtpy and I want the provider to copy the whole database. The only objects that are copied are the organizationalUnit class objects. The objects that are "under" the organizationalUnits (like for example a 'person' objetct) are not being copied. What could be the reason for that? Regards.

2 1

syncrepl findbase failed! 32 errors
by Barry Colston 12 Aug '09

12 Aug '09

I'm running OpenLDAP 2.4.17 with 3 servers configured in multi-master mode (server 1 replicates to server 2 and server 3, server 2 replicates to server 1 and server 3, and server 3 replicates to server 1 and server 2). While executing shell scripts to test replication, all 3 slapd instances began returning error code 32 to all requests. No information could be retrieved from any of the 3 LDAP servers using ldapsearch, Apache Directory Studio, LDAP Administrator tool, or the LDAP Browser tool. The slapd log records with debug level = sync contained numerous "findbase failed! 32" errors. Starting and restarting the slapd instances still resulted in error code 32 being returned for any LDAP request. I had to restore the LDAP databases to be able to view/update records in any of the 3 LDAP databases. Server 1 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3892 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3893 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Server 2 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3893 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Server 3 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3892 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Snippets from log file from server 1 around the slapd error 32 problem time: syncprov_sendresp: to=002, cookie=rid=001,sid=001,csn=20090811143737.466654Z#000000#001#000000 syncprov_sendresp: to=003, cookie=rid=001,sid=001,csn=20090811143737.466654Z#000000#001#000000 slap_queue_csn: queing 0xa2452d98 20090811143737.567781Z#000000#001#000000 syncprov_sendresp: to=002, cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa17098a8 20090811143737.567781Z#000000#001#000000 syncprov_sendresp: to=003, cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 connection_input: conn=456 deferring operation: binding findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 connection_input: conn=461 deferring operation: binding Snippets from log file from server 2 around the slapd error 32 problem time: slap_queue_csn: queing 0xa1709520 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa1709650 20090811143737.567781Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (32) do_syncrepl: rid=001 rc 32 retrying (59 retries left) syncprov_sendresp: to=003, cookie=rid=002,sid=002,csn=20090811143737.567781Z#000000#001#000000 do_syncrep2: cookie=rid=002,sid=003,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=002 be_search (32) syncrepl_entry: rid=002 (null) slap_queue_csn: queing 0xa1714320 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa1716558 20090811143737.567781Z#000000#001#000000 do_syncrepl: rid=002 rc 32 retrying (59 retries left) findbase failed! 32 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=001 (32) No such object do_syncrepl: rid=001 rc -2 retrying (59 retries left) do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 rc -2 retrying (59 retries left) findbase failed! 32 Snippets from log file from server 3 around the slapd error 32 problem time: slap_graduate_commit_csn: removing 0x835e498 20090811143737.466654Z#000000#001#000000 do_syncrep2: cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=001 be_search (0) syncrepl_entry: rid=001 dc=authentx slap_queue_csn: queing 0xa160ee80 20090811143737.567781Z#000000#001#000000 syncprov_matchops: skipping original sid 001 slap_graduate_commit_csn: removing 0xa16134f8 20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=001 be_delete dc=authentx (0) slap_queue_csn: queing 0xa160ee80 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa16134f8 20090811143737.567781Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (32) do_syncrepl: rid=001 rc 32 retrying (59 retries left) syncprov_sendresp: to=002, cookie=rid=002,sid=003,csn=20090811143737.567781Z#000000#001#000000 do_syncrep2: cookie=rid=002,sid=002,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=002 be_search (32) syncrepl_entry: rid=002 (null) slap_queue_csn: queing 0x8338688 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0x8360318 20090811143737.567781Z#000000#001#000000 do_syncrepl: rid=002 rc 32 retrying (59 retries left) do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 rc -2 retrying (59 retries left) findbase failed! 32 I have been unable to reproduce this problem. Any suggestions on how to prevent this problem from occurring and how to recover when this problem occurs? Thanks, Barry Colston

2 3

Changing the top object
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

In the slapd.conf file of a provider server I have the following suffix parameter: suffix "dc=example,dc=org" And with slapcat I see the followind: dn: dc=example,dc=org objectClass: top objectClass: dcObject objectClass: organization o: example.org dc: example structuralObjectClass: organization entryUUID: ead90d7a-c02b-102c-8c00-cb58049f9ef6 creatorsName: modifiersName: createTimestamp: 20080527112930Z modifyTimestamp: 20080527112930Z entryCSN: 20080527112930.000000Z#000000#000#000000 I wanted to set a consumer but I set the suffix parameter wrong: suffix "dc=corp,dc=example,dc=org" So this was created: dn: objectClass: top objectClass: dcObject objectClass: organization o: corp.example.org dc: corp structuralObjectClass: organization entryUUID: 29af5532-1abb-102e-9f19-896497a83f9b creatorsName: createTimestamp: 20090811120636Z entryCSN: 20090811120636.425151Z#000000#000#000000 modifiersName: modifyTimestamp: 20090811120636Z Is there any way to change this? I also don't know why the dn in the second case is empty (I thought it should be dc=corp,dc=example,dc=org). If this can't be easily fixed, is there any way of starting from scratch? Regards.

4 13

RE: syncrepl findbase failed! 32 errors
by Quanah Gibson-Mount 12 Aug '09

12 Aug '09

--On Wednesday, August 12, 2009 3:29 PM -0400 Barry Colston <bcolston(a)xtec.com> wrote: > BDB 4.6.21. I'm checking with the person who built BDB/LDAP to see what > patches have been applied. > Please keep replies on the list, thanks. :) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

unique
by Márcio Luciano Donada 12 Aug '09

12 Aug '09

Hi, Currently I'm using the unique to the mail, but I would also add other attributes, is this possible? overlay unique unique_uri ldap:///?mail?sub? -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 1

Entry not listed when requesting all entries with ldapsearch
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

I've added a new entry with ldapadd like this: I've got this in a file (myfile.ldif): dn: mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com cn: Mr Someone mail: someone(a)example.com maildrop: someone(a)corporative.example.com sn: Boss objectClass: CourierMailAlias objectClass: person objectClass: top objectClass: inetOrgPerson $>ldapadd -D "cn=admin,dc=example,dc=com" -w secret -x -h "localhost" -f myfile.ldif I can see it if I search specifically for it with ldapsearch (no problem with this): $> ldapsearch -x -b "mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com" # extended LDIF # # LDAPv3 # base <mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # someone(a)example.com, alias, postfix, someone.com dn: mail=someone(a)example.com,ou=alias,ou=postfix,dc=someone,dc=com cn: Mr Someone mail: someone(a)example.com sn: Boss objectClass: CourierMailAlias objectClass: person objectClass: top objectClass: inetOrgPerson maildrop: someone(a)corporative.example.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Howerver, when I try to search for this entry with ldapsearch I can't see it if I list all the entries: $> ldapsearch -x -b "ou=alias,ou=postfix,dc=example,dc=com" | grep "someone" $> I have some other entries that were previously there and they are all listed. It's very extrange that in the complete list the new etnry doesn't get listed. Any idea? Regards.

2 1

openldap 2.4.16, rwm, syncrepl
by mkappe 12 Aug '09

12 Aug '09

Hello everybody, I'm front a problem with my openldap 2.4.16 server and i hope you can give me help to solve it. The problem is the following one: I use a schema for email addresses but i need to make it compliant with another one. I found some matching fields from my current model to the other one but i wouldn't like to duplicate them or define a schema for the new model. I tried to use rwm module in this way: include /usr/local/../schema/core.schema include /usr/local/../schema/cosine.schema include /usr/local/../schema/inetorgperson.schema include /usr/local/../schema/my_email.schema ... ... database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxx directory /openldap/data/mydomain index objectClass,uid eq index entryCSN eq index entryUUId eq overlay rwm rwm-map attribute myemail theNewEmail rwm-map attribute mypassword theNewPassword ... Searching for theNewEmail in dc=mydomain,dc=it nothing appears. What do i wrong? Another question: are there any problem if i use rwm overlay in a delta-syncrepl mode? Thank you! M.

1 0

OpenLDAP Virtual File System
by Jon Rascal 12 Aug '09

12 Aug '09

Hi, I want to create a virtual file system where metadata is stored in an LDAP repository. Metadata includes owner, mod-time, create-time, access-control-lists, pysical file path, and, of course, LDAP's hierarchy instead of a file-system directory base. Files are to be stored on physical medium and (preferably pyton) code used to bridge the request (over https), the metadata, and the physical file stream. Users and Keys are also stored in the LDAP directory. Is this a bad use for LDAP? I'm also looking for an LDAP guru to consult for this particular project. JR

2 1

LDAP stopping without apparent reason
by Márcio Luciano Donada 11 Aug '09

11 Aug '09

Hi list, We have a service ldap, version 2.4.11-1, debian lenny, but the times have been falling and does not even have a message in the log about the fall of it. Use it for e-mail service, jabber, ftp, and website. In the logs I have the following message: Aug 8 09:34:41 ldap slapd[15338]: connection_input: conn=1332300 deferring operation: binding Aug 8 09:34:42 ldap slapd[15338]: connection_input: conn=1332301 deferring operation: binding Aug 8 09:47:46 ldap slapd[15338]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 My configuration allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/authldap.schema include /etc/ldap/schema/RADIUS-LDAPv3.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 1024 modulepath /usr/lib/ldap moduleload back_hdb TLSVerifyClient demand TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem tool-threads 16 threads 32 backend hdb database hdb suffix "dc=auroraalimentos,dc=com,dc=br" rootdn "cn=suporte,dc=auroraalimentos,dc=com,dc=br" rootpw secret directory "/var/lib/ldap" idletimeout 30 timelimit 320 schemacheck on checkpoint 1024 5 cachesize 100000 dbconfig set_cachesize 0 2097152 0 lastmod on sizelimit unlimited index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uniqueMember eq index uidNumber eq index gidNumber eq index memberUID eq index mailAlternateAddress eq index MailForwardingAddress eq index mail pres,eq index default sub index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index sambaSIDList,sambaGroupType eq index givenName eq access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * none access to * by self write by users read by * read when the service to have a big problem, mainly because the e-mail service is affected. thanks -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 10

ppolicy and ACLs of pwdAccountLockedTime?
by Jiri Bohac 11 Aug '09

11 Aug '09

Hi, I am having troubles making the ppolicy overlay to prevent password guessing attacks with pwdLockout with slapd-2.4.11-1 in Debian Lenny. I set pwdMaxFailure to 3. In the user object I am testing with, I never get more than two entries for pwdFailureTime and pwdAccountLockedTime is never added at all. I tracked the problem down to the ACL settings in slapd.conf. With my default access to * by dn="cn=admin,dc=example,dc=net" write by * read , I get the above result. When I rewrite the last line to "by * write", it works. The pwdFailureTime is updated, because it is defined as NO-USER-MODIFICATION, which bypasses te ACL checks for write. The problem happens when pwdMaxFailure failed logins are reached, and ppolicy.c tries to update pwdFailureTime and pwdAccountLockedTime in a single request. How is this supposed to work? - Shouldn't pwdAccountLockedTime also be defined with NO-USER-MODIFICATION? - couldn't the update request in ppolicy.c be executed with higher privileges? I tried to set up an non-anonymous bind in pam_ldap but this did not help. - is there some recommended ACL setting to grant the necessary privileges so that ppolicy.c can update pwdAccountLockedTime, but users can't? I am a splapd newbie, so maybe I don't see something obvious, but in the log below, I see: "acl_mask: to all values by "", (=0)" -- that looks like an anonymous bind, right? Allowing write for the pwdAccountLockedTime attribute to anyone does not seem a good idea ;-) Thanks for any insight! Jiri P.S.: some detailed notes from my debugging are attached below: I am authenticating with pam-ldap. When I mis-type the password of a user and do a search on the user object (with a +, to see the operational attributes), the pwdFailureTime is created. This is good. When I preform the bad login again, I get a second value for pwdFailureTime. Still good. But on the next login, instead of getting a third value for pwdFailureTime and an updated value for pwdAccountLockedTime, nothing happens. I put some more debug info into ppolicy_bind_response() like this: ----- * We only count those failures * which are not due to expire. */ Debug(LDAP_DEBUG_ANY, "xxx: counting pwdFailureTime %i/%d\n", i, fc, 0); } } if ((ppb->pp.pwdMaxFailure > 0) && (fc >= ppb->pp.pwdMaxFailure - 1)) { Debug(LDAP_DEBUG_ANY, "xxx: trying to insert pwdAccountLockedTime\n", 0, 0, 0); ----- ... in the logs (with loglevel 65535), I really see: ------ Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 0/1 Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 1/2 Aug 8 00:05:42 localhost slapd[15416]: xxx: trying to insert pwdAccountLockedTime [snip] Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: delete access to "uid=j.bohac,ou=users,dc=example,dc=net" "pwdAccountLockedTime" requested Aug 8 00:05:42 localhost slapd[15416]: => acl_get: [2] attr pwdAccountLockedTime Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: result not in cache (pwdAccountLockedTime) Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: access to entry "uid=j.bohac,ou=users,dc=example,dc=net", attr "pwdAccountLockedTime" requested Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: to all values by "", (=0) Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: cn=admin,dc=example,dc=net Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: * Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] applying read(=rscxd) (stop) Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] mask: read(=rscxd) Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: delete access denied by read(=rscxd) Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: no more rules ------

2 1

ldapsearch is not able to show Japanese chars
by anish patil 11 Aug '09

11 Aug '09

Hi All, I am using openldap-2.4.11 I have added localized that is japaneese use names into ldap database .Format(ldif) that i have used was UTF-8. However when i run ladearch it shows me invalid values in dn and uid filed. I want there values in localized format? how can i achieve this ? Thanks in advance -- Anish Patil -- Anish Patil

2 3

Phpldapadmin + openldap - is not registering new users
by Édnei Rodrigues 10 Aug '09

10 Aug '09

Good morning. I have OpenLdap 2.4.12 and phpldapadmin 1.0.1.. My problem is occuring when i try register a new user. Follow error: *O servidor LDAP respondeu: Object class violation Erro número: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Descrição: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass.* And /var/log/messages: *Aug 10 07:58:11 webs slapd[3426]: Entry (cn=cyrusadmin cyrusadmin,ou=People,dc=novohamburgo,dc=rs,dc=gov,dc=br): object class 'posixAccount' requires attribute 'gidNumber'* This is stranger. In the PhpLdapAdmin, the fill gidNumber is blank, don't have option for change. What's happening ? My sladp.conf: *include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/yast.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/openldap/modules moduleload back_hdb moduleload autoPosixIds sizelimit 500 tool-threads 1 backend hdb access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read loglevel -1 database bdb suffix "dc=novohamburgo,dc=rs,dc=gov,dc=br" checkpoint 1024 5 cachesize 30000 sizelimit -1 rootdn "cn=Manager,dc=novohamburgo,dc=rs,dc=gov,dc=br" rootpw {SSHA}GS89uCsqQaeBuBQ+RoxgDuY6hkg2946U* *directory /var/lib/ldap overlay autoPosixIds index objectClass eq index uid eq index memberUid eq index member eq dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30* Thanks!

2 1

Trouble with slapd-ldap in various scenarios (LdarErr: DSID-0C090627)
by Martin Rubáš 10 Aug '09

10 Aug '09

Hello, I'm evaluating OpenLDAP and I've got cornered with slapd-ldap combined together with slapd-relay or slapo-translucent. First of all, I would like to mention that I read man pages back and forth. I also read archives of openldap.org mailing lists as well as configuration files for slapd tests. I'm still a little bit confused. The second important thing is that I don't want to enable anonymous binding at this time. Each user that access slapd is required to bind using its own DN and credentials. This statement is valid for both kind of repositories - local or remote. So, give me a chance, please... ;-) I tried several scenarios but was only partially successful. You can find more info about them below. I read about acl-bind, idassert-bind & idassert-authzFrom, mode=self but I was not able to get them working so far. I haven't used any 'authz-xxx' options yet. So, the configuration parts (below) doesn't contain only the schema includes and the config database settings. 1. What's wrong with my configuration? (cases A & B at first) I suppose that I had to use idassert-bind somehow but I don't have any idea how to do it. 2. Why is there the second connection with the strange binding request? This is probably related with question 1 but it could be an error symptom. I just want to be sure... 3. Do I have to use something else except "idassert-bind mode=self" option? I just want to bind to remote server with the proper user DN (my application is requesting data on behalf of user) and additionaly on some specific account DN (if the application is requesting data for private use). I feel that these questions could look silly, but I hope that it's better to make itself to look like fool, get advice and move forward then stand still. Thanks for any advice, Martin Rubas PS: I'm sorry for being so long... #++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Notes: ~ using slapd version 2.4.15 on Ubuntu (9.04/jaunty;64-bit;localhost) - using Windows 2003 Server as PDC (pdc.domain.net) ~ command used to query: ldapsearch -x -w secret -H ldap://localhost:389 \ -D 'CN=The Root,CN=Users,DC=domain,DC=net' \ -b 'CN=The User,CN=Users,DC=domain,DC=net' \ -s sub -a always '(objectClass=*)' ~ all used accounts (The Root, The User, The Bind & Administrator) exists in Windows domain (AD) and have set password to 'secret'. 'The Root' is also member 'Domain Admins', so it should have the same access rights as 'Administrator' (at least, for AD/LDAP operations) === Case A === I started with slapd-hdb and slapo-translucent to combine data from Active Directory repository with other data from local DB. It finally got it working but only when ldapsearch command was binding with "rootdn" from slapd-hdb configuration. But I want to do binding with the (proper) user DN to slapd (local repository) as well as to AD (remote one). #====================================================================== database hdb suffix "dc=domain,dc=net" rootdn "cn=The Root,cn=Users,dc=domain,dc=net" rootpw secret directory /var/lib/ldap/lib-trans index objectClass eq index cn eq overlay translucent uri ldap://pdc.domain.net:389 binddn "cn=The Bind,cn=Users,dc=domain,dc=net" bindpw heslo lastmod off chase-referrals true rebind-as-user true #---------------------------------------------------------------------- If I use ldapsearch -D "cn=The Root,..." -b "cn=The User,..." then slapd binds to "cn=The Bind". That's correct, I guess... But when I use some other DN for -D parameter then the response is "LdarErr: DSID-0C090627 ... " (I saw that one many time in archives). It doesn't matter if it was "cn=The User,..." or "cn=The Bind". === Case B === I also tried to combine slapd-ldap together with slapd-relay extended by slapo-rwm, to get something like "domain-alias" (2 names for one repository). #====================================================================== database ldap suffix "dc=domain,dc=net" uri ldap://pdc.domain.net:389 chase-referrals yes rebind-as-user yes database relay suffix "dc=alias,dc=net" relay "dc=domain,dc=net" overlay rwm rwm-suffixmassage "dc=domain,dc=net" #---------------------------------------------------------------------- In this case, I was able to get result with -D option set to "cn=The User,cn=Users,dc=domain,dc=net" but I got the same error while using the aliased DN "cn=The Users,cn=Users,dc=alias,dc=net". === Case C/D === Finally, I gave up and tried most simple case. Plain slapd-ldap (C) and with slapo-rwm (D). This way I've got simple bridge to AD or an alias for it. #====================================================================== database ldap suffix "dc=domain,dc=net" #for C only #D#suffix "dc=alias,dc=net" uri ldap://pdc.domain.net:389 chase-referrals yes rebind-as-user yes #D#overlay rwm #D#rwm-suffixmassage "dc=domain,dc=net" #---------------------------------------------------------------------- Whoa, it worked! One small step for me, but ... Hm, pretty useless at the whole scope :-( === Network Dump === I catched a network packets and noticed some pretty wierd thing... Each ldapsearch received "LdarErr: DSID-0C090627" there way the same scenario: 1. slapd opens the connection 2. slapd binds succefully (mostly with the credentials I wanted to use) 3. slapd opens another connection 4. slapd binds again with "nothing" (displayed as "<ROOT>" in Wireshark) 5. slapd sends request and receives LdapErr 6. slapd unbinds and closses connection from step 3 x. other requests are processed repeating step 3 to 6 #++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 0.000000 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=85650917 TSER=0 WS=6 2 0.000304 a.b.c.153 -> a.b.c.174 :: ldap > 50178 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 WS=0 TSV=0 TSER=0 3 0.000321 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=85650917 TSER=0 4 0.000455 a.b.c.174 -> a.b.c.153 :: bindRequest(1) "cn=The Root,cn=Users,dc=domain,dc=net" simple 5 0.053060 a.b.c.153 -> a.b.c.174 :: bindResponse(1) success 6 0.053086 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [ACK] Seq=77 Ack=23 Win=5888 Len=0 TSV=85650930 TSER=7278645 7 0.058317 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=85650932 TSER=0 WS=6 8 0.058604 a.b.c.153 -> a.b.c.174 :: ldap > 50179 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 WS=0 TSV=0 TSER=0 9 0.058622 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=85650932 TSER=0 10 0.058746 a.b.c.174 -> a.b.c.153 :: bindRequest(1) "<ROOT>" simple 11 0.058972 a.b.c.153 -> a.b.c.174 :: bindResponse(1) success 12 0.058992 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [ACK] Seq=15 Ack=23 Win=5888 Len=0 TSV=85650932 TSER=7278645 13 0.059158 a.b.c.174 -> a.b.c.153 :: searchRequest(2) "cn=The User,cn=Users,dc=domain,dc=net" wholeSubtree 14 0.059380 a.b.c.153 -> a.b.c.174 :: searchResDone(2) operationsError (00000000: LdapErr: DSID-0C090627, comment: ...) 15 0.098978 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [ACK] Seq=140 Ack=196 Win=6912 Len=0 TSV=85650942 TSER=7278645 16 225.873049 a.b.c.174 -> a.b.c.153 :: unbindRequest(3) 17 225.873111 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [FIN, ACK] Seq=147 Ack=196 Win=6912 Len=0 TSV=85707385 TSER=7278645 18 225.873183 a.b.c.174 -> a.b.c.153 :: unbindRequest(2) 19 225.873227 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [FIN, ACK] Seq=84 Ack=23 Win=5888 Len=0 TSV=85707385 TSER=7278645 #++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ For case A the steps 1 & 2 happens when translucent_bind action is executed (for the first time) and the step 3-6 are related to translucent_search action. I didn't check those for case B. Each successful request is processed the following way: 1. slapd opens the connection 2. slapd binds succefully (mostly with the credentials I wanted to use) 3. slapd sends request and receives the requested data 4. slapd unbinds and closses connection from step 1

2 3

Strong authentication required error
by Steinmetz, Robin 10 Aug '09

10 Aug '09

Hi, I am trying to setup a chaining configuration, all seems to work except that is i try to add/modify/del i get the message Strong auth required. Can someone help met out? Part of Chain server config: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org overlay chain chain-uri "ldap://10.253.2.7" chain-idassert-bind bindmethod="simple" binddn="xxxx" credentials="xxxxx" mode="self" chain-tls start chain-return-error TRUE access to * by * read pidfile /var/run/slapd-test-chain.pid argsfile /var/run/slapd-test-chain.args allow bind_v2 ####################################################################### # BDB database definitions ####################################################################### database bdb overlay syncprov #sessionlog 666 10000 syncprov-checkpoint 100 10 syncprov-sessionlog 100 suffix "dc=test,c=test" # Access database admin rootdn "xxxx" rootpw xxxxx syncrepl rid=444 provider=ldap://10.253.2.9:389 bindmethod=simple binddn="xxxxx" credentials=xxxx searchbase="dc=test,c=test" schemachecking=off type=refreshAndPersist retry="60 +" updateref "ldap://10.253.2.9"

2 2

Why did an index broke my config ?
by Denis BUCHER 10 Aug '09

10 Aug '09

Hello everyone, I added this in the config of my email server : > index virtualdomain eq But it broke the mail server, all emails were refused because Relaying denied. In fact postfix was not able anymore to find domains. For some reason, adding this index in the config made impossible to find this domain for programs... Don't know if my explanation is clear, but my question is "why adding an index breaks the config" ? Thanks a lot in advance for any help ! Denis

4 4

OpenLDAP + Kerberos on FreeBSD 7.2, close to working but not quite
by Allan 10 Aug '09

10 Aug '09

Hello, I've been reading around on OpenLDAP + Kerberos (FreeBSD 7.2) for authentication/authorization. I'm a bit confused on how to get it all working but I've gotten far enough that I can run getent passwd test.user and it pulls down the information from ldap (ran as root and non-root user). I can also successfully get a ticket with kinit from various users. Where I run into problems, is actually getting services to use GSSAPI. I am currently using nss_ldap and pam_ldap to authenticate during ssh login, if there's a better alternative please let me know. Here's the setup I've got: Services -> FQDN -> IP ldap/kdc -> frisbee.crazy.lan -> 192.168.1.5 ssh -> cake.crazy.lan -> 192.168.1.6 Running kinit: ============================================================== cake# kinit ldapadm ldapadm(a)CRAZY.LAN's Password: kinit: NOTICE: ticket renewable lifetime is 1 week cake# klist Credentials cache: FILE:/tmp/krb5cc_0 Principal: ldapadm(a)CRAZY.LAN Issued Expires Principal Aug 9 17:45:41 Aug 10 03:45:41 krbtgt/CRAZY.LAN(a)CRAZY.LAN ============================================================== Here's what I run to authenticate with SSH: ============================================================== cr4z3d@Allan-PC:~$ ssh -v -oGSSAPIAuthentication=yes -oGSSAPIDelegateCredentials=yes test.user(a)cake.crazy.lan OpenSSH_5.1p1 Debian-5ubuntu1, OpenSSL 0.9.8g 19 Oct 2007 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to cake.crazy.lan [192.168.1.6] port 22. debug1: Connection established. debug1: identity file /home/cr4z3d/.ssh/identity type -1 debug1: identity file /home/cr4z3d/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /home/cr4z3d/.ssh/id_dsa type 2 debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024 debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 FreeBSD-20080901 debug1: match: OpenSSH_5.1p1 FreeBSD-20080901 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'cake.crazy.lan' is known and matches the DSA host key. debug1: Found key in /home/cr4z3d/.ssh/known_hosts:47 debug1: ssh_dss_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received ============================================================== I've tried different options in /usr/local/etc/ldap.conf for pam_ldap/nss_ldap (the conf files are symlinked). The first one is with SASL turned on and the second with out. ============================================================== #define the ldap server's fqdn host frisbee.crazy.lan # define the base search pattern base dc=crazy,dc=lan # define the uri uri ldap://frisbee.crazy.lan # use starttls ssl start_tls # use sasl for all authentications use_sasl on # SASL authorization ID sasl_auth_id host/cake.crazy.lan #check the server's cert tls_checkpeer yes # full path to CA's cert tls_cacertfile /usr/local/etc/openldap/certs/cacert.pem # enable debug #debug 9 ============================================================== Here is the logs from the ldap server: ============================================================== Aug 9 17:47:21 frisbee slapd[86935]: conn=15 fd=11 ACCEPT from IP= 192.168.1.6:56955 (IP=0.0.0.0:389) Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=0 STARTTLS Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=0 RESULT oid= err=0 text= Aug 9 17:47:21 frisbee slapd[86935]: conn=15 fd=11 TLS established tls_ssf=256 ssf=256 Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=1 BIND dn="" method=163 Aug 9 17:47:21 frisbee slapd[86935]: SASL [conn=15] Failure: Couldn't find mech GSSAPI Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=1 RESULT tag=97 err=7 text=SASL(-4): no mechanism available: Couldn't find mech GSSAPI Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=2 UNBIND Aug 9 17:47:21 frisbee slapd[86935]: conn=15 fd=11 closed ============================================================== This is where I get a bit confused, it tells me that there's no mechanism for GSSAPI.. So I try changing to no SASL options in the configuration file: ============================================================== #define the ldap server's fqdn host frisbee.crazy.lan # define the base search pattern base dc=crazy,dc=lan # define the uri uri ldap://frisbee.crazy.lan # use starttls ssl start_tls #check the server's cert tls_checkpeer yes # full path to CA's cert tls_cacertfile /usr/local/etc/openldap/certs/cacert.pem # enable debug #debug 9 ============================================================== This leads to the following in the ldap logs when trying to SSH in: ============================================================== Aug 9 18:16:57 frisbee slapd[86935]: conn=87 fd=11 ACCEPT from IP= 192.168.1.6:63817 (IP=0.0.0.0:389) Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=0 STARTTLS Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=0 RESULT oid= err=0 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 fd=11 TLS established tls_ssf=256 ssf=256 Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=1 BIND dn="" method=128 Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=1 RESULT tag=97 err=0 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=2 SRCH base="dc=crazy,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=test.user))" Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire Aug 9 18:16:57 frisbee slapd[86935]: <= bdb_equality_candidates: (uid) not indexed Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=3 SRCH base="dc=crazy,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixGroup))" Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=3 SRCH attr=cn userPassword memberUid uniqueMember gidNumber Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=4 SRCH base="dc=crazy,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=test.user))" Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=4 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire Aug 9 18:16:57 frisbee slapd[86935]: <= bdb_equality_candidates: (uid) not indexed Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= ============================================================== It just keeps asking for my password and outputs the following in auth.log on the ssh server: ============================================================== Aug 9 18:36:42 cake sshd[63643]: pam_ldap: error trying to bind as user "uid=test.user,ou=people,dc=crazy,dc=lan" (Server is unwilling to perform) Aug 9 18:36:42 cake sshd[63640]: error: PAM: authentication error for test.user from 192.168.1.119 Aug 9 18:36:42 cake sshd[63644]: nss_ldap: reconnected to LDAP server ldap://frisbee.crazy.lan after 1 attempt ============================================================== So while root I tried su test.user and was surprised to see that had worked. I was able to run commands as test.user souch as touch file, but if I tried whoami it just sat there until I broke the command with ctrl+c. On the ldap server I had the following in the logs: ============================================================== Aug 9 18:49:29 frisbee slapd[86935]: conn=150 fd=15 ACCEPT from IP= 192.168.1.6:60126 (IP=0.0.0.0:389) Aug 9 18:49:29 frisbee slapd[86935]: conn=150 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:49:29 frisbee slapd[86935]: conn=150 op=0 STARTTLS Aug 9 18:49:29 frisbee slapd[86935]: conn=150 op=0 RESULT oid= err=0 text= Aug 9 18:49:29 frisbee slapd[86935]: conn=150 fd=15 closed (TLS negotiation failure) Aug 9 18:49:29 frisbee slapd[86935]: conn=151 fd=15 ACCEPT from IP= 192.168.1.6:60601 (IP=0.0.0.0:389) Aug 9 18:49:29 frisbee slapd[86935]: conn=151 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:49:29 frisbee slapd[86935]: conn=151 op=0 STARTTLS Aug 9 18:49:29 frisbee slapd[86935]: conn=151 op=0 RESULT oid= err=0 text= Aug 9 18:49:29 frisbee slapd[86935]: conn=151 fd=15 closed (TLS negotiation failure) Aug 9 18:49:29 frisbee slapd[86935]: conn=152 fd=15 ACCEPT from IP= 192.168.1.6:50915 (IP=0.0.0.0:389) Aug 9 18:49:29 frisbee slapd[86935]: conn=152 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:49:29 frisbee slapd[86935]: conn=152 op=0 STARTTLS Aug 9 18:49:29 frisbee slapd[86935]: conn=152 op=0 RESULT oid= err=0 text= Aug 9 18:49:29 frisbee slapd[86935]: conn=152 fd=15 closed (TLS negotiation failure) ============================================================== There seems to be something wrong with the TLS negotiation, but I've ensured that the CN for my key is frisbee.crazy.lan. I Set the CA's cert CN to allanfeid.com (i own the domain) At this point I'm unsure where to go to continue troubleshooting and getting this to work. I'm just trying to get a solid Single Sign-on solution using kerberos, ldap, and sasl for a learning experience. If there is a more appropriate way of acheiving this, I'm open to suggestions. Here's my ldap and slapd configuration files: (server) frisbee# cat /usr/local/etc/openldap/ldap.conf ============================================================== TLS_CACERT /usr/local/etc/openldap/certs/CA/cacert.pem ============================================================== (client) cake# cat /usr/local/etc/openldap/ldap.conf ============================================================== # path to CA's cert TLS_CACERT /usr/local/etc/openldap/certs/cacert.pem # define base to our search BASE dc=crazy,dc=lan # define uri to openldap URI ldap://frisbee.crazy.lan ============================================================== (server) frisbee# cat /usr/local/etc/openldap/slapd.conf note: i removed a lot of comments to save space ============================================================== include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/duaconf.schema include /usr/local/etc/openldap/schema/dyngroup.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/krb5-kdc.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # SSL/TLS cipher order preference TLSCipherSuite HIGH # Full path to CA cert file TLSCACertificateFile /usr/local/etc/openldap/certs/CA/cacert.pem # Full path to server's TLS cert TLSCertificateFile /usr/local/etc/openldap/certs/private/slapdcert.pem # Full path to server's TLS key TLSCertificateKeyFile /usr/local/etc/openldap/certs/private/slapdkey.pem # Password hashing mechanism password-hash {SSHA} # log level loglevel 256 # refuse simple binds disallow bind_simple ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=crazy,dc=lan" directory /var/db/openldap-data # Indices to maintain index default eq,pres index objectClass eq index cn,sn,givenname,mail eq,pres,sub # ACL Definitions authz-policy from authz-regexp uid=(.*),cn=crazy.lan,cn=GSSAPI,cn=auth uid=$1,ou=people,dc=crazy,dc=lan # SASL hostname sasl-host frisbee.crazy.lan access to * by dn="uid=ldapadm,cn=gssapi,cn=auth" write by * read access to * by * read ==============================================================

2 1

Using syncrepl in single slapd instance.
by Laurence Field 07 Aug '09

07 Aug '09

I have been investigating the use of syncrepl as a replacement for the mechanism we are currently using in our system and become stuck. Here is the scenario to put the problem in context. Within our infrastructure there is the order of 1000 Grid services each of which runs its own LDAP server that contains information about its structure and state under the DN mds-vo-name=resource,o=grid. Each institute that that operates a Grid service (in the order of 300 distributed globally), runs an LDAP server containing the consolidated information from all services within its domain under the DN mds-vo-name=site-name,o=grid. In addition, there are about 70 top-level LDAP servers distributed globally that contain the consolidated information from all sites using the DN mds-vo-name=local,o=grid. At the moment the LDAP databases are updated externally via process that polls the LDAP server for all information, which is very inefficient. Syncrepl seems to be a better mechanism to use however, I am having difficulty with one scenario. Using standard syncrepl with a relay, the site-level LDAP server can be configured with the following slapd.conf file. http://lfield.web.cern.ch/lfield/bdii-slapd.conf-basic-rep However, the site LDAP server is a Grid service and needs to publish itself. If I try to just to an LDAP add I get the following message, which I guess is due to the fact that this part of the database is now "owned" by the syncrepl process. ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral I tried to work around this problem by using another database and some more relays the result of which can be seen in the following file. http://lfield.web.cern.ch/lfield/bdii-slapd.conf However, this result with the following error, which suggests that I can't "mask" a database with a relay that points somewhere else. bdii-slapd.conf: line 69: <suffix> namingContext "Mds-Vo-name=resource,o=internal" already served by a preceding bdb database serving namingContext "Mds-Vo-name=resource,o=internal" Does anyone have an example of how to do a syncrepl where a single slapd instance can act as both the consumer and producer? Also, has anyone done any scalability/reliability tests with syncrepl? Thanks, Laurence

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical