- openldap-technical - openldap.org

OpenLDAP client authentication against JDS 6.3.1 server
by Cannon, Andrew C 02 Sep '09

02 Sep '09

Dear list members, I've been fighting with this problem on and off for 6 months now (you can see some of my queries if you Google for me...) and I cannot for the life of me figure out what is going on. We are trying to get a Fedora 9 test box to authenticate against a Solaris 10 (SPARC) Sun Java Directory Server 6.3.1 box using anonymous binding and no SSL (we are on an internal, trusted network). The JDS is running the NIS-to-LDAP script that Sun provide and can get information from the directory. The Fedora box is running OpenLDAP client (version: openldap-clients-2.4.10-2.fc9.x86_64) and can't get any infromation from the directory after I switch to LDAP authentication from NIS authentication using system-config-authentication. NIS on the Fedora box works fine, so it isn't a network issue. An extract from the access log on the server shows the following: [01/Sep/2009:11:11:24 +0100] conn=2618 op=-1 msgId=-1 - fd=47 slot=47 LDAP connection from 172.28.1.172:46682 to 172.28.1.173 [01/Sep/2009:11:11:24 +0100] conn=2618 op=0 msgId=1 - BIND dn="" method=128 version=3 [01/Sep/2009:11:11:24 +0100] conn=2618 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="" [01/Sep/2009:11:11:24 +0100] conn=2618 op=1 msgId=2 - SRCH base="ou=people,dc=example,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=dmm))" attrs="uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass" [01/Sep/2009:11:11:24 +0100] conn=2618 op=1 msgId=2 - RESULT err=0 tag=101 nentries=0 etime=0 [01/Sep/2009:11:11:42 +0100] conn=2618 op=2 msgId=0 - RESULT err=80 tag=120 nentries=0 etime=0 [01/Sep/2009:11:11:42 +0100] conn=2618 op=-1 msgId=-1 - closing from 172.28.1.172:46682 - A1 - Client aborted connection - [01/Sep/2009:11:11:42 +0100] conn=2618 op=-1 msgId=-1 - closed. [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - SRCH base="ou=hosts,dc=example=com" scope=1 filter="(&(objectClass=ipHost)(cn=lin05))" attrs=ALL [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - SORT cn uid (1) [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - VLV 0:49999:0:0 1:1 (0) [01/Sep/2009:11:12:01 +0100] conn=4 op=4166 msgId=4167 - RESULT err=0 tag=101 nentries=1 etime=0 notes=U [01/Sep/2009:11:12:25 +0100] conn=4 op=4167 msgId=4168 - SRCH base="automountkey=userf,automountmapname=auto_home,dc=example,dc=com" scope=0 filter="(objectClass=automount)" attrs=ALL [01/Sep/2009:11:12:25 +0100] conn=4 op=4167 msgId=4168 - RESULT err=0 tag=101 nentries=1 etime=0 [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - SRCH base="ou=people,dc=example=com" scope=1 filter="(&(objectClass=posixAccount)(uidNumber=254))" attrs=ALL [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - SORT cn uid (1) [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - VLV 0:49999:0:0 1:1 (0) [01/Sep/2009:11:12:28 +0100] conn=4 op=4168 msgId=4169 - RESULT err=0 tag=101 nentries=1 etime=0 notes=U Connection 2618 is from the Fedora box and is unsuccessful. Connection 4 is the NIS-to-LDAP service on the Solaris box and is successful. I have a number of questions, but, chiefly, am I actually using anonymous binding? If I need to set a bind DN, what should it be? Can I modify the search base so that it looks more like the search given in msgid 4168? I'm sorry for the newbie questions (especially about a JDS server) but I am really tearing my hair out over this. I hope some of you can help. Thanks in advance. Andy -- This email contains confidential information. The contents must not be disclosed to anyone else except with the authority of the sender. Unauthorised recipients are requested to maintain this confidentiality and immediately advise the sender of any error or misdirection in transmission. The following notice applies to emails originating in the UK. E-mails sent on behalf of AMEC are sent on behalf of the relevant AMEC company below. These are registered in England and Wales with registered office at Booths Park, Chelford Road, Knutsford, Cheshire WA16 8QZ and number as shown: AMEC plc 01675285, AMEC Group Limited 04612748, AMEC Capital Projects Limited 02804109, AMEC Earth and Environmental UK Limited 04987981, AMEC Nuclear Holdings Limited 03725076, AMEC Nuclear M & O Limited 05664844, AMEC Nuclear UK Limited 01120437, AMEC Nuclear International Limited 03260477, AMEC Nuclear Projects Limited 05664962 and National Nuclear Corporation Limited 02290928 --

1 0

Sycrepl cookie question
by Robert Hanson 01 Sep '09

01 Sep '09

(2.4.17; linux, bdb 4.5 backend; two nodes in a multi-master configuration) When I start up a slapd server, it reads the contextCSN from the database. There are some synchronization issues I'm dealing with (see the email I sent yesterday to this group). The question of the day is, what are the implications if I delete this from the database before I start up? That is: Assume that in a 2-node multi-master scenario, both sides are completely in sync. One of the nodes goes down; assume that the remaining node gets some updates. The down node comes back up. If the down node does not have this synchronization cookie, will it still sync correctly with the other node?

2 1

PADL migration tools / NIS to LDAP
by Ivan De Masi 01 Sep '09

01 Sep '09

Hello, I'm fairly new to LDAP and testing for migration (NIS to LDAP). I found the PADL migration tools http://www.padl.com/OSS/MigrationTools.html which are great and now im testing the export of data-sources to *.ldif files. When exporting the passwd-file for example, I have all system-accounts like "daemon", "bin", "sys", etc. (let's say everything with the uid below 1000) in the ldif file. Do I need this all these accounts in LDAP? I see that there is "krbName" for all exported entrys/accounts. That's good for some services and kerberos, but do I really need *all* system accounts in LDAP? Thanks! Regards, Ivan

1 0

Slow LDAP
by sgmayo＠mail.bloomfield.k12.mo.us 01 Sep '09

01 Sep '09

Is there some way to speed up LDAP? I am guessing this has to do with it searching the database on ldap? This is a new server and my old one did not take that long. It is not as slow if just one or two people are logging in with ldap, but when many login, it seems to bring ldap to a bottle neck, I guess while searching the directory for all the names. There are probably about 1000 users in my LDAP. Is that too large? I assume it isn't since most of the other schools around have AD which is basically Microsoft LDAP if I understand correctly and they have no problems and have many more users than I have. Can multiple schema's in the config file cause this? I know that on my old server I had the following in slapd.conf: core cosine inetorgperson nis samba On my new one it has the above plus: corba duaconf dyngroup java misc openldap ppolicy collective Those were just in there when I installed it so I left them. Should I take them out or would that not have any affect on logins at all? I am guessing that they wont' affect anything and it is more related to some sort of configuration in my ldap configs. Is there something else I need in a config? Here are my configs. slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema loglevel -1 sizelimit -1 allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=school,dc=bloomfield.k12.mo.us" checkpoint 1024 15 rootdn "cn=Manager,dc=school,dc=bloomfield.k12.mo.us" rootpw ***** directory /var/lib/ldap index objectClass eq index cn,sn,uid,displayName eq,pres,sub index uidNumber,gidNumber eq index memberUid eq index sambaSID,sambaPrimaryGroupSID eq index sambaDomainName eq index default sub database monitor ldap.conf SIZELIMIT 200 HOST 127.0.0.1 10.0.0.5 BASE dc=school,dc=bloomfield.k12.mo.us I have a DB_CONFIG file that contains the following, but not sure if it needs anything else or not: set_cachesize 0 268435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

3 6

Samba + ldap questions
by Allgood, John 01 Sep '09

01 Sep '09

Hey All I am having a problems with using openldap and samba. We have been having issues with samba passwords expiring and I have tried several things to resolve the issues. The ldap server was setup using the smbldap-tools. When the password expires the only thing I have been able to do is to reset the password. I have tried the smbldap-usemod -B -1 &username to disable the SambaPwdMustChange. Also tried to set the SambaAcctFlags to UX. We set this ldap server up in hurry and did not have a chance to implement a proper password policy. This is using the stock version of Samba that came with RHEL5. Best Regards John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com www.ohl.com ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 1

LDAPcon 2009
by Dieter Kluenter 01 Sep '09

01 Sep '09

Hi, the 2nd. International Conference on LDAP, LDAPcon 2009 will be held on September 20th and 21st at Waterfront Marriott Hotel, Portland. Oregon, *please register now*. http://www.symas.com/ldapcon2009/ Proceedings are available at http://www.symas.com/ldapcon2009/papers.shtml The 1st LDAPcon 2007 had been helt at Cologne, Germany, proceedings can be found here http://www.guug.de/veranstaltungen/ldapcon2007/further_readings.html The Organization Committee -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

1 0

recreating DB from ldiff
by Tihomir Culjaga 31 Aug '09

31 Aug '09

Hello, I have an issue when adding entries to DB. for some reason im getting this autput: [root@ldap]# slapadd -f /etc/openldap/slapd.conf -l /home/tculjaga/export.ldif -q -c str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=38512331810,ou=redirec" and "uniqueID=38512322963,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=1727833) str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=385138" and "uniqueID=38513899170,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=10487774) str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=38514552151,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" and "uniqueID=38514558227,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=10895623) Can someone please explain whats wrong ? also, i went to lines listed above and found nothing strange at all ... any help ?

3 7

Select subtree with access filter
by Torsten Rehn 31 Aug '09

31 Aug '09

I have a number of objects scattered around my DIT that I want to dynamically "tag" for access by a certain user by giving them a memberOf attribute pointing to that user. Now here's the fun part: Is it possible to also give that user access to the subtree starting at the "tagged" object? E.g. I have an office manager who manages a random number of rooms around the building. I assign the rooms to him via memberOf, but the rooms also have people in them that he should have access to. For that I would need something like this: access to filter.subtree="(memberOf=managerguy)" by managerguy read Is there any way to do this today? Otherwise make it a feature request :) -- Torsten Rehn

1 1

the way to calculate the cache size.
by Huynhn, Nguyen Dac 31 Aug '09

31 Aug '09

Hi All, Im tuning my LDAP DB (BDB type). Im reading at http://www.openldap.org/doc/admin24/tuning.html#Berkeley%20DB%20Cache At 21.4.1.1 #(Number of hash buckets + number of overflow pages + number of duplicate pages) * page size / 2 #The objectClass index for my example database is 5.9MB and uses 3 hash buckets and 656 duplicate pages. So: # ( 3 + 656 ) * 4KB / 2 =~ 1.3MB. #With only this index enabled, I'd figure at least a 4MB cache for this backend. (Of course you're using a single cache shared among all of the database files, so the cache pages will most likely #get used for something other than what you accounted for, but this gives you a fighting chance.) I understand that: with each index ( in this case only objectclass is indexed), we must calculate their cache size individually and sum every them. (1) - I can specify Number of hash buckets & Cache Size (2)by command Shell> db_stat-4.4 -m | head -n 25 32771 Number of hash buckets used for page location Pool file: <index>.bdb <number> page size - I can specify Number of overflow pages & Number of duplicate pages by command Shell> db_stat-4.4 -d *.bdb (3) 0 Number of tree duplicate page 0 Number of tree overflow pages (1) Did I understand right? (2) Which page size will we use, some of index file use 4K page size, others use 16K page size? (3) Do must I run for each index or *.bdb is still ok? Could anyone help me? This chapter is not clearly huh? Thank for reading

1 0

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 28 Aug '09

28 Aug '09

> Well, we'd need to see the config file for the replica as > well. > > --Quanah > Was in a previous post, but here you go.

2 11

ldapadd error while adding localized users
by anish patil 27 Aug '09

27 Aug '09

Hi all, I am trying to add localized users into ldap i.e LANG=ja_JP.SJIS while creating ldif file i am converting SJIS chars into UTF-8 format. if i give value attribute "gecos:" in ldif file in localized format I am not able add the user its giving me following error <error> additional info: gecos: value #0 invalid per syntax </error> If i am giving rest of the attributes in localized format it works fine Only problem is with gecos field can anyone tell is this the desired behavior or Am i missing something? OpenLDAP version:2.4.11 O.S: RHEL 4.3 Thanks in advance -- Anish Patil

3 3

Replicate AD User and Group accounts
by James A. Cleland 25 Aug '09

25 Aug '09

Hi, I need to simulate an Active Directory server to an LDAP client application using openldap. I am only interested in retrieving users and groups from openldap, but I need to have attributes match those in AD. I have found a number of guides on how to migrate from AD to OpenLDAP, but my application is not quite this complicated. At least I don't think it is. Here's what I've got so far. My AD server is Windows Server 2008. I have dumped ldif using ldifde: ldifde -d "CN=Users,DC=[domain],DC=com" -f export.ldif This returns me an ldif of Users and Groups, which is what I want. I have set up OpenLDAP as suggested in numerous migration docs to include core, cosine, and nis schemas. I am able to access the LDAP server and browse it using a manager DN and a clear password for now. I have attempted to import my ldif using the following: Ldapadd -H ldap://<server> -f export.ldif -x -D "cn=Manager,dc=[domain],dc=com" -W The reply from the server is: ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I believe this error is due to the second (#1) record in the ldif which is the first group and has an objectClass: group. "group" does not appear to be a defined object class in any of the aforementioned schema. Can I obtain schema for this ldif? I can't find any docs on doing this or any schema files that contain this objectClass. BTW, I am a complete LDAP newbie, so please forgive any terminology misuse, etc. Thanks!

2 1

Replace Active Directory with OpenLDAP and Others
by Serge Fonville 25 Aug '09

25 Aug '09

Both, Thanks for the info > To get a drop-in replacement for AD you probably should ask in a Samba forum; AD does a lot more than just LDAP service and you need Samba to bring all the pieces together. If you only need directory service, then we can talk about it more here. But when migrating off MS, you typically need more than just LDAP to work... I will ask there then, thanks for the tip >> I was wondering if there is an uptodate guide/tutorial/howto to >> replace Active Directory. >> I found http://www.bayour.com/LDAPv3-HOWTO.html but that was last >> updated in 2005. >> >> Also I could not find any references to people actually having >> replaced Active Directory. >> In my head it should be possible, but replacing MS products does not >> always make sense in practice. ;-) >> >> I have not yet had the time to fully work through the howto. but >> either way I will give it a try (well a couple probably) >> > There is currently no drop-in replacement for Active directory in open > source world. Samba in conjunction with LDAP gets as close as replacing > NT4.0 domain controller. This is a legacy in MS world and has it's > disadvantages over Active directory. > I recommend reading the following SAMBA docs > http://us3.samba.org/samba/docs/man/Samba-HOWTO-Collection/ > http://us3.samba.org/samba/docs/man/Samba-Guide/ I've been looking at samba a couple of times in the last couple of years. But in it's current form, it is only suitable for SMB/CIFS imho Thanks for the help and the info! Regards, Serge Fonville

2 1

Replace Active Directory with OpenLDAP and Others
by Serge Fonville 25 Aug '09

25 Aug '09

Hi, I was wondering if there is an uptodate guide/tutorial/howto to replace Active Directory. I found http://www.bayour.com/LDAPv3-HOWTO.html but that was last updated in 2005. Also I could not find any references to people actually having replaced Active Directory. In my head it should be possible, but replacing MS products does not always make sense in practice. ;-) I have not yet had the time to fully work through the howto. but either way I will give it a try (well a couple probably) Has anyone have any experience or advice with this? Thanks in advance Regards, Serge Fonville

3 2

Not able to authenticate Apache against OpenLDAP
by Michael March 24 Aug '09

24 Aug '09

I'm using Centos / RHEL 5.2 using the stock LDAP.. I'm trying to get Apache to authenicate with my LDAP server... Using other client software I can bind as the user 'bob'. Here is my Apache config: <VirtualHost *:443> ServerName addressbook-stage.acme.com AllowEncodedSlashes on ProxyPass / http://domu-140.acme.com/ ProxyPassReverse / http://domu-140.acme.com/ <Proxy *> allow from all </Proxy> <Location /> AuthType Basic AuthName "Login with your Acme ID" #AuthLDAPEnabled on AuthBasicProvider ldap AuthLDAPURL ldap://192.168.150.140:389/ou=People,dc=acme,dc=com AuthLDAPBindDN uid=root,ou=People,dc=acme,dc=com AuthLDAPBindPassword passwd #require group cn=it,ou=groups,dc=acme,dc=com require valid-user bob </Location> </VirtualHost> Here is my LDAP config: access to attrs=userPassword by anonymous auth by self write by * none # private LDAP Addressbook is readable and writable for the owner only access to dn.regex="(.*,)?ou=Contacts,uid=([^,]+),ou=People,(.*)$" by dn.regex="uid=$2,ou=People,$3" write by * none # global LDAP Addressbook is writable for all authenticated users # This entry has to be _before_ any other entry that matches the contact # tree eg. the * entry access to dn.subtree="ou=Contacts,dc=acme,dc=com" by users write by users read # The admin dn has full write access access to * by users read by peername="IP=192\.168\.150\.5" read Here is the error from from OpenLDAP: Aug 24 03:57:06 localhost slapd[23856]: conn=2 fd=14 ACCEPT from IP= 192.168.150.5:59041 (IP=0.0.0.0:389) Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=0 RESULT tag=97 err=0 text= Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=1 SRCH base="ou=People,dc=acme,dc=com" scope=2 deref=3 filter="(&(objectClass=*)(uid=bob))" Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 BIND anonymous mech=implicit ssf=0 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:06 localhost slapd[23856]: conn=2 op=2 RESULT tag=97 err=0 text= Aug 24 03:57:37 localhost slapd[23856]: conn=3 fd=17 ACCEPT from IP= 192.168.150.5:59042 (IP=0.0.0.0:389) Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=0 BIND dn="uid=root,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=0 RESULT tag=97 err=0 text= Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=1 SRCH base="ou=People,dc=acme,dc=com" scope=2 deref=3 filter="(&(objectClass=*)(uid=bmason))" Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 BIND anonymous mech=implicit ssf=0 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" method=128 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 BIND dn="uid=bob,ou=People,dc=acme,dc=com" mech=SIMPLE ssf=0 Aug 24 03:57:37 localhost slapd[23856]: conn=3 op=2 RESULT tag=97 err=0 text= -- <admiral> Michael F. March ----- mmarch(a)gmail.com Ph: (415)462-1910 ---- Fax: (602)296-0400 P.O. Box 2254 ---- Phoenix, AZ 85002-2254 "Seriously" - HSR

5 6

Cannot dynamically delete olcOverlay configuration object
by Barry Colston 24 Aug '09

24 Aug '09

As part of an emergency failover situation, I was attempting to change a syncrepl provider to a syncrepl consumer. When I tried to delete the "olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config" object, I received a "Server is unwilling to perform (53)" error. Can this be accomplished dynamically or do I have to make the changes while slapd is not executing? Barry Colston

2 1

master-slave replication woes
by charles 24 Aug '09

24 Aug '09

{i'm sorry if this a duplicated} i've "successfully" set up replication in a master-slave orientation, with persistent replication; the consumer receives database changes as they are made to the master. i initialize the consumer database using a ldif created on the provider: *"* *slapcat -b dc=murphy,dc=bz-v -l transfer.ldif" * it has been functional for the past three weeks.for the most part it works, entries are updated immediately. however, twice the data entires within all organizational units have been deleted and about four times either the syncuser or the admin cn's have been deleted from the consumer. i'm about to start over and entirely reconfigure the consumer. i'd appreciate any feedback on anything that needs adjusting in my configuration or any gotchas. specifically - is my syncrepl directive accurate? - in initial configuration (dpkg) should i setup a different database than the one i intend to replicate? both consumer and provider are running openldap 2.4.15-1ubuntu3 thanks. provider's configuration: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=murphy,dc=bz olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" read by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" read by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: entryCSN,entryUUID eq structuralObjectClass: olcHdbConfig entryUUID: e1dbc798-0ac2-102e-9977-37c480b68b78 creatorsName: cn=admin,cn=config createTimestamp: 20090722042133Z olcLimits: {0}dn.exact="cn=syncuser,dc=murphy,dc=bz" time.soft=unlimited time. hard=unlimited size.soft=unlimited size.hard=unlimited entryCSN: 20090806001008.586987Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090806001008Z dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: e1da8df6-0ac2-102e-996f-37c480b68b78 creatorsName: cn=config createTimestamp: 20090722042133Z entryCSN: 20090805014105.909778Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090805014105Z dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: c94c1ab2-15ac-102e-8886-213db5dc8256 creatorsName: cn=admin,cn=config createTimestamp: 20090805014105Z entryCSN: 20090805014105.945605Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090805014105Z consumer's configuration: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=murphy,dc=bz olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=murphy,dc=bz" write by dn="cn=syncuser,dc=murphy,dc=bz" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: entryCSN,entryUUID eq structuralObjectClass: olcHdbConfig entryUUID: ac0c4eee-1c74-102e-8275-a73f90e057e6 creatorsName: cn=admin,cn=config createTimestamp: 20090813164703Z olcRootDN: cn=admin,dc=murphy,dc=bz olcSyncrepl: {0}rid=16 provider=ldaps://marcos.murphy.bzbinddn="cn=syncuser,dc=murphy,dc=bz" bindmethod=simple credentials=replication searchbase="dc=murphy,dc=bz" scope=sub type=refreshAndPersist interval=00:00:20:00 retry="10 5 3 00 5" entryCSN: 20090813183713.024346Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090813183713Z dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: ac04c368-1c74-102e-826d-a73f90e057e6 creatorsName: cn=config createTimestamp: 20090813164703Z entryCSN: 20090813183712.967024Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090813183712Z dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 10653536-1c84-102e-9258-bf448f0d99c4 creatorsName: cn=admin,cn=config createTimestamp: 20090813183714Z entryCSN: 20090813183714.001905Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20090813183714Z -- Charles Belmopan, Belize "... we just love cars and we love driving them!" http://www.cardomain.com/ride/2400106

2 2

top-level data entries not replicating, 2.4.15
by Brian Neu 24 Aug '09

24 Aug '09

Even with no logfilter on the consumer, cn=replicator,dc=domain,dc=com & sambaDomainName=SRG,dc=domain,dc=com don't replicate, even after wiping the database and restarting. Everything else seems to replicate fine. How do I get top-level data entries to replicate?

2 4

Password policy
by Aravind M D 23 Aug '09

23 Aug '09

Hi All, Can anyone provide me check_password.so with cracklib. I tried to compile check_password.c but its giving me a lot of error. Regards, Aravind M D

1 0

ldap search filters and groups..
by Michael March 23 Aug '09

23 Aug '09

First, can anyone recommend a good link or book on ldap search filters? I have a few books on LDAP ("Deploying OpenLDAP" from Apress and the O'reilly LDAP book) and they devote less than a page to the topic. There doesn't seem to be a ton of info on the Google about it either. What am I overlooking? What I'm trying to do is create a search filter so when I search a certain tree for all DNs the result will return only DNs that are members of a certain "groupOfNames" group. Is that possible? thanks!

2 1

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 21 Aug '09

21 Aug '09

--- On Fri, 8/21/09, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > From: Quanah Gibson-Mount <quanah(a)zimbra.com> > Subject: Re: top-level data entries not replicating, 2.4.15, now 2.4.17 > To: "Brian Neu" <proclivity76(a)yahoo.com>, openldap-technical(a)openldap.org > Date: Friday, August 21, 2009, 12:05 PM > --On Friday, August 21, 2009 8:52 AM > -0700 Brian Neu <proclivity76(a)yahoo.com> > wrote: > > > I really only created the test2 record to find out why > the > > > > sambaDomainName=SRG,dc=srg,dc=com > > > > record wasn't replicating. > > > > This entry won't replicate either, even with a cn > attribute . . . > > dn:cn=test3,dc=srg,dc=com > > objectclass: top > > objectclass: person > > userpassword:blah > > sn:test3 > > cn:test3 > > Please don't top post. > > Your config is a little... odd. You have per-db > access rules, and yet you break them like you expect more: > > database hdb > suffix "cn=accesslog" > ... > access to * > by dn.base="cn=replicator,dc=srg,dc=com" > read > by * break > > > Not that this hurts anything, but it is a weird read. > > Also, I don't see *any* access rules on the main DB. > You have: > > database hdb > suffix > "dc=srg,dc=com" > .... > database monitor > access to * > by dn.exact="cn=Manager,dc=srg,dc=com" > write > by > dn.exact="uid=root,ou=People,dc=srg,dc=com" write > by dn.base="cn=replicator,dc=srg,dc=com" > read > by * break > > > Which means you just gave a lot of access to the *monitor* > database but not your *primary* database. I suggest go > re-read the slapd.access(5) man page. If you want > global ACLs, they need to come before any "database xyz" > line. If you want per-db ACLs, which I think is what > you're trying to do, then you need to do them > *per-db*. Not the odd acl in accesslog, none in your > main db, and some for your monitor database. > > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and > collaboration OK, my sloppy ACL is cleaned up and makes much more sense now -- but the problem remains.

2 1

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 21 Aug '09

21 Aug '09

I compiled new rpms and upgraded to 2.4.17 on both the provider and consumer. The problem persists. New entries like: dn:cn=test2,dc=srg,dc=com objectclass: top objectclass: person userpassword:blah sn:test2 don't replicate. But other entries do, like: dn: uid=user1,ou=People,dc=srg,dc=com uid: user1 cn: Advanced Open Systems objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: shadowLastChange: 14441 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5000 gidNumber: 5000 homeDirectory: /home/user1 gecos: Advanced Open Systems I've attached the slapd.conf for the master/provider. Thank you in advance for any assistance. --- On Thu, 8/20/09, Brian Neu <proclivity76(a)yahoo.com> wrote: > From: Brian Neu <proclivity76(a)yahoo.com> > Subject: Re: top-level data entries not replicating, 2.4.15 > To: "Jonathan Clarke" <jonathan(a)phillipoux.net> > Cc: openldap-technical(a)openldap.org > Date: Thursday, August 20, 2009, 8:39 AM > Forgive me if pasting here is bad > etiquette. > > > <consumer slapd.conf> > > include > /etc/openldap/schema/corba.schema > include > /etc/openldap/schema/core.schema > include > /etc/openldap/schema/cosine.schema > include > /etc/openldap/schema/duaconf.schema > include > /etc/openldap/schema/dyngroup.schema > include > /etc/openldap/schema/inetorgperson.schema > include > /etc/openldap/schema/java.schema > include > /etc/openldap/schema/misc.schema > include > /etc/openldap/schema/nis.schema > include > /etc/openldap/schema/openldap.schema > include > /etc/openldap/schema/ppolicy.schema > include > /etc/openldap/schema/collective.schema > include > /etc/openldap/schema/samba.schema > > allow bind_v2 > > pidfile > /var/run/openldap/slapd.pid > argsfile > /var/run/openldap/slapd.args > > TLSCACertificateFile /etc/openldap/cacerts/cavictory2.crt > TLSCertificateFile /etc/openldap/keys/victory3cert.pem > TLSCertificateKeyFile /etc/openldap/keys/victory3key.pem > > database hdb > suffix "dc=srg,dc=com" > checkpoint 1024 15 > rootdn > "cn=Manager,dc=srg,dc=com" > > rootpw {MD5}blah > > directory /var/lib/ldap > > index objectClass > eq,pres > index ou,cn,mail,surname,givenname > eq,pres,sub > index uidNumber,gidNumber,loginShell eq,pres > index uid,memberUid > eq,pres,sub > index nisMapName,nisMapEntry > eq,pres,sub > > syncrepl rid=0 > > provider=ldap://victory2.srg.com:389 > bindmethod=simple > starttls=critical > > binddn="cn=replicator,dc=srg,dc=com" > credentials=blah > searchbase="dc=srg,dc=com" > logbase="cn=accesslog" > schemachecking=on > type=refreshAndPersist > retry="60 +" > syncdata=accesslog > > updateref > ldaps://victory2.srg.com > > database monitor > > access to * > by > dn.exact="cn=Manager,dc=srg,dc=com" write > by * none > > </consumer slapd.conf> > > > --- On Thu, 8/20/09, Jonathan Clarke <jonathan(a)phillipoux.net> > wrote: > > > From: Jonathan Clarke <jonathan(a)phillipoux.net> > > Subject: Re: top-level data entries not replicating, > 2.4.15 > > To: "Brian Neu" <proclivity76(a)yahoo.com> > > Cc: openldap-technical(a)openldap.org > > Date: Thursday, August 20, 2009, 8:02 AM > > On 19/08/2009 19:29, Brian Neu > > wrote: > > > Even with no logfilter on the consumer, > > > > > cn=replicator,dc=domain,dc=com& > > > > > sambaDomainName=SRG,dc=domain,dc=com > > > > > > don't replicate, even after wiping the database > and > > restarting. Everything else seems to replicate > fine. > > > > > > How do I get top-level data entries to > replicate? > > > > This really depends on your syncrepl configuration on > the > > consumer. > > If you provide it here, maybe we can take a look. > > > > Aside from that, the latest version, 2.4.17, contains > a few > > fixes that > > might help with this problem. > > > > Jonathan > > >

3 3

errors when trying to modify olcAttributeTypes
by Alexander 'Leo' Bergolth 21 Aug '09

21 Aug '09

Hi! I'd like to slightly change the attribute definition of olcDbConfig by modifying olcAttributeTypes in cn=schema,cn=config with openldap-2.4.16. I tried to apply the modification using two different ways, both failing with different errors: 1) Delete the old attribute value and adding the new one: --------------------------------------------------------- $ ldapmodify -xvW -h bach-s49 -D cn=Manager,cn=config -f cn-schema-olcAttributeTypes-add-del.ldif ldap_initialize( ldap://bach-s49 ) Enter LDAP Password: delete olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONFIG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) add olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONFIG configuration directives' SYNTAX OMsIA5String EQUALITY CaseExactIA5Match X-ORDERED 'VALUES' ) modifying entry "cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: olcAttributeTypes: Duplicate attributeType: "" Apache DirectoryStudio shows a little bit more info: #!ERROR [LDAP: error code 80 - olcAttributeTypes: Duplicate attributeType: "?? 6.1.4.1.4203.1.12.2.3.2.1.3"] dn: cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONF IG configuration directives' EQUALITY caseExactIA5Match SYNTAX OMsIA5String X -ORDERED 'VALUES' ) - delete: olcAttributeTypes olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONF IG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) - 2) Replace all olcAttributeTypes-attributes: -------------------------------------------- $ ldapmodify -xvW -h bach-s49 -D cn=Manager,cn=config -f cn-schema-olcAttributeTypes-repl.ldif ldap_initialize( ldap://bach-s49 ) Enter LDAP Password: replace olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: structural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which object was last modified' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creator' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has children' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change sequence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change sequence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syncrepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the largest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512: alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RFC4512: naming contexts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC 'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC 'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' DESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC4512: features supported by the server' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'monitor context' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'config context' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of implementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version of implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: administrative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE directoryOperation ) ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtree specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE directoryOperation ) ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT structure rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.17 USAGE directoryOperation ) ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT content rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.16 USAGE directoryOperation ) ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.30 USAGE directoryOperation ) ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute types' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 USAGE directoryOperation ) ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object classes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.37 USAGE directoryOperation ) ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.35 USAGE directoryOperation ) ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching rule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.31 USAGE directoryOperation ) ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.54 USAGE directoryOperation ) ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) DESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subordinate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE distributedOperation ) ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL entry pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' ) DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFrom' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589: entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'RFC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common supertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of name attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common name(s) for which the entity is known by' SUP name ) ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'RFC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An integer uniquely identifying a user in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An integer uniquely identifying a group in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Uniform Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related object' SUP distinguishedName ) ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd configuration directives' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for slapd configuration backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs against content of Add ops' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of deprecated features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd command line options' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP attributeTypes' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBLINGS' ) ( OLcfgGlAt:10 NAME 'olcConcurrency' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:11 NAME 'olcConnMaxPending' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type for a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' ) ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP DIT content rules' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:17 NAME 'olcGentleHUP' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:0.17 NAME 'olcHidden' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:18 NAME 'olcIdleTimeout' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI ) ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:84 NAME 'olcIndexIntLen' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.4 NAME 'olcLastMod' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldapSyntax' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:26 NAME 'olcLocalSSF' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:27 NAME 'olcLogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.16 NAME 'olcMirrorMode' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:31 NAME 'olcModulePath' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:0.18 NAME 'olcMonitoring' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP object classes' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-VALUE X-ORDERED 'SIBLINGS' ) ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:37 NAME 'olcPidFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:39 NAME 'olcPluginLogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:40 NAME 'olcReadOnly' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-VALUE ) ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY caseIgnoreMatch X-ORDERED 'VALUES' ) ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:49 NAME 'olcReverseLookup' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedNameMatch SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:0.9 NAME 'olcRootPW' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:53 NAME 'olcSaslHost' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:54 NAME 'olcSaslRealm' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:56 NAME 'olcSaslSecProps' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedNameMatch SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgGlAt:60 NAME 'olcSizeLimit' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose values will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:0.15 NAME 'olcSubordinate' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNameMatch SYNTAX OMsDN ) ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgGlAt:66 NAME 'olcThreads' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgGlAt:67 NAME 'olcTimeLimit' SYNTAX OMsDirectoryString ) ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:74 NAME 'olcTLSRandFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgGlAt:80 NAME 'olcToolThreads' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUALITY caseIgnoreMatch ) ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for database content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'monitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'monitor managed info' SUP name ) ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'monitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DESC 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DESC 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzDN' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalAddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAddress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC 'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC 'name of overlays defined for a given database' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/write status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' DESC 'name of restricted operation for a given database' SUP managedInfo ) ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProtocol' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsReceived' DESC 'monitor number of operations received by the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsExecuting' DESC 'monitor number of operations in execution within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPending' DESC 'monitor number of pending operations within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCompleted' DESC 'monitor number of operations completed within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet' DESC 'number of times connection_get() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead' DESC 'number of times connection_read() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite' DESC 'number of times connection_write() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask' DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListener' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerDomain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStartTime' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActivityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC 'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC 'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE dSAOperation ) ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig' DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) ( OLcfgDbAt:1.11 NAME 'olcDbCacheFree' DESC 'Number of extra entries to free when max is reached' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.1 NAME 'olcDbCacheSize' DESC 'Entry cache size in entries' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.2 NAME 'olcDbCheckpoint' DESC 'Database checkpoint interval in kbytes and minutes' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:1.16 NAME 'olcDbChecksum' DESC 'Enable database checksum validation' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.13 NAME 'olcDbCryptFile' DESC 'Pathname of file containing the DB encryption key' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:1.14 NAME 'olcDbCryptKey' DESC 'DB encryption key' SYNTAX OMsOctetString SINGLE-VALUE ) ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONFIG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) ( OLcfgDbAt:1.4 NAME 'olcDbNoSync' DESC 'Disable synchronous database writes' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.15 NAME 'olcDbPageSize' DESC 'Page size of specified DB, in Kbytes' EQUALITY caseExactMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:1.5 NAME 'olcDbDirtyRead' DESC 'Allow reads of uncommitted data' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.12 NAME 'olcDbDNcacheSize' DESC 'DN cache size' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.6 NAME 'olcDbIDLcacheSize' DESC 'IDL cache size in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:0.2 NAME 'olcDbIndex' DESC 'Attribute index parameters' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( OLcfgDbAt:1.7 NAME 'olcDbLinearIndex' DESC 'Index attributes one at a time' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:1.8 NAME 'olcDbLockDetect' DESC 'Deadlock detection algorithm' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:0.3 NAME 'olcDbMode' DESC 'Unix permissions of database files' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:1.9 NAME 'olcDbSearchStack' DESC 'Depth of search stack in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:1.10 NAME 'olcDbShmKey' DESC 'Key for shared memory region' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgOvAt:3.1 NAME 'olcChainingBehavior' DESC 'Chaining behavior control parameters (draft-sermersheim-ldap-chaining)' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgOvAt:3.2 NAME 'olcChainCacheURI' DESC 'Enables caching of URIs not present in configuration' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgOvAt:3.3 NAME 'olcChainMaxReferralDepth' DESC 'max referral depth' EQUALITY integerMatch SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgOvAt:3.4 NAME 'olcChainReturnError' DESC 'Errors are returned instead of the original referral' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:0.14 NAME 'olcDbURI' DESC 'URI (list) for remote DSA' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.1 NAME 'olcDbStartTLS' DESC 'StartTLS' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.2 NAME 'olcDbACLAuthcDn' DESC 'Remote ACL administrative identity' OBSOLETE SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:3.3 NAME 'olcDbACLPasswd' DESC 'Remote ACL administrative identity credentials' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.4 NAME 'olcDbACLBind' DESC 'Remote ACL administrative identity auth bind configuration' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.5 NAME 'olcDbIDAssertAuthcDn' DESC 'Remote Identity Assertion administrative identity' OBSOLETE SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:3.6 NAME 'olcDbIDAssertPasswd' DESC 'Remote Identity Assertion administrative identity credentials' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.7 NAME 'olcDbIDAssertBind' DESC 'Remote Identity Assertion administrative identity auth bind configuration' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.8 NAME 'olcDbIDAssertMode' DESC 'Remote Identity Assertion mode' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.9 NAME 'olcDbIDAssertAuthzFrom' DESC 'Remote Identity Assertion authz rules' SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) ( OLcfgDbAt:3.10 NAME 'olcDbRebindAsUser' DESC 'Rebind as user' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.11 NAME 'olcDbChaseReferrals' DESC 'Chase referrals' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.12 NAME 'olcDbTFSupport' DESC 'Absolute filters support' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.13 NAME 'olcDbProxyWhoAmI' DESC 'Proxy whoAmI exop' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.14 NAME 'olcDbTimeout' DESC 'Per-operation timeouts' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.15 NAME 'olcDbIdleTimeout' DESC 'connection idle timeout' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.16 NAME 'olcDbConnTtl' DESC 'connection ttl' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.17 NAME 'olcDbNetworkTimeout' DESC 'connection network timeout' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.18 NAME 'olcDbProtocolVersion' DESC 'protocol version' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:3.19 NAME 'olcDbSingleConn' DESC 'cache a single connection per identity' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.20 NAME 'olcDbCancel' DESC 'abandon/ignore/exop operations when appropriate' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.21 NAME 'olcDbQuarantine' DESC 'Quarantine database if connection fails and retry according to rule' SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:3.22 NAME 'olcDbUseTemporaryConn' DESC 'Use temporary connections if the cached one is busy' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.23 NAME 'olcDbConnectionPoolMax' DESC 'Max size of privileged connections pool' SYNTAX OMsInteger SINGLE-VALUE ) ( OLcfgDbAt:3.25 NAME 'olcDbNoRefs' DESC 'Do not return search reference responses' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:3.26 NAME 'olcDbNoUndefFilter' DESC 'Do not propagate undefined search filters' SYNTAX OMsBoolean SINGLE-VALUE ) ( OLcfgDbAt:5.1 NAME 'olcRelay' DESC 'Relay DN' SYNTAX OMsDN SINGLE-VALUE ) ( OLcfgDbAt:7.1 NAME 'olcDbSocketPath' DESC 'Pathname for Unix domain socket' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) ( OLcfgDbAt:7.2 NAME 'olcDbSocketExtensions' DESC 'binddn, peername, or ssf' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) ( olmBDBAttributes:1 NAME 'olmBDBEntryCache' DESC 'Number of items in Entry Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( olmBDBAttributes:2 NAME 'olmBDBDNCache' DESC 'Number of items in DN Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( olmBDBAttributes:3 NAME 'olmBDBIDLCache' DESC 'Number of items in IDL Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) ( olmBDBAttributes:4 NAME 'olmDbDirectory' DESC 'Path name of the directory where the database environment resides' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) modifying entry "cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) The corresponding ldif-files and the original cn=schema,cn=config entry can be found at http://leo.kloburg.at/tmp/openldap-olcattributetypes/ Any hints? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 2

runtime config: adding values to olcDbConfig
by Alexander 'Leo' Bergolth 21 Aug '09

21 Aug '09

Hi! I am experiencing troubles when trying to add an additional value to the olcDbConfig attribute (openldap-2.4.16): $ ldapmodify -xvW -h bach-s49 -D cn=Manager,cn=config <<EOF > dn: olcDatabase={1}bdb,cn=config > changetype: modify > add: olcDbConfig > olcDbConfig: {19}# urxn > - > EOF ldap_initialize( ldap://bach-s49 ) Enter LDAP Password: add olcDbConfig: {19}# urxn modifying entry "olcDatabase={1}bdb,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcDbConfig: no equality matching rule replacing all attribute values with "changetype: modify" and "replace: olcDbConfig" works fine but unfortunately Apache DirectoryStudio doesn't seem to offer that way of committing changes... Unfortunately the attribute definition of olcDbConfig seems to be hardcoded, so is there any way to make the above modification work? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 1

question for some code in sasl binding
by Xu, Qiang (FXSGSC) 20 Aug '09

20 Aug '09

Hi, all: In reading OpenLDAP code related to SASL binding, I found the following snippet: ======================================== int ldap_sasl_bind( LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *mechanism, struct berval *cred, LDAPControl **sctrls, LDAPControl **cctrls, int *msgidp ) { ... if( mechanism == LDAP_SASL_SIMPLE ) { /* simple bind */ rc = ber_printf( ber, "{it{istON}" /*}*/, id, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SIMPLE, cred ); } else if ( cred == NULL || cred->bv_val == NULL ) { /* SASL bind w/o credentials */ rc = ber_printf( ber, "{it{ist{sN}N}" /*}*/, id, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SASL, mechanism ); } else { /* SASL bind w/ credentials */ rc = ber_printf( ber, "{it{ist{sON}N}" /*}*/, id, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SASL, mechanism, cred ); } ... } ======================================== Just wanna know that if I remove the condition "|| cred->bv_val == NULL" in the "else if" brance, what will happen? Anyone can tell me why this condition was added? What bug did it fix? My guess is that if it is removed, then the network trace will display some packet marked with "Malformed Packet", but the binding result should be the same. Still, I need some confirmation from your guys. P.S. Shouldn't another condtion, say, "|| cred->bv_len == 0" be added into the "else if" brance as well? Thanks, Xu Qiang

1 0

Avoid unexistent user queries
by Jordi Espasa Clofent 20 Aug '09

20 Aug '09

Hi all, I'm using OpenLDAP as account server. In the server I see a lot of queries from inexistents users in LDAP: filter="(&(objectClass=posixGroup)(|(memberUid=ivan)(uniqueMember=uid=ivan,ou=sat,ou=tecnic,dc=cdmon,dc=com)))" filter="(&(objectClass=posixAccount)(uidNumber=900))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=nobody))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=postfix))" gidNumbercn filter="(&(objectClass=posixAccount)(uidNumber=125))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=xatlantax))" gidNumbercn filter="(&(objectClass=posixAccount)(uidNumber=900))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=cetr))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uidNumber=900))" gidNumbercn filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=www-data))" I don't understand why because of users as '900, postfix, root, www-data' don't exists as users in LDAP server. On the other hand, the user 'ivan' exists and you can see the difference in the log record. ¿Where is the problem? Maybe in my /etc/nsswitch.conf of LDAP clients? # cat /etc/nsswitch.conf passwd: files ldap group: files ldap shadow: files ldap sudoers: ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis Taking for example the common 'www-data' user query, I see in the LDAP client the next: # cat /var/log/auth.log | grep apache Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:30 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:20:58 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:02 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:04 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:04 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:06 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:48 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:49 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:50 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:21:59 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:00 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:00 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:03 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:05 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:07 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:07 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:24 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:24 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:24 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ Aug 20 01:22:25 xen-ad0010 apache2: nss_ldap: reconnected to LDAP server ldap://192.168.10.1/ ¿Why Apache2 tries to connect to LDAP (192.168.10.1)? ¿How I can avoid it? -- Thanks, Jordi Espasa Clofent

1 0

using ldapsearch to get whole data
by mukim pathan 20 Aug '09

20 Aug '09

Hi, I am unable to use slapcat to get whole database into a ldif file because I have a 32 bit machine which cannot write file having size more than 2 GB. So I am looking for alternate ways to get full database into ldif file. So please tell me if there are any alternate ways to do this. I am using openldap-2.4.16 with BDB-4.5 Regards, Mukim Pathan

4 4

LDAP Multimaster Replication
by Paul bob 19 Aug '09

19 Aug '09

Hi - I have question regarding the HA, configured LDAP Multimaster Replication (Openldap 2.4.17 & BDB 4.6.21 ) I can see the Users data in both Server1 and Server2. When I turned off the server2 the users are not getting authenticated through Server1. It always getting authentication through Server2. I would appreciate your valuable suggestion! Thanks, PB

1 0

ldap_add: Already exists (68) errors when testing multi-master sync replication
by Barry Colston 19 Aug '09

19 Aug '09

While testing sync replication, I encountered a situation in which a previously deleted DN cannot be added again because the ldapadd command receives a 68 error code. If I perform an ldapsearch command for the DN, the DN is not found. If I try to add the DN, the add fails with a 68 error code. If I perform a slapcat command for that DN, slapcat displays the record. I have removed all BDB index files and rerun the slapindex command, but the DN is still not found with the ldapsearch command and fails to be added because of a 68 error code. 1 reason I can think of is that deleting a DN does not physically delete the record, but flags the DN as being logically deleted. This condition does not happen all the time, but it does happen eventually after I have been adding, modifying, and deleting records for approximately 15 minutes. I'm running openLDAP 2.4.17 with BDB 4.6.21 (and have not applied the 4 BDB patches). Running sync replication with 2 masters defined in mirror mode using refreshandpersist; issuing LDAP commands against only master slapd #1. Barry Colston

2 3

Need help migrating from Novell eDirectory to OpenLDAP
by Donal Duane 19 Aug '09

19 Aug '09

Hi all, Has anyone tried to migrate data between eDirectory and OpenLDAP? I am having a lot of trouble with invalid attributes. /D

2 1

[PROBLEM] delta-syncrepl, accesslog and filters
by mkappe 19 Aug '09

19 Aug '09

Hello, I use openldap 2.4.16. I configured 2 servers using syncrepl. I would like to sync only a DIT fragment and so i put these lines in the consumer slapd.conf file: syncrepl rid=111 provider=ldaps://mydomain.it<http://ldapstudenti.cca.unipd.it:12315/> type=refreshAndPersist searchbase="dc=mydomain,dc=it" filter="(&(objectClass=MyClass)(Email=true))" attrs="Username,UserStatus,UserExpireDate" schemachecking=off bindmethod=simple binddn="cn=reader,dc=mydomain,dc=it" credentials=xxxxxx retry="60 +" When i try to get out of the scope an entry (setting its attribute 'Email' = false) in the producer, i see that the same entry is removed from the consumer. Everything works fine if i don't activate delta syncrepl mode using accesslog overlay. If i do that, every changes in the producer is propagated to the consumer even if the entry is out of the scope defined in the consumer. How can i configure delta syncrepl (with accesslog) for sync only a DIT fragment? My producer (delta-syncrepl mode) slapd.conf is: moduleload syncprov.la ####################################################################### # ACCESSLOG database definitions ####################################################################### moduleload accesslog.la database bdb suffix "cn=accesslog" rootdn "cn=accesslog" directory /openldap/data/accesslog index default eq index entryCSN,objectClass overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE ####################################################################### # BDB database definitions ####################################################################### # RAMO LOCALE: database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxxx directory /openldap/data index objectClass,uid eq index entryCSN eq index entryUUId eq index Email pres,eq ####################################################################### # Syncrepl - Sincprov ####################################################################### overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 00+01:00 00+00:15 ####################################################################### # ACL ####################################################################### access to dn.subtree="dc=mydomain,dc=it" attrs="userPassword" by anonymous auth by self write by * search access to * by dn.base="cn=reader,dc=mydomain,dc=it" read by * break My consumer (delta-syncrepl mode) slapd.conf is: ####################################################################### # BDB database definitions ####################################################################### # RAMO LOCALE: database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxxx directory /openldap/data index objectClass,uid eq index entryUUID,entryCSN eq index Email pres,eq ####################################################################### # DELTA-SYNCREPL ####################################################################### syncrepl rid=005 provider=ldaps://mydomain.it:123 type=refreshAndPersist searchbase="dc=mydomain,dc=it" filter="(&(objectClass=myClass)(Email=true))" logbase="cn=accesslog" syncdata=accesslog schemachecking=off bindmethod=simple binddn="cn=reader,dc=mydomain,dc=it" credentials=xxxxxx retry="60 +" updateref ldaps://mydomain.it:123 ###################################################################### # ACL ###################################################################### access to dn.subtree="dc=mydomain,dc=it" attrs="userPassword" by anonymous auth by self write by * search access to * by dn.base="cn=reader,dc=mydomain,dc=it" read by * break Thank you! Marco

1 0

Missing UUID for entry being copied by syncrepl to secondary ldap
by Robert Hanson 18 Aug '09

18 Aug '09

(Openldap 2.4.17; BDB 4.5) I have a database that I have set up in non-replicated mode (no syncrepl setup). Now, I've added a second node in a multi-master configuration. When I start slapd on the second node, syncrepl starts up and tries to copy data to the second node. I've stepped through the syncrepl code on the master using a debugger, and it is clear that onespecific node (from the set of nodes in the master database is being queued up and sent to the secondary) has a UUID entry of length 1, and a value of "0". When that node is sent to the secondary, it is treated as if it has no UUID, which is caught by an assertion. This causes the slapd on the secondary to exit. Why is the node on the primary missing the UUID? Is there some code I can trace through to determine this? Is there a way to add the UUID to the entry? Or is there a way to patch the syncrepl code to avoid sending the node that is missing the UUID?

1 0

How to get some overlays?
by ulises gonzalez 18 Aug '09

18 Aug '09

Hello I'm begining to use Openldap, I'm using the version 2.4.11 which comes precompiled with Debian Lenny, the problem is that each time I try to load some overlay the logs saids... Aug 17 13:56:36 ldap slapd[4935]: @(#) $OpenLDAP: slapd 2.4.11 (Oct 12 2008 04:13:21) $#012#011buildd@ninsei:/build/buildd/openldap-2.4.11/debian/build/servers/slapd Aug 17 13:56:36 ldap slapd[4935]: overlay "syncprov" not found Aug 17 13:56:36 ldap slapd[4935]: slapd stopped. Aug 17 13:56:36 ldap slapd[4935]: connections_destroy: nothing to destroy. Aug 17 14:44:23 ldap slapd[5027]: @(#) $OpenLDAP: slapd 2.4.11 (Oct 12 2008 04:13:21) $#012#011buildd@ninsei:/build/buildd/openldap-2.4.11/debian/build/servers/slapd Aug 17 14:44:23 ldap slapd[5027]: overlay "unique" not found Aug 17 14:44:23 ldap slapd[5027]: slapd stopped. Aug 17 14:44:23 ldap slapd[5027]: connections_destroy: nothing to destroy. Aug 17 14:49:07 ldap slapd[5040]: @(#) $OpenLDAP: slapd 2.4.11 (Oct 12 2008 04:13:21) $#012#011buildd@ninsei:/build/buildd/openldap-2.4.11/debian/build/servers/slapd Aug 17 14:49:08 ldap slapd[5040]: overlay "ppolicy" not found Aug 17 14:49:08 ldap slapd[5040]: slapd stopped. Aug 17 14:49:08 ldap slapd[5040]: connections_destroy: nothing to destroy. And Openldap doesn't start, I've been searching in the Openldap website but I haven't found any link to download so my question is where I can get overlays? I need exactly unique and syncprov overlays. Thanks... -- Salu2 ________________________ Ulinx Administrador de redes Ministerio de Finanzas y Precios Linux user 366775 "En un problema con n ecuaciones siempre habrá al menos n+1 incógnitas."

2 2

OpenLDAP structural object class problems
by Henrik Dige Semark 17 Aug '09

17 Aug '09

Hey Im trying to get OpenLDAP database + SAMBA to work as a unit. But when I try to create mashine accaunts I get this error: slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed tail -200f /var/log/syslog | grep slapd Aug 16 22:43:18 hds-linux slapd[28381]: bdb_idl_insert_key: 15 [80002715] Aug 16 22:43:18 hds-linux slapd[28381]: bdb_idl_insert_key: 15 [80000203] Aug 16 22:43:18 hds-linux slapd[28381]: send_ldap_result: err=0 matched="" text="" Aug 16 22:43:22 hds-linux slapd[28381]: connection_get(17) Aug 16 22:43:22 hds-linux slapd[28381]: conn=14 op=8 do_modify: dn (uid=hds$,ou=Computers,dc=semark,dc=dk) Aug 16 22:43:22 hds-linux slapd[28381]: conn=14 op=8 modifications: Aug 16 22:43:22 hds-linux slapd[28381]: ^Ireplace: objectClass Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Imultiple values Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLogonTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 1 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLogoffTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaKickoffTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdCanChange Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 1 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdMustChange Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdLastSet Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaAcctFlags Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 13 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLMPassword Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 32 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaNTPassword Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 32 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaSID Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 47 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPrimaryGroupSID Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 45 Aug 16 22:43:22 hds-linux slapd[28381]: hdb_modify: uid=hds$,ou=Computers,dc=semark,dc=dk Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace objectClass Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLogonTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLogoffTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaKickoffTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdCanChange Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdMustChange Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdLastSet Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaAcctFlags Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLMPassword Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaNTPassword Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaSID Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPrimaryGroupSID Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace entryCSN Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace modifiersName Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace modifyTimestamp *Aug 16 22:43:22 hds-linux slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed Aug 16 22:43:22 hds-linux slapd[28381]: send_ldap_result: err=69 matched="" text="structural object class modification from 'account' to 'inetOrgPerson' not allowed"* Aug 16 22:43:22 hds-linux slapd[28381]: connection_get(17) Aug 16 22:47:37 hds-linux slapd[28381]: connection_get(25) Aug 16 22:47:37 hds-linux slapd[28381]: SRCH "sambaDomainName=SEMARK.DK,dc=semark,dc=dk" 2 0 Aug 16 22:47:37 hds-linux slapd[28381]: 0 15 0 Aug 16 22:47:37 hds-linux slapd[28381]: filter: (?objectClass=sambaTrustedDomainPassword) Aug 16 22:47:37 hds-linux slapd[28381]: attrs: Aug 16 22:47:37 hds-linux slapd[28381]: sambaDomainName Aug 16 22:47:37 hds-linux slapd[28381]: sambaSID Aug 16 22:47:37 hds-linux slapd[28381]: Aug 16 22:47:37 hds-linux slapd[28381]: bdb_idl_fetch_key: [b49d1940] Aug 16 22:47:37 hds-linux slapd[28381]: send_ldap_result: err=0 matched="" text="" What do I have to do to allow structural object changes ? Im running: Debian Lenny (5.0.2) Kernel - 2.6.26-2-xen-686 OpenLDAP: slapd 2.4.17 (Jul 29 2009 00:52:57) Samba Version 3.2.5 Winbind Version 3.2.5 Thanx for the help :) -- Med Venlig Hilsen / Best regards Henrik Dige Semark

3 4

Regarding using ldap_modif_ext_s for modifying all users globally in AD?
by Santosh Kumar 17 Aug '09

17 Aug '09

Hi Everyone, Please help us to modify all users under "users" container. could modify for individual user entry for attributes. Is the the user_dn parameter specified correct? Will the ldap_modify_ext_s supports the globally users entry modification? 1) Modify the user "tetsuser5" char *user_dn = "cn=testuser5,cn=users,dc=kpvmpdc,dc=com" if (ldap_modify_ext_s(ld, user_dn, mods,NULL,NULL) != LDAP_SUCCESS) { ldap_perror( ld, "ldap_modify_s" ); exit(EXIT_FAILURE); } ->Works 2)To modify users globally, used : char *user_dn = "cn=users,dc=kpvmpdc,dc=com" that gives error ldap_modify_s: Object class violation (65) additional info: 0000207D: UpdErr: DSID-03150F9C, problem 6002 (OBJ_CLASS_VIOLATION), data 0 Thanks in advance. Regards Santosh

1 0

Samba PDC + OpenLDAP (Debian Lenny)
by Henrik Dige Semark 15 Aug '09

15 Aug '09

Hey. I'm trying to move my existing MS-AD over to SAMBA, the place I'm working for is changing all servers from MS to Debian, but all the clients is still a mixed environment for now. We have MAC, *NIX, and Windows clients, so its imported that everything keeps running in the same or almost the same way as before the change but. When I try to join a Windows Vista Ultimate ore Windows XP Pro to the domain it takes 30 sec and then it says "The machine account dos not exist" but as I understand that is what "add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u"" has to do right ? I have pasted my config + log from OpenLDAP and SAMBA, can anybody see what I have don wrung # cat /etc/samba/smb.conf ------------------------- # Defining domain name, hostname #################################################### [global] workgroup = MY-DOMAIN netbios name = HDS-Linux - PDC server string = Debian Samba-PDC %v name resolve order = host bcast hosts allow = 192.168.1. 192.168.2. 127. wins support = yes # Network settings # #interfaces = 192.168.5.11 #username map = /etc/samba/smbusers # Security # security = ads realm = MY-DOMAIN nt acl support = Yes enable privileges = yes encrypt passwords = Yes obey pam restrictions = Yes password server = my-server.my-domain #min passwd length = 5 #pam password change = no # method 1: #unix password sync = no #ldap passwd sync = yes # method 2: unix password sync = No ldap passwd sync = Yes passwd program = /usr/sbin/smbldap-passwd -u "%u" passwd chat = "Skift kode: *\n Ny kode*" %n\n "*Gentag ny kode*" %n\n" # Log # log level = 1 syslog = 1 log file = /var/log/samba/samba_my-domain.log max log size = 100000 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 mangling method = hash2 Dos charset = 850 Unix charset = ISO8859-1 # Logon scripts # logon script = scripts/logon.bat logon path = \\%L\profile\%U logon drive = H: logon home = \\%L\%u # Server settings # time server = Yes domain logons = Yes domain master = Yes os level = 65 preferred master = Yes # Winbind settings # winbind use default domain = yes winbind separator = % winbind uid = 10000-21000 winbind gid = 10000-21000 winbind enum users = yes winbind enum groups = yes template homedir = /home/%U # LDAP settings # # passdb backend = ldapsam:"ldap://ldap1.company.com ldap://ldap2.company.com" passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=admin,dc=domain,dc=dk ldap suffix = dc=domain,dc=dk ldap group suffix = ou=groups ldap user suffix = ou=people ldap machine suffix = ou=Computers ldap idmap suffix = ou=Idmap idmap uid = 10000-21000 idmap gid = 10000-21000 ldap ssl = No ldap delete dn = Yes add user script = /usr/sbin/smbldap-useradd -a -m "%u" add machine script = /usr/sbin/smbldap-useradd -t 0 -w -i "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user script = /usr/sbin/smbldap-userdel "%u" delete group script = /usr/sbin/smbldap-groupdel "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%u" "%g" # printers configuration # printer admin = @"Print Operators" load printers = Yes create mask = 0640 directory mask = 0750 #force create mode = 0640 #force directory mode = 0750 printing = cups printcap name = cups deadtime = 10 guest account = nobody map to guest = Bad User dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd show add printer wizard = yes ; to maintain capital letters in shortcuts in any of the profile folders: preserve case = yes short preserve case = yes case sensitive = no [netlogon] path = /home/netlogon/ browseable = No read only = yes [profiles] comment = Roaming Profiles #path = /var/lib/samba/profiles path = /home/profiles read only = no writeable = yes create mask = 0600 directory mask = 0700 browseable = No guest ok = Yes profile acls = yes csc policy = disable # next line is a great way to secure the profiles force user = %U # next line allows administrator to access all profiles valid users = %U "Domain Admins" [printers] comment = Network Printers printer admin = @"Print Operators" guest ok = yes printable = yes path = /home/spool/ browseable = No read only = Yes printable = Yes print command = /usr/bin/lpr -P%p -r %s lpq command = /usr/bin/lpq -P%p lprm command = /usr/bin/lprm -P%p %j # print command = /usr/bin/lpr -U%U@%M -P%p -r %s # lpq command = /usr/bin/lpq -U%U@%M -P%p # lprm command = /usr/bin/lprm -U%U@%M -P%p %j # lppause command = /usr/sbin/lpc -U%U@%M hold %p %j # lpresume command = /usr/sbin/lpc -U%U@%M release %p %j # queuepause command = /usr/sbin/lpc -U%U@%M stop %p # queueresume command = /usr/sbin/lpc -U%U@%M start %p [print$] path = /home/printers guest ok = No browseable = Yes read only = Yes valid users = @"Print Operators" write list = @"Print Operators" create mask = 0664 directory mask = 0775 [public] path = /tmp guest ok = yes browseable = Yes writable = yes [homes] path = /home/%u comment = Home Directories valid users = %u read only = No browseable = Yes create mode = 0750 # tail -200f /var/log/samba/samba_domain.log -------------------------- [2009/08/14 18:22:24, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:22:24, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:22:24, 0] passdb/pdb_get_set.c:pdb_get_group_sid(210) pdb_get_group_sid: Failed to find Unix account for DomAdmin [2009/08/14 18:22:24, 1] auth/auth_util.c:make_server_info_sam(562) User DomAdmin in passdb, but getpwnam() fails! [2009/08/14 18:22:24, 0] auth/auth_sam.c:check_sam_security(355) check_sam_security: make_server_info_sam() failed with 'NT_STATUS_NO_SUCH_USER' [2009/08/14 18:22:47, 0] passdb/pdb_get_set.c:pdb_get_group_sid(210) pdb_get_group_sid: Failed to find Unix account for DomAdmin [2009/08/14 18:22:47, 1] auth/auth_util.c:make_server_info_sam(562) User DomAdmin in passdb, but getpwnam() fails! [2009/08/14 18:22:47, 0] auth/auth_sam.c:check_sam_security(355) check_sam_security: make_server_info_sam() failed with 'NT_STATUS_NO_SUCH_USER' Error: modifications require authentication at /usr/share/perl5/smbldap_tools.pm line 1083. [2009/08/14 18:22:48, 0] passdb/pdb_interface.c:pdb_default_create_user(336) _samr_create_user: Running the command `/usr/sbin/smbldap-useradd -t 0 -w -i "hds$"' gave 127 [2009/08/14 18:23:49, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:23:49, 1] param/loadparm.c:lp_do_parameter(7202) WARNING: The "printer admin" option is deprecated [2009/08/14 18:23:49, 1] libads/cldap.c:recv_cldap_netlogon(156) no reply received to cldap netlogon [2009/08/14 18:23:49, 0] printing/nt_printing.c:nt_printing_init(664) nt_printing_init: error checking published printers: WERR_ACCESS_DENIED [2009/08/14 18:23:49, 0] groupdb/mapping.c:pdb_create_builtin_alias(802) pdb_create_builtin_alias: Could not add group mapping entry for alias 545 (NT_STATUS_GROUP_EXISTS) tail -200f /var/log/syslog | grep slapd -------------------------- Aug 14 18:32:33 hds-linux slapd[4180]: connection_get(20) Aug 14 18:32:33 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0 Aug 14 18:32:33 hds-linux slapd[4180]: 0 15 0 Aug 14 18:32:33 hds-linux slapd[4180]: filter: (?objectClass=sambaTrustedDomainPassword) Aug 14 18:32:33 hds-linux slapd[4180]: attrs: Aug 14 18:32:33 hds-linux slapd[4180]: sambaDomainName Aug 14 18:32:33 hds-linux slapd[4180]: sambaSID Aug 14 18:32:33 hds-linux slapd[4180]: Aug 14 18:32:33 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:32:33 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="value does not conform to assertion syntax" Aug 14 18:32:46 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: ==> hdb_bind: dn: cn=admin,dc=domain,dc=dk Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "" 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: supportedControl Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (&(?objectClass=sambaTrustedDomainPassword)(sambaDomainName=MY-DOMAIN)) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=10 matched="sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" text="value does not conform to assertion syntax" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (&(uid=domadmin)(objectClass=sambaSamAccount)) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: uid Aug 14 18:33:01 hds-linux slapd[4180]: uidNumber Aug 14 18:33:01 hds-linux slapd[4180]: gidNumber Aug 14 18:33:01 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:01 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:01 hds-linux slapd[4180]: cn Aug 14 18:33:01 hds-linux slapd[4180]: sn Aug 14 18:33:01 hds-linux slapd[4180]: displayName Aug 14 18:33:01 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:01 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:01 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:01 hds-linux slapd[4180]: description Aug 14 18:33:01 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:01 hds-linux slapd[4180]: sambaSID Aug 14 18:33:01 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:01 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:01 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:01 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:01 hds-linux slapd[4180]: objectClass Aug 14 18:33:01 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:01 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:01 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:01 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:01 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:01 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:01 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:01 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:01 hds-linux slapd[4180]: uidNumber Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [08a4f228] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [f937ce0f] Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: sambaPwdHistoryLength Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: base_candidates: base: "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" (0x00000011) Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 0 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: sambaMaxPwdAge Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: base_candidates: base: "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" (0x00000011) Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:01 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:01 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:01 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:01 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(gidNumber=65534)) Aug 14 18:33:01 hds-linux slapd[4180]: attrs: Aug 14 18:33:01 hds-linux slapd[4180]: gidNumber Aug 14 18:33:01 hds-linux slapd[4180]: sambaSID Aug 14 18:33:01 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:01 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:01 hds-linux slapd[4180]: description Aug 14 18:33:01 hds-linux slapd[4180]: displayName Aug 14 18:33:01 hds-linux slapd[4180]: cn Aug 14 18:33:01 hds-linux slapd[4180]: objectClass Aug 14 18:33:01 hds-linux slapd[4180]: Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:01 hds-linux slapd[4180]: bdb_idl_fetch_key: [8000fffe] Aug 14 18:33:01 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:02 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:02 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:02 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:02 hds-linux slapd[4180]: filter: (&(uid=hds$)(objectClass=sambaSamAccount)) Aug 14 18:33:02 hds-linux slapd[4180]: attrs: Aug 14 18:33:02 hds-linux slapd[4180]: uid Aug 14 18:33:02 hds-linux slapd[4180]: uidNumber Aug 14 18:33:02 hds-linux slapd[4180]: gidNumber Aug 14 18:33:02 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:02 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:02 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:02 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:02 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:02 hds-linux slapd[4180]: cn Aug 14 18:33:02 hds-linux slapd[4180]: sn Aug 14 18:33:02 hds-linux slapd[4180]: displayName Aug 14 18:33:02 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:02 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:02 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:02 hds-linux slapd[4180]: description Aug 14 18:33:02 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:02 hds-linux slapd[4180]: sambaSID Aug 14 18:33:02 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:02 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:02 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:02 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:02 hds-linux slapd[4180]: objectClass Aug 14 18:33:02 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:02 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:02 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:02 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:02 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:02 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:02 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:02 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:02 hds-linux slapd[4180]: uidNumber Aug 14 18:33:02 hds-linux slapd[4180]: Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [a06475a6] Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:02 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:02 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:02 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:02 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(|(displayName=hds$)(cn=hds$))) Aug 14 18:33:02 hds-linux slapd[4180]: attrs: Aug 14 18:33:02 hds-linux slapd[4180]: gidNumber Aug 14 18:33:02 hds-linux slapd[4180]: sambaSID Aug 14 18:33:02 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:02 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:02 hds-linux slapd[4180]: description Aug 14 18:33:02 hds-linux slapd[4180]: displayName Aug 14 18:33:02 hds-linux slapd[4180]: cn Aug 14 18:33:02 hds-linux slapd[4180]: objectClass Aug 14 18:33:02 hds-linux slapd[4180]: Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [9767cf87] Aug 14 18:33:02 hds-linux slapd[4180]: bdb_idl_fetch_key: [4194d841] Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:02 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:12 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: ==> hdb_bind: dn: cn=admin,dc=domain,dc=dk Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "" 0 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (objectClass=*) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: supportedControl Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(?objectClass=sambaTrustedDomainPassword)(sambaDomainName=MY-DOMAIN)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=10 matched="sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" text="value does not conform to assertion syntax" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(uid=domadmin)(objectClass=sambaSamAccount)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: uid Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: sn Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:24 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:24 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [08a4f228] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [f937ce0f] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(gidNumber=65534)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:24 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [8000fffe] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(uid=hds$)(objectClass=sambaSamAccount)) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: uid Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: homeDirectory Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdLastSet Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdCanChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaPwdMustChange Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogoffTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaKickoffTime Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: sn Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomeDrive Aug 14 18:33:24 hds-linux slapd[4180]: sambaHomePath Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonScript Aug 14 18:33:24 hds-linux slapd[4180]: sambaProfilePath Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: sambaUserWorkstations Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaPrimaryGroupSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaLMPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaNTPassword Aug 14 18:33:24 hds-linux slapd[4180]: sambaDomainName Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: sambaAcctFlags Aug 14 18:33:24 hds-linux slapd[4180]: sambaMungedDial Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordCount Aug 14 18:33:24 hds-linux slapd[4180]: sambaBadPasswordTime Aug 14 18:33:24 hds-linux slapd[4180]: sambaPasswordHistory Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: sambaLogonHours Aug 14 18:33:24 hds-linux slapd[4180]: modifyTimestamp Aug 14 18:33:24 hds-linux slapd[4180]: uidNumber Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [a06475a6] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:24 hds-linux slapd[4180]: connection_get(14) Aug 14 18:33:24 hds-linux slapd[4180]: SRCH "ou=groups,dc=domain,dc=dk" 2 0 Aug 14 18:33:24 hds-linux slapd[4180]: 0 15 0 Aug 14 18:33:24 hds-linux slapd[4180]: filter: (&(objectClass=sambaGroupMapping)(|(displayName=hds$)(cn=hds$))) Aug 14 18:33:24 hds-linux slapd[4180]: attrs: Aug 14 18:33:24 hds-linux slapd[4180]: gidNumber Aug 14 18:33:24 hds-linux slapd[4180]: sambaSID Aug 14 18:33:24 hds-linux slapd[4180]: sambaGroupType Aug 14 18:33:24 hds-linux slapd[4180]: sambaSIDList Aug 14 18:33:24 hds-linux slapd[4180]: description Aug 14 18:33:24 hds-linux slapd[4180]: displayName Aug 14 18:33:24 hds-linux slapd[4180]: cn Aug 14 18:33:24 hds-linux slapd[4180]: objectClass Aug 14 18:33:24 hds-linux slapd[4180]: Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [36d2b1e2] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [9767cf87] Aug 14 18:33:24 hds-linux slapd[4180]: bdb_idl_fetch_key: [4194d841] Aug 14 18:33:24 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:25 hds-linux slapd[4180]: SRCH "dc=domain,dc=dk" 2 2 Aug 14 18:33:25 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:25 hds-linux slapd[4180]: filter: (&(objectClass=posixAccount)(uid=hds$)) Aug 14 18:33:25 hds-linux slapd[4180]: attrs: Aug 14 18:33:25 hds-linux slapd[4180]: Aug 14 18:33:25 hds-linux slapd[4180]: bdb_idl_fetch_key: [b49d1940] Aug 14 18:33:25 hds-linux slapd[4180]: bdb_idl_fetch_key: [5941c014] Aug 14 18:33:25 hds-linux slapd[4180]: bdb_idl_fetch_key: [a06475a6] Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:25 hds-linux slapd[4180]: SRCH "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" 0 2 Aug 14 18:33:25 hds-linux slapd[4180]: 0 0 0 Aug 14 18:33:25 hds-linux slapd[4180]: filter: (objectClass=sambaUnixIdPool) Aug 14 18:33:25 hds-linux slapd[4180]: attrs: Aug 14 18:33:25 hds-linux slapd[4180]: Aug 14 18:33:25 hds-linux slapd[4180]: base_candidates: base: "sambaDomainName=MY-DOMAIN,dc=domain,dc=dk" (0x00000011) Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=0 matched="" text="" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:25 hds-linux slapd[4180]: conn=44 op=2 do_modify: dn (sambaDomainName=MY-DOMAIN,dc=domain,dc=dk) Aug 14 18:33:25 hds-linux slapd[4180]: conn=44 op=2 modifications: Aug 14 18:33:25 hds-linux slapd[4180]: ^Ireplace: uidNumber Aug 14 18:33:25 hds-linux slapd[4180]: ^I^Ione value, length 5 Aug 14 18:33:25 hds-linux slapd[4180]: send_ldap_result: err=8 matched="" text="modifications require authentication" Aug 14 18:33:25 hds-linux slapd[4180]: connection_get(29) Aug 14 18:33:35 hds-linux slapd[4180]: connection_get(14) # net groupmap list -------------------------- Domain Admins (S-1-5-21-3045805106-2558287267-4023452987-512) -> 512 Domain Users (S-1-5-21-3045805106-2558287267-4023452987-513) -> 513 Domain Guests (S-1-5-21-3045805106-2558287267-4023452987-514) -> 514 Domain Computers (S-1-5-21-3045805106-2558287267-4023452987-515) -> 515 Administrators (S-1-5-32-544) -> 544 Account Operators (S-1-5-32-548) -> 548 Print Operators (S-1-5-32-550) -> 550 Backup Operators (S-1-5-32-551) -> 551 Replicators (S-1-5-32-552) -> 552 Users (S-1-5-32-545) -> 10000 System info: -------------------------- Debian Lenny 5.0.2 Kernel - 2.6.26-2-xen-686 Samba Version 3.2.5 Winbind Version 3.2.5 OpenLDAP Version 2.4.11 if there is more info you need plz just ask :)

2 1

v. 2.4.15 , set as provider giving msg: "logdb <suffix>" missing or invalid
by Brian Neu 14 Aug '09

14 Aug '09

My apologies if I'm overlooking the obvious, but I'm past deadline, late for my kid's football practice, and my brain is fried. I've done my best to follow the Admin Guide example at 18.3.2.1. When issuing a "service ldap restart" or /etc/init.d/ldap restart I get this output hdb_db_open: database "dc=accesslog": unclean shutdown detected; attempting recovery. hdb_db_open: database "dc=accesslog": recovery skipped in read-only mode. Run manual recovery if errors are encountered. hdb_db_open: database "dc=srg,dc=com": unclean shutdown detected; attempting recovery. hdb_db_open: database "dc=srg,dc=com": recovery skipped in read-only mode. Run manual recovery if errors are encountered. accesslog: "logdb <suffix>" missing or invalid. backend_startup_one: bi_db_open failed! (1) slap_startup failed (test would succeed using the -u switch) stale lock files may be present in /var/lib/ldap/accesslog [WARNING] stale lock files may be present in /var/lib/ldap [WARNING] I've tried a -s 192 and a -d 192 as an argument to slapd ---- I'm not even sure where the logs are supposed to go, as nothing ends up in /var/log/messages . Any help would be greatly appreciated. I put the attached slapd.conf up at pastebin too: http://pastebin.com/m11dc35a5 Thanks!

2 1

Multi-master configuration -- check my slapd.conf files please?
by Robert Hanson 14 Aug '09

14 Aug '09

Over the last weeks, we've been installing systems that have multi-master configurations (where there are 2 servers; each one meant to accept modifications and forward those modifications on to the other server). Occasionally, we've seen a case where a node in the tree has a structuralObjectClass of "glue" rather than the intended structuralObjectClass. Someone on this list suggested I post the slapd.conf files and logs. We don't at the moment have any logs, but I do have the slapd.conf files. Would someone take a look at these and see if anything stands out? ================================================== Server 10.192,252.64 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 1 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.65:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10 ================================================== Server 10.192,252.65 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 2 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.64:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10

2 2

FW: Multi-master configuration -- check my slapd.conf files please?
by Robert Hanson 14 Aug '09

14 Aug '09

I have not had a response yet. Would someone please check the syncrepl setup of the config files (below) to see if there are any issues? In particular, do I need the syncprov-checkpoint ? Thanks. ________________________________ From: Robert Hanson Sent: Monday, August 03, 2009 4:01 PM To: openldap-technical(a)openldap.org Subject: Multi-master configuration -- check my slapd.conf files please? Over the last weeks, we've been installing systems that have multi-master configurations (where there are 2 servers; each one meant to accept modifications and forward those modifications on to the other server). Occasionally, we've seen a case where a node in the tree has a structuralObjectClass of "glue" rather than the intended structuralObjectClass. Someone on this list suggested I post the slapd.conf files and logs. We don't at the moment have any logs, but I do have the slapd.conf files. Would someone take a look at these and see if anything stands out? ================================================== Server 10.192,252.64 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 1 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.65:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10 ================================================== Server 10.192,252.65 ================================================== # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path "/opt/cisco/uccx/desktop/database" include "/opt/cisco/uccx/desktop/schemaconf/core.schema" include "/opt/cisco/uccx/desktop/schemaconf/corba.schema" include "/opt/cisco/uccx/desktop/schemaconf/cosine.schema" include "/opt/cisco/uccx/desktop/schemaconf/inetorgperson.schema" include "/opt/cisco/uccx/desktop/schemaconf/nis.schema" include "/opt/cisco/uccx/desktop/schemaconf/OurCompanyName.schema" pidfile "/var/run/desktop/slapd.pid" argsfile "/var/run/desktop/slapd.args" # inactive, but still open connections, # and any connections closed by the client, # are held open by slapd for this number of seconds #900 = 15 minutes #300 = 5 minutes idletimeout 300 sizelimit unlimited # Max # of threads. Default is 16 #threads 16 # For older Enterprise clients - AM allow bind_v2 # Maximum # of authenticate connections that can be pending conn_max_pending_auth 2000 # Don't allow clients to modify anything under People access to dn.subtree="ou=People,o=OurCompanyName Communications" by dn="cn=Client,ou=People,o=OurCompanyName Communications" read by * read # Allow clients to modify Company and so on access to * by dn="cn=Client,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep1,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep2,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep3,ou=People,o=OurCompanyName Communications" write by dn="cn=SplkRep4,ou=People,o=OurCompanyName Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=OurCompanyName Communications" rootdn "cn=OurCompanyName,ou=People,o=OurCompanyName Communications" checkpoint 10 1 # Number of entries mantain in cache. Default is 1000 cachesize 50000 # 8 = 4 MB per thr. Default is 16 searchstack 8 # Root user password rootpw {SSHA}qTp612HSRZ9HX7ICW95TCAOOnVNacOK6 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/cisco/uccx/desktop/database" # Indices to maintain index objectClass eq index empID eq index tid eq index svrType eq index ipHostName eq index keyName eq # for sync repl serverID 2 syncrepl rid=123 searchbase="o=OurCompanyName Communications" provider=ldap://10.192.252.64:3016 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=OurCompanyName, ou=People, o=OurCompanyName Communications" credentials=5385 mirrormode true # ash - following will cause circular reaction if in both sides in slapd.conf # updateref ldap://10.192.252.84:999 # set the host up as a provider overlay syncprov syncprov-checkpoint 100 10

2 1

syncrepl problem?
by Tim Tyler 14 Aug '09

14 Aug '09

Openldap experts, We are running 2.3.43 Openldap on Centos 5.3 systems. I have one provider and two consumers. I believe the consumers were working fine in terms of receiving replication data and staying synchronized until today. I have this entry in slapd.conf syncrepl rid=102 type=refreshAndPersist interval=00:01:00:00 The problem is that I had to completely restore the provider's entire ldap database from a backup ldif file after screwing up over 200 accounts. I got the provider back to the way I wanted, but now the consumers won't synchronize (replicate) any more. 1. Should syncrepl ultimately be able to replicate after a major change to the provider such as a ldif restoration? Or should I expect to have to reload the consumer entries from scratch from a provider generated ldif in situations like this? 2. I thought I read once that the interval settings was still important for when refreshandpersist missed an update. Is that true? Tim Tyler Network Engineer Beloit College

3 3

Cleaning slapcat(1) LDIF output
by Jordi Espasa Clofent 14 Aug '09

14 Aug '09

Hi all, According slapcat(1) man: "The output of slapcat is intended to be used as input to slapadd(8). The output of slapcat cannot generally be used as input to ldapadd(1) or other LDAP clients without first editing the output. This editing would normally include reordering the records into superior first order and removing no-user-modification operational attributes." So, I've done: # making normal LDIF using slapcat(1) $ slapcat -l test_backup.ldif # cleaning the LDIF and dump the results in another file $ egrep -ve '^(entryUUID|creatorsName|structuralObjectClass|createTimestamp|entryCSN|modifiersName|modifyTimestamp): ' \ test_backup.ldif > test_backup_cleaned.ldif #viewing the differences $ diff -y test_backup.ldif test_backup_cleaned.ldif | less ¿Is it a correct way to "clean" the initial LDIF you can get with slapcat(1)? And another minor question ¿Can I use the slapcat(1) tool on the fly? man pages say nothing about it. -- Thanks, Jordi Espasa Clofent

3 5

Re: Cleaning slapcat(1) LDIF output
by masarati＠aero.polimi.it 14 Aug '09

14 Aug '09

Please keep replies to the list. >> Please carefully re-read the above text: "IT IS ALWAYS SAFE TO RUN >> SLAPCAT >> WITH THE SLAPD-BDB(5) BACKEND". > > Piero, > > I think I'm missing something but the question stills here: ¿is possible > to use slapcat(8) on the fly (which means with slapd running)? > Maybe the text you've quoted means: stop the slapd service and runs > slapcat(8) directly against bdb. You see, there's a first sentence, which states that it might not be always safe to run slapcat while slapd is running, as results might be inconsistent. Then there is a second sentence, stating that it is always safe when slapcat is used for slapd-bdb. So the answer is: yes, it is safe. p.

1 0

Re: OpenLDAP + Kerberos on FreeBSD 7.2, close to working but not quite
by Allan 13 Aug '09

13 Aug '09

Thank you for the response. I ran the command and it looks like there's none supported.. This is strange. How can I allow GSSAPI? frisbee# /usr/local/bin/ldapsearch -x -H ldap://localhost -b "" -s base supportedSaslMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSaslMechanisms # # dn: # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 On Mon, Aug 10, 2009 at 9:29 AM, <cr4z3d(a)gmail.com> wrote: > I apologize for that it was early in the morning. Gmail likes to reply to > sender > ------Original Message------ > From: Dieter Kluenter > To: Allan > Subject: Re: OpenLDAP + Kerberos on FreeBSD 7.2, close to working but not > quite > Sent: Aug 10, 2009 8:46 AM > > Please no private mail, stay on the mailinglist, unless you want to > buy my professional support. > > -Dieter > > Allan <cr4z3d(a)gmail.com> writes: > > > Thank you for the response. I ran the command and it looks like there's > none > > supported.. This is strange. How can I allow GSSAPI? > > > > frisbee# /usr/local/bin/ldapsearch -x -H ldap://localhost -b "" -s base > > supportedSaslMechanisms > > # extended LDIF > > # > > # LDAPv3 > > # base <> with scope baseObject > > # filter: (objectclass=*) > > # requesting: supportedSaslMechanisms > > # > > > > # > > dn: > > > > # search result > > search: 2 > > result: 0 Success > > > > # numResponses: 2 > > # numEntries: 1 > > > -- > Dieter Klünter | Systemberatung > http://dkluenter.de > GPG Key ID:8EF7B6C6 > 53°08'09,95"N > 10°08'02,42"E > >

3 11

Re: Just organizationalUnits objects copied doing sync replication
by Yeray Gutiérrez Cedrés 13 Aug '09

13 Aug '09

On Wed, Aug 12, 2009 at 11:40 PM, Quanah Gibson-Mount<quanah(a)zimbra.com> wrote: > --On Wednesday, August 12, 2009 11:17 PM +0100 Yeray Gutiérrez Cedrés > <ycedres(a)gmail.com> wrote: > >> I'm trying to replicate an openldap database from a consumer like this: >> >> index objectClass,entryCSN,entryUUID eq >> overlay syncprov >> syncprov-checkpoint 100 10 >> syncprov-sessionlog 100 >> >> >> To a provider like this: >> >> >> index objectClass,entryCSN,entryUUID eq >> >> syncrepl rid=123 >> provider=ldap://10.140.200.3:389 >> type=refreshOnly >> interval=00:00:00:01 >> searchbase="dc=example,dc=org" >> scope=sub >> attrs="*" >> schemachecking=off >> bindmethod=simple >> binddn="cn=admin,dc=example,dc=org" >> credentials="mypassword" >> >> The provider database is completely emtpy and I want the provider to >> copy the whole database. The only objects that are copied are the >> organizationalUnit class objects. The objects that are "under" the >> organizationalUnits (like for example a 'person' objetct) are not >> being copied. What could be the reason for that? > > > I think you are confused about the differences between "provider" and > "consumer". The provider is what starts with the full database. The > consumer is what gets the database from the provider. So the provider does > *not* copy the database, the consumer does. > I'm sorry for mixing my e-mail up a little bit. I read it three times before sending but at certain hours your brain doesn't work as you expect :-). > In any case, your "attrs" line is wrong. You really shouldn't set it at all > and just use the default unless you really know what you're doing. > Well I tried first leaving those lines at their default value. According to the openldap documentation: "The scope defaults to sub, the filter defaults to (objectclass=*), attrs defaults to "*,+" to replicate all user and operational attributes, and attrsonly is unset by default." I try this in the consumer: syncrepl rid=123 provider=ldap://10.140.209.254:389 type=refreshOnly interval=00:00:00:01 searchbase="dc=example,dc=org" schemachecking=off bindmethod=simple binddn="cn=admin,dc=example,dc=org" credentials="secret" Then I check the slapd.con file: # slaptest /etc/ldap/slapd.conf: line 152: rootdn is always granted unlimited privileges. /etc/ldap/slapd.conf: line 174: rootdn is always granted unlimited privileges. config file testing succeeded Then I restart: # /etc/init.d/slapd restart I see this in the logfile slapd[22700]: slapd starting slapd[22700]: syncrepl_entry: rid=123 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) slapd[22700]: syncrepl_entry: rid=123 inserted UUID ead90d7a-c02b-102c-8c00-cb58049f9ef6 slapd[22700]: syncrepl_entry: rid=123 be_search (32) slapd[22700]: syncrepl_entry: rid=123 dc=example,dc=org slapd[22700]: syncrepl_entry: rid=123 be_add (0) If does the same for "cn=admin,dc=example,dc=org", "ou=users,dc=example,dc=org", "ou=groups,dc=groups,dc=org","ou=postfix,dc=example,dc=org", "ou=alias,ou=postfix,dc=example,dc=org","cn=vmail,ou=groups,dc=example,dc=org" and finally I get this message: slapd[22700]: syncrepl_message_to_entry: rid=123 mods check (objectClass: value #0 invalid per syntax) slapd[22700]: do_syncrepl: rid=123 quitting When I try with ldapsearch (from the consumer to the provider, the provider IP is 10.140.200.3): # ldapsearch -D "cn=admin,dc=example,dc=org" -W -x -h 10.140.200.3 objectClass=* attr=*,+ it does return all entries: # numResponses: 705 # numEntries: 704 As additional information, when I do slapcat, I get this (apart from the objects that were created before, as I said): dn: objectClass: top objectClass: dcObject objectClass: organization o: corp.example.org dn: objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin I think this objects are there as a result of starting slapd in the first moment with a wrong configuration file (for example, the suffix line was incorrectly set to corp.example.com insted of example.com). But I don't know how to delete those entries. And I also don't know if this is affecting to the correct behaviour of the replication. > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 1

Just organizationalUnits objects copied doing sync replication
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

I'm trying to replicate an openldap database from a consumer like this: index objectClass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 To a provider like this: index objectClass,entryCSN,entryUUID eq syncrepl rid=123 provider=ldap://10.140.200.3:389 type=refreshOnly interval=00:00:00:01 searchbase="dc=example,dc=org" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=admin,dc=example,dc=org" credentials="mypassword" The provider database is completely emtpy and I want the provider to copy the whole database. The only objects that are copied are the organizationalUnit class objects. The objects that are "under" the organizationalUnits (like for example a 'person' objetct) are not being copied. What could be the reason for that? Regards.

2 1

syncrepl findbase failed! 32 errors
by Barry Colston 12 Aug '09

12 Aug '09

I'm running OpenLDAP 2.4.17 with 3 servers configured in multi-master mode (server 1 replicates to server 2 and server 3, server 2 replicates to server 1 and server 3, and server 3 replicates to server 1 and server 2). While executing shell scripts to test replication, all 3 slapd instances began returning error code 32 to all requests. No information could be retrieved from any of the 3 LDAP servers using ldapsearch, Apache Directory Studio, LDAP Administrator tool, or the LDAP Browser tool. The slapd log records with debug level = sync contained numerous "findbase failed! 32" errors. Starting and restarting the slapd instances still resulted in error code 32 being returned for any LDAP request. I had to restore the LDAP databases to be able to view/update records in any of the 3 LDAP databases. Server 1 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3892 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3893 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Server 2 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3893 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Server 3 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3892 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Snippets from log file from server 1 around the slapd error 32 problem time: syncprov_sendresp: to=002, cookie=rid=001,sid=001,csn=20090811143737.466654Z#000000#001#000000 syncprov_sendresp: to=003, cookie=rid=001,sid=001,csn=20090811143737.466654Z#000000#001#000000 slap_queue_csn: queing 0xa2452d98 20090811143737.567781Z#000000#001#000000 syncprov_sendresp: to=002, cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa17098a8 20090811143737.567781Z#000000#001#000000 syncprov_sendresp: to=003, cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 connection_input: conn=456 deferring operation: binding findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 connection_input: conn=461 deferring operation: binding Snippets from log file from server 2 around the slapd error 32 problem time: slap_queue_csn: queing 0xa1709520 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa1709650 20090811143737.567781Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (32) do_syncrepl: rid=001 rc 32 retrying (59 retries left) syncprov_sendresp: to=003, cookie=rid=002,sid=002,csn=20090811143737.567781Z#000000#001#000000 do_syncrep2: cookie=rid=002,sid=003,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=002 be_search (32) syncrepl_entry: rid=002 (null) slap_queue_csn: queing 0xa1714320 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa1716558 20090811143737.567781Z#000000#001#000000 do_syncrepl: rid=002 rc 32 retrying (59 retries left) findbase failed! 32 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=001 (32) No such object do_syncrepl: rid=001 rc -2 retrying (59 retries left) do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 rc -2 retrying (59 retries left) findbase failed! 32 Snippets from log file from server 3 around the slapd error 32 problem time: slap_graduate_commit_csn: removing 0x835e498 20090811143737.466654Z#000000#001#000000 do_syncrep2: cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=001 be_search (0) syncrepl_entry: rid=001 dc=authentx slap_queue_csn: queing 0xa160ee80 20090811143737.567781Z#000000#001#000000 syncprov_matchops: skipping original sid 001 slap_graduate_commit_csn: removing 0xa16134f8 20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=001 be_delete dc=authentx (0) slap_queue_csn: queing 0xa160ee80 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa16134f8 20090811143737.567781Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (32) do_syncrepl: rid=001 rc 32 retrying (59 retries left) syncprov_sendresp: to=002, cookie=rid=002,sid=003,csn=20090811143737.567781Z#000000#001#000000 do_syncrep2: cookie=rid=002,sid=002,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=002 be_search (32) syncrepl_entry: rid=002 (null) slap_queue_csn: queing 0x8338688 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0x8360318 20090811143737.567781Z#000000#001#000000 do_syncrepl: rid=002 rc 32 retrying (59 retries left) do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 rc -2 retrying (59 retries left) findbase failed! 32 I have been unable to reproduce this problem. Any suggestions on how to prevent this problem from occurring and how to recover when this problem occurs? Thanks, Barry Colston

2 3

Changing the top object
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

In the slapd.conf file of a provider server I have the following suffix parameter: suffix "dc=example,dc=org" And with slapcat I see the followind: dn: dc=example,dc=org objectClass: top objectClass: dcObject objectClass: organization o: example.org dc: example structuralObjectClass: organization entryUUID: ead90d7a-c02b-102c-8c00-cb58049f9ef6 creatorsName: modifiersName: createTimestamp: 20080527112930Z modifyTimestamp: 20080527112930Z entryCSN: 20080527112930.000000Z#000000#000#000000 I wanted to set a consumer but I set the suffix parameter wrong: suffix "dc=corp,dc=example,dc=org" So this was created: dn: objectClass: top objectClass: dcObject objectClass: organization o: corp.example.org dc: corp structuralObjectClass: organization entryUUID: 29af5532-1abb-102e-9f19-896497a83f9b creatorsName: createTimestamp: 20090811120636Z entryCSN: 20090811120636.425151Z#000000#000#000000 modifiersName: modifyTimestamp: 20090811120636Z Is there any way to change this? I also don't know why the dn in the second case is empty (I thought it should be dc=corp,dc=example,dc=org). If this can't be easily fixed, is there any way of starting from scratch? Regards.

4 13

RE: syncrepl findbase failed! 32 errors
by Quanah Gibson-Mount 12 Aug '09

12 Aug '09

--On Wednesday, August 12, 2009 3:29 PM -0400 Barry Colston <bcolston(a)xtec.com> wrote: > BDB 4.6.21. I'm checking with the person who built BDB/LDAP to see what > patches have been applied. > Please keep replies on the list, thanks. :) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

unique
by Márcio Luciano Donada 12 Aug '09

12 Aug '09

Hi, Currently I'm using the unique to the mail, but I would also add other attributes, is this possible? overlay unique unique_uri ldap:///?mail?sub? -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 1

Entry not listed when requesting all entries with ldapsearch
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

I've added a new entry with ldapadd like this: I've got this in a file (myfile.ldif): dn: mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com cn: Mr Someone mail: someone(a)example.com maildrop: someone(a)corporative.example.com sn: Boss objectClass: CourierMailAlias objectClass: person objectClass: top objectClass: inetOrgPerson $>ldapadd -D "cn=admin,dc=example,dc=com" -w secret -x -h "localhost" -f myfile.ldif I can see it if I search specifically for it with ldapsearch (no problem with this): $> ldapsearch -x -b "mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com" # extended LDIF # # LDAPv3 # base <mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # someone(a)example.com, alias, postfix, someone.com dn: mail=someone(a)example.com,ou=alias,ou=postfix,dc=someone,dc=com cn: Mr Someone mail: someone(a)example.com sn: Boss objectClass: CourierMailAlias objectClass: person objectClass: top objectClass: inetOrgPerson maildrop: someone(a)corporative.example.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Howerver, when I try to search for this entry with ldapsearch I can't see it if I list all the entries: $> ldapsearch -x -b "ou=alias,ou=postfix,dc=example,dc=com" | grep "someone" $> I have some other entries that were previously there and they are all listed. It's very extrange that in the complete list the new etnry doesn't get listed. Any idea? Regards.

2 1

openldap 2.4.16, rwm, syncrepl
by mkappe 12 Aug '09

12 Aug '09

Hello everybody, I'm front a problem with my openldap 2.4.16 server and i hope you can give me help to solve it. The problem is the following one: I use a schema for email addresses but i need to make it compliant with another one. I found some matching fields from my current model to the other one but i wouldn't like to duplicate them or define a schema for the new model. I tried to use rwm module in this way: include /usr/local/../schema/core.schema include /usr/local/../schema/cosine.schema include /usr/local/../schema/inetorgperson.schema include /usr/local/../schema/my_email.schema ... ... database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxx directory /openldap/data/mydomain index objectClass,uid eq index entryCSN eq index entryUUId eq overlay rwm rwm-map attribute myemail theNewEmail rwm-map attribute mypassword theNewPassword ... Searching for theNewEmail in dc=mydomain,dc=it nothing appears. What do i wrong? Another question: are there any problem if i use rwm overlay in a delta-syncrepl mode? Thank you! M.

1 0

OpenLDAP Virtual File System
by Jon Rascal 11 Aug '09

11 Aug '09

Hi, I want to create a virtual file system where metadata is stored in an LDAP repository. Metadata includes owner, mod-time, create-time, access-control-lists, pysical file path, and, of course, LDAP's hierarchy instead of a file-system directory base. Files are to be stored on physical medium and (preferably pyton) code used to bridge the request (over https), the metadata, and the physical file stream. Users and Keys are also stored in the LDAP directory. Is this a bad use for LDAP? I'm also looking for an LDAP guru to consult for this particular project. JR

2 1

LDAP stopping without apparent reason
by Márcio Luciano Donada 11 Aug '09

11 Aug '09

Hi list, We have a service ldap, version 2.4.11-1, debian lenny, but the times have been falling and does not even have a message in the log about the fall of it. Use it for e-mail service, jabber, ftp, and website. In the logs I have the following message: Aug 8 09:34:41 ldap slapd[15338]: connection_input: conn=1332300 deferring operation: binding Aug 8 09:34:42 ldap slapd[15338]: connection_input: conn=1332301 deferring operation: binding Aug 8 09:47:46 ldap slapd[15338]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 My configuration allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/authldap.schema include /etc/ldap/schema/RADIUS-LDAPv3.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 1024 modulepath /usr/lib/ldap moduleload back_hdb TLSVerifyClient demand TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem tool-threads 16 threads 32 backend hdb database hdb suffix "dc=auroraalimentos,dc=com,dc=br" rootdn "cn=suporte,dc=auroraalimentos,dc=com,dc=br" rootpw secret directory "/var/lib/ldap" idletimeout 30 timelimit 320 schemacheck on checkpoint 1024 5 cachesize 100000 dbconfig set_cachesize 0 2097152 0 lastmod on sizelimit unlimited index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uniqueMember eq index uidNumber eq index gidNumber eq index memberUID eq index mailAlternateAddress eq index MailForwardingAddress eq index mail pres,eq index default sub index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index sambaSIDList,sambaGroupType eq index givenName eq access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * none access to * by self write by users read by * read when the service to have a big problem, mainly because the e-mail service is affected. thanks -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 10

ppolicy and ACLs of pwdAccountLockedTime?
by Jiri Bohac 11 Aug '09

11 Aug '09

Hi, I am having troubles making the ppolicy overlay to prevent password guessing attacks with pwdLockout with slapd-2.4.11-1 in Debian Lenny. I set pwdMaxFailure to 3. In the user object I am testing with, I never get more than two entries for pwdFailureTime and pwdAccountLockedTime is never added at all. I tracked the problem down to the ACL settings in slapd.conf. With my default access to * by dn="cn=admin,dc=example,dc=net" write by * read , I get the above result. When I rewrite the last line to "by * write", it works. The pwdFailureTime is updated, because it is defined as NO-USER-MODIFICATION, which bypasses te ACL checks for write. The problem happens when pwdMaxFailure failed logins are reached, and ppolicy.c tries to update pwdFailureTime and pwdAccountLockedTime in a single request. How is this supposed to work? - Shouldn't pwdAccountLockedTime also be defined with NO-USER-MODIFICATION? - couldn't the update request in ppolicy.c be executed with higher privileges? I tried to set up an non-anonymous bind in pam_ldap but this did not help. - is there some recommended ACL setting to grant the necessary privileges so that ppolicy.c can update pwdAccountLockedTime, but users can't? I am a splapd newbie, so maybe I don't see something obvious, but in the log below, I see: "acl_mask: to all values by "", (=0)" -- that looks like an anonymous bind, right? Allowing write for the pwdAccountLockedTime attribute to anyone does not seem a good idea ;-) Thanks for any insight! Jiri P.S.: some detailed notes from my debugging are attached below: I am authenticating with pam-ldap. When I mis-type the password of a user and do a search on the user object (with a +, to see the operational attributes), the pwdFailureTime is created. This is good. When I preform the bad login again, I get a second value for pwdFailureTime. Still good. But on the next login, instead of getting a third value for pwdFailureTime and an updated value for pwdAccountLockedTime, nothing happens. I put some more debug info into ppolicy_bind_response() like this: ----- * We only count those failures * which are not due to expire. */ Debug(LDAP_DEBUG_ANY, "xxx: counting pwdFailureTime %i/%d\n", i, fc, 0); } } if ((ppb->pp.pwdMaxFailure > 0) && (fc >= ppb->pp.pwdMaxFailure - 1)) { Debug(LDAP_DEBUG_ANY, "xxx: trying to insert pwdAccountLockedTime\n", 0, 0, 0); ----- ... in the logs (with loglevel 65535), I really see: ------ Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 0/1 Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 1/2 Aug 8 00:05:42 localhost slapd[15416]: xxx: trying to insert pwdAccountLockedTime [snip] Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: delete access to "uid=j.bohac,ou=users,dc=example,dc=net" "pwdAccountLockedTime" requested Aug 8 00:05:42 localhost slapd[15416]: => acl_get: [2] attr pwdAccountLockedTime Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: result not in cache (pwdAccountLockedTime) Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: access to entry "uid=j.bohac,ou=users,dc=example,dc=net", attr "pwdAccountLockedTime" requested Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: to all values by "", (=0) Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: cn=admin,dc=example,dc=net Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: * Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] applying read(=rscxd) (stop) Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] mask: read(=rscxd) Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: delete access denied by read(=rscxd) Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: no more rules ------

2 1

ldapsearch is not able to show Japanese chars
by anish patil 11 Aug '09

11 Aug '09

Hi All, I am using openldap-2.4.11 I have added localized that is japaneese use names into ldap database .Format(ldif) that i have used was UTF-8. However when i run ladearch it shows me invalid values in dn and uid filed. I want there values in localized format? how can i achieve this ? Thanks in advance -- Anish Patil -- Anish Patil

2 3

Phpldapadmin + openldap - is not registering new users
by Édnei Rodrigues 10 Aug '09

10 Aug '09

Good morning. I have OpenLdap 2.4.12 and phpldapadmin 1.0.1.. My problem is occuring when i try register a new user. Follow error: *O servidor LDAP respondeu: Object class violation Erro número: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Descrição: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass.* And /var/log/messages: *Aug 10 07:58:11 webs slapd[3426]: Entry (cn=cyrusadmin cyrusadmin,ou=People,dc=novohamburgo,dc=rs,dc=gov,dc=br): object class 'posixAccount' requires attribute 'gidNumber'* This is stranger. In the PhpLdapAdmin, the fill gidNumber is blank, don't have option for change. What's happening ? My sladp.conf: *include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/yast.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/openldap/modules moduleload back_hdb moduleload autoPosixIds sizelimit 500 tool-threads 1 backend hdb access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read loglevel -1 database bdb suffix "dc=novohamburgo,dc=rs,dc=gov,dc=br" checkpoint 1024 5 cachesize 30000 sizelimit -1 rootdn "cn=Manager,dc=novohamburgo,dc=rs,dc=gov,dc=br" rootpw {SSHA}GS89uCsqQaeBuBQ+RoxgDuY6hkg2946U* *directory /var/lib/ldap overlay autoPosixIds index objectClass eq index uid eq index memberUid eq index member eq dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30* Thanks!

2 1

Trouble with slapd-ldap in various scenarios (LdarErr: DSID-0C090627)
by Martin Rubáš 10 Aug '09

10 Aug '09

Hello, I'm evaluating OpenLDAP and I've got cornered with slapd-ldap combined together with slapd-relay or slapo-translucent. First of all, I would like to mention that I read man pages back and forth. I also read archives of openldap.org mailing lists as well as configuration files for slapd tests. I'm still a little bit confused. The second important thing is that I don't want to enable anonymous binding at this time. Each user that access slapd is required to bind using its own DN and credentials. This statement is valid for both kind of repositories - local or remote. So, give me a chance, please... ;-) I tried several scenarios but was only partially successful. You can find more info about them below. I read about acl-bind, idassert-bind & idassert-authzFrom, mode=self but I was not able to get them working so far. I haven't used any 'authz-xxx' options yet. So, the configuration parts (below) doesn't contain only the schema includes and the config database settings. 1. What's wrong with my configuration? (cases A & B at first) I suppose that I had to use idassert-bind somehow but I don't have any idea how to do it. 2. Why is there the second connection with the strange binding request? This is probably related with question 1 but it could be an error symptom. I just want to be sure... 3. Do I have to use something else except "idassert-bind mode=self" option? I just want to bind to remote server with the proper user DN (my application is requesting data on behalf of user) and additionaly on some specific account DN (if the application is requesting data for private use). I feel that these questions could look silly, but I hope that it's better to make itself to look like fool, get advice and move forward then stand still. Thanks for any advice, Martin Rubas PS: I'm sorry for being so long... #++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Notes: ~ using slapd version 2.4.15 on Ubuntu (9.04/jaunty;64-bit;localhost) - using Windows 2003 Server as PDC (pdc.domain.net) ~ command used to query: ldapsearch -x -w secret -H ldap://localhost:389 \ -D 'CN=The Root,CN=Users,DC=domain,DC=net' \ -b 'CN=The User,CN=Users,DC=domain,DC=net' \ -s sub -a always '(objectClass=*)' ~ all used accounts (The Root, The User, The Bind & Administrator) exists in Windows domain (AD) and have set password to 'secret'. 'The Root' is also member 'Domain Admins', so it should have the same access rights as 'Administrator' (at least, for AD/LDAP operations) === Case A === I started with slapd-hdb and slapo-translucent to combine data from Active Directory repository with other data from local DB. It finally got it working but only when ldapsearch command was binding with "rootdn" from slapd-hdb configuration. But I want to do binding with the (proper) user DN to slapd (local repository) as well as to AD (remote one). #====================================================================== database hdb suffix "dc=domain,dc=net" rootdn "cn=The Root,cn=Users,dc=domain,dc=net" rootpw secret directory /var/lib/ldap/lib-trans index objectClass eq index cn eq overlay translucent uri ldap://pdc.domain.net:389 binddn "cn=The Bind,cn=Users,dc=domain,dc=net" bindpw heslo lastmod off chase-referrals true rebind-as-user true #---------------------------------------------------------------------- If I use ldapsearch -D "cn=The Root,..." -b "cn=The User,..." then slapd binds to "cn=The Bind". That's correct, I guess... But when I use some other DN for -D parameter then the response is "LdarErr: DSID-0C090627 ... " (I saw that one many time in archives). It doesn't matter if it was "cn=The User,..." or "cn=The Bind". === Case B === I also tried to combine slapd-ldap together with slapd-relay extended by slapo-rwm, to get something like "domain-alias" (2 names for one repository). #====================================================================== database ldap suffix "dc=domain,dc=net" uri ldap://pdc.domain.net:389 chase-referrals yes rebind-as-user yes database relay suffix "dc=alias,dc=net" relay "dc=domain,dc=net" overlay rwm rwm-suffixmassage "dc=domain,dc=net" #---------------------------------------------------------------------- In this case, I was able to get result with -D option set to "cn=The User,cn=Users,dc=domain,dc=net" but I got the same error while using the aliased DN "cn=The Users,cn=Users,dc=alias,dc=net". === Case C/D === Finally, I gave up and tried most simple case. Plain slapd-ldap (C) and with slapo-rwm (D). This way I've got simple bridge to AD or an alias for it. #====================================================================== database ldap suffix "dc=domain,dc=net" #for C only #D#suffix "dc=alias,dc=net" uri ldap://pdc.domain.net:389 chase-referrals yes rebind-as-user yes #D#overlay rwm #D#rwm-suffixmassage "dc=domain,dc=net" #---------------------------------------------------------------------- Whoa, it worked! One small step for me, but ... Hm, pretty useless at the whole scope :-( === Network Dump === I catched a network packets and noticed some pretty wierd thing... Each ldapsearch received "LdarErr: DSID-0C090627" there way the same scenario: 1. slapd opens the connection 2. slapd binds succefully (mostly with the credentials I wanted to use) 3. slapd opens another connection 4. slapd binds again with "nothing" (displayed as "<ROOT>" in Wireshark) 5. slapd sends request and receives LdapErr 6. slapd unbinds and closses connection from step 3 x. other requests are processed repeating step 3 to 6 #++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 0.000000 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=85650917 TSER=0 WS=6 2 0.000304 a.b.c.153 -> a.b.c.174 :: ldap > 50178 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 WS=0 TSV=0 TSER=0 3 0.000321 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=85650917 TSER=0 4 0.000455 a.b.c.174 -> a.b.c.153 :: bindRequest(1) "cn=The Root,cn=Users,dc=domain,dc=net" simple 5 0.053060 a.b.c.153 -> a.b.c.174 :: bindResponse(1) success 6 0.053086 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [ACK] Seq=77 Ack=23 Win=5888 Len=0 TSV=85650930 TSER=7278645 7 0.058317 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=85650932 TSER=0 WS=6 8 0.058604 a.b.c.153 -> a.b.c.174 :: ldap > 50179 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 WS=0 TSV=0 TSER=0 9 0.058622 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=85650932 TSER=0 10 0.058746 a.b.c.174 -> a.b.c.153 :: bindRequest(1) "<ROOT>" simple 11 0.058972 a.b.c.153 -> a.b.c.174 :: bindResponse(1) success 12 0.058992 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [ACK] Seq=15 Ack=23 Win=5888 Len=0 TSV=85650932 TSER=7278645 13 0.059158 a.b.c.174 -> a.b.c.153 :: searchRequest(2) "cn=The User,cn=Users,dc=domain,dc=net" wholeSubtree 14 0.059380 a.b.c.153 -> a.b.c.174 :: searchResDone(2) operationsError (00000000: LdapErr: DSID-0C090627, comment: ...) 15 0.098978 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [ACK] Seq=140 Ack=196 Win=6912 Len=0 TSV=85650942 TSER=7278645 16 225.873049 a.b.c.174 -> a.b.c.153 :: unbindRequest(3) 17 225.873111 a.b.c.174 -> a.b.c.153 :: 50179 > ldap [FIN, ACK] Seq=147 Ack=196 Win=6912 Len=0 TSV=85707385 TSER=7278645 18 225.873183 a.b.c.174 -> a.b.c.153 :: unbindRequest(2) 19 225.873227 a.b.c.174 -> a.b.c.153 :: 50178 > ldap [FIN, ACK] Seq=84 Ack=23 Win=5888 Len=0 TSV=85707385 TSER=7278645 #++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ For case A the steps 1 & 2 happens when translucent_bind action is executed (for the first time) and the step 3-6 are related to translucent_search action. I didn't check those for case B. Each successful request is processed the following way: 1. slapd opens the connection 2. slapd binds succefully (mostly with the credentials I wanted to use) 3. slapd sends request and receives the requested data 4. slapd unbinds and closses connection from step 1

2 3

Strong authentication required error
by Steinmetz, Robin 10 Aug '09

10 Aug '09

Hi, I am trying to setup a chaining configuration, all seems to work except that is i try to add/modify/del i get the message Strong auth required. Can someone help met out? Part of Chain server config: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org overlay chain chain-uri "ldap://10.253.2.7" chain-idassert-bind bindmethod="simple" binddn="xxxx" credentials="xxxxx" mode="self" chain-tls start chain-return-error TRUE access to * by * read pidfile /var/run/slapd-test-chain.pid argsfile /var/run/slapd-test-chain.args allow bind_v2 ####################################################################### # BDB database definitions ####################################################################### database bdb overlay syncprov #sessionlog 666 10000 syncprov-checkpoint 100 10 syncprov-sessionlog 100 suffix "dc=test,c=test" # Access database admin rootdn "xxxx" rootpw xxxxx syncrepl rid=444 provider=ldap://10.253.2.9:389 bindmethod=simple binddn="xxxxx" credentials=xxxx searchbase="dc=test,c=test" schemachecking=off type=refreshAndPersist retry="60 +" updateref "ldap://10.253.2.9"

2 2

Why did an index broke my config ?
by Denis BUCHER 10 Aug '09

10 Aug '09

Hello everyone, I added this in the config of my email server : > index virtualdomain eq But it broke the mail server, all emails were refused because Relaying denied. In fact postfix was not able anymore to find domains. For some reason, adding this index in the config made impossible to find this domain for programs... Don't know if my explanation is clear, but my question is "why adding an index breaks the config" ? Thanks a lot in advance for any help ! Denis

4 4

OpenLDAP + Kerberos on FreeBSD 7.2, close to working but not quite
by Allan 09 Aug '09

09 Aug '09

Hello, I've been reading around on OpenLDAP + Kerberos (FreeBSD 7.2) for authentication/authorization. I'm a bit confused on how to get it all working but I've gotten far enough that I can run getent passwd test.user and it pulls down the information from ldap (ran as root and non-root user). I can also successfully get a ticket with kinit from various users. Where I run into problems, is actually getting services to use GSSAPI. I am currently using nss_ldap and pam_ldap to authenticate during ssh login, if there's a better alternative please let me know. Here's the setup I've got: Services -> FQDN -> IP ldap/kdc -> frisbee.crazy.lan -> 192.168.1.5 ssh -> cake.crazy.lan -> 192.168.1.6 Running kinit: ============================================================== cake# kinit ldapadm ldapadm(a)CRAZY.LAN's Password: kinit: NOTICE: ticket renewable lifetime is 1 week cake# klist Credentials cache: FILE:/tmp/krb5cc_0 Principal: ldapadm(a)CRAZY.LAN Issued Expires Principal Aug 9 17:45:41 Aug 10 03:45:41 krbtgt/CRAZY.LAN(a)CRAZY.LAN ============================================================== Here's what I run to authenticate with SSH: ============================================================== cr4z3d@Allan-PC:~$ ssh -v -oGSSAPIAuthentication=yes -oGSSAPIDelegateCredentials=yes test.user(a)cake.crazy.lan OpenSSH_5.1p1 Debian-5ubuntu1, OpenSSL 0.9.8g 19 Oct 2007 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to cake.crazy.lan [192.168.1.6] port 22. debug1: Connection established. debug1: identity file /home/cr4z3d/.ssh/identity type -1 debug1: identity file /home/cr4z3d/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /home/cr4z3d/.ssh/id_dsa type 2 debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024 debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 FreeBSD-20080901 debug1: match: OpenSSH_5.1p1 FreeBSD-20080901 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'cake.crazy.lan' is known and matches the DSA host key. debug1: Found key in /home/cr4z3d/.ssh/known_hosts:47 debug1: ssh_dss_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received ============================================================== I've tried different options in /usr/local/etc/ldap.conf for pam_ldap/nss_ldap (the conf files are symlinked). The first one is with SASL turned on and the second with out. ============================================================== #define the ldap server's fqdn host frisbee.crazy.lan # define the base search pattern base dc=crazy,dc=lan # define the uri uri ldap://frisbee.crazy.lan # use starttls ssl start_tls # use sasl for all authentications use_sasl on # SASL authorization ID sasl_auth_id host/cake.crazy.lan #check the server's cert tls_checkpeer yes # full path to CA's cert tls_cacertfile /usr/local/etc/openldap/certs/cacert.pem # enable debug #debug 9 ============================================================== Here is the logs from the ldap server: ============================================================== Aug 9 17:47:21 frisbee slapd[86935]: conn=15 fd=11 ACCEPT from IP= 192.168.1.6:56955 (IP=0.0.0.0:389) Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=0 STARTTLS Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=0 RESULT oid= err=0 text= Aug 9 17:47:21 frisbee slapd[86935]: conn=15 fd=11 TLS established tls_ssf=256 ssf=256 Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=1 BIND dn="" method=163 Aug 9 17:47:21 frisbee slapd[86935]: SASL [conn=15] Failure: Couldn't find mech GSSAPI Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=1 RESULT tag=97 err=7 text=SASL(-4): no mechanism available: Couldn't find mech GSSAPI Aug 9 17:47:21 frisbee slapd[86935]: conn=15 op=2 UNBIND Aug 9 17:47:21 frisbee slapd[86935]: conn=15 fd=11 closed ============================================================== This is where I get a bit confused, it tells me that there's no mechanism for GSSAPI.. So I try changing to no SASL options in the configuration file: ============================================================== #define the ldap server's fqdn host frisbee.crazy.lan # define the base search pattern base dc=crazy,dc=lan # define the uri uri ldap://frisbee.crazy.lan # use starttls ssl start_tls #check the server's cert tls_checkpeer yes # full path to CA's cert tls_cacertfile /usr/local/etc/openldap/certs/cacert.pem # enable debug #debug 9 ============================================================== This leads to the following in the ldap logs when trying to SSH in: ============================================================== Aug 9 18:16:57 frisbee slapd[86935]: conn=87 fd=11 ACCEPT from IP= 192.168.1.6:63817 (IP=0.0.0.0:389) Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=0 STARTTLS Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=0 RESULT oid= err=0 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 fd=11 TLS established tls_ssf=256 ssf=256 Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=1 BIND dn="" method=128 Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=1 RESULT tag=97 err=0 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=2 SRCH base="dc=crazy,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=test.user))" Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire Aug 9 18:16:57 frisbee slapd[86935]: <= bdb_equality_candidates: (uid) not indexed Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=3 SRCH base="dc=crazy,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixGroup))" Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=3 SRCH attr=cn userPassword memberUid uniqueMember gidNumber Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=4 SRCH base="dc=crazy,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=test.user))" Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=4 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire Aug 9 18:16:57 frisbee slapd[86935]: <= bdb_equality_candidates: (uid) not indexed Aug 9 18:16:57 frisbee slapd[86935]: conn=87 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= ============================================================== It just keeps asking for my password and outputs the following in auth.log on the ssh server: ============================================================== Aug 9 18:36:42 cake sshd[63643]: pam_ldap: error trying to bind as user "uid=test.user,ou=people,dc=crazy,dc=lan" (Server is unwilling to perform) Aug 9 18:36:42 cake sshd[63640]: error: PAM: authentication error for test.user from 192.168.1.119 Aug 9 18:36:42 cake sshd[63644]: nss_ldap: reconnected to LDAP server ldap://frisbee.crazy.lan after 1 attempt ============================================================== So while root I tried su test.user and was surprised to see that had worked. I was able to run commands as test.user souch as touch file, but if I tried whoami it just sat there until I broke the command with ctrl+c. On the ldap server I had the following in the logs: ============================================================== Aug 9 18:49:29 frisbee slapd[86935]: conn=150 fd=15 ACCEPT from IP= 192.168.1.6:60126 (IP=0.0.0.0:389) Aug 9 18:49:29 frisbee slapd[86935]: conn=150 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:49:29 frisbee slapd[86935]: conn=150 op=0 STARTTLS Aug 9 18:49:29 frisbee slapd[86935]: conn=150 op=0 RESULT oid= err=0 text= Aug 9 18:49:29 frisbee slapd[86935]: conn=150 fd=15 closed (TLS negotiation failure) Aug 9 18:49:29 frisbee slapd[86935]: conn=151 fd=15 ACCEPT from IP= 192.168.1.6:60601 (IP=0.0.0.0:389) Aug 9 18:49:29 frisbee slapd[86935]: conn=151 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:49:29 frisbee slapd[86935]: conn=151 op=0 STARTTLS Aug 9 18:49:29 frisbee slapd[86935]: conn=151 op=0 RESULT oid= err=0 text= Aug 9 18:49:29 frisbee slapd[86935]: conn=151 fd=15 closed (TLS negotiation failure) Aug 9 18:49:29 frisbee slapd[86935]: conn=152 fd=15 ACCEPT from IP= 192.168.1.6:50915 (IP=0.0.0.0:389) Aug 9 18:49:29 frisbee slapd[86935]: conn=152 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 9 18:49:29 frisbee slapd[86935]: conn=152 op=0 STARTTLS Aug 9 18:49:29 frisbee slapd[86935]: conn=152 op=0 RESULT oid= err=0 text= Aug 9 18:49:29 frisbee slapd[86935]: conn=152 fd=15 closed (TLS negotiation failure) ============================================================== There seems to be something wrong with the TLS negotiation, but I've ensured that the CN for my key is frisbee.crazy.lan. I Set the CA's cert CN to allanfeid.com (i own the domain) At this point I'm unsure where to go to continue troubleshooting and getting this to work. I'm just trying to get a solid Single Sign-on solution using kerberos, ldap, and sasl for a learning experience. If there is a more appropriate way of acheiving this, I'm open to suggestions. Here's my ldap and slapd configuration files: (server) frisbee# cat /usr/local/etc/openldap/ldap.conf ============================================================== TLS_CACERT /usr/local/etc/openldap/certs/CA/cacert.pem ============================================================== (client) cake# cat /usr/local/etc/openldap/ldap.conf ============================================================== # path to CA's cert TLS_CACERT /usr/local/etc/openldap/certs/cacert.pem # define base to our search BASE dc=crazy,dc=lan # define uri to openldap URI ldap://frisbee.crazy.lan ============================================================== (server) frisbee# cat /usr/local/etc/openldap/slapd.conf note: i removed a lot of comments to save space ============================================================== include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/duaconf.schema include /usr/local/etc/openldap/schema/dyngroup.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/krb5-kdc.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # SSL/TLS cipher order preference TLSCipherSuite HIGH # Full path to CA cert file TLSCACertificateFile /usr/local/etc/openldap/certs/CA/cacert.pem # Full path to server's TLS cert TLSCertificateFile /usr/local/etc/openldap/certs/private/slapdcert.pem # Full path to server's TLS key TLSCertificateKeyFile /usr/local/etc/openldap/certs/private/slapdkey.pem # Password hashing mechanism password-hash {SSHA} # log level loglevel 256 # refuse simple binds disallow bind_simple ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=crazy,dc=lan" directory /var/db/openldap-data # Indices to maintain index default eq,pres index objectClass eq index cn,sn,givenname,mail eq,pres,sub # ACL Definitions authz-policy from authz-regexp uid=(.*),cn=crazy.lan,cn=GSSAPI,cn=auth uid=$1,ou=people,dc=crazy,dc=lan # SASL hostname sasl-host frisbee.crazy.lan access to * by dn="uid=ldapadm,cn=gssapi,cn=auth" write by * read access to * by * read ==============================================================

2 1

Using syncrepl in single slapd instance.
by Laurence Field 07 Aug '09

07 Aug '09

I have been investigating the use of syncrepl as a replacement for the mechanism we are currently using in our system and become stuck. Here is the scenario to put the problem in context. Within our infrastructure there is the order of 1000 Grid services each of which runs its own LDAP server that contains information about its structure and state under the DN mds-vo-name=resource,o=grid. Each institute that that operates a Grid service (in the order of 300 distributed globally), runs an LDAP server containing the consolidated information from all services within its domain under the DN mds-vo-name=site-name,o=grid. In addition, there are about 70 top-level LDAP servers distributed globally that contain the consolidated information from all sites using the DN mds-vo-name=local,o=grid. At the moment the LDAP databases are updated externally via process that polls the LDAP server for all information, which is very inefficient. Syncrepl seems to be a better mechanism to use however, I am having difficulty with one scenario. Using standard syncrepl with a relay, the site-level LDAP server can be configured with the following slapd.conf file. http://lfield.web.cern.ch/lfield/bdii-slapd.conf-basic-rep However, the site LDAP server is a Grid service and needs to publish itself. If I try to just to an LDAP add I get the following message, which I guess is due to the fact that this part of the database is now "owned" by the syncrepl process. ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral I tried to work around this problem by using another database and some more relays the result of which can be seen in the following file. http://lfield.web.cern.ch/lfield/bdii-slapd.conf However, this result with the following error, which suggests that I can't "mask" a database with a relay that points somewhere else. bdii-slapd.conf: line 69: <suffix> namingContext "Mds-Vo-name=resource,o=internal" already served by a preceding bdb database serving namingContext "Mds-Vo-name=resource,o=internal" Does anyone have an example of how to do a syncrepl where a single slapd instance can act as both the consumer and producer? Also, has anyone done any scalability/reliability tests with syncrepl? Thanks, Laurence

2 3

SASL LDAP binding over IPv6
by Xu, Qiang (FXSGSC) 07 Aug '09

07 Aug '09

Hi, all: In using ldapsearch to bind to a server with IPv6 address, some error pops up: =========================================================== qxu@durian(pts/3):/etc[133]$ kinit XCTEST100(a)XCIPV6.COM Password for XCTEST100(a)XCIPV6.COM: qxu@durian(pts/3):/etc[134]$ klist Ticket cache: FILE:/tmp/krb5cc_20153 Default principal: XCTEST100(a)XCIPV6.COM Valid starting Expires Service principal 06/09/09 17:35:18 06/10/09 03:34:41 krbtgt/XCIPV6.COM(a)XCIPV6.COM renew until 06/10/09 17:35:18 qxu@durian(pts/3):/etc[135]$ ldapsearch -Y GSSAPI -H 'ldap://3ffe:2000:0:1:e0be:1872:d4f8:6b2c' -b 'dc=xcipv6,dc=com' -s sub -LLL 'cn=XCTEST100' mail Could not create LDAP session handle for URI=ldap://3ffe:2000:0:1:e0be:1872:d4f8:6b2c (-9): Bad parameter to an ldap routine qxu@durian(pts/3):/etc[136]$ ldapsearch -Y GSSAPI -H 'ldap://[3ffe:2000:0:1:e0be:1872:d4f8:6b2c]' -b 'dc=xcipv6,dc=com' -s sub -LLL 'cn=XCTEST100' mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) =========================================================== Shall I add the brackets [] around the IPv6 address? DNS server has been correctly set up, because sasl binding over IPv4 address is good. Any possible reason for the failure of ldapsearch? Thanks, Xu Qiang

3 20

Secret not in database
by Seau Yeen Su 06 Aug '09

06 Aug '09

Hi everyone, I have successfully installed cyrus-sasl-2.1.23 and openldap-2.3.27 plus BerkeleyDB.4.3 in my RHEL5.2 server. After the installation, i used saslpasswd2 -c to create an admin user: saslpasswd2 -c admin After that, I thought of doing a search on the database with the command : ldapsearch -H ldap:///localhost -Y DIGEST-MD5 -d 2 -U admin but it returned an error of : ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database When i did a check on /etc/, the sasldb2 file is there. I do not know and understand why it cannot find this user. Did i miss out anything. Below is excerpt from my slapd.conf file password-hash {CLEARTEXT} authz-regexp uid=(.*),cn=synabase-dev5.synamatixdev.com,cn=DIGEST-MD5,cn=auth ldap:///dc=synamatixdev,dc=com??sub?uid=$1 authz-regexp uid=(.*),cn=synabase-dev5.synamatixdev.com,cn=DIGEST-MD5,cn=auth uid=$1 Under rootpw, i typed the password in clear text, for eg, the password i create for admin was root. Hence it looks like: rootpw root Did i do anything wrong? Where is the error? Hope to receive some help. I have been trying to install openldap with cyrus for 4 months but to no avail :( -- Warmest Regards, Seau Yeen

4 5

Possible workaround to slapo-ppolicy sync limitations
by Jordi Espasa Clofent 06 Aug '09

06 Aug '09

Hi, This post is because of: http://www.openldap.org/lists/openldap-technical/200906/msg00221.html http://www.openldap.org/lists/openldap-technical/200908/msg00028.html So, if you're using ppolicy-slapo in a load-balanced environment, you pool servers never will be sync completely; at least, the ppolicy state atributes will be not replicated. I know isn't really a slapo-ppolicy limitation rather than RFC especification consequence. Well... I want my load-balancing environment and I want also the ppolicy overlay. So ¿how to make an effective workaround? At first, I've thinked in next scenario: * 1 provider and 2 consumers * every 5 minutes the consumers rsync the contents of master ddbb (/var/lib/ldap/* in my case, Debian Lenny boxes) ¿It will be enough? I wonder if consumers slapd can accept these data change "on the fly" or maybe restarting the service is mandatory. -- Thanks, Jordi Espasa Clofent

3 2

Problems with heimdal ldap backend
by Andreas Roth 06 Aug '09

06 Aug '09

Hello, i've a heimdal (1.2) server which uses the OpenLDAP (2.4.15) directory for data storage. When i run the following script: #!/bin/sh for i in `seq 1 10000`; do kinit --password-file=passwd && echo "ok $i" || break; done At some point the kinit fails, because heimdal cannot connect to the LDAP server. heimdal-kdc server fails at ldap_sasl_bind_s with 'Can't contact LDAP server'. Heimdal access the LDAP directory is using the ldapi:///. When i 'slow-down' the LDAP server with strace or by enable debug log to console the number of successful kinit runs increase. It seems to be a some kind of timing problem, but i don't have a clue to find out what's the reason for it. Maybe someone here on the list can help me. Thanks in advance, Andreas

1 0

error when setting an alias entry.. (ldap_add: Naming violation (64))
by Michael March 05 Aug '09

05 Aug '09

I'm following this: http://www.openldap.org/faq/data/cache/1111.html I'm getting this error: ldap_add: Naming violation (64) additional info: value of naming attribute 'uid' is not present in entry Here are the sample ldif entries: dn: uid=luzer,ou=main,dc=acme,dc=com uid: luzer objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash userPassword: {SSHA}8Sz/X2Fv1S1COqD46K5kEwFS2Lyj4h2I shadowWarning: 7 uidNumber: 1000 shadowMax: 99999 gidNumber: 1000 sn: De Torre homeDirectory: /home/luzer mail: luzer givenName: Bob shadowLastChange: 14007 cn: luzer dn: uid=luzer,ou=alternate,dc=acme,dc=com objectclass: alias objectclass: extensibleObject uid: alias aliasedobjectname: uid=luzer,ou=main,dc=acme,dc=com -- <admiral> Michael F. March

4 7

How to detect a corrupt database?
by Jordi Espasa Clofent 05 Aug '09

05 Aug '09

Hi folks, I've experienced some problems in one of my 3 OpenLDAP servers. First glance suggests a ppolicy overlay problem, but, at the end, the problem was resolved, simply, deleting the bbdd (BDB4) and restarting the system (is a consumer server, so the ddbb was automatically regenerated). So, my questions are * ¿How I can detect a corrupt database? * ¿Is there any tool/command to check the ddbb health (DBD4)? * ¿What can I do if the corrupted database is the provider database? -- Thanks, Jordi Espasa Clofent

4 5

ldap database directory permission denied
by yilmaz 05 Aug '09

05 Aug '09

Hello, I have a problem to run openldap in a different directory other than /var/lib/ldap I am using Redhat AS 4 (update 4) with selinux disabled. Openldap version is 2.4.13 . The message written into syslog is "line 24: invalid path: Permission denied " . Line 24 specifies is a different directory than /var/lib/ldap and directory has the 755 permission of the user running ldap daemon. Google search has revealed some issues on ubuntu and on redhat with selinux enabled but I have neither of these. If I change the directory to /var/lib/ldap everything works fine. I hope someone could shed me light on this issue. thanks a lot.

2 1

objectclass glue problem
by Steinmetz, Robin 05 Aug '09

05 Aug '09

Hi, I created some records with phpldapadmin but now they look like this: dn: ozsSys=aaaaa,o=bbbb,ozsDir=APO-patient,o=ozs,c=nl objectClass: top objectClass: glue structuralObjectClass: glue ozsSys=aaaaa instead of dn: ozsSys=aaaaa,o=bbbb,ozsDir=APO-patient,o=ozs,c=nl objectClass: ozsSystem structuralObjectClass: ozsSystem ozsSys=aaaaa Is There a way to change these glue entries without reloading a complete tree? The normal ldapmodify doesn't allow to change this and ldapsearch can't find these records. Ldapdelete won't delete them either. Entries loaded under this dn can be found/modifies/deleted as normal Regards, Robin

1 0

value-based modify operation on binary attribute fails
by Kay.Kirchhoefer＠t-systems.com 05 Aug '09

05 Aug '09

Hi, I´m trying to remove the attribute "userCertificate;binary" from an entry, if it (attr) contains a special value (certificate). I´m trying this operation with perl ldap modules and also with Gawojar ldap browser. Both were working for me when I was using OpenLDAP 2.3.20. Now I´m using OpenLDAP 2.4.12 and I get an error message MOD attr=userCertificate;binary RESULT tag=103 err=16 text=modify/delete: userCertificate;binary: no such value but I send the modify request by using exactly the same value as I get from the ldap server (I compared the bytes sent across the network with wireshark) when requesting it with a ldapsearch. As I already wrote the same function worked for me with the older OpenLDAP version. I also tried to modify text attributes; that´s working. I didn´t found anything in the change log which is pointing to a fix regarding the comparison mechanism. Has anybody else had that problem ? Yours sincerely, Kay

2 2

Re: ldap PDC -- Failed to issue the StartTLS instruction
by Quanah Gibson-Mount 04 Aug '09

04 Aug '09

--On August 4, 2009 4:20:06 PM -0700 Ivan Ordonez <iordonez(a)nature.berkeley.edu> wrote: > Sorry Quanah, I am not following you on what you want me to do. Can you > please elaborate? > > Thank you for all your help. Keep replies on the list please. I was saying, I would have kept the ldaps:// URI in your config file, and drop the start TLS bit, and seen whether or not that works. In either case, I would use the ldapsearch binary to test against your server, both with ldaps:// URIs, and with ldap:// URIs using the -ZZ or -ZZZ flags to ldapsearch. ldapsearch with ldap:/// and -ZZ(Z) will use startTLS. ldapsearch with ldaps:// will try an SSL connection to the LDAP server. This way, you can hopefully get more meaningful error messages. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ldap PDC -- Failed to issue the StartTLS instruction
by Ivan Ordonez 04 Aug '09

04 Aug '09

Hello, We've been using an ldap based PDC from quite a while. Now we're suddenly having trouble getting our main fileserver to talk with the PDC. samba-3.2.13 on solaris 10. Here is our smb.conf global defs: Server role: ROLE_DOMAIN_MEMBER [global] workgroup = CNRDOM server string = nature (Samba %v) security = DOMAIN passdb backend = ldapsam:ldaps://169.229.xxx.yyy log level = 5 log file = /var/log/samba/log.%m name resolve order = wins host lmhosts os level = 65 local master = No domain master = No dns proxy = No wins support = Yes ldap ssl = start tls When we start up samba, we see many lines like these in log.smbd: [2009/08/03 15:40:40, 1] lib/smbldap.c:another_ldap_try(1170) Connection to LDAP server failed for the 4 try! and these: [2009/08/03 15:51:56, 0] lib/smbldap.c:smb_ldap_start_tls(595) Failed to issue the StartTLS instruction: Can't contact LDAP server [2009/08/03 15:51:56, 5] lib/smbldap.c:smbldap_search_ext(1199) smbldap_search_ext: base => [], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-22-1-97)(sambaSIDList=S-1-22-2-97)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2] [2009/08/03 15:51:56, 5] lib/smbldap.c:smbldap_close(1103) The connection to the LDAP server was closed But over on the PDC (gentoo linux 2.6.29, samba-3.2.13 , openldap-2.4.27) we see this in tcpdump: $ tcpdump -vv -c 4 port ldaps tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 15:51:29.736629 IP (tos 0x0, ttl 61, id 60609, offset 0, flags [DF], proto TCP (6), length 52) nature.Berkeley.EDU.56299 > xxxyyy.CNR.Berkeley.EDU.ldaps: S, cksum 0x6a18 (correct), 1637042825:1637042825(0) win 49640 <mss 1380,nop,wscale 0,nop,nop,sackOK> 15:51:29.736651 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) xxxyyy.CNR.Berkeley.EDU.ldaps > nature.Berkeley.EDU.56299: R, cksum 0x6c68 (correct), 0:0(0) ack 1637042826 win 0 15:51:30.746803 IP (tos 0x0, ttl 61, id 60610, offset 0, flags [DF], proto TCP (6), length 52) nature.Berkeley.EDU.56302 > xxxyyy.CNR.Berkeley.EDU.ldaps: S, cksum 0xa6d9 (correct), 2235230749:2235230749(0) win 49640 <mss 1380,nop,wscale 0,nop,nop,sackOK> 15:51:30.746827 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) xxxyyy.CNR.Berkeley.EDU.ldaps > nature.Berkeley.EDU.56302: R, cksum 0xa929 (correct), 0:0(0) ack 2235230750 win 0 It appears that there is indeed an ldaps conversation going on. We created new certificate on the PDC to see if certificate is the problem to no avail. Same message, and same problem. We disable firewall on the PDC as well and make sure that LDAP ports are all open. The Solaris 10 machine (ROLE_DOMAIN_MEMBER) and the PDC are on two different subnets. We're hoping someone will recognize this behavior and reveal our mistake to us. Or perhaps point out where we should check/debug/RTFM next.

2 3

olcDbConfig: value #14 provided more than once
by Matthew Edlefsen 03 Aug '09

03 Aug '09

Hello, I'm trying to do multi-master replication and after following the directions in the User Guide I came across the error: Aug 3 20:21:38 gabbro slapd[81578]: syncrepl_message_to_entry: rid=001 mods check (olcDbConfig: value #14 provided more than once) This is from the logs when it is syncing the cn=config tree. The especially odd thing about this error is that olcDbConfig is one of the numbered entries (the ones with {#} prepending each value), not to mention that the line is question is blank. This isn't the first time I've encountered this error when trying to do this type of thing (alas, I never got around to trying to fix it before :) ), so I'm hoping that means either I'm doing something obviously wrong or somebody has seen this before. Both servers are freebsd jails running FreeBSD 7.2 Stable. Here are some of the relevant configs. These are not the full entries, just the important bits. They are identical on both servers and they do sync parts of the config (everything up to the value that fails). dn: cn=config olcServerID: 1 ldap://rock.earlham.edu/ olcServerID: 2 ldap://gabbro.earlham.edu/ dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=dap://rock.earlham.edu/ binddn="<snip>" bindmethod=simple credentials=<snip> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://gabbro.earlham.edu/ binddn="<snip>" bindmethod=simple credentials=<snip> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcDatabase={1}bdb,cn=config olcDbConfig: {0}# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/12/18 11:53:27 ghenry Exp $ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co…> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig: {8}# <http://www.openldap.org/faq/index.cgi?file=2> olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon rebuilding olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 1 GB cache olcDbConfig: {16}set_cachesize 0 1073741824 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 104857600 olcDbConfig: {24}set_lk_max_locks 100000 olcDbConfig: {25}#set_lg_dir logs olcDbConfig: {26} olcDbConfig: {27}# Note: special DB_CONFIG flags are no longer needed for "quick" olcDbConfig: {28}# slapadd(8) or slapindex(8) access (see their -q option). Thanks! Matt Edlefsen Earlham College

5 8

slapd + TLS + SAMBA
by Alessandro Baggi 02 Aug '09

02 Aug '09

Hi there. I've another problem with TLS slapd and samba. For each operation with slapd (ldapsearch -x -ZZ, getent, or samba tls connection) I receive from slapd: Aug 2 11:31:05 PDC slapd[1709]: connection_read(23): unable to get TLS client DN, error=49 id=4 What's the problem? My certificate? Certificate's creation is: /usr/lib/ssl/misc/CA.pl -newca openssl req -newkey rsa:1024 -nodes -keyout key.pem -out newreq.pem /usr/lib/ssl/misc/CA.pl -sign Then another problem is when I start slapd on the boot, after slapd startup, samba , that try to connect to ldap with tls, could not connect to slapd and give me: 2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_parse_extended_result [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_parse_result [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_msgfree [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] TLS: can't connect: Error in the push function.. [2009/08/01 17:45:15, 0] lib/smbldap.c:smb_ldap_start_tls(596) [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_err2string Failed to issue the StartTLS instruction: Connect error This only if I put in slapd.conf TLSClientVerify demand, if I put TLSClientVerify never, samba connect to it, under TLS without problems. Another issue is that, if i run slapd on startup and run samba after login with /etc/init.d/samba start, it makes the connection successfully without error. In the same script of slapd boot I set an "ldapsearch -x -ZZ -d -1" I receive: TLS: can't connect: Error in the push function.. the same of samba. Anyone has ideas? The problem is in certificates? thanks in advance

1 0

force creation of a "glue" node in the database?
by Robert Hanson 31 Jul '09

31 Jul '09

Using 2.4.16 on RedHat Linux. Does anyone know of a way to force the creation of a "glue" node in ldap? Here is the scenario: For some (as yet unknown) reason, our database sometimes has "glue" nodes. I'm suspecting this relates to syncrepl, but have not been able to diagnose the problem yet. I'm working on adding the manageDSAit control to our server requests (using the c client interface). I'd like a way to test this automatically. One way to do that would be to have the test program create a "glue" node and see that it can be found by the client code. I can't find a way to get the glue node created; I'm always getting a error 65 invalid structural object class chain.

1 0

lastmod in slapd.conf
by Srinidhi Sharma 31 Jul '09

31 Jul '09

Hi, Is it possible to detect using JNDI api's if the lastmod is turned on in Open-ldap slapd.conf file ? any pointers would be helpful. -- Thanks, Srinidhi

2 1

RE: entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16)
by Robert Hanson 31 Jul '09

31 Jul '09

What I need is to have the "glue" items returned as part of the search. It looks to me like I can get nodes that are "glue" nodes to be part of the results by commenting out these lines: in src\servers\slapd\back-bdb\search.c, lilnes 908-91 if ( !manageDSAit && is_entry_glue( e )) { goto loop_continue; } If I comment out these lines, then I get the results I'm looking for. Are there any other implications to the "glue" nodes? It looks like I'm able to edit and delete these nodes as well. But there is code in delete.c, modify.c, modrdn.c that worry about glue nodes. Another option would be to redefine the is_entry_glue macro to always return false. Is that a better approach? ________________________________ From: Robert Hanson Sent: Thursday, July 30, 2009 11:08 AM To: 'openldap-technical(a)openldap.org' Subject: entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16) Is this bug ITS#4626? Or is there a workaround? ==== Using a build of 2.4.16 on RedHat linux; in a multi-master environment with 2 nodes. On both nodes, I have a tree that has a node "ou=Company, o=MyCompanyName". Under that are several nodes that are "glue" nodes. Following those is a actual data node. Slapd 2.4.16, built from source, running on redhat linux) I have seen this occur several times on various test systems with similar configurations. The data in these nodes is inserted, in the proper order, (parent then children) using ldap client calls (ldap_add_s). Later, when I go to look at the output of slapcat, I see that some nodes are replaced with "glue" nodes. Questions: 1) Why are these glue nodes created? Is there a known bug that will cause existing nodes to be deleted without the children being deleted? Is this an issue in replication? (where syncrepl needs to create a node where the parent does not exist). Is that why the glue nodes are created later? 2) How can I change the "glue" to some other class? Can that be done programmatically? 3) ======== This is a dump of slapcat (with unnecessary nodes removed) dn: o=MyCompanyName objectClass: organization o: MyCompanyName structuralObjectClass: organization entryUUID: feb5b352-2eb7-102d-8c1f-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.418938Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z contextCSN: 20090728202448.877262Z#000000#001#000000 contextCSN: 20090728202123.336320Z#000000#002#000000 dn: ou=Company,o=MyCompanyName ou: Company description: 3.0.0 objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: feb7a41e-2eb7-102d-8c28-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.432024Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z dn: lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 0136f8e0-0ff7-102e-8da5-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Servers,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 014e7632-0ff7-102e-8db3-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Application Data,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: e5a152de-0fff-102e-923c-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: appName=Configurations,ou=Application Data,lcc=Call Center 1,ou=Company,o= MyCompanyName entryUUID: e5a299f0-0fff-102e-923d-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z structuralObjectClass: applicationUnit appName: Configurations objectClass: applicationUnit entryCSN: 20090728202143.649526Z#000000#001#000000 modifiersName: cn=Client,ou=People,o=MyCompanyName modifyTimestamp: 20090728202143Z

3 3

entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16)
by Robert Hanson 30 Jul '09

30 Jul '09

Is this bug ITS#4626? Or is there a workaround? ==== Using a build of 2.4.16 on RedHat linux; in a multi-master environment with 2 nodes. On both nodes, I have a tree that has a node "ou=Company, o=MyCompanyName". Under that are several nodes that are "glue" nodes. Following those is a actual data node. Slapd 2.4.16, built from source, running on redhat linux) I have seen this occur several times on various test systems with similar configurations. The data in these nodes is inserted, in the proper order, (parent then children) using ldap client calls (ldap_add_s). Later, when I go to look at the output of slapcat, I see that some nodes are replaced with "glue" nodes. Questions: 1) Why are these glue nodes created? Is there a known bug that will cause existing nodes to be deleted without the children being deleted? Is this an issue in replication? (where syncrepl needs to create a node where the parent does not exist). Is that why the glue nodes are created later? 2) How can I change the "glue" to some other class? Can that be done programmatically? 3) ======== This is a dump of slapcat (with unnecessary nodes removed) dn: o=MyCompanyName objectClass: organization o: MyCompanyName structuralObjectClass: organization entryUUID: feb5b352-2eb7-102d-8c1f-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.418938Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z contextCSN: 20090728202448.877262Z#000000#001#000000 contextCSN: 20090728202123.336320Z#000000#002#000000 dn: ou=Company,o=MyCompanyName ou: Company description: 3.0.0 objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: feb7a41e-2eb7-102d-8c28-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.432024Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z dn: lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 0136f8e0-0ff7-102e-8da5-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Servers,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 014e7632-0ff7-102e-8db3-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Application Data,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: e5a152de-0fff-102e-923c-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: appName=Configurations,ou=Application Data,lcc=Call Center 1,ou=Company,o= MyCompanyName entryUUID: e5a299f0-0fff-102e-923d-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z structuralObjectClass: applicationUnit appName: Configurations objectClass: applicationUnit entryCSN: 20090728202143.649526Z#000000#001#000000 modifiersName: cn=Client,ou=People,o=MyCompanyName modifyTimestamp: 20090728202143Z

1 0

Radius authentication and storing passwords in cleartext
by Eric Bourkland 29 Jul '09

29 Jul '09

I have zimbra openLDAP v2.3.43 running on RHEL4.7 ES and I am trying to connect our freeRadius server to authenitcate against LDAP. I have also being trying to stand up plane openLDAP v2.4.17 to see if I can get that to work. Free Radius requires PEAP/CHAPv2 to authenticate, which means it needs to be handed a clear text password in order to work. Yes, I know in general this is not a good idea. How can I configure openLDAP to store passwords (userpassword attribute) in cleartext. Or at the very least create a script that will be able to take the encrypted password and store it in cleartext as another attribute. Thanks,

5 4

Member-of plugin support for nested membership
by Mathias Gug 29 Jul '09

29 Jul '09

Hi, While discussing the possibility of using openldap in place of 389 directory in the FreeIPA project [1] the following technical detail was mentioned. [1]: https://www.redhat.com/archives/freeipa-devel/2009-July/msg00333.html According to the memberof overlay man page: The memberof overlay to slapd(8) allows automatic reverse group member‐ ship maintenance. Any time a group entry is modified, its members are modified as appropriate in order to keep a DN-valued "is member of" attribute updated with the DN of the group. Does the memberOf overlay deal with nested membership? Or is it strictly a 1:1 relationship (forward pointer, reverse pointer)? The 389 memberOf plug-in maintains reverse pointers for inherited membership which IPA takes advantage of. -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

1 0

Re: get_ava: illegal value with translucent proxy
by Petteri Heinonen 29 Jul '09

29 Jul '09

Pierangelo Masarati [masarati(a)aero.polimi.it] kirjoitti: > Petteri Heinonen wrote: > > Pierangelo Masarati [masarati(a)aero.polimi.it] wrote: > >> Petteri Heinonen wrote: > >> > Hi, I've setup a translucent proxy. Now, I have tried to do some > >> test > searches. For example this works ok: > >> > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > >> "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" > >> > > Search is proxied through proxy to the actual server, and correct > >> result > is returned. However, if I try this: > >> > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > >> "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" > >> > > I get no results. I have monitored the traffic between proxy and > >> backend > server, and the query is not even sent there. In OpenLDAP > >> log there is: > >> > > Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for > > >> attributeType objectClass > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 > >> > > What would be the problem here? > >> > >> The objectClass "User" is not defined in the proxy's schema? > >> > >> p. > >> > > > > That's correct. But in translucent overlay's documentation, there is: > > > > "Note: The Translucent Proxy overlay will disable schema checking in the > > local database, so that an entry consisting of overlay attributes need > > not adhere to the complete schema." > > > > But it seems that schema checking is still in affect when doing > > searches. Is there a way to disable local schema checking altogether? Or > > do I have to build some dummy schema so that OpenLDAP is aware about > > objectClasses I want to search for? > > What happens is that you use unknown schema items in the *filter*, which > requires it to be known in order to apply appropriate matching rules and > so. The schema relaxation in the documentation refers to enforcing > adherence with allowed and required attributes of an objectclass, and > with stored objectclasses complying with structural inheritance > relationship. Schema items need to be known anyway. > > p. > Ok, thanks for the clarification. I guess that my goal to have an Active Directory proxied properly is not going to happen. I would need a complete AD schema for OpenLDAP, and that's probably now available anywhere.

2 1

Mirror mode with additional consumer
by Jens Thomas 29 Jul '09

29 Jul '09

Hi, i am new at this list, please forgive me my broken english. I have two questions, first, is it possible to setup two slapd (2.4.x) in mirror mode and add later one or more additional consumer slapd with syncrepl? The goal is to have a 2-server-HA system (where one server is always writeable) and distributed cache slapd's. Are there theoretical issues? A second problem, maybe you can give me a pointer: I would like to assign the right to add, modify and delete an object to an attribute inside the same object (and necessarily to the container object). Maybe ACI and the corresponding overlay is what i need. Or can this be solved by using regex? Thanks a lot, with kind regards Jens -- linux systeme thomas Jens Thomas Völklinger Straße 9 42285 Wuppertal Telefon: +49.202.3097507 Mobil: +49.177.9301386 eFax: +49.202.85064329 Web: http://linux-systeme-thomas.de USt-ID: DE250711901

3 3

Re: get_ava: illegal value with translucent proxy
by Petteri Heinonen 28 Jul '09

28 Jul '09

Pierangelo Masarati [masarati(a)aero.polimi.it] wrote: > Petteri Heinonen wrote: > > Hi, I've setup a translucent proxy. Now, I have tried to do some test > > searches. For example this works ok: > > > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" > > > > Search is proxied through proxy to the actual server, and correct result > > is returned. However, if I try this: > > > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" > > > > I get no results. I have monitored the traffic between proxy and backend > > server, and the query is not even sent there. In OpenLDAP log there is: > > > > Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter > > Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY > > Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for > > attributeType objectClass > > Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 > > > > What would be the problem here? > > The objectClass "User" is not defined in the proxy's schema? > > p. > That's correct. But in translucent overlay's documentation, there is: "Note: The Translucent Proxy overlay will disable schema checking in the local database, so that an entry consisting of overlay attributes need not adhere to the complete schema." But it seems that schema checking is still in affect when doing searches. Is there a way to disable local schema checking altogether? Or do I have to build some dummy schema so that OpenLDAP is aware about objectClasses I want to search for? -Petteri Heinonen --

2 1

send_search_entry: conn 9279837 ber write failed
by jakjr 27 Jul '09

27 Jul '09

Hello, some time ago I upgraded our server to version 2.4.16. Since then, for 3 times, the server hangs with this message: Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 fd=110 ACCEPT from IP=XXX.XXX.XXX.XX:41577 (IP=0.0.0.0:389) Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 BIND dn="cn=admin" method=128 Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 BIND dn="cn=admin" mech=SIMPLE ssf=0 Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 RESULT tag=97 err=0 text= Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=1 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=2 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=3 SRCH base="ou=seed" scope=2 deref=0 filter="(uidNumber=12916)" Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=4 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=5 SRCH base="ou=seed" scope=2 deref=0 filter="(&(gidNumber=20877)(phpgwAccountType=g))" Jul 27 09:32:33 sseed0013 slapd[22555]: conn=9279837 op=6 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=20877)(phpgwAccountType=u))" Jul 27 09:32:36 sseed0013 slapd[22555]: conn=9279837 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= *Jul 27 09:32:42 sseed0013 slapd[22555]: send_search_entry: conn 9279837 ber write failed.* The config and load of this server is almost the same of the old version (2.3.30) Thanks for any tip, Regards, João Alfredo

2 2

ACL on referral object (chaining) does not work
by Kay.Kirchhoefer＠t-systems.com 27 Jul '09

27 Jul '09

Hi, I have a question regarding ACL used together with chaining overlay configuration. I´m building several ldap servers which should chain each other, based on the selected path. I now wanted to prevent a chaining loop by using ACLs, but that doesn´t work for me. It seems like the ACL is not used for the referral objects. sample referral object: dn: o=testldap2,c=de objectClass: referral objectClass: extensibleObject o=testldap2 ref: ldap://testldap2/c=de <ldap://testldap2/c=de> chaining config: overlay chain chain-uri ldap://testldap2 <ldap://testldap2> chain-rebind-as-user yes chain-idassert-bind bindmethod="simple" binddn="cn=xxxxxx" credentials="yyyy" mode="self" chain-max-depth 1 chain-return-error TRUE ACL config: access to dn.base="o=testldap2,c=de" by peername.ip=192.168.1.1 none by * read 192.168.1.1 is the ip address of "testldap2". Everytime a request from this ip occurs, the server should block the access to the (referral) object because it must be a "chained" request But that doesn´t work. Also the parameter "chain-max-depth" seems not to work. I´m currently using OpenLDAP version 2.3.20 (but I also tried the latest one). Yours sincerely, Kay

2 1

get_ava: illegal value with translucent proxy
by Petteri Heinonen 27 Jul '09

27 Jul '09

Hi, I've setup a translucent proxy. Now, I have tried to do some test searches. For example this works ok: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" Search is proxied through proxy to the actual server, and correct result is returned. However, if I try this: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" I get no results. I have monitored the traffic between proxy and backend server, and the query is not even sent there. In OpenLDAP log there is: Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for attributeType objectClass Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 What would be the problem here? Regards, Petteri Heinonen

2 1

Problem - ldapadd invalid syntex (21)
by Bruno Steven 24 Jul '09

24 Jul '09

Hello I am newbie in use OpenLdap , I have simple problem I can´t add structure of tree directory, the file org.lidf show my structure dn: dc=labcom,dc=factory objectClass: top objectClass: dcObject #objectClass: organization dc: labcom o : Linuxtech When I type this command ldapadd -f /etc/openldap/lidfs/org.ldif -x -D "cn=adm,dc=labcom,dc=factory" -W Show this message error Enter LDAP Password: adding new entry "dc=labcom,dc=factory " ldapadd: Invalid syntax (21) Why this message error ? I have include the follow schemas include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema The process slapd have been started by user root, so haven´t problem of permission That is ... Thanks -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx

4 5

syncrepl and "no equality matching rule"
by Alain ZAMBONI 24 Jul '09

24 Jul '09

Hello, I run an LDAP directory on 3 servers : one master, and two slaves, synchronised with syncrepl. The 3 servers are running FreeBSD 7.0 and openLDAP 2.4.13. I encountered yesterday an issue with syncrepl that should have been solved with openLDAP 2.4.13 http://www.openldap.org/lists/openldap-software/200812/msg00040.html The synchronisation was blocking on the deletion of a facsimileTelephoneNumber. When the problem occured, the master entry was (only showing the facsimileTelephoneNumber attribute) : dn: uid=veinantep,ou=uds,ou=people,o=annuaire facsimileTelephoneNumber: 0388613347 And the slave entry was : dn: uid=veinantep,ou=uds,ou=people,o=annuaire facsimileTelephoneNumber: 0388612908 facsimileTelephoneNumber: 0388613347 The application doing the modification on the master is always using a "replace" operation, to avoid the "no equality matching rule" problem. It seems that syncrepl tries to synchronise the slave by generating the forbidden operation of deleting a precise facsimileTelephoneNumber. Is this problem known ? the release between 2.4.13 and 2.4.16 don't mentionned something about it. I managed to unlock the situation by completely deleting the "facsimileTelephoneNumber" on the master, then adding it again. The big problem of this little issue is that it is blocking all the synchronisation process between master and slaves ... By the way, is there a way to check the good state of the synchronisation with syncrepl (besides parsing the sync logs or doing recurring diff between the servers) ? I must admit that I miss slurpd's .rej files. Just in case, here are the log of one of the slaves : syncrepl_entry: rid=101 be_search (0) syncrepl_entry: rid=101 uid=veinantep,ou=uds,ou=people,o=annuaire bdb_modify: uid=veinantep,ou=uds,ou=people,o=annuaire bdb_dn2entry("uid=veinantep,ou=uds,ou=people,o=annuaire") bdb_modify_internal: 0x0001fc23: uid=veinantep,ou=uds,ou=people,o=annuaire <= acl_access_allowed: granted to database root bdb_modify_internal: delete facsimileTelephoneNumber bdb_modify_internal: 18 modify/delete: facsimileTelephoneNumber: no equality matching rule bdb_modify: modify failed (18) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=18 matched="" text="modify/delete: facsimileTelephoneNumber: no equality matching rule" null_callback : error code 0x12 syncrepl_entry: rid=101 be_modify (18) syncrepl_entry: rid=101 be_modify failed (18) Thanks, -- Alain ZAMBONI Direction Informatique Université de Strasbourg

2 2

access control
by Darryl Moore 24 Jul '09

24 Jul '09

I'm trying to set up access controls for the server. Here are the rules I am trying to impliment olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none olcAccess: {1}to dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none olcAccess: {2}to dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none olcAccess: {3}to dn.regex="cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=Admin,cn=$1,ou=Groups,dc=moores,dc=ca" write by group="cn=Management,ou=Groups,dc=moores,dc=ca" write by users read olcAccess: {4}to dn.base="ou=Groups,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {5}to dn.base="ou=People,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {6}to * by users read by * none - Basically I have groups, and within those groups I have Contact lists and administrators. I want the administrator to have write access, other members to have read access, and non members to have none. This rule is what I think should work for that: dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none I know this rule works for individual user contact lists: dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none I think the problem I am running into is having the <who> field as group.exact,expand Can I not do this? If not, is there any way to acheive the same result? thanks, darryl

3 5

Dying LDAP process and TLS
by Florian Götz 24 Jul '09

24 Jul '09

Hello everybody, I got some two serious problems with my LDAP, maybe you got a hint for it. Problem 1 might have a connection to nr 2, but I´m not sure. I use OpenLDAP 2.4.12 on a SLES11 system. The initscript to start/stop the service called "rcldap" know 3 states: unused, running and dead. When I startup the LDAP it´s in state running. It takes about 10-15min, the LDAP doesn´t respond anymore and a "rcldap status" tells me that the service is dead. I have no clue why it behaves this way. The logs tell me, that the Backup-System fetches some data and then the log ends without any further notice. The pid file still exists, but the process is gone. Problem 2 has to do with TLS. I got the CA of our (sub)company, a certificate for the ldap-machine and the associated private key file. The certificate chain is: Deutsche Telekom Root CA -> Company CA -> Subcompany CA -> Certificate of LDAP machine. The certificate for the ldap machine seems to be generated with/by the Company CA. If I put these files into the slapd config with: TLSCACertificateFile /etc/openldap/certs/SubcompanyCA.pem TLSCertificateFile /etc/openldap/certs/ldapcert.pem TLSCertificateKeyFile /etc/openldap/certs/ldapprivkey.pem TLSVerifyClient demand and the following lines in the /etc/ldap.conf: TLS_CACERT /etc/openldap/certs/SubcompanyCA.pem TLS_REQCERT demand it crashes at the TLS certificate verification, because he can´t get the local issuer certificate. If I use the Company CAs in both places instead of the Subcompany CA it´s failing too. If I mix it up with the SubcompanyCA in the slapd.conf and the CompanyCA in the ldap.conf, the certificate verification succeeds, but I get a TLS trace: SSL3 alert read:fatal:handshake failure I don´t know how to handle that problem. -- Best regards, Florian Götz -----

2 1

Propagation of proxyAuthz control
by Javier Manteiga 24 Jul '09

24 Jul '09

Hi all, We are trying to set a system with the DIT split in several servers, using the Meta backend to proxy the LDAP requests among them. In the remote servers we would like to check the ACLs using the identity of the client that sent the request, instead of the identity used to create the proxy connections. For this we have configured the idassert parameters in the meta targets as follows: idassert-bind bindmethod=simple binddn="cn=manager,dc=operator,dc=com" (root user of the backend receiving the proxied query) credentials="manager" mode=self iddassert-authzFrom "dn:*" When the first proxy is made everything is OK. The proxyAuthz extension control is added to the LDAP message and the remote server behaves as expected. Our problem is that in some cases we have requests that must be proxied several times. E.g: consider a scenario with three servers in A, B and C. in which the LDAP request sent by the external client is received in A, this server proxies it to B. Finally B proxies it to C. When B tries to set the proxyAuthz control it detects that there is already one and it returns the error "proxyAuthz not allowed within namingContext". Is there anyway in which we can avoid this error and propagate the credentials of the external client to the last server?. Thank you very much for your help. Best regards. Javier Manteiga

2 1

ACL processing performance
by Christian Manal 24 Jul '09

24 Jul '09

Hi, I've got a question regarding ACLs and their processing performance. I use the NIS-schema to store userinformation and the likes in OpenLDAP (using the maps passwd, group, services, ethers, hosts, automount stuff etc.) plus samba-schema plus some self defined stuff. I have ACLs defined for some special attributes, like userPassword, and for each OU (People, Groups, ...). If I start multiple searches without a filter (so everythin accessible will be displayed) anonymously or with some user, I can get the CPU load of my servers up to 80-90%. It's definitely the ACLs, since I have no problems when using the rootDN or if I reduce the ACLs. What I'd like to know now is, what is so damn expensive in my ACLs and how I could reduce the cost without lessening the access restrictions... OpenLDAP version is 2.4.17 using back-hdb with BDB 4.4 from opencsw respository on Solaris 10 (SunOS 5.10 Generic_139556-08). There are around 30k entries in my database. I have one master and four slaves using delta-syncrepl for replication. Configuration files can be found here: http://www.informatik.uni-bremen.de/~moenoel/ldap/ Thanks in advance. Regards, Christian Manal

3 2

Use of syncprov overlay in slave
by rommel＠buxit.nl 24 Jul '09

24 Jul '09

I am wondering whether it is possible to use the syncprov overlay in the slave database? The configuration at hand consists of two masters in mirror-mode and n-replica's in syncrepl-mode. The client application connects to one of the replica's and attempt to use the SyncControl to monitor the replica for changes. Both the master's and replica's have been configured with 'overlay syncprov'. When the client application connects to one of the masters and a changes in made in the other master, the application gets notified about the change through the SyncControl. However when I connect the client application to one of the replica's and make a change in one of the master's the client does not get notified about the change. When I look into the replica database directly the change made on the master is visible though. So I'm wondering is it possible to use the syncprov overlay in the slave database? And what would be the correct configuration to achieve this? The version of openldap I'm using is 2.4.13 Any help is appreciated. /Rob

3 2

openldap and dadlauthd
by Olivier Nicole 24 Jul '09

24 Jul '09

Hi, I have problems to get saslauthd to work with my openldap server: - saslauthd binds/autneticates if I connect to the non SSL port ldap://ldap.cs.ait.ac.th/ - saslauthd fails to bind/autneticate if I connect to the SSL port ldaps://ldap.cs.ait.ac.th/ Jul 23 12:02:00 ldap slapd[41289]: conn=22 fd=19 ACCEPT from IP=192.41.170.50:62502 (IP=192.41.170.6:636) Jul 23 12:02:00 ldap slapd[41289]: connection_closing: readying conn=22 sd=19 for close Jul 23 12:02:00 ldap slapd[41289]: connection_close: conn=22 sd=-1 Jul 23 12:02:00 ldap slapd[41289]: conn=22 fd=19 closed (TLS negotiation failure) I really don't know where to look. TIA, Olivier

2 7

Help with slurpd referral error
by phamp008＠yahoo.com 23 Jul '09

23 Jul '09

Hi, I am new to Openldap + Keberos project. I am setting up slurpd from ldap1(master) to ldap2(replica). I am hopping someone can give me some suggestion to troubleshoot this. I ran into this error when slurpd attempt to add new DN to ldap2. This is the error when I run slurpd -d 4 begin replication thread for ldap2.test.domain:389 Initializing session to ldap2.test.domain:389 request done: ld 0x9b27778 msgid 1 bind to ldap2.test.domain as host/krbmaster.test.domain(a)TEST.DOMAIN via GSSAPI (SASL) request done: ld 0x9b27778 msgid 2 request done: ld 0x9b27778 msgid 3 request done: ld 0x9b27778 msgid 4 replica ldap2.test.domain:389 - add dn "uid=ppham4,ou=people,dc=test,dc=domain" request done: ld 0x9b27778 msgid 5 Error: ldap_add_s failed adding DN "uid=ppham4,ou=people,dc=test,dc=domain": Referral Error: ldap operation failed, data written to "/var/lib/ldap/replica/ldap2.test.domain:389.rej Here's the slapd.conf on ldap1(master) include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org disallow bind_simple #security tls=1 #require authc # Create a replication log in /var/lib/ldap for use by slurpd. # REPLICA: Comment this out on the replicas replogfile /var/lib/ldap/master-slapd.replog TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd1-cert.pem TLSCertificateKeyFile /etc/openldap/slapd1.key sasl-secprops noanonymous,noplain,noactive # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=domain # This should be a ^ plus, not a star, but slapd won't accept it # REPLICA: # On replica servers replace the first line of each section below (the # line that allows /admin principals to write to things) with the # following line (allowing the primary server to write instead). Thus # admins can make changes on the primary server, and the primary # server can push changes to the replicas. #by dn.exact="uid=host/foo.example.com,cn=GSSAPI,cn=auth" write # Users with /admin principals can change anything # Users can change their shell, anyone else can see it access to attrs=loginShell by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self read by * none # Default read access for everything else access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read sizelimit 5000 threads 8 loglevel 256 # Allow LDAPv2 for Mozilla's address book #allow bind_v2 database bdb suffix "dc=test,dc=domain" cachesize 10000 checkpoint 256 15 # Uncomment these only for the initial load, then comment them back # out and restart slapd. rootdn "cn=Manager,dc=test,dc=domain" rootpw Secret! # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial # REPLICA: Comment this out on replicas replica host=ldap2.test.domain:389 tls=critical bindmethod=sasl saslmech=GSSAPI authcId=host/krbmaster.test.domain(a)TEST.DOMAIN Here's the copy of my slapd.conf on replica ldap2 server: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema #referral ldap://root.openldap.org #pidfile /var/run/slapd.pid #argsfile /var/run/slapd.args # Create a replication log in /var/lib/ldap for use by slurpd. # REPLICA: Comment this out on the replicas #replogfile /var/lib/ldap/master-slapd.replog TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd1-cert.pem TLSCertificateKeyFile /etc/openldap/slapd1.key sasl-secprops noanonymous,noplain,noactive saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=domain access to attrs=loginShell by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write by self read by * none # Default read access for everything else access to * by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write sizelimit 5000 threads 8 idletimeout 14400 loglevel 256 # Allow LDAPv2 for Mozilla's address book allow bind_v2 database bdb suffix "dc=test,dc=domain" # Increase the size of slapd's entry cache. Note that this is a cachesize 10000 checkpoint 256 15 # Uncomment these only for the initial load, then comment them back # out and restart slapd. rootdn "cn=Manager,dc=test,dc=domain" rootpw Secret! # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial # The purpose of the updatedn is to tell slapd not to send the updateref # if that DN tries to make changes. Any other user which attempts to # submit a change will be refered to the master LDAP server found in # updateref. # REPLICA: Uncomment these on replicas updatedn "uid=host/krbmaster.test.domain" updateref ldaps://ldap1.test.domain/ Greatly appreciate any help. Thanks Phil

2 1

error in SSLv3 read client certificate
by Jittinan Suwanrueangsri 23 Jul '09

23 Jul '09

Dear all After I execute command " ldapsearch -x -W -D 'cn=admin,dc=example,dc=com' -ZZ '(uid=david)' " I get following log portion(debug at level 1): slapd starting slap_listener_activate(8): >>> slap_listener(ldap:///) connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 29 contents: ber_get_next conn=0 op=0 do_extended ber_scanf fmt ({m) ber: send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush2: 14 bytes to sd 13 connection_get(13): got connid=0 connection_read(13): checking for input on id=0 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A TLS trace: SSL_accept:SSLv3 flush data /TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A/ connection_get(13): got connid=0 connection_read(13): checking for input on id=0 TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data /connection_read(13): unable to get TLS client DN, error=49 id=0/ connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 44 contents: ber_get_next conn=0 op=1 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=admin,dc=example,dc=com> <<< dnPrettyNormal: <cn=admin,dc=example,dc=com>, <cn=admin,dc=example,dc=com> do_bind: version=3 dn="cn=admin,dc=example,dc=com" method=128 do_bind: v3 bind: "cn=admin,dc=example,dc=com" to "cn=admin,dc=example,dc=com" send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=97 err=0 ber_flush2: 14 bytes to sd 13 connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 55 contents: ber_get_next conn=0 op=2 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <dc=example,dc=com> <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: => hdb_search bdb_dn2entry("dc=example,dc=com") => hdb_dn2id("dc=example,dc=com") <= hdb_dn2id: got id=0x1 entry_decode: "" <= entry_decode() search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 => hdb_dn2idl("dc=example,dc=com") => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 => bdb_equality_candidates (uid) <= bdb_equality_candidates: (uid) not indexed bdb_search_candidates: id=-1 first=1 last=11 hdb_search: 1 does not match filter entry_decode: "" <= entry_decode() hdb_search: 2 does not match filter entry_decode: "" <= entry_decode() hdb_search: 3 does not match filter entry_decode: "" <= entry_decode() hdb_search: 4 does not match filter entry_decode: "" <= entry_decode() hdb_search: 5 does not match filter entry_decode: "" <= entry_decode() hdb_search: 6 does not match filter entry_decode: "" <= entry_decode() hdb_search: 7 does not match filter entry_decode: "" <= entry_decode() hdb_search: 8 does not match filter entry_decode: "" <= entry_decode() hdb_search: 9 does not match filter entry_decode: "" <= entry_decode() => send_search_entry: conn 0 dn="uid=david,ou=Users,dc=example,dc=com" ber_flush2: 199 bytes to sd 13 <= send_search_entry: conn 0 exit. entry_decode: "" <= entry_decode() hdb_search: 11 does not match filter send_ldap_result: conn=0 op=2 p=3 send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 13 connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify ber_get_next on fd 13 failed errno=0 (Success) conn=0 op=3 do_unbind connection_close: conn=0 sd=13 TLS trace: SSL3 alert write:warning:close notify What cause these errors? ,What do these errors mean? /TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A //connection_read(13): unable to get TLS client DN, error=49 id=0 /How can I fix these problems? Thankyou Jittinan Suwanrueangsri/ /

2 1

adding/modifying local attributes with translucent overlay
by Hart, Brian R. 22 Jul '09

22 Jul '09

Hey everyone - I have an openldap server setup using the translucent overlay and pulling entries from a remote ldap server (running Fedora DS). I seem to have gotten the translucent overlay configured correctly as I can perform searches and obtain entries from the remote ldap server by way of the local one. I can even add local attributes for users and groups in the local server and perform searches and obtain the results with the local attributes. However when I try to change or modify anything that has been stored in the local ldap server I either get 'ldapadd: already exists (68)' or 'ldapmodify: no such object (32)'. I'm using openldap 2.4.16 on RHEL5. When I'm trying to make these changes I'm using an ldif file just like I did when I added the attributes to begin with. I've tried just modifying the ldif file and re-adding as if it didn't already exist and I've tried writing the ldif as if it was for a modify with a changetype: modify line in the file. If I need to post the configuration file I can I just thought I'd hold off on putting all of that here if it wasn't necessary. I hope somebody can help - thanks in advance! Sincerely, Brian Hart

1 0

slow search and connection problem
by mukim pathan 22 Jul '09

22 Jul '09

Hi, I am using openldap2.4.16 with bdb 4.5. I am doing search in database using java. When I am doing search for first time, it is connecting and giving response in 4-5 milliseconds. But then its is taking around 100-150ms for search.I don't know what might be the problem. I searched online for this but could not find any solution. Following are my ldap configuration files. slapd.conf : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/xxx.schema allow bind_v2 concurrency 3 threads 3 database bdb suffix "dc=xxx,dc=com" rootdn "cn=Manager,dc=xxx,dc=com" rootpw xxx directory /usr/local/var/openldap-data index objectClass eq index attr1 eq index attr2 eq index attr3 eq checkpoint 1024 60 cachesize 1000000 DBCONFIG: set_cachesize 2 268435456 1 set_lg_dir /opt2/logs set_data_dir /opt2/db set_flags DB_LOG_AUTOREMOVE Please help me with any improvements i must do to get fast search result. Regards, Mukim Pathan

3 3

LdapErr: DSID-0C090627 with translucent proxy and AD
by Petteri Heinonen 22 Jul '09

22 Jul '09

Hello list, I've been trying to setup a translucent proxy to display a modified version of our ActiveDirectory (Server 2003) to Linux clients. The ultimate goal is to be able to transparently add UID, default shell etc. parameters missing in AD by default. Usage of Services for Unix is not possible this time because of "company policies". Config file is like this: # Default realm sasl-realm company.com # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 504 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload accesslog moduleload translucent # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 backend hdb database hdb # The base of your directory in database #1 suffix "dc=company,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=company,dc=com" rootpw {SSHA}blaablaa # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod off overlay translucent uri ldap://ad1.company.com:389 acl-bind binddn="CN=ldapuser,OU=tools,DC=company,DC=com" credentials="verysecure" Now, if I do a search with rootdn cn=admin,dc=company,dc=com, proxy binds to AD as ldapuser and search is successful. But, if I use a user existing in AD only, for example like this: ldapsearch -x -W -D "CN=Some User,OU=Users,DC=company,DC=com" -b "CN=Some User,OU=Users,DC=company,DC=com" I get: # extended LDIF # # LDAPv3 # base <CN=Some User,OU=Users,DC=company,DC=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1 I monitored the traffic using wireshark, and from there I can see that binding is actually successful. What fails is the search request after that: 0.000361 10.65.31.26 -> 10.65.26.34 LDAP bindRequest(1) "cn=Some User,ou=Users,dc=company,dc=com" simple 0.002285 10.65.26.34 -> 10.65.31.26 LDAP bindResponse(1) success 0.002297 10.65.31.26 -> 10.65.26.34 TCP 43898 > ldap [ACK] Seq=79 Ack=23 Win=5888 Len=0 TSV=67497094 TSER=69277767 0.003840 10.65.31.26 -> 10.65.26.34 LDAP searchRequest(4) "Some User,ou=Users,dc=company,dc=com" wholeSubtree 0.004067 10.65.26.34 -> 10.65.31.26 LDAP searchResDone(4) operationsError (00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece) OpenLDAP version is the one with Debian Lenny: slapd/lenny uptodate 2.4.11-1 Any suggestions how to continue? Is this some AD related quirk or possibly a problem problem related to how OpenLDAP does binding? Regards, Petteri Heinonen

1 0

Fwd: OpenLdap manual howto available
by Gavin Henry 21 Jul '09

21 Jul '09

Will take a look too. ---------- Forwarded message ---------- From: Lukasz Szybalski <szybalski(a)gmail.com> Date: Mon, 20 Jul 2009 11:45:15 -0500 Subject: OpenLdap manual howto available To: Debian User List <debian-user(a)lists.debian.org> Just an FYI. I'm working on openldap howto for Debian. http://lucasmanual.com/mywiki/OpenLdap This manual shows how to setup openldap and gives a workaround to some of the known bugs that prevent openldap to be reconfigured, and migration tools from finish migration. The setting up of openldap is fairly easy, but without few key instructions that I've listed its almost impossible for new user to finish. Took me 2 weeks but after reading above OpenLdap Manual howto you will setup ldap server in as little as 10minutes. Enjoy. (More content coming as days go by) Contents 1. OpenLDAP 1. What is required 2. Install 3. Authentication 4. Connect to openldap 5. Simple addressbook 1. Thunderbird 2. Outlook 2. Linux integration with LDAP 1. libnss-ldap 1. migrationtools 2. libpam 3. Troubleshooting 1. result: 32 No such object 4. References -- To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/ http://www.suretectelecom.com

1 0

Suggestion for 2 domains samba+ldap and Windows AD
by Alberto Moreno 20 Jul '09

20 Jul '09

Hi people. I want to know if this is possible. I have right now 3 domains in my network. Dom A = Samba 3.0.33 Gentoo + LDAP. This serve to a domain of 10 users at location 1. Dom B = Windows 2003 AD serving 8 users at location 2. Dom C = WinNT + samba as client serving most of the users(35) at location 2. As u can see, the NT is the most busy, I need to remove that domain, is in the same location as "Dom B", my path is to move all the users from "Dom C" to "Dom B" most of the machines are windows boxes. This is easy, the only issue I was having before is my 2 samba boxes, I could not make possible to be part of the "Dom B", but last week I made that possible, them I can make this move. Well, the main reason of this email is because, after I remove the NT server, at location 2 I would just have a Window 2k3 AD domain working, on the other site (location 1) I would have a domain running samba+ldap working. Right now, if I'm at location 1 I cannot see location 2 the "Dom B"(Win 2k3), the same thing happen at location 2. There is a way to make this possible, can a domain with samba+ldap see a domain with win 2k3? Is possible to share users? I was think to setup another server at location 2 with samba+ldap and sync users but I still have the users of the win 2k3 domain...? Hope to be clear, if someone have some experience here at will appreciated, thanks for your time!!! P.S. my samba serves at location 2 are Centos 5.x Samba 3.0.33. -- LIving the dream...

2 2

on-the-fly tweaking of AccessControl (be_acl)
by Daniel 20 Jul '09

20 Jul '09

Dear slapd-Experts, I've a perhaps slightly strange question regarding tweaking of be_acl from within an overlay and would be very happy if you could please help me. I'm looking after a possibility to change AccessControl struct's content on "overlay-operation-basis": For each processed Operation within my test overlay I want to modify this sample ACL from a) into b): a) cn=config initially stores: access to filter=(x=*) by users read by * none b) overlay has detected operation "z" ==> the acl should be tuned into: access to filter=(y=*) by users read by * none I think I've already found the concerned structs and I'm able to get the above modification done in theory, but I'm a little bit afraid/unsure regarding side effects, e.g thread locking and so on. I could imagine that in general be_acl is not intend to be changed from one operation to another...?! What would be the "best" pseudo-code-style way to achive the above a-b-transition in a safe/consistent way from within an overlay? Many thanks for your advice! Cheers Daniel

1 0

add and modify
by mukim pathan 20 Jul '09

20 Jul '09

Hi, I was just wondering if there is any command like ldapadd/ldapmodify or any configuration parameter in this commands which will add an entry in database if its not present like ldapadd and modify that entry if its there in database like ldapmodify?? Regards, Mukim Pathan

2 1

Problem with new writetimeout
by Christian Manal 20 Jul '09

20 Jul '09

Hi everyone, I have noticed a problem regarding the new writetimeout feature in OpenLDAP 2.4.17. I have a setup with one master and four replicas running on Solaris 10, using the hdb-backend with BDB 4.4 from the opencsw repository. Clients are Sun, Linux and Mac boxes in every possible variation. I updated my servers last Friday from version 2.4.15 and now some cronjobs accessing the directory were sporadically failing over the weekend. I monitored the server logs (log level 'stats') while running the involved scripts repeatedly and got something like the following results after fail-runs on all servers: (IPs and DNs altered) > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 848112 local4.debug] conn=12479 fd=79 ACCEPT from IP=192.168.1.1:50210 (IP=0.0.0.0:389) > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 270379 local4.debug] conn=12479 op=0 EXT oid=1.3.6.1.4.1.1466.20037 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 560212 local4.debug] conn=12479 op=0 STARTTLS > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 875301 local4.debug] conn=12479 op=0 RESULT oid= err=0 text= > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 105384 local4.debug] conn=12479 fd=79 TLS established tls_ssf=256 ssf=256 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 215403 local4.debug] conn=12479 op=1 BIND dn="uid=dummyuser,ou=System,dc=example,dc=com" method=128 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 600343 local4.debug] conn=12479 op=1 BIND dn="uid=dummyuser,ou=System,dc=example,dc=com" mech=SIMPLE ssf=0 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 588225 local4.debug] conn=12479 op=1 RESULT tag=97 err=0 text= > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 469902 local4.debug] conn=12479 op=2 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=2 filter="(objectClass=posixAccount)" > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 744844 local4.debug] conn=12479 op=2 SRCH attr=uid userpassword uidnumber gidnumber gecos homedirectory loginshell > Jul 20 11:43:00 ldapserver slapd[9053]: [ID 485650 local4.debug] conn=12479 fd=79 closed (writetimeout) I don't have the writetimeout keyword configured on any of the boxes and the affected script doesn't do any writes anyway. Also, the problem only seems to arise if the client takes a while to process a search result. The failing scripts are Net::LDAP based Perl scripts running on some old SPARC boxes, so it took them up to half a minute and more to complete. Setting writetimeout to a high enough value seems solve the problem, but referring to the docs, this shouldn't happen with the keyword unset or set to 0. Is this a bug or did I miss something? Did anyone else encounter this so far? Regards, Christian Manal

2 1

how to uninstall openldap
by mukim pathan 20 Jul '09

20 Jul '09

Hi, I wish uninstall openldap-2.4.16 from my linux system and install it again. I tried uninstalling it using make uninstall but it's not working. Can you please tell me how to uninstall openldap?? Regards, Mukim Pathan

2 1

Extend Schema correctly
by Techie 17 Jul '09

17 Jul '09

Hello List, I want to correctly extend schema but I have a question regarding the OID assignment of the custom objectClass and attributes I have created. I want to know if the OID number is absolutely necessary and if I do not use an OID number, what are the repercussions if any. For example will it cause any issues say with syncing with Active Directory or any other directory down the line if I go that route , I created a custom schema extension file to extend my schema so I can associate server names containing resources to my user accounts in LDAP. This schema file has a single auxiliary objectClasses entry and three (MAY) attributeTypes entries. I added the schema file to my Directory with schema checking on and it starts up correctly. I can add this objectClass and the 3 associated attributes to any account in my directory with no issue. I have not assigned an OID to these entries only names. Does this mean the OID is not necessary? Is there a suggested base OID I can use without requesting a company specific OID from IANA? Would be for for inter company use only. My company has an OID name space through IANA but the people that managed that are long gone and I do not want to overlap anything or cause issues. So basically I am looking to give this object class and associated attributes OID numeric assignments and am unsure how to do that. Thank you

1 0

syncrepl configuration possibilities
by Laurence Field 15 Jul '09

15 Jul '09

Hi, I am investigating the use of syncrepl to improve the efficiency of the transport mechanism that we are currently using in a world-wide distributed OpenLDAP deployment. If LDAP server A has information under "cn=my_resource,dc=example,dc=com" is it possible to replicate this information to LDAP server B but slightly modify the DN so that this becomes a sub tree of a larger tree eg. "cn=my_resource,cn=my_group,dc=example,dc=com"? Alternative suggestions are welcome and I would be happy to explain what we are trying to do in more detail if anyone is interested. Thanks, Laurence

2 3

auth works with cn=My Name but not with uid=myname
by Arne Schirmacher 15 Jul '09

15 Jul '09

This is probably trivial but I can't figure it out: my OpenLDAP entry has an attribute of cn=My Name, an attribute of uid=myname and a password. I can successfully log in using JXplorer using cn=My Name,ou=people,o=my company but not using uid=myname,ou=people,o=my company (error code 49 - Invalid Credentials) However searching with that dn is successful and returns 1 entry, so the uid attribute is in fact there. Please advise how I could enable the second login method which I need for exim authentication. Thanks!

3 2

Re: Multi master topology.
by Gavin Henry 14 Jul '09

14 Jul '09

----- "Alejandro Leyva" <alex.leyva(a)gmail.com> wrote: > Hi all. > > We are implementing a solution with multi master LDAP, we have 11 > instances at different locations, and maybe we will grow to 21 or 31 > instances before the end of the year, expecting to hold something > like > 200,000 or 300,000 user entries. What topology would be the best? > Right now each server synch to all the other servers, is it possible > to configure each server to synch only to a central LDAP? is it > convenient? Then that is not Multi-Master, but normal Provider/Consumer replication. Depending on your client requirements for writing, you may be better served using MirrorMode and numerous consumers/slaves with the chaining overlay to push writes back to the master. This would be simpler for monitoring write propagation. See the diagram here http://www.openldap.org/doc/admin24/replication.html#MirrorMode -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 2

slapd proxy
by Sergio Cioban Filho 13 Jul '09

13 Jul '09

Hi all, I'm trying to configurate an OpenLdap proxy for high availability, with ldap backend. My problem is the timeout. When the first server in URI is gone down, my ldapsearch delay 3 minutes, how do I change this timeout? Server 192.168.166.171 UP TIME: real 0m0.036s user 0m0.002s sys 0m0.003s Server 192.168.166.171 DOWN TIME: real 3m8.957s user 0m0.003s sys 0m0.004s I want the ldap-proxy immediately redirect the ldapsearch to the server 192.168.166.172 when server 192.168.166.172 gone down. My back-ldap configuration:* database ldap suffix "dc=digitro,dc=com,dc=br" rootdn "cn=axs,dc=digitro,dc=com,dc=br" uri "ldap://192.168.166.171/ ldap://192.168.166.172/" conn-ttl 0 idle-timeout 0 timeout 1 * Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

1 0

syncrepl randomly failing to sync
by Jay Christopherson 12 Jul '09

12 Jul '09

Hi- First of all, I hope I am not rehashing a topic that has been endlessly discussed. I know that syncrepl gets discussed a lot from my searches, but I have not found a specific topic on my issue. I started out with OpenLDAP 2.3, with a single provider and two consumers doing syncrepl using a refreshAndPersist type of replication. Periodically, I would see that one or more of the consumers would fail to synchronize a change made to the provider. A restart of the consumer would fix this and we could move on. It was annoying, but not critical at this point. Since then, I have become more dependent on OpenLDAP and syncrepl. I have upgraded to 2.4 to try to fix the replication issue, but it seems worse than ever. I now have one provider and six consumers. The consumers randomly fail to synchronize (as evidences by contextCSN monitoring). This happens several times a day. I'm thinking that maybe there is something wrong with my configuratiuon. This is what I am using: Provider: overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replica,o=users,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Consumers (all consumers have the exact same config): syncrepl rid=123 provider=ldap://ldap.sea.corp.domain.com:389 binddn="uid=replica,o=users,dc=domain,dc=com" bindmethod=simple retry="10 +" credentials=secret searchbase="dc=domain,dc=com" schemachecking=off type=refreshAndPersist interval=00:00:00:05 updateref ldap://ldap.sea.corp.domain.com A few "weird" things: * After the upgrade, I notice that the Directory Type on the Root DSE is still OpenLDAP 2.3 * I notice that where previously I could simple create a new consumer by installing a fresh copy of openldap, copying the config from another consumer over, and starting up to get a full copy of the directoy, it now fails to completely replicate and I have to do a full slapcat/slapadd to do the initial population. Like I said, I hope it's just something stupid I am doing...

3 2

Problem with unusual tree structure ...
by Garry Glendown 10 Jul '09

10 Jul '09

Hi, I'm trying to authenticate users against an LDAP database ... now, I already have that running on several servers that use the "normal" tree setup, something like "cn=username,ou=somebranch,ou=domain,ou=tld", with a search_base of ou=domain,ou=tld. The place I'm trying to configure it for now is using a - AFAICT - rather unusal schema, as they have a tree that uses multiple top level o=, and start underneath there, so there may by user entries like cn=user1,ou=USERS,o=branch1 and cn=user2,ou=USERS,o=branch2 (historically, ldap trees from several locations were just merged together, which led to this) How can I get SASL to search in such a configuration? I already tried a "ou=USERS,o=*" syntax, which I didn't expect to work (and it didn't) Also, I know that saslauthd or other apps will need to check the resulting username/pw, so I tried binding with the DN and PW of an account, resulting in a "Confidentiality required" ... using ldaps:// notation didn't work, as the remote server (Novell eDirectory) probably isn't configured for that, and -Z for TLS also fails with ldap_start_tls: Server is unavailable (52) additional info: TLS services are not available >From what I can find, the message should come up if the server is configured for requiring secure queries, but then I would expect it to also be configured to SUPPORT either one of the methods ... Help appreciated, -garry

1 0

Multi master topology.
by Alejandro Leyva 10 Jul '09

10 Jul '09

Hi all. We are implementing a solution with multi master LDAP, we have 11 instances at different locations, and maybe we will grow to 21 or 31 instances before the end of the year, expecting to hold something like 200,000 or 300,000 user entries. What topology would be the best? Right now each server synch to all the other servers, is it possible to configure each server to synch only to a central LDAP? is it convenient? Thanks in advance.

1 0

bindmethod and credentials in slurpd replication.
by Sai 10 Jul '09

10 Jul '09

Hi All - Our server team does not want to update our openldap version beyond 2.2 because redhat supports 2.2 as the latest and greatest for RHEL4. So I am trying to configure slurpd replication for them. I got the replication to work. But when defining "replica", I got the following questions. 1) For credentials, can I use hashed password like for rootpw 2) If we could use hashed password, what should the bindmethod be? replica uri=<URL> binddn=<Bind DN> bindmethod=simple --> ??? credentials=XXXXXXXXX Thanks in advance. -Sai

3 5

ldapmodify is modifying my code
by Darryl Moore 10 Jul '09

10 Jul '09

HELP I've been able to replace nis.schema with rfc2307bis.schema so that I can have groups with both member and memberUID attributes. when I try using ldapmodify to add members to the group such as: echo "dn: cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid=newuser1,ou=People,dc=moores,dc=ca" | /usr/bin/ldapmodify -v -y /etc/ldap.secret -D cn=admin,dc=moores,dc=ca -xH ldap://localhost it returns the following error message: ldap_initialize( ldap://localhost:389/??base ) modifying entry "cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid=newuser1,ou=People,dc=moores,dc=ca" ldap_modify: No such object (32) matched DN: ou=People,dc=moores,dc=ca The group and the user both exist. What is most interesting is that ldapmodify appears to modify my request because slapd itself gives this message: hdb_referrals: tag=102 target="cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid\3Dnewuser1,ou=People,dc=moores,dc=ca" matched="ou=People,dc=moores,dc=ca" bdb_dn2entry("cn=newgrou1,ou=groups,dc=moores,dc=ca changetype: modify add: memberuid memberuid: newuser1 replace: member member: uid\3Dnewuser1,ou=people,dc=moores,dc=ca") => hdb_dn2id("dc=ca changetype: modify add: memberuid memberuid: newuser1 replace: member member: uid\3Dnewuser1,ou=people,dc=moores,dc=ca") <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) notice that the "uid=newuser" part of my request has been changed to "uid\3Dnewuser". I've tried a number of different combinations and it appears to me that the first '=' is always replace with \3D and then the silly thing tries to look up that element, and low and behold it does not exist. If I can make this work, then I think I will have group permissions for unix groups working on LDAP. Does anybody have any idea why ldapmodify would be doing this??????

3 6

integrate motd on openldap
by Alejandro Feijoo Fraga 10 Jul '09

10 Jul '09

Hi. i have a large number of users... from diferent language (spanish,english,etc...) all under the same ldap directory and i need change de /etc/motd if user speak spanish or english. I not found info if ldap can do that, i think put a new entry at ldap (like lenguage:es/en/ga/..) and de /etc/bashrc or similar make a if and compare that entry... any diferent idea? or any method more easy? thanks!

2 1

Re: slapd + tls problem
by Alessandro Baggi 10 Jul '09

10 Jul '09

Gavin Henry wrote: > > # openssl req -newkey rsa:1024 -nodes -keyout key.pem -out > >> newreq.pem /*for server/client certificate building and >> sing*/ >> # /usr/lib/ssl/misc/CA.pl -sign >> >> I've tried using only openssl with slapd and all work very good, but not >> with GnuTLS. My system is Debian Lenny. >> >> > > What version of OpenLDAP? > > > Hi there. The problem was solved. It works fine with tls, the problem was that TLS works on port 389 not 636 (ldaps). This is the first time for me to use openldap with gnutls support. With OpenSSL works very good. Then, there was an configuration mismatch. Thanks

1 0

Query several LDAP servers
by tmp123＠menta.net 10 Jul '09

10 Jul '09

Hello, Please, are you so kind of provide me a hint about how to configure or develop the following feature?: A proxy LDAP, like the ones with slapd-ldap, must forward all received queries to a LDAP server1. If this server contains the requested item, the answer is send backward and handling stops. If the server doesn't contains the requested item, the query must be sent to a second LDAP server2. In the worst case, a maximum of 5 different servers should be queried in sequence. Initially, any server can contain any item. Nowadays, there are no tree estructure. Thanks a lot.

1 0

Solaris LDAP Mapping
by Matthew.GARRETT＠external.total.com 09 Jul '09

09 Jul '09

Folks I hope this is the right list for this. I am trying to get our Solaris Machine use LDAP for automounts. Under Solaris the file I would normally change is /var/ldap/ldap_client_file for Solaris using Ldap Version 2.0 But I am not 100% sure what I need to get LDAP automount to work. The OpenLdap Server has the following entries dn: ou=auto.apps,dc=unix,dc=total objectClass: top objectClass: automountMap ou: auto.apps A typical Map entry is dn: cn=acrobat,ou=auto.apps,dc=unix,dc=total objectClass: automount cn: acrobat automountInformation: uk-abz-vgl:/apps/acrobat Can anybody suggest suitable entries for the above ? Thanks Matthew Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

2 1

replicating cn=config
by Matthew Edlefsen 09 Jul '09

09 Jul '09

Hi, I've been trying to use syncrepl to replicate my cn=config tree and have been running into some issues. After running into a number of things not working I completely stripped everything down and attempted to follow test049 by building it from scratch. I've gotten it to work by running two instances of slapd on the same machine, on both machines, but I still can't get it to work between the two machines. System info Provider: FreeBSD 7.1-PRERELEASE FreeBSD 7.1-PRERELEASE #0: Sat Nov 15 18:38:32 EST 2008 OpenLDAP 2.4.16 Consumer: FreeBSD 7.2-STABLE FreeBSD 7.2-STABLE #1: Mon Jun 1 12:29:14 EDT 2009 OpenLDAP 2.4.16 My process is this: First I create slapd.d directories for both servers and populate them with a basic config mkdir slapd.d slapadd -n 0 -F slapd.d <<END dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: Trace olcLogLevel: Config olcLogLevel: Stats olcLogLevel: Sync olcLogLevel: Args olcLogLevel: Conns dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcRootDN: $MANAGER olcRootPW: $CONFIGPW olcDatabase: {0}config dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov END chown -R ldap:ldap slapd.d Then I launch slapd with: /usr/local/libexec/slapd -h $URI -u ldap -g ldap on both machines. At this point I can do ldapsearch on both servers and get back the correct results. I then do: ldapmodify -D "$MANAGER" -x -w "$CONFIGPW" <<END dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$PROVIDER_URI binddn="$MANAGER" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="3 5 300 5" timeout=3 - add: olcUpdateRef olcUpdateRef: $PROVIDER_URI END At this point I start logging the same error over and over. Here are the log messages I get: Consumer: Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: >>> dnPrettyNormal: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPrettyNormal: <cn=config>, <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=subschema> Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 3 19:55:35 jet slapd[51003]: dn_callback : entries have identical CSN cn=config 20090603203325.264042Z#000000#000#000000 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=0 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_search (0) Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 cn=config Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 entry unchanged, ignored (cn=config) Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: >>> dnPrettyNormal: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPrettyNormal: <cn=schema,cn=config>, <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=subschema> Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=0 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_search (0) Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 cn=schema,cn=config Jun 3 19:55:35 jet slapd[51003]: conn=-1 op=0: config_add_internal: DN="cn=schema,cn=config" already exists Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=68 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_add cn=schema,cn=config (68) Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=0 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=1 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: null_callback : error code 0x1 Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_modify cn=schema,cn=config (1) Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_modify failed (1) Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: do_syncrepl: rid=001 rc 1 retrying (4 retries left) Provider: Jun 3 17:02:36 rock slapd[75268]: slap_listener_activate(6): Jun 3 17:02:36 rock slapd[75268]: >>> slap_listener($PROV_URI) Jun 3 17:02:36 rock slapd[75268]: conn=391 fd=8 ACCEPT from IP=$CONS_IP:56003 (IP=$PROV_IP:389) Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_read(8): checking for input on id=391 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 do_bind Jun 3 17:02:36 rock slapd[75268]: >>> dnPrettyNormal: <cn=manager,cn=config> Jun 3 17:02:36 rock slapd[75268]: <<< dnPrettyNormal: <cn=manager,cn=config>, <cn=manager,cn=config> Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 BIND dn="cn=manager,cn=config" method=128 Jun 3 17:02:36 rock slapd[75268]: do_bind: version=3 dn="cn=manager,cn=config" method=128 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 BIND dn="cn=manager,cn=config" mech=SIMPLE ssf=0 Jun 3 17:02:36 rock slapd[75268]: do_bind: v3 bind: "cn=manager,cn=config" to "cn=manager,cn=config" Jun 3 17:02:36 rock slapd[75268]: send_ldap_result: conn=391 op=0 p=3 Jun 3 17:02:36 rock slapd[75268]: send_ldap_response: msgid=1 tag=97 err=0 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 RESULT tag=97 err=0 text= Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_read(8): checking for input on id=391 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=1 do_search Jun 3 17:02:36 rock slapd[75268]: >>> dnPrettyNormal: <cn=config> Jun 3 17:02:36 rock slapd[75268]: <<< dnPrettyNormal: <cn=config>, <cn=config> Jun 3 17:02:36 rock slapd[75268]: => get_ctrls Jun 3 17:02:36 rock slapd[75268]: => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) Jun 3 17:02:36 rock slapd[75268]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) Jun 3 17:02:36 rock slapd[75268]: <= get_ctrls: n=2 rc=0 err="" Jun 3 17:02:36 rock slapd[75268]: conn=391 op=1 SRCH base="cn=config" scope=2 deref=0 filter="(objectClass=*)" Jun 3 17:02:36 rock slapd[75268]: conn=391 op=1 SRCH attr=* + Jun 3 17:02:36 rock slapd[75268]: send_ldap_result: conn=391 op=1 p=3 Jun 3 17:02:36 rock last message repeated 2 times Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_write(8): waking output for id=391 Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={0}core,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_write(8): waking output for id=391 Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={1}cosine,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_write(8): waking output for id=391 Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={2}inetorgperson,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={3}nis,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="olcDatabase={-1}frontend,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="olcDatabase={0}config,cn=config" Jun 3 17:02:36 rock slapd[75/: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="olcOverlay={0}syncprov,olcDatabase={0}config,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: send_ldap_result: conn=391 op=1 p=3 Jun 3 17:02:36 rock slapd[75268]: send_ldap_intermediate: err=0 oid=1.3.6.1.4.1.4203.1.9.1.4 len=56 Jun 3 17:02:36 rock slapd[75268]: send_ldap_response: msgid=2 tag=121 err=0 Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_read(8): checking for input on id=391 Jun 3 17:02:36 rock slapd[75268]: ber_get_next on fd 8 failed errno=0 (Undefined error: 0) Jun 3 17:02:36 rock slapd[75268]: conn=391 op=2 do_unbind Jun 3 17:02:36 rock slapd[75268]: conn=391 op=2 UNBIND Jun 3 17:02:36 rock slapd[75268]: connection_close: conn=391 sd=8 Jun 3 17:02:36 rock slapd[75268]: conn=391 fd=8 closed As I said it works perfectly if it's two slapd instances on the same machine on different ports. The machines can talk to each other and can both ldapsearch the other one. Also the firewall is reporting no blocks. If anybody has seen this before or has some insight into what the problem might be it would be very much apprectiated. Thank you in advance, Matt Edlefsen Earlham College

2 1

LDAP Access controls
by Darryl Moore 09 Jul '09

09 Jul '09

Hi all, I've installed a LDAP server on my network against which all my users can authenticate. They can even change their passwords via GUI or CLI without any issue. What I am trying to do now is allow each one of them to have an address book in their subtree. I created a subtree in each authentication relm that looks like this ou=Contacts,uid=user,ou=People,dc=domain,dc=ca Their is no problem with the rootdn adding entries below this, but I am unable to get the user to be able to. In fact I can't seem to allow the user to write anywhere. Even with the lone access rule: access to * by * write in the /etc/ldap/ldap.conf file (and yes I restart slapd everytime I change this file) I beleive the correct access rule for what I want is: access to dn.children="ou=People,dc=domain,dc=ca" by self write but that doesn't work either and I figured I'd ruduce the number of unknowns by trying to give global write permission first. A commandline test to create an entry yields this result: darryl@bison:~$ ldapadd -w ${NETPASS} -x -D "uid=darryl,ou=People,dc=domain,dc=ca" -f ~/tmp adding new entry "cn=test_test1,ou=Contacts,uid=darryl,ou=People,dc=domain,dc=ca" ldap_add: Insufficient access (50) additional info: no write access to parent ~/tmp looks like this: dn: cn=test_test1,ou=Contacts,uid=darryl,ou=People,dc=domain,dc=ca cn: test_test1 objectClass: inetOrgPerson sn: testestestets It's not an authentication issue because if NETPASS is wrong it returns: ldap_bind: Invalid credentials (49) Anyone have any ideas? There must be somthing simple I am missing, but I'm stumped! cheers, darryl

2 8

Delete operation is delayed...
by Bad Guy 09 Jul '09

09 Jul '09

Dear all, I have a 4 way Multi-master LDAP synchronization version 2.4.11 configured to run in refreshonly mode, config is below : # syncrepl directives syncrepl rid=001 provider=ldap://ldap01 bindmethod=simple binddn="cn=Manager" credentials=xxxxx searchbase="o=ABCDE" schemachecking=off type=refreshOnly interval="00:00:00:30" attrs="*,+" retry="5 5 300 +" #syncrepl rid=002 # provider=ldap://ldap02 # bindmethod=simple # binddn="cn=Manager" # credentials=xxxxx # searchbase="o=ABCDE" # schemachecking=off # type=refreshOnly # interval="00:00:00:30" # attrs="*,+" # retry="5 5 300 +" syncrepl rid=003 provider=ldap://ldap03 bindmethod=simple binddn="cn=Manager" credentials=xxxxx searchbase="o=ABCDE" schemachecking=off type=refreshOnly interval="00:00:00:30" attrs="*,+" retry="5 5 300 +" syncrepl rid=004 provider=ldap://ldap04 bindmethod=simple binddn="cn=Manager" credentials=xxxxx searchbase="o=ABCDE" schemachecking=off type=refreshOnly interval="00:00:00:30" attrs="*,+" retry="5 5 300 +" #overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 16 idletimeout 0 cachesize 10000 checkpoint 256 15 We will do add/modify/delete operation daily and I have a script to check record by record of the sync status. From time to time, there is some records deleted in one of the LDAP server will not be replicated to the other servers occasionaly. But it will eventually deleted after long random time. (may be 1-2 days) Any idea ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

5 11

syncrepl consumer process
by Allan Lyons 09 Jul '09

09 Jul '09

Hi, I'm looking at developing a simple internal app that is supposed to do things based on changes to our directory. One solution would be to periodically poll the directory. A seemingly better solution would be to have some client watch for changes using the refreshAndPersist mode of syncrepl. Does anyone know of any example code that connects to the directory as a syncrepl consumer? Python examples would be preferred. Thanks, Allan.

2 2

Max number of attributes in entry
by Patric 08 Jul '09

08 Jul '09

Hi all, I am attempting to add an entry to my directory with a large number of mail attributes. This works fine until I have more than 51 mail attributes. Any more than that and the add fails with the following: Error 80 - Unknown error What I find strange is that if I add the entry with up to 51 mail attributes, I can then go and add individual mail attributes to the existing entry. If I attempt to delete the entry when it has more than 51 mail attributes I get the same error: Error 80 - Unknown error But if I remove individual mail attributes until there are only 51 then I am able to remove the entire entry. Is there some limitation that I am not aware of, and could any body suggest a method for me to get around this? Any advice would be much appreciated! Regards, Patric

1 0

Checkpointing and syncrepl
by John Kane 08 Jul '09

08 Jul '09

I am a bit confused with the difference between the slapd.bdb 'checkpoint' option and the syncprov overlay option 'syncprov-checkpoint'. On the provider, will these basically do the same thing? If so, is there an advantage to using one over the other? Also, should we do checkpointing on the consumers as well? Thanks, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 1

Text files or text on OpenLdap
by Sergio Cioban Filho 08 Jul '09

08 Jul '09

Hi all, How I do to store text files or text on OpenLdap? I'm trying with octetString, but the line termination do not respected. I want store openssh Keys (Public and Private) on OpenLdap. ** Sorry for my por english.. ;) Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

2 1

Openldap 2.3 syncrepl filter problem
by Lanfeust troy 08 Jul '09

08 Jul '09

Hi list, In configuration of provider and consumer server with syncrepl is possible to modify the replication filter for add new user in replica. In fisrt time the replica is : syncrepl rid=123 provider=ldap://rh-test3.kvm.rla:389 type=refreshOnly interval=00:00:01:00 retry="30 10 600 20" searchbase="dc=local" filter="(|(objectClass=sambaGroupMapping)(uid=user1))" scope=sub schemachecking=off bindmethod=simple binddn="uid=syncrepl,ou=sysusers,dc=local" credentials=pwdsyncrepl # BEGIN Session TLS starttls="critical" tls_cacert=__CACERTFILE__ # End Session TLS When start the replica server it doing an ldapsearch and retrieve my data in replica. So now we modify the filter as the following : filter="(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Now when the replica doing the ldapsearch request it do with the new filter but returning numentrie to 0 like this in the log of master LDAP server: Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=1 BIND dn="uid=syncrepl,ou=sysusers,dc=local" mech=SIMPLE ssf=0 Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=1 RESULT tag=97 err=0 text= Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=2 SRCH base="dc=local" scope=2 deref=0 filter="(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=2 SRCH attr=* + Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=2 SEARCH RESULT tag=101 err=0 *nentries=0* text= And when i do ldapsearch manually : ldapsearch -x -b dc=local -H ldap://rh-test3.kvm.rla "(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=1 BIND dn="" method=128 Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=1 RESULT tag=97 err=0 text= Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=2 SRCH base="dc=local" scope=2 deref=0 filter="(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=2 SEARCH RESULT tag=101 err=0 *nentries=13* text= I don't understand why my new user is not sync !! thanks for your help,

2 1

Maximum uidNumber (posix / ldap).
by Alejandro Leyva 07 Jul '09

07 Jul '09

Hi all, we are looking at the maximum uidNumber, we need to know the maximum allowed uidNumber for LDAP / POSIX accounts. The schema definition for uidNumber says that it is defined with syntax 1.3.6.1.4.1.1466.115.121.1.27, which is an LDAP number / integer, in http://www.zytrax.com/books/ldap/apa/types.html#numbers the range is defined as 2,147,483,648 to 2,147,483,647, did somebody know if this range is common to LDAP and POSIX? Could we have a user with uidNumber 2,147,483,646 without any problem? Thanks in advance.

2 2

slapd-ldap proxy
by Sergio Cioban Filho 07 Jul '09

07 Jul '09

Hi all, I'm trying to configurate an OpenLdap proxy for high availability, with ldap backend. My problem is the timeout. When the first server in URI is gone down, my ldapsearch delay 3 minutes, how do I change this timeout? Server 192.168.166.171 UP TIME: real 0m0.036s user 0m0.002s sys 0m0.003s Server 192.168.166.171 DOWN TIME: real 3m8.957s user 0m0.003s sys 0m0.004s I want the ldap-proxy immediately redirect the ldapsearch to the server 192.168.166.172 when server 192.168.166.172 gone down. My back-ldap configuration:* database ldap suffix "dc=digitro,dc=com,dc=br" rootdn "cn=axs,dc=digitro,dc=com,dc=br" uri "ldap://192.168.166.171/ ldap://192.168.166.172/" conn-ttl 0 idle-timeout 0 timeout 1 * Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

1 0

Ubuntu Jaunty Certificate Issue Solved
by gruntler-ldap＠yahoo.com 07 Jul '09

07 Jul '09

Hi, Ubuntu distributes a patched version of GNUtls 2.6.x. Run: gnutls-cli -VV --print-cert -p 636 my-ldap-server.com 2>&1 | egrep 'RSA-MD5|warning' See no output. Using "-d 4711" instead of "-VV" doesn't show any problems either. Download the real GNUtls 2.8.1 and build it and try again: Run: /opt/gnutls/bin/gnutls-cli -VV --print-cert -p 636 my-ldap-server.com 2>&1 | egrep 'RSA-MD5|warning' Signature Algorithm: RSA-MD5 warning: signed using a broken signature algorithm that can be forged. Note that the CA cert is secure, it's the LDAP server's cert that was weak. -Ken

1 0

Virtual List View
by Patrick Patterson 07 Jul '09

07 Jul '09

Hello All: I am trying to debug a problem with an Outlook 2003 client querying an OpenLDAP 2.4.11 server. The Outlook client is returning from the lookup with an "unavailable critical extension" error. Looking at : http://support.microsoft.com/default.aspx?scid=kb;en-us;555536&sd=rss&spid=… It appears that Outlook may be trying to perform a search using the Virtual List View extension. Since this is on a large corporate network, I am loath to just apply the registry fix to every workstation as suggested by the Microsoft KB article, if there is a way to either enable or configure this extension on the server. Is this extension supported on OpenLDAP? Thanks. -- Personal Mail from Patrick Patterson No company affiliation

2 1

OpenLDAP as an anonymous bind proxy for Active Directory
by jjeffery＠sp.com.au 06 Jul '09

06 Jul '09

I have been attempting to configure openldap to act as a proxy for our corporate Active Directory installation. The idea is, of course, that users of linux workstations can use their AD credentials. While we are also experimenting with AD integration using winbind, we also want the option to use standard LDAP, as it means that the linux workstations do not have to be joined to the Active Directory domain. Many previous posts on this forum have been most helpful, (as have posts to the openldap-software list), and I have our setup working, but there is one strange problem. I prefer that our linux workstations can connect to the openldap anonymously, as it means we do not have to have credentials stored in /etc/ldap.conf. This should not be a problem as our openldap proxy can have credentials stored for connecting to the AD server. But what I find is that when I start the slapd, none of the linux workstations can connect until I first issue a query to the slapd using valid credentials. Eg: 1. Start slapd /usr/local/libexec/slapd 2. Linux workstations cannot bind anonymously 3. Issue query against slapd /usr/bin/ldapsearch -H ldap://localhost \ -D "cn=someuser,ou=Accounts,dc=example,dc=com" \ -w "secret" -x -s base "(objectclass=*)" namingContext 4. Linux workstations can now bind anonymously Although there is the obvious work-around that after starting the slapd, we issue the query above, I would kind of like to know why this is happening. Maybe there is a better way? I am using openldap 2.4.16, with ldap and bdb backends, and all overlays. Operating system is CentOS 5. Any pointers on how to improve my config would be most welcome. My slapd.conf: ==== BEGIN slapd.conf ==== include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel 256 monitoring on defaultsearchbase "dc=example,dc=com" database ldap suffix "dc=example,dc=com" uri "ldap://adserver.example.com" # Not sure why, but when this is not set, the JDK LDAP browser # will not connect anonymously about one time in four. chase-referrals no # If this is not set, the user cannot connect anonymously. # The first connection must be bound, but subsequent connections can # be anonymous. (More investigation required) rebind-as-user yes acl-bind bindmethod=simple binddn="cn=username,ou=Accounts,dc=example,dc=com" credentials="secret" idassert-bind bindmethod=simple binddn="cn=username,ou=Accounts,dc=example,dc=com" credentials="secret" mode=none flags=non-prescriptive overlay rwm # Because posixAccount does not exist in the Active Directory schema, we need # to map to an objectclass that does exist. We could use user, but at this # time we don't have a schema for the AD 'user' objectclass. It just happens # that organizationalPerson is defined in our AD. rwm-map objectclass posixAccount organizationalPerson rwm-map attribute homeDirectory unixHomeDirectory access to dn.subtree="dc=example,dc=com" by * read ==== END slapd.conf ====

1 0

Unable to retrieve the authFilterId attribute from the openldap server
by Navin 06 Jul '09

06 Jul '09

Hi, I am new to LDAP. Hence kindly do excuse if any of my terminology is different. Issue: ----- I installed the openldap server through debian package. ie. did NOT get the source. Was able to add the record and display them. ie. the slaptest worked fine and also could able to search the database with ldapsearch command also. Also able to start and stop the daemon. But i am having an issue regarding the retrieval of authFilterId attribute stored in the LDAP database. Is authFilterId and FilterId attribute same?? Tried to retrieve both of them but unable to get the values of the attribute. Added a schema by name auth.schema in the slapd.conf. This file was not present in the default installation of the openldap. The below are the details of the configuration: openldap server version: OpenLDAP: slapd 2.4.9 Operating System: Ubuntu 8.04 slapd.conf: # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema #auth.schema added by me. Did not get installed by default include /etc/ldap/schema/auth.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel none # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=example,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=example,dc=com" rootpw secret123 # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=nodomain" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=nodomain" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=nodomain" write # by dnattr=owner write ####################################################################### end of slapd.conf Auth.schema File Auth.schema: Manually included by me in the slapd.conf. This schema file added by me. It did not come in the default installation. This is required as my proprietary ldap client needs it. I am not sure of its exact use. but i guess its related to radius. attributetype ( 1.3.6.1.4.1.3317.4.3.1.9 NAME ( 'authFilterId' ) DESC 'radiusSchema: authFilterId' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) objectclass ( 2.16.840.1.113730.3.2.222 NAME 'auth' DESC 'Authentication database' SUP top STRUCTURAL MUST ( uid $ userPassword $ authFilterId)) ######################################################## end of auth.schema LDAP ldif file: init.ldif dn: dc=example,dc=com objectClass: dcObject objectClass: organizationalUnit dc: example ou: Example Dot Com dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: secret123 dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=fsmith,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile uid: fsmith sn: Smith givenName: Fred cn: Fred Smith displayName: Fred Smith uidNumber: 1001 gidNumber: 1001 userPassword: secret123 gecos: Fred Smith loginShell: /bin/bash homeDirectory: /home/fsmith shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: fsmith(a)example.com authFilterId: fsmith initials: FS Added the above records using the command: $ slapadd -l init.ldif Added successfully no errors on the command line. When i searched the database using the command $ ldapsearch -xLLL -b "dc=example,dc=com" '(objectclass=*)' I was able to see all the details present in the init.ldif file except the FilterId field: authFilterId: fsmith When i issue the command, $ ldapsearch -xLLL -b "dc=example,dc=com" '(objectclass=*)' '(authFilterId=*)' then also it does not display the authFilterId attribute. The slaptest when run in the debug level 16783 does not show any errors. The tail message of the slaptest o/p is: .... slaptest startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=module{0}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}nis" config_build_entry: "cn={3}inetorgperson" config_build_entry: "cn={4}auth" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}hdb" backend_startup_one: starting "dc=example,dc=com" hdb_db_open: "dc=example,dc=com" hdb_db_open: database "dc=example,dc=com": dbenv_open(/var/lib/ldap). config file testing succeeded slaptest shutdown: initiated ====> bdb_cache_release_all slaptest destroy: freeing system resources. Kindly do suggest of how to retrieve the authFilterId attribute value. have a nice day, navin

3 2

Max number of failed attempts to connect
by Sergiy Milko 06 Jul '09

06 Jul '09

Hi guys, Is anyone aware of a configuration parameter (in slapd.conf or OpenLDAP back-end database) that specifies a maximum number of unsuccessful attempts to connect to the LDAP before any further attempts are blocked? Is there a possibility to impose this logic at all? I am using JNDI library to bind to the LDAP using 'Simple' authentication. I would appreciate any related information! Many thanks! Sergiy

2 1

how to get the source of jldap
by owen nirvana 03 Jul '09

03 Jul '09

I can't login cvs of openldap-jdap by anonymous in cvsnt, and I have not account of openldap how to get the source of jldap gtalk:freeespeech@gmail.com

5 5

Re :Re: how to get the source of jldap
by Santosh Kumar 03 Jul '09

03 Jul '09

Cheers, Santosh Kumar Sr Software Engineer Cell:09881481468 Computers can never replace human stupidity.

1 0

Re: how to get the source of jldap
by Michael Ströder 03 Jul '09

03 Jul '09

Please stay on the mailing list (Cc:-ed again). owen nirvana wrote: > cvs -d :pserver@cvs.openldap.org:/repo/JLDAP login > or cvs -d :pserver@cvs.openldap.org:/repo/OpenLDAP-JLDAP login > password: OpenLDAP > > error : No Such Repository > gtalk:freeespeech@gmail.com What's the reason you don't do *exactly* what I've posted? Please have a closer look at the commands I sent since before answering your question I've spend my spare time to test it. Basically you're using the wrong CVSROOT. Ciao, Michael. >> 2009/7/3 Michael Ströder <michael(a)stroeder.com>: >>> owen nirvana wrote: >>>> I can't login cvs of openldap-jdap by anonymous in cvsnt, and I have >>>> not account of openldap >>>> >>>> how to get the source of jldap >>> The description on this web page works for me at least on Linux: >>> >>> http://www.openldap.org/software/repo.html#AnonCVS >>> >>> $ export CVSROOT=":pserver:anonymous@cvs.OpenLDAP.org:/repo/OpenLDAP" >>> $ cvs login >>> Password: (enter OpenLDAP) >>> $ cvs co openldap-jldap >>> >>> I don't have cvsnt though. Can you please elaborate on the specific >>> problem you see? Probably it's just a cvsnt usage issue. >>> >>> Ciao, Michael.

1 0

Proxying AD : troubles with the comma character
by Emmanuel Lesouef 03 Jul '09

03 Jul '09

Hello, I'm new to openldap's meta backend and I get a strange issue. I'm able to proxy active directory via openldap using meta backend. It works well except that in my user's DN, I have a comma character which is translated with the following "\2C". How can I handle that ? Thanks. -- Emmanuel Lesouef

3 4

Prb: UID Fields Over 7 Chars - add transaction hangs
by David.CTR.Muench＠faa.gov 02 Jul '09

02 Jul '09

All, I have a problem with a new OpenLDAP configuration that is likely my own doing, but I am unable to discern the cause. Environment: Solaris 9, OpenLDAP 2.4.16, Berkeley DB 4.7.25 I installed the OpenLDAP software from the stable release at the openldap.org site. After some basic configuration and very basic tests, I did the "full" slapd.conf and DB_CONFIG configurations using various resources, including the Admin Guide and the FAQ-o-matic. All seemed to be going well until I tried to add (ldapmodify -a w/ldif files) some new "person" entries based on data I want to migrate. The first one was OK, but subsequent ones never completed. When the problem occurs, there's no return from the ldapmodify command and likewise any "db_stat" commands that I attempt. When I look at the log (local4.debug) entries, the last entry is for the "ADD dn="uid=DCM...". The daemon is *not* looping, there's just never a response. [I need to break to get my prompt back.] When I attempt to stop the daemon, I get "waiting for 1 operations/tasks to finish" and I have to kill the daemon to get it to stop. When I restart, it goes through DB recovery and everything is as it was before the ldapmodify -a started. A colleague suggested something that seems to be an indicator: - an add of "dn: uid=DCM11,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM1123,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM11234,ou=People,o=USNS" does *not* work So it seems that "uid" values with lengths over 7 characters fail. Yeah, this seems plenty odd to me, but I've created\tested\deleted DBs multiple times over and this still happens consistently. I have tried multiple levels of "debug", down to "488" anyway, but still no message that seems like an error. Not wanting to swamp anyone, here's some basic config extracts: ===DB_CONFIG=== set_cachesize 0 67108864 1 set_lg_bsize 2097152 set_lg_max 10485760 set_lg_regionmax 262144 === ===slapd_t10.conf=== [obviously stripped] ... backend bdb database bdb suffix "o=XXXX" checkpoint 128 15 index objectClass eq index uid pres,eq [Have tried taking this out & re-creating - no difference] lastmod on monitoring on ... === Anyone have any ideas? I have spent many hours looking at this, but I'm willing to believe it's something simple I can't see. Thanks in advance for you help. DCM

4 7

Re: TLS init def ctx failed: -1
by gruntler-ldap＠yahoo.com 02 Jul '09

02 Jul '09

--- On Thu, 7/2/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: TLS init def ctx failed: -1 > To: "François Mehault" <Francois.Mehault(a)netplus.fr> > Cc: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Date: Thursday, July 2, 2009, 7:02 AM > François Mehault wrote: > > > > |*openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout > > server.pem -days 365*| > > This is a terrible way to generate a server certificate. > Instead you should generate a CA, following the steps in > (the current) section 4.2. What document is being referred to here? It can't be http://www.openldap.org/doc/admin/ because section 4.2. there is "Prerequisite software". Thanks, Ken

2 1

TLS init def ctx failed: -1
by François Mehault 02 Jul '09

02 Jul '09

Hi all I contact you because I don't succeed to configure my OpenLDAP with TLS. First I create self signed certificate server.pem like I read on this page http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#5.1.1 in /usr/local/etc/openldap/tls. openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 Then I add this line in slapd.conf : TLSCertificateFile /usr/local/etc/openldap/tls/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/tls/server.pem TLSCACertificateFile /usr/local/etc/opendldap/tls/server.pem TLSVerifyClient never Then I restart slapd. /usr/local/etc/rc.d/slapd stop , start. And in my /var/log/debug.log I have Jul 2 12:18:39 labobe2 slapd[97816]: main: TLS init def ctx failed: -1 Jul 2 12:18:39 labobe2 slapd[97816]: slapd destroy: freeing system resources. Jul 2 12:18:39 labobe2 slapd[97816]: syncinfo_free: rid=001 Jul 2 12:18:39 labobe2 slapd[97816]: slapd stopped. I use FreeBSD 7. If someone can help me, I appreciate, thanks in advance Regards, François

3 4

RE: monitor mirror mode
by François Mehault 02 Jul '09

02 Jul '09

Thanks for your response. ContextCSN seems perfect but, I try on my two OpenLDAP: <10:13>[labobe2:~]# ldapsearch -x -LLL -H ldap://openldapID1:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 <10:07>[labobe1:~]# ldapsearch -x -LLL -H ldap:// openldapID2:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 As you can see I have two results by request. And I have effectively the same result on each server. Can I conclude just with this results that the replication works well ? I though I would have one contextCSN for each request instead of two. Thanks for your help. Regards, François De : Gavin Henry [mailto:ghenry@OpenLDAP.org] Envoyé : vendredi 26 juin 2009 17:14 À : François Mehault Cc : openldap-technical(a)openldap.org Objet : Re: monitor mirror mode You can use: http://blog.suretecsystems.com/archives/146-OpenLDAP-Quick-Tips-Checking-th… ----- "François Mehault" <Francois.Mehault(a)netplus.fr> wrote: > > Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found
by Andreas Krummrich 01 Jul '09

01 Jul '09

Hi all, I'm running OpenLDAP 2.4.11 on a debian lenny box and it seems that I'm having trouble with the log files. I had a corrupt database some days ago and needed to restore the database from the backup. The log said: Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": unclean shutdown detected; attempting recovery. Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": dbenv_open(/var/lib/ldap). Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Ignoring log file: /var/lib/ldap/log.0000000005: magic number 0, not 40988 Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Invalid log file: log.0000000005: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de" cannot be recovered, err -30978. Restore from backup! Jun 28 01:16:59 old slapd[17374]: ====> bdb_cache_release_all Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 28 01:16:59 old slapd[17374]: bdb_db_close: database "dc=intern,dc=domain,dc=de": txn_checkpoint failed: Invalid argument (22). Jun 28 01:16:59 old slapd[17374]: backend_startup_one: bi_db_open failed! (-30978) So I installed a new OpenLDAP server with the same versions and the same configuration. The first thing what I found out was that db_archive has some trouble: On the new box I get the following results from db_archive: root@new:/var/lib/ldap# db4.2_archive -sa /var/lib/ldap/cn.bdb /var/lib/ldap/dn2id.bdb /var/lib/ldap/gidNumber.bdb /var/lib/ldap/givenName.bdb /var/lib/ldap/id2entry.bdb /var/lib/ldap/loginShell.bdb /var/lib/ldap/objectClass.bdb /var/lib/ldap/sn.bdb /var/lib/ldap/uid.bdb /var/lib/ldap/uidNumber.bdb root@new:/var/lib/ldap# db4.2_archive -la /var/lib/ldap/log.0000000001 root@new:/var/lib/ldap# Looks good so far. On the old box I get the following results (there are the same databases) root@new:/var/lib/ldap# db4.2_archive -sa root@new:/var/lib/ldap# db4.2_archive -la db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found root@new:/var/lib/ldap# I searched the archive and googled this message, but found nothing that fits my case. Hope that someone can give me a hint, solving this issue. Thanks and kind regards, Andreas

4 6

LDAP user cannot login
by Richard Gillman 01 Jul '09

01 Jul '09

Hi, I'm moving an LDAP server from one system to another. Data I copied using slapcat -l ldapdata; slapadd -c -q -l ldapdata on new system, then start ldap. But I can't log in as an ordinary user. I've tried resetting the user password using JXplorer, but no luck. Can anyone spot something wrong in what I'm trying to do? Suggestions appreciated. thanks in advance, Dick slapd.conf contains access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.exact="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.exact="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read slapd -d acl gives at startup (#) $OpenLDAP: slapd 2.3.43 (Jan 21 2009 03:59:37) $ mockbuild@builder10.centos.org:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd Backend ACL: access to attrs=SambaLMPassword,SambaNTPassword by dn.base="cn=manager,dc=nerc-sf,dc=ac,dc=uk" write by * none Backend ACL: access to dn.base="" by * read Backend ACL: access to dn.base="cn=subschema" by * read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword,sambaLMPassword,sambaNTPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="ou=admins,dc=nerc-sf,dc=ac,dc=uk" by dn.regex="cn=[^,]+,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by anonymous auth Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" by peername.ip="192.171.172.0%255.255.255.0" read by peername.ip="192.171.159.192%255.255.255.192" read by peername.ip="127.0.0.1" read => bdb_entry_get: found entry: "dc=nerc-sf,dc=ac,dc=uk" => access_allowed: search access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "entryCSN" requested <= root access granted slapd starting When I try to login, slapd gives => access_allowed: read access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "userPassword" requested => dn: [1] dc=nerc-sf,dc=ac,dc=uk => acl_get: [1] matched => acl_get: [1] attr userPassword access_allowed: no res from state (userPassword) => acl_mask: access to entry "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: anonymous <= acl_mask: [1] applying auth(=xd) (stop) <= acl_mask: [1] mask: auth(=xd) => access_allowed: read access denied by auth(=xd) send_search_entry: conn 1 access to attribute userPassword, value #0 not allowed -- Richard Gillman ITC UNIX Systems Group, Maclean Building, Wallingford OX10 8BB Tel: 01491 - 692 339 Fax: 01491 - 692 424

1 0

RE: MirrorMode VS load balancing
by Brett Maxfield 30 Jun '09

30 Jun '09

Yes simple is a good thing, but you have to decide for yourself what risk and downtime is acceptable, how long to recover and how many writes is acceptable to lose. E.g. Is a one daily backup acceptable for recovery (and you lose changes since then), or do you need every single write to the hour/minute ? The more continously/frequently you write to both nodes, the more likely are sync errors, and also less recoverability of your bdb logs in the event of catastrophic power failure or inproper shutdown. I dont think anyone can decide this for you.. You need to evaluate your level of risk and what loss / downtime is acceptable to you / your employer / your customers etc., Cheers Brett -----Original Message----- From: Hideo NAKAMITSU <nomo(a)bluecoara.net> Sent: Monday, 29 June 2009 11:51 AM To: openldap-technical(a)openldap.org Subject: Re: MirrorMode VS load balancing and how about 1write/sec, 10writes/sec, 50writes/sec, 100writes/sec... I want to know this threshold like, - if writes happen 0-5/sec, it's 99% safe (at the worst unlucky case, only 2writes at the same time may break something) - 6-50/sec, may safe or not. - more than 50/sec, danger.

5 4

ppolicy and syncrepl aclaration
by Jordi Espasa Clofent 30 Jun '09

30 Jun '09

Hi, According to http://www.openldap.org/lists/openldap-software/200701/msg00149.html, the "In general, ppolicy related state values are not replicated; each replica is on its own as far as state-related attributes in enforcing password policy." ¿Is it means that of I've one provider and two consumers, the changes made in ppolicy statements in provider are not sync againt the consumers as other kind entries/attributes are? I need to know because of I've change my userPassword in provider and: * I can use without problems the new password using the provider * I cannot use the new password against the two consumers. I use LVS balancer in front of the 3 openldap servers (one provider and two consumers), so it's important that ANY change made in provider will be always synced. -- Thanks, Jordi Espasa Clofent

3 5

openldap+sasl confusion
by Seau Yeen Su 29 Jun '09

29 Jun '09

Hi, I am trying to install OpenLdap with SASL. The version of openldap i installed is openldap-2.4.16 whereas the cyrus-sasl version installed is cyrus-sasl-2.1.23. The BerkeleyDB version installed is 4.4. I followed the guidance in this link to do the installation : http://tldp.org/HOWTO/LDAP-HOWTO/sasl.html However, when i tried to add users defined in ldif file, I received ldap_sasl_interactive_bind_s: Invalid credentials (49) error when i keyed in the password generated for admin using saslpasswd2 command. I have a few questions: 1. After using saslpasswd2 to create the username and password in sasl database, do i need to add the entry into ldap database with slappasswd command? When i used slapadd command and it prompts for password, does it authenticate against sasl database or ldap database? 2. Do i need to issue saslpasswd2 for each and every user that i want to add into ldap database and to be authenticated via ldap? 3. In the slapd.conf file, under rootpw, am i supposed to use the word "secret" or the cleartext password that i keyed in using saslpasswd2 or some encrypted password? 4. What is the difference between sasl-regexp and authz-regexp? 5. Let's say i issued saslpasswd2 -c admin to create admin as the LDAP administrator. Does this mean in the slapd.conf, the rootdn should be admin or can it be another name, that will be mapped via sasl-regexp/authz-regexp? (Which does it use anyway between these 2 : sasl-regexp & authz-regexp?) 6. Previously I set up without sasl and it was rather straightforward, merely using slappasswd and save the encyrpted pasword into slapd.conf. Now, i am totally lost with its concept. I do know that names in ldap database has to be mapped to the names in sasl database. Hopefully you can enlighten me on the whole concept and how the configuration should be done. Thank you. Hope to receive some advice and guidance. -- Warmest Regards, Seau Yeen

3 5

MirrorMode VS load balancing
by Hideo NAKAMITSU 29 Jun '09

29 Jun '09

Guys, I've already read this, and understand the difference between MirrorMode and Multi Master. http://www.openldap.org/doc/admin24/replication.html Actually, when I setup 2-nodes MirrorMode and add too much entries to both nodes, at the same time, sometimes both databases weren't syncrhonized correctly. (I made a script to add 10,000 entries, and run it on both nodes at the same time.) In this case, we shouldn't update both nodes at the same time. and of course this is already discribed in the document as following. -------------------------------------------------------- MirrorMode is not what is termed as a Multi-Master solution. This is because writes have to go to just one of the mirror nodes at a time -------------------------------------------------------- but on some cases(including my environment), UPDATE happens 3-10 times in a day. it's much less than SEARCH. in this case, I think we can just put loadbalancer, and enable "load balancing" and "redundancy" (I understand UPDATE isn't load balanced.) -------------------------------------------------------- CLIENT | SLB(RoundRobin) | +-----+ SRV1 SRV2 * MirrorMode is enabled on SRV1 and SRV2 -------------------------------------------------------- My question is, MirrorMode document says "writes have to go to just one of the mirror nodes at a time." but if the writes don't happen very often, I think "writes can be done on every nodes at a time." When I did some tests, it could be done. but I'm not sure developer's thoughts. How do you think guys ?

5 9

Re: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 29 Jun '09

29 Jun '09

> Hi ! > > We are trying to define (in our own ldap schema) an IA5String attribute > type that > is required to be managed (from our ldap clients) as "case insensitive" > > "greaterOrEqual" and "lessOrEqual" filters are required to be managed > over this > attribute, so we wanted to assigne (in its attribute type definition) an > ORDERING > matching requesting "case insensitive" behaviour > > According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO > any > ordering Matching Rule for IA5String syntax AND case insensitive support. > We > tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error > (at schema > loading) as attribute type syntax (IA5String) is not allowed for this > "ordering match rule" Correct. > We checked that defining the attribute as "PrintableString" works (as > "caseIgnoreOrderingMatch" > is a valid matching rule for that sysntax according to RFC4517) ... but we > are really interested in > IA5String syntax .... > > Does openLDAP server technolgy provide a "case insensitive ordering > match" method > for IA5String syntax ? No. It doesn't because there's no standard track definition for it. However, there's nothing preventing OpenLDAP software from supporting this non-standard track feature. Adding custom matching rules is relatively "trivial". p.

2 2

ldappasswd use for admin
by Gustavo Mendes de Carvalho 28 Jun '09

28 Jun '09

Hi there, Does anybody know which parameters to use in ldappasswd command when admin user (cn=admin,dc=domain,dc=com) has to reset user's password ? The situation is: LDAP user forgot his/her password and LDAP Admin has to reset it, allowing his/her to login and then to change his/her password. Thanks in advance --- Gustvo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 2

monitor mirror mode
by François Mehault 26 Jun '09

26 Jun '09

Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François

2 1

RE: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 26 Jun '09

26 Jun '09

> Hi ! > > OK ... we will check that approach. > > Do you know if it was something forgotten in the RFC4517 ?... it > sounds > really odd (to me) that PrintableString (that is a subset of IA5String) > and DirectoryString (that is a superset) are allowed syntaxis for > "caseIgnoreOrderingMatch" ... but IA5String is not allowed to use it > (maybe I am missunderstanding/mixing things ....???) I do not recall in detail, but this or something related should have already been discussed (I'd let others step in if they know the story in more detail). Basically, it should be something like the caseIgnore stuff for IA5 was absent in the RFC 225* series, and it was not added to the RFC 451* series because IA5 is essentially obsolete, directoryString should be used instead. p.

5 4

ldap auth from external application
by Zdenek Styblik 26 Jun '09

26 Jun '09

Hi, I'd like to ask why is auth from external applications like eg. ftp server done via proxy user, and not straight with user provided credentials. The only thing I came up with is that there is possible risk with hi-jacking session due to flaw in application, still- I'm missing the big picture here. Or return code 49 is not enough for failed auth? Could somebody, please, clarify this for me? I'm sure there are really good reasons no to so (straight auth), still I've "found" pros in not having additional user which is capable to read others (even hashed) passwords, and probably no need to be password hash dependent as whole auth would be LDAPs domain. Thanks, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 6

openldap search configuration
by mukim pathan 26 Jun '09

26 Jun '09

Hi, I am using openldap 2.4.16 with bdb-4.5. This database has to give response to around 200 search queries at a time. I wish to know what my configuration of ldap should be so that this search queries will be answered in milliseconds. Any help will be appreciated. Regards, Mukim Pathan

1 0

Case Ignore Ordering matching rule for IA5 String sysntax ?
by Antonio Alonso 25 Jun '09

25 Jun '09

Hi ! We are trying to define (in our own ldap schema) an IA5String attribute type that is required to be managed (from our ldap clients) as "case insensitive" "greaterOrEqual" and "lessOrEqual" filters are required to be managed over this attribute, so we wanted to assigne (in its attribute type definition) an ORDERING matching requesting "case insensitive" behaviour According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO any ordering Matching Rule for IA5String syntax AND case insensitive support. We tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error (at schema loading) as attribute type syntax (IA5String) is not allowed for this "ordering match rule" We checked that defining the attribute as "PrintableString" works (as "caseIgnoreOrderingMatch" is a valid matching rule for that sysntax according to RFC4517) ... but we are really interested in IA5String syntax .... Does openLDAP server technolgy provide a "case insensitive ordering match" method for IA5String syntax ? Thanks in advance BR / Antonio Antonio Alonso Alarcón CUDB System Engineer Ericsson España, S.A. Phone: +34 91 339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) (Millenium building, Fax: +34 91 339 1636 5th floor, B1 side, desk 61) 28033 Madrid, Spain E-mail: antonio.alonso(a)ericsson.com

1 0

Re: OpenLDAP Mirror Mode configuration
by Mathieu MILLET 25 Jun '09

25 Jun '09

On Thu, 25 Jun 2009 07:41:42 -0600, Matt Kassawara <battery(a)writeme.com> wrote: > I'm running mirror mode on a pair of VMs and haven't noticed any issues > with > replication. If you're using VMware ESX/ESXi 3.5, I recommend configuring > Linux guests with the kernel boot parameter "clocksource=acpi_pm" and > configuring VMware Tools to handle clock management in the guest. Verify > NTP isn't running in the guest. Also, making sure the Linux kernel > periodic > interrupt timer runs at 100 Hz instead of 250 or 1000 Hz can reduce timing > issues. VMware provides some documentation on best practices for > performance tuning I'd recommend reading. Yes, I have read these (but was using VM workstation). Also, My experimentation was during last summer 2008 and at the same period VMWare switch from "DO NOT USE NTP in Guest, instead VmwareTools" to "Use NTP" without any explanation ... The main trouble was when modifying on both side "too quickly". Other testings with differents applications show up that virtualization is no good for timing-picky application (but it is going off-topic ;) Thanks for the sharing. Sincerely yours, Mathieu. > On Thu, Jun 25, 2009 at 12:16 AM, Mathieu MILLET <ldap(a)htam.net> wrote: > >> On Tue, 23 Jun 2009 09:36:23 +0100, Fernando Silva >> <fernandolrsilva(a)gmail.com> wrote: >> > Hi all, >> >> Hi >> >> > I'm trying to setup a Mirror Mode configuration using 2 machines >> > running >> > OpenLDAP v2.4.11 on both. To make things easy both machines are on the >> > same (private) network. >> > >> > [snip] >> > mirrormode on >> > >> > I'm using Ubuntu 8.10 inside a VMWare image, but both images are >> > running >> > on independent machines and the network on both is Bridge Mode. >> >> >From previous experiment, especially with OpenLDAP 2.4.11, I have very >> hard >> time with making OpenLDAP N-way replication working on VM, especially >> VMWare-based ones. >> >> The main problem was with the management of the system clock, where >> VMWare >> was making the clock slower and then make a "jump" to compensate the >> slowiness. So, I got a lot of line "new modification with older timer >> value" (can't remember the precise log line, though). >> >> I had to switch to plain physical server (which was my target by then). >> >> > All >> > seems well according to OpenLDAP manual, but maybe I'm missing >> > something. I start both servers using "slapd -d sync" in order to >> > filter >> > only the sync part. >> > >> > I created a script to insert 200 employees in my directory, to force >> > the >> > servers to sync up. When I start both servers and insert the employees >> > in machine 1, I get this too much lines with this sample: >> > slap_queue_csn: queing 0xb6851b4a >> 20090623082909.571025Z#000000#000#000000 >> > slap_graduate_commit_csn: removing 0xb82165c8 >> > 20090623082909.571025Z#000000#000#000000 >> > >> > So the CSN is being created (I think), but there's no sync to machine >> > 2, >> > which makes me frustated. . . >> > >> > I'd appreciate any comments you can have, especially if you already >> > have >> > this kind of setup running. >> > >> > Best regards, >> > Fernando >> >> Hope it can help. >> Sincerely yours, Mathieu MILLET. >> >>

1 0

getnetbyaddr not working with LDAP
by Eric Ritchie 25 Jun '09

25 Jun '09

I'm running 2.3.39 under Redhat 4.0. I'm transitioning my Redhat clients from NIS to LDAP. It seems that getnetbyaddr doesn't work under LDAP. The following perl code shows the problem: #!/usr/local/bin/perl -w use Socket; $n = getnetbyname ( "nasd" ); $name = getnetbyaddr($n, AF_INET); print "$name\n"; exit 0; Host running NIS: # ./eric.pl nasd Host running LDAP: # ./eric.pl Use of uninitialized value in concatenation (.) or string at ./eric.pl line 9. The getnetbyname call works and I can print out the network IP. Can anyone help with this? Thanks -- Eric Ritchie Interactive Brokers LLC 203-618-5868

1 1

OpenLDAP Mirror Mode configuration
by Fernando Silva 25 Jun '09

25 Jun '09

Hi all, I'm trying to setup a Mirror Mode configuration using 2 machines running OpenLDAP v2.4.11 on both. To make things easy both machines are on the same (private) network. Here's a sample of both my slapd.conf: Machine 1: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 001 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.2 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on Machine 2: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 002 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.1 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on I'm using Ubuntu 8.10 inside a VMWare image, but both images are running on independent machines and the network on both is Bridge Mode. All seems well according to OpenLDAP manual, but maybe I'm missing something. I start both servers using "slapd -d sync" in order to filter only the sync part. I created a script to insert 200 employees in my directory, to force the servers to sync up. When I start both servers and insert the employees in machine 1, I get this too much lines with this sample: slap_queue_csn: queing 0xb6851b4a 20090623082909.571025Z#000000#000#000000 slap_graduate_commit_csn: removing 0xb82165c8 20090623082909.571025Z#000000#000#000000 So the CSN is being created (I think), but there's no sync to machine 2, which makes me frustated. . . I'd appreciate any comments you can have, especially if you already have this kind of setup running. Best regards, Fernando

3 3

RHEL 5 rpms
by Adam Leach 25 Jun '09

25 Jun '09

Anyone know where to find RHEL 5 rpms that are higher than 2.4.11? -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 2

How to backup/restore on remote servers
by Josir Gomes 23 Jun '09

23 Jun '09

Hi folks, I just installed a openldap server and I want to test backup/restore routines. I have two machines, one is a clone of the second one.The first one I add several users and then my test is to restore those users in the new machine. To backup, it was easy: slapcat -l /path/to/your/backup.ldif But when I tried to restore, I shutdown the samba/ldap service with: /etc/init.d/ebox samba stop /etc/init.d/ebox slapd stop And then I issue: slapadd -l /path/to/your/backup.ldif => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=ebox" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) I understand that there are other records and I can't replace them. Do I have to erase everything ? Or is there a merge option ? I know that there is a replication service but those two servers will not be on the same network (ie. one server will not communicate with the other) so I think this approach does not apply. Any tip or suggestion will be very welcome. Thanks in advance, Josir Gomes

4 5

Re: ldap not finding internal CA?
by gruntler-ldap＠yahoo.com 23 Jun '09

23 Jun '09

--- On Wed, 6/17/09, Mathias Gug <mathiaz(a)ubuntu.com> wrote: > From: Mathias Gug <mathiaz(a)ubuntu.com> > Subject: Re: ldap not finding internal CA? > To: "Kurt Yoder" <ktyopenldap(a)yoderhome.com> > Cc: openldap-technical(a)openldap.org > Date: Wednesday, June 17, 2009, 9:13 PM > > [...] > >> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I >> had the same message about self-signed certificates on previous >> Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works >> fine. > > As Howard mentioned this should have been fixed in 2.4.16. However > could you try to put both the CA certificate *and* the server > certificate in the cert.file used by the slapd server - (that way > the whole CA chain is sent to the client by gnutls) ? Hi Mathias, How exactly does one do that? I've tried simply appending the contents of the CA file to the server certificate file and restarting slapd and it has no effect. I've tried other various combinations as well but testing against Jaunty still fails while Intrepid works. Meanwhile I built OpenLDAP 2.4.16 on Jaunty with no Ubuntu patches added to OpenLDAP and it works: gruntler@jaunty-64:~/src/openldap-2.4.16/clients/tools$ ./ldapsearch -x -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.16 (Jun 22 2009 17:04:33) $ gruntler@jaunty-64:/home/gruntler/src/openldap-2.4.16/clients/tools (LDAP library: OpenLDAP 20416) # extended LDIF # # LDAPv3 # base <dc=abcd, dc=efgh, dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # ... snip ... ldap.conf settings: BASE dc=abcd, dc=efgh, dc=com URI ldaps://auth01-test ldaps://auth02-test TLS_CACERT /etc/ssl/cacerts/my-org.cert.pem TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 ----- Meanwhile... gruntler@jaunty-64:~/src/openldap-2.4.16/clients/tools$ /usr/bin/ldapsearch -x -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.15 (Mar 19 2009 10:07:04) $ buildd@yellow:/build/buildd/openldap-2.4.15/debian/build/clients/tools (LDAP library: OpenLDAP 20415) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

1 0

proxy cache not really caching?
by Tyler Gates 23 Jun '09

23 Jun '09

Hello, I've been running my openldap 2.4 proxy directory server using back_ldap and pcache in front of two masters for a few days and have been a little confused about why I'm not getting more "QUERY ANSWERED" messages in the logs considering all the "QUERY CACHED" messages. According to the script I wrote to parse the log file for certain key words, I'm seeing data like this: ******************************* QUERIES ANSWERED: 26901 QUERIES NOT ANSWERED: 142386 QUERIES CACHEABLE: 114491 QUERIES NOT CACHEABLE: 27895 ------------------------------- TOTAL QUERIES: 169287 QUERIES ADDED: 114080 QUERIES STORED: 7 QUERY HIT: %15.8907653866 ******************************* As you can see my templates are catching a good majority of the queries and they appear to be added to cache. For example I see messages like this: 'Added query expires at 1244899436 (NEGATIVE)' But even though I've tried bumping the ttl up, I'm still seeing a lot of QUERY NOT ANSWERABLE messages fly by about queries that should have been in cache before. For example, this snippet below appears to cache querystr '(&(objectClass=posixGroup)(memberUid=xfs))' but then one query later the exact same query comes up and it says its not answerable and adds it to cache again. Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SRCH attr=gidNumber Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(memberUid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Entering QC, querystr = (&(objectClass=posixGroup)(memberUid=xfs)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock QC index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Not answerable: Unlock QC index=0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Added query expires at 1244899436 (NEGATIVE) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: TEMPLATE 0x8354560 QUERIES++ 1 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Unlock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1661 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(uid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1661 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1662 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1662 SRCH attr=gidNumber Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(memberUid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Entering QC, querystr = (&(objectClass=posixGroup)(memberUid=xfs)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock QC index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Not answerable: Unlock QC index=0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Added query expires at 1244899436 (NEGATIVE) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: TEMPLATE 0x8354560 QUERIES++ 1 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Unlock AQ index = 0x8354560 According to the logs I currently have 7 cached queries and about a %15.8 hit rate which seems ridiculous given all the 'added query' messages I'm getting. Is there something wrong with my caching engine on the directory server or am I missing something with how the caching mechanism works? Thanks, Tyler

2 5

Howto setup OpenLDAP as ACL for Servers?
by openbsd shen 23 Jun '09

23 Jun '09

I have many Windows 2003/Linux Server, and a OpenLDAP server as auth server, I want setup ACL in OpenLDAP server, maybe user A allowed to login in windows-1 server and Linux-1 server, and user B allowed to login in windows-2 server and Linux-2 server. How to setup it in OpenLDAP server?

3 2

Database error 22
by Olivier Nicole 23 Jun '09

23 Jun '09

Hi, After a reboot this morning I had the error: Jun 23 06:47:47 ldap slapd[512]: @(#) $OpenLDAP: slapd 2.3.40 (Jan 29 2008 12:27:46) $ root@fbsd35.cs.ait.ac.th:/usr/ports/net/openldap23-server/work/openldap-2.3.40/servers/slapd Jun 23 06:47:49 ldap slapd[522]: bdb_db_open: Database cannot be opened, err 22. Restore from backup! Jun 23 06:47:49 ldap slapd[522]: bdb(dc=cs,dc=ait,dc=ac,dc=th): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem Jun 23 06:47:49 ldap slapd[522]: bdb(dc=cs,dc=ait,dc=ac,dc=th): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 23 06:47:49 ldap slapd[522]: bdb_db_close: txn_checkpoint failed: Invalid argument (22) Jun 23 06:47:49 ldap slapd[522]: backend_startup_one: bi_db_open failed! (22) Jun 23 06:47:49 ldap slapd[522]: bdb_db_close: alock_close failed Jun 23 06:47:49 ldap slapd[522]: slapd stopped. Jun 23 06:47:49 ldap slapd[522]: connections_destroy: nothing to destroy. Yesterday I think I cleanly halted the LDAP server before the UPS ran out of battery (major power failure). This morning when I restarted the machine I find the above error. 1) What could cause this error? 2) How to do clean and regular backups? Best regards, Olivier

2 1

(no subject)
by Sai 22 Jun '09

22 Jun '09

Hi all, You can consider I am fairly new to LDAP Server, let alone OPENLDAP. But I went through most of the documentation and configured openldap for our Web Site almost year and half to 2 ago. Now I am required to configure passive fail over for this. I am trying to understand and weigh my options. 1) What I want to configure? Two LDAP servers, with their content being in sync at all times. 2) What should I use? Slurpd or syncrepl or some other configuration. 3) What version we are running on? 2.2.13. Sadly but truly, the project does not have the time and resources to update to the latest one. 4) How are we going to use this replication configuration? a. Currently the Web App points to server A. b. In case of a catastrophic failure of server A (Machine down, power plug pulled, disk failure, etc), they will point the Web App to server B. c. Fix server A. d. Point Web App back to server A (I know there is no harm in leaving it pointed to B but that is the way they want. "Return every thing back to how it was"). I think in order to satisfy 4.b (any updates while pointed to server B while server A is down), both the servers should be Master-Master (N-Way master). What I am trying to understand is question 2. I am currently going through chapter 14 and 15 of openldap documentation. I noticed there are some slight differences and I want to get your expert opinion so that I am on the right track and not doing my own little weird configuration. Any help in helping me understand this and decide what to use is much appreciated. Thanks, -Sai

2 3

control rules
by olivier morel 19 Jun '09

19 Jun '09

hy when I try to find a contact with outlook I see all computeur of my area of the ou=machines i would like to ban the route of the ou=machines for just to see the people how can i do . thank you very mutch for your help ------------------------- Olivier Morel - Service Informatique 4 allée de Seine - 93285 Saint Denis Cedex E-mail : olivier.morel(a)panoranet.com

3 2

Mirror Mode question
by Ivan Ordonez 19 Jun '09

19 Jun '09

Hi, I am trying to setup mirror mode on two identical machines. Previously, these two machine were setup as PDC and BDC, using syncrepl provider and comsumer method. All changes are done through the PDC, and will sync to BDC. We decided to use mirror mode for high availability but having issue getting it to work. When I try to create an account, I will get an error message regarding smbldap-tools. See below. Error: shadow context; no update referral at /usr/sbin//smbldap_tools.pm line 1083, <DATA> line 466. Is there anything on smbldap.conf that I need to change? I made sure that the master were pointing to each other. Below is my mirror mode configuration. Machine 1 - IP Address 192.0.0.201 ServerID 1 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.0.0.202:389 type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" searchbase="dc=my,dc=domain,dc=com" scope=sub schemachecking=on bindmethod=simple binddn="cn=Manager,dc=my,dc=domain,dc=com" credentials=mypassword mirrormode on Machine 2 - IP Address 192.0.0.202 ServerID 2 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.0.0.201:389 type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" searchbase="dc=my,dc=domain,dc=com" scope=sub schemachecking=on bindmethod=simple binddn="cn=Manager,dc=my,dc=domain,dc=com" credentials=mypassword mirrormode on Thanks in advance.

4 11

Update schema
by Olivier Nicole 19 Jun '09

19 Jun '09

Hi, I have an openldap server running and being used day to day for authentication. I developped a small schema, and all is working fine. Only I just noticed that in the definition of the object class, I ussed the OID 9999 instead of my own enterprise number: objectclass ( 1.3.6.1.4.1.9999.2.1.1 Should be objectclass ( 1.3.6.1.4.1.26754.4.1.1 I beleive I cannot just stop slapd, correct the schema and restart slapd. What would be the clean way to proceed to a schema upgrade? As this is a production server, I cannot afford to break it. Bestregards, Olivier

2 3

puzzling Open LDAP dn errors
by Frizzell, Ryan 18 Jun '09

18 Jun '09

Hi all, I'm trying to setup and ldap proxy and I'm running into a bunch of bad dn errors in my endeavors. Currently, my slapd.conf file looks like: Database ldap Suffix "" Uri "ldap://myLdapIP:389" Idassert-bind bindmethod=simple Binddn="cn=privilagedAcct" Credentials="privPass" Trying to keep it simple as this is only a sandbox setup. The issues I'm running into are when I try to change the suffix dn to something useful like Suffix "dc=mydomain,dc=net" Changing suffix to that will produce slaptest errors of "<suffix> invalid DN 21 (invalid syntax)" I can connect to my ldap server and perform searchs with: Ldapsearch -LLL "uid=mytestuser" -x -H "ldap://myLdapIP:389" -D "cn=privilagedAcct,OU=test,dc=mydomain,dc=net" -b "dc=mydomain,dc=net" -W I've also tired to change the binddn to cn=privilagedAcct,OU=test,dc=mydomain,dc=net slaptest will then produce Invalid bind config value binddn=cn=privilagedAcct,OU=test,dc=mydomain,dc=net I've worked quite a bit with DNs in the past and I can't seem to see anything wrong with the DNs especially since the ldapsearch commands will complete on the running ldap server. I'm guessing I'm overlooking something very simple. Any ideas? Thanks, Ryan

2 2

Re: ldap not finding internal CA?
by gruntler-ldap＠yahoo.com 18 Jun '09

18 Jun '09

--- On Wed, 6/17/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: ldap not finding internal CA? > To: "Kurt Yoder" <ktyopenldap(a)yoderhome.com> > Cc: openldap-technical(a)openldap.org > Date: Wednesday, June 17, 2009, 8:55 PM > Kurt Yoder wrote: [... skip ...] > > My openldap is version 2.4.15 on Ubuntu Jaunty. [... skip ...] > The GnuTLS issues with X.509v1 certs were fixed in 2.4.16, > so you need to upgrade. Sorry about any confusion but Jaunty doesn't actually have 2.4.15 but a custom version ("2.4.15-1ubuntu3") from Ubuntu: https://launchpad.net/ubuntu/jaunty/amd64/slapd The diff for ITS#5992 is in Jaunty $ cat gnutls-enable-v1-ca-certs ## Mathias Gug <mathiaz-at-ubuntu.com> ## Enable V1 CA certs to be trusted. ## ITS: 5992 - http://www.openldap.org/its/index.cgi?findid=5992 ## LP: https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/305264 ## Fixed in > 2.4.15 ## Patch: http://bazaar.launchpad.net/%7Evcs-imports/openldap/main-src/diff/17238 --- openldap.orig/libraries/libldap/tls_g.c 2009-03-02 02:01:41 +0000 +++ openldap/libraries/libldap/tls_g.c 2009-03-05 03:35:49 +0000 @@ -1,5 +1,5 @@ /* tls_g.c - Handle tls/ssl using GNUTLS. */ -/* $OpenLDAP: pkg/ldap/libraries/libldap/tls_g.c,v 1.6.2.2 2009/02/10 16:41:01 quanah Exp $ */ +/* $OpenLDAP: pkg/ldap/libraries/libldap/tls_g.c,v 1.9 2009/03/05 03:35:49 hyc Exp $ */ /* This work is part of OpenLDAP Software <http://www.openldap.org/>. * * Copyright 2008-2009 The OpenLDAP Foundation. @@ -349,6 +349,13 @@ if ( rc < 0 ) return -1; rc = 0; } + + /* FIXME: ITS#5992 - this should go be configurable, + * and V1 CA certs should be phased out ASAP. + */ + gnutls_certificate_set_verify_flags( ctx->cred, + GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT ); + if ( is_server ) { gnutls_dh_params_init(&ctx->dh_params); gnutls_dh_params_generate2(ctx->dh_params, DH_BITS); However: Jaunty does not appear to contain the diff for ITS#5991. Both ITS#5991 and ITS#5992 are squashed into the same CVS delta for: openldap-*/libraries/libldap/tls_g.c diffs between version 1.6.2.3 and 1.6.2.4 of tls_g.c http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_g.c.diff?r1=… Mathias Gug writes in ITS#5991: << Thanks for the workaround. It works as expected. I haven't tested the patch applied to CVS and thus haven't included it in Ubuntu yet. >> Link to ITS#5991 - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5991;selectid=5991… On a related note, Jaunty vs. pre-Jaunty does this: $ gnutls-cli -p 636 XXXX.XXX.XXX -d 4711 --x509cafile /etc/ldap/cacerts/my-ca.cert.pem --print-cert On Jaunty the output contains: - Peer's certificate is NOT trusted On previous Ubuntu releases (Intrepid, Hardy): - Peer's certificate is trusted Same certificate, same command line arguments, same /etc/ldap/ldap.conf file. Thanks, Ken

1 0

LDAP Sync Replication with Active Directory
by mailings＠atlantismedia.de 18 Jun '09

18 Jun '09

Hi, I have a Win 2k3 SBS and I want to replicate the users into my OpenLDAP 2.4.11. When I start slapd, I can see that one entry of a user is being sent, but after that I get the message "got search entry without Sync State control". I had hoped that replication not only works with OpenLDAP as a master, but also with Active Directory. Is it possible to get this to work? Lars

4 5

Cosine schema - RFC 4524
by Zdenek Styblik 18 Jun '09

18 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, my question is regarding updated Cosine schema [RFC 4524] which has been accepted in March 1991 by IANA. This obsoletes previous Cosine schema [RFC 1274]. OpenLDAP has support for RFC 4524, yet it comes with pre-defined older RFC 1274. So, I'm wondering, is there reason for keep using RFC 1274, or is it safe to define/create new Cosine schema by RFC 4524? Note: I've found ldif file which corresponds with RFC 4524, but no schema file. But I think [believe] it won't be that hard to define schema by published RFC. But, if somebody knows where I can get those files for OpenLDAP, I would be really happy. Thank you for your reply. Regards, Zdenek Styblik - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkoeUiMACgkQ8MreUbSH7ilMtACgwoLkn1KtS/D84yxCRrRfZHHv F9IAnjl8PNOaJ3P6Wm783u9c/J3reit4 =EtIk -----END PGP SIGNATURE-----

2 4

Re: Are hyphens in attribute names supported when using sql backend?
by Grzesiek K 18 Jun '09

18 Jun '09

> > > Thanks for the prompt answer. > > I tried to perform queries in the database using AS 'attr-name' and AS > > "attr-name" - both don't work. > > OK, then you need to figure out a normalization rule that replaces "-" > with an acceptable character, possibly not allowed by LDAP, so that > bidirectional translation is possible. Yes, the other option is to change database because it looks that PostgreSQL DB doesn't support hyphens in aliases nor in table names. Thanks, greg

1 0

Are hyphens in attribute names supported when using sql backend?
by Greg K 18 Jun '09

18 Jun '09

Hi, I use OpenLDAP + PostgreSQL as a sql backend. Just for tests if hyphens are supported I defined object class and attribute having hyphen in the names: Schema: attributetype ( 1.3.6.1.4.1.3814.4.4 NAME ( 'person-type' ) SUP name) objectClass ( 1.3.6.1.4.1.3814.3.5 NAME 'person-oc' DESC 'Test Person' SUP ( inetOrgPerson ) MAY ( person-type) ) insert into ldap_oc_mappings (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) values (4,'person-oc','persons','id',NULL,NULL,0); insert into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) values (10,4,'person-type','persons.name','persons',NULL,NULL,NULL,3,0); When I search for object having this object class and attribute I get the following in debug from slapd: <= ldap_dn2bv(cn=kori hutton,o=sql,c=ru)=0 Success <<< dnPrettyNormal: <cn=Kori Hutton,o=sql,c=RU>, <cn=kori hutton,o=sql,c=ru> backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="person-oc" attr="ref" keyval=12478 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person-oc" attr="objectClass" keyval=12478 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person-oc" attr="person-type" keyval=12478 backsql_get_attr_values(): error executing attribute query "SELECT persons.name AS person-type FROM persons WHERE persons.id=? ORDER BY persons.name" Return code: -1 Native error code: 7 SQL engine state: 42601 Message: ERROR: syntax error at or near "-"; Error while executing the query Looks that hyphen is not allowed in attribute name. Is it any workaround for this to support "-" in attribute names? Thank you, greg

3 3

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by mukim pathan 18 Jun '09

18 Jun '09

Hi, I have installed ldap 2.4.16 with bdb 4.5. When I am doing ldapsearch or ldapadd i am getting error "ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)". I tried searching for the answers but it seems none of them applies in this case, like permission to ldap, ldap server running on 389, configuration file is good without any spaces in rootdn and suffix. is there any solution to this?? Regards, Mukim Pathan

4 4

ldap not finding internal CA?
by Kurt Yoder 17 Jun '09

17 Jun '09

Hello all, On Ubuntu, I have set up an LDAP server and am authenticating to it over SSL for my LDAP queries. I had it working on previous Ubuntu releases, but something seems to have changed in the newest release (maybe this: http://www.debian-administration.org/users/dkg/weblog/ 42). I am having trouble figuring out exactly what is breaking. Some background: I have set up my own CA and generated a certificate for it, which the LDAP server is using. Without specifying this CA, I get "self-signed certificate" errors when connecting: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts CONNECTED(00000003) <... trimmed certificate information ...> verify error:num=19:self signed certificate in certificate chain verify return:0 <... trimmed more certificate information ...> If I specify the path to my internal CA file, I receive no errors: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts - CAfile /path/to/my/ca/file CONNECTED(00000003) <... trimmed certificate and internal CA information ...> verify return:1 <... trimmed more certificate information ...> That being said, I manually specified the path to my internal CA file in /etc/ldap/ldap.conf: BASE dc=my, dc=search, dc=base URI ldaps://my.ldap.server TLS_CACERT /path/to/my/ca/file TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 This still allows no secure ldap queries: root@host:# ldapsearch -x -d1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP my.ldap.server:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying my.ldap.server.ip:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) TLS: can't connect: (unknown error code). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Just to prove that the above configuration is the one being used, if I switch the above configuration to "TLS_REQCERT allow", the ldap queries bypass this issue: root@myhost:# ldapsearch -x -d1 > /dev/null ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP auth01.rdc.internal:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.41:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) ldap_open_defconn: successful <... trimmed rest of results ...> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I had the same message about self-signed certificates on previous Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works fine. So what is the solution to this problem? Do I switch to "TLS_REQCERT allow"? Or perhaps there's some way to debug why openldap is not seeing the internal CA file even though I've told it where to look? Thanks for any pointers... -Kurt

3 2

N-way Master synchronization
by Bad Guy 17 Jun '09

17 Jun '09

Dear all, I am using a 4-way LDAP servers version 2.4.11. (type=refreshOnly, interval="00:00:00:30",attrs="*,+") Everyday, there will be some records updated in any of the servers. >From time to time, I will dump the records in all 4 servers and checked the modifyTimestamp attribute. I find that there is some records where the modifyTimestamp attribute value are different from other 3 servers. But the other content seems synced. Only differ by the modifyTimestamp attribute. Any idea of how come such situation occur ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

3 2

Check ppolicy
by Jordi Espasa Clofent 17 Jun '09

17 Jun '09

Hi folks, I use a OpenLDAP as a central accounting servers through the sshd service and I use sudo also. All works like a charm. However I wanto to use SLAPO_PPOLICY(5). Well, I think I've implemented it correctly: xen-ldap01:~# ldapsearch -x -b 'cn=DefaultPassword,ou=Policies,dc=company,dc=com' # extended LDIF # # LDAPv3 # base <cn=DefaultPassword,ou=Policies,dc=company,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # DefaultPassword, Policies, company.com dn: cn=DefaultPassword,ou=Policies,dc=company,dc=com cn: DefaultPassword objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15552000 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 3 pwdMinLength: 8 pwdMaxFailure: 5 pwdLockout: TRUE pwdInHistory: 5 pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The main problem is I don't know how to ckeck it. I mean, when a user connects to a machine (a box which is OpenLDAP client) using sshd, sshd goes to OpenLDAP and query about the user and his password. But I don't see anymore that the classical "Password:" prompt. So ¿how can I check if ppolicy is really working? I want to test it, changing the password for example or blocking a user who type wrong their password for more tant 5 times. I suspect a PAM issue (after all, the sshd service goes to LDAP using PAM modules), but I'm not sure. ¿Any clue? -- Thanks, Jordi Espasa Clofent

2 3

ldap_bind: Invalid credentials (49)
by J. Bakshi 17 Jun '09

17 Jun '09

Hello list, Here is a very typical problem. I have already done some googling but I am more confused now. I like to query a user information with his own id and password. When I do this as cn=Manager the there is no problem ```````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: (&(objectclass=inetOrgPerson)(cn=test2)) # requesting: uid # # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com uid: rbilly # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ``````````````````````````````````````````````````````````````````` Now if I search with the user credential the problem starts `````````````````````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "uid=rbilly,ou=people,dc=example,dc=com" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) ```````````````````````````````````````````````` I have typed the correct password and repeated the above command a no. of times. But the same error. why Invalid credentials ? Any clue please ? Thanks

3 3

Re: password change and ppolicy
by Gustavo Mendes de Carvalho 17 Jun '09

17 Jun '09

Hi Tizo, Suposed that your users has to login in some linux/Unix machine using their LDAP accounts, I sugest you to create some binary or script to allow your users to change their passwords invoking ldappasswd command. I mean, you can create a C program or shell script or even a PHP page, to validate some weaks in their passwords, like min length, capital letters, numbers, and so on. After that, you can call ldappasswd command with all parameters (using system() call in a C source code) to change it. I know that this is not an elegant option, but it works. Let me know if it works for you that I can post my C source code here to help you there. See you Gustavo Date: Wed, 10 Jun 2009 18:54:14 -0300 From: tizo <tizone(a)gmail.com> Subject: Re: password change and ppolicy To: openldap-technical(a)openldap.org Message-ID: <e55f48520906101454i3e5b4b59v2b755278cd34437(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" On Tue, Jun 9, 2009 at 12:12 PM, tizo <tizone(a)gmail.com> wrote: > > Before starting this, I have been testing password changing with > phpLDAPAdmin. The fact is that I could only change a user password with > clear text. I guess that this behaviour happens because we have > pwdCheckQulity setting in 2 in our default password policy. So, when the > client (phpLDAPAdmin) tries to modify the password enconding it, the server > (OpenLDAP) cannot check the min length of the password, as it is encoded, > and then fails. I am guessing too, that phpLDAPAdmin is performing a simple > modify operation to change the password, as it is stored in clear text. On > the other hand, I could change passwords with ldappasswd withouth problem, > and they are stored with SSHA. I know that this command uses RFC 3062. > > tizo > >

3 2

slapd-config(5) Disaster Recovery - Best Practices?
by gruntler-ldap＠yahoo.com 16 Jun '09

16 Jun '09

Hi, I am considering migrating from a monolithic slapd.conf file to the newer DIT slapd-config(5). My primary concern is how to recover if a dynamic change brings down slapd so it becomes difficult to recover since the configuration is in a database and slapd will not start. Is it as simple as making a slapcat backup of the configuration database (or some other backup of the configuration database that resides in the slapd.d directory) prior to making changes so that a roll-back would consist of replacing the contents of the slapd.d directory? Or is there some other recovery method that is preferred? Thanks, Ken

2 1

pwdFailureTime not being deleted
by Adam Leach 16 Jun '09

16 Jun '09

I'm having a problem with the pwdFailureTime entries not being deleted after a successful login. What steps could I take to see if there is an error occurring? I'm running openldap 2.4.11 RHEL5, rpms came from http://staff.telkomsa.net/packages/rhel5/openldap/i386/ Thanks -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 1

LDAP search question
by Tihomir Culjaga 16 Jun '09

16 Jun '09

Hello, maybe it is a dummy question but i'd like to know why i have so big discrepancy in execution between two apparently identical ldapsearch ? The 1st search takes 94 ms while the 2nd one only 7 ms. It doesn't matter how many times i execute the 1st search (meaning everytihng should be already cached) .. it is always the same. Does anyone know why? ~$ time ldapsearch -h localhost -x -b ou=redirecting,ou=Dir,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w **** uniqueID=38512303736 # extended LDIF # # LDAPv3 # base <ou=redirecting,ou=Dir,dc=ot,dc=hr> with scope subtree # filter: uniqueID=38512303736 # requesting: ALL # # 38512303736, redirecting, Dir, ot.hr dn: uniqueID=38512303736,ou=redirecting,ou=Dir,dc=ot,dc=hr objectClass: top objectClass: uniqueID Prefix: 68A10 uniqueID: 38512303736 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 *real 0m0.094s* user 0m0.004s sys 0m0.000s ~$ time ldapsearch -h localhost -x -b ou=redirecting,ou=Dir,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w **** uniqueID=38515000400 # extended LDIF # # LDAPv3 # base <ou=redirecting,ou=Direktor,dc=ot,dc=hr> with scope subtree # filter: uniqueID=38515000400 # requesting: ALL # # 38515000400, redirecting, Dir, ot.hr dn: uniqueID=38515000400,ou=redirecting,ou=Dir,dc=ot,dc=hr objectClass: top objectClass: uniqueID Prefix: 68B99 uniqueID: 38515000400 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 *real 0m0.007s* user 0m0.000s sys 0m0.004s tculjaga@l01sipindir2:~$

3 5

How to temporarily downgrade to LDAPv2 ?
by J. Bakshi 15 Jun '09

15 Jun '09

Dear all, I like to downgrade the ldap communication protocol to do some experiments. An api which has been designed in 2005 can not work with my ldap server ( suse 11.1) as the log reports ````````````````````````` historical protocol version requested, use LDAPv3 instead ````````````````````````````````````` so i need to temporarily allow the old v2 protocol so that the api can communicate with the ldap server. How can i do this ? Thanks

3 6

RE: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Brett Maxfield 15 Jun '09

15 Jun '09

I checked ownership and permissions on /var/lib/ldap: francesco@bob:/var/lib$ ls -l | grep ldap drwxr-xr-x 5 openldap openldap 4096 2009-06-15 17:03 ldap --=-- Have you run the process under strace(linux) or truss (solaris) as that will give you the exact file/path failing.. Perhaps it is writing files outside the directories you have prepared?

1 0

Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG - SOLVED
by Francesco Cicolani 15 Jun '09

15 Jun '09

You got it Matt! I really missed the point that an apparmor profile for slapd is generated by default in Ubuntu during openldap installation. I did a test putting slapd apparmor profile in compliant-mode and all went well this time! Now, time for a resume of the steps I eventually made to successfully change Berkeley DB data and log file directories, integrated with a BDB backup and recovery, on Ubuntu 8.04.2 with Apparmor framework enabled, just in case it could also help someone else having similar problems in the future: 1. Make a standard BDB backup (see Berkeley DB Reference Guide, in particular: http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/…): 1.1. stop slapd 1.2. force a checkpoint with db4.2_checkpoint -1v 1.3. copy all .bdb files returned by db4.2_archive -s to backup location /backup (cp -p) 1.4. copy all log.XXXXXXXXXX files returned by db4.2_archive -l to backup location /backup (cp -p) 2. Update apparmor profile for slapd (/etc/apparmor.d/usr.sbin.slapd): ## customized bdb data and log files: /new/path/to/bdbdata/ r, /new/path/to/bdbdata/* rw, /new/path/to/bdblogs/ r, /new/path/to/bdblogs/* rw, ## lock file in customized bdbdata dir /new/path/to/bdbdata/alock kw, 3. Parse updated apparmor profile for slapd: apparmor_parser -r < /etc/apparmor.d/usr.sbin.slapd 4. Update bdb data 'directory' directive in slapd.conf directory "/new/path/to/bdbdata" 5. remove all .bdb, alock, __db.XXX and log.XXXXXXXXXX files from /var/lib/ldap (old default location) 6. edit DB_CONFIG file with new directives set_data_dir and set_lg_dir: # Directory for the data files set_data_dir /new/path/to/bdbdata [...] # Directory for the logfiles set_lg_dir /new/path/to/bdblogs 7. move DB_CONFIG file to /new/path/to/bdbdata and verify ownerships are preserved: -rw-r--r-- 1 openldap openldap 410 2009-06-15 22:00 DB_CONFIG 8. copy .bdb files from backup location /backup to /new/path/to/bdbdata (cp -p) 9. copy log.XXXXXXXXXX file from backup location /backup to /new/path/to/bdblogs (cp -p) 10. Finally, cd to /new/path/to/bdbdata and issue the recovery command (as root): root@bob:/new/path/to/bdbdata# db4.2_recover -cv db_recover: Finding last valid log LSN: file: 1 offset 141201 db_recover: Recovery starting from [1][28] db_recover: Recovery complete at Mon Jun 15 22:14:04 2009 db_recover: Maximum transaction ID 80000044 Recovery checkpoint [1][141201] 11. Restart slapd and force a checkpoint just to keep things clean on db side: root@bob:/new/path/to/bdbdata# /etc/init.d/slapd start root@bob:/new/path/to/bdbdata# db4.2_checkpoint -1v db_checkpoint: checkpoint: Mon Jun 15 22:18:03 2009 Note1: doing a backup and recovery of bdb could not be strictly required, but I thought that removing the bdb data and log files from the old path would contribute to keep things cleaner. Note2: putting slapd logging level to 'any' prior to restarting slapd would help to troubleshoot startup problems and verify that bdb starts cleanly. Thank you again guys!... and see you to the next 'mayday' thread! =) fra --- On Mon, 6/15/09, Matt Kassawara <battery(a)writeme.com> wrote: > From: Matt Kassawara <battery(a)writeme.com> > Subject: Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG > To: "Klaus Lemkau" <klaus.lemkau(a)tu-berlin.de> > Cc: "Francesco Cicolani" <francescocicolani(a)yahoo.it>, openldap-technical(a)openldap.org > Date: Monday, June 15, 2009, 6:40 PM > By default, the Ubuntu AppArmor > profile for slapd prevents it from writing databases to > anywhere but /var/lib/ldap. You'll need to modify the > usr.sbin.slapd profile in /etc/apparmor.d to correct the > problem. > > Matt

1 0

Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Francesco Cicolani 15 Jun '09

15 Jun '09

Hi Klaus, thx for your reply. I checked ownership and permissions on /var/lib/ldap: francesco@bob:/var/lib$ ls -l | grep ldap drwxr-xr-x 5 openldap openldap 4096 2009-06-15 17:03 ldap while the two subdirs I'm trying to place bdb data files and logs have: francesco@bob:/var/lib$ ls -l ldap [...] drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:39 bdbdata drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:39 bdblogs [...] During test, I also tried to change permissions on bdbdata and bdblogs to 775 and even 777: but I had no success in getting bdb log.0000000001 accessible when placed in bdblogs. I'm running short of ideas... I'm even wondering if someone else had similar problems when trying to set different dir for data files and logs... see you fra --- On Sun, 6/14/09, Klaus Lemkau <klaus.lemkau(a)tu-berlin.de> wrote: From: Klaus Lemkau <klaus.lemkau(a)tu-berlin.de> Subject: Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG To: "Francesco Cicolani" <francescocicolani(a)yahoo.it> Cc: openldap-technical(a)openldap.org Date: Sunday, June 14, 2009, 9:03 PM Hi Francesco, likely the files in /var/lib/ldap/ have the wrong owner (root?). chown -R openldap:openldap /var/lib/ldap should solve Your problem. Greetings Klaus

3 2

Re: TLS certificates
by Michael Ströder 15 Jun '09

15 Jun '09

Matthew, please stay on the mailing list (Cc:-ed) when answering so others can answer and learn as well. Matthew Edlefsen wrote: > 2009/6/13 Michael Ströder <michael(a)stroeder.com>: >> Matthew Edlefsen wrote: >>> Hello, I'm trying to get TLS setup with openldap and am having some >>> issues. I have a CA signed certificate (not self-signed) and have >>> created a chain with my CA cert and the root CA cert. I've verified >>> that it works with openssl verify -CAfile on both the client and >>> server but then when I try to connect using ldaps I get the following >>> error on the client: >>> >>> TLS certificate verification: depth: 2, err: 19, subject: >>> /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust >>> External CA Root, issuer: /C=SE/O=AddTrust AB/OU=AddTrust External TTP >>> Network/CN=AddTrust External CA Root >>> TLS certificate verification: Error, self signed certificate in >>> certificate chain >>> TLS trace: SSL3 alert write:fatal:unknown CA >>> TLS trace: SSL_connect:error in SSLv3 read server certificate B >>> TLS trace: SSL_connect:error in SSLv3 read server certificate B >>> TLS: can't connect. >>> >>> I assume it's saying that the root CA is self signed, but if I don't >>> include it in the chain it says it can't trust the CA. >> Could you please elaborate on how you configured TLS settings on your >> LDAP client? I assume that your OpenLDAP build was linked to OpenSSL >> libs. Is that right? > > I did not configure my client at all. I confirmed it is linked to > OpenSSL though. I'm hoping to not have to do any client configuration > (other than turning it on obviously) because we would like end users > to be able to use ldaps without any hassle. You have to configure each LDAP client to trust the CA cert. For OpenLDAP command-line clients or derived clients you should consult the man page ldap.conf(5) about how to place system-wide or specific configuration files and the client-side (TLS-related) configuration options. Ciao, Michael.

1 0

OpenLDAP and AD integration
by Santosh Balan 15 Jun '09

15 Jun '09

Hi Friends, I am newbee to this community and want to know how I can integrate an OpenLdap Server with MS Active Directory. Such that I create a user in LDAP it reflects in AD as well and vice-a-versa. Similarly any changes should effect on both AD and LDAP. Also I want to know how this can be done with a technical documentation. Also a user incase AD is not available gets authenticated using LDAP and vice-a-versa. Your urgent help on this issue will be highly appreciated. Expecting a reply from you at the earliest. Thanks and Regards Santosh Balan +91-9819419509 -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com

4 3

ldpsearch filter showing all records.
by J. Bakshi 15 Jun '09

15 Jun '09

Hello list, My filter on ldapsearch is not working as expected but showing all the records. If I simply do an search on object class like below it shows all records belong to that object ```````````````````````````````````````````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "objectclass=inetOrgPerson" -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: objectclass=inetOrgPerson # requesting: ALL # # test1, people, example.com dn: cn=test1,ou=people,dc=example,dc=com objectClass: inetOrgPerson cn: test1 sn: smith uid: rjsmith userPassword:: MTIzNDU2 carLicense: HISCAR 123 homePhone: 555-111-2222 description: swell guy ou: Human Resources mail: r.smith(a)example.com # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com objectClass: inetOrgPerson cn: test2 sn: Billy uid: rbilly userPassword:: MTIzNDU2 carLicense: HISCAR 123 homePhone: 555-111-2222 mail: billy(a)example.com description: sales guy ou: Sales # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 `````````````````````````````````````````````````````````````````````````````````````` Now to redifine the filter. Want to result where gid=rjsmith ` ` ` ` ` ` ` ` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "objectclass=inetOrgPerson" uid=rjsmith -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: objectclass=inetOrgPerson # requesting: uid=rjsmith # # test1, people, example.com dn: cn=test1,ou=people,dc=example,dc=com # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 ` ` ` ` ` ` Again both the results are showing. something wrong in my filter ? Please enlighten me. Thanks

3 4

openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Francesco Cicolani 14 Jun '09

14 Jun '09

Hi everybody, sorry for the long post, but I'm new to openLDAP, and I wish to provide as much information as possible in order to pinpoint the troublesome issue that is driving me nuts. First of all, I installed openLDAP server with Berkeley DB on a machine running Ubuntu 8.04.2, using available packages from certified sources. Following some details I think might be useful: root@bob:/etc/ldap# uname -a Linux bob 2.6.24-24-generic #1 SMP Wed Apr 15 15:54:25 UTC 2009 i686 GNU/Linux These are slapd and bdb version info I get from syslog when starting slapd: Jun 14 17:08:19 bob slapd[9475]: @(#) $OpenLDAP: slapd 2.4.9 (Aug 5 2008 20:18:55) $ ^Ibuildd@palmer:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd [...] Jun 14 17:08:19 bob slapd[9475]: hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) After installation everything seemed to work fine, and I could populate and browse my LDAP directory with no problems. Following some details I think may be useful to know: some directives in slapd.conf: [...] loglevel stats # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb [...] # Specific Backend Directives for hdb: backend hdb [...] # Specific Directives for database #1, of type hdb: database hdb [...] # Where the database file are physically stored for database #1 directory "/var/lib/ldap" [...] # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. [...] dbconfig set_cachesize 0 2097152 0 [...] # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 [...] # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 this was the content of DB_CONFIG file after installation and first start of slapd: root@bob:/var/lib/ldap# cat DB_CONFIG set_cachesize 0 2097152 0 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500 this was the structure of /var/lib/ldap (the timestamps refer to the last successful working recovery I made): root@bob:/var/lib/ldap# l total 816 -rw-r--r-- 1 openldap openldap 2048 2009-06-14 17:09 alock -rw------- 1 openldap openldap 8192 2009-06-14 17:08 cn.bdb -rw------- 1 openldap openldap 8192 2009-06-14 17:39 __db.001 -rw------- 1 openldap openldap 2629632 2009-06-14 17:39 __db.002 -rw------- 1 openldap openldap 1081344 2009-06-14 17:39 __db.003 -rw------- 1 openldap openldap 565248 2009-06-14 17:09 __db.004 -rw------- 1 openldap openldap 24576 2009-06-14 17:39 __db.005 -rw-r--r-- 1 openldap openldap 383 2009-06-14 17:07 DB_CONFIG -rw------- 1 openldap openldap 8192 2009-06-14 17:39 dn2id.bdb -rw------- 1 openldap openldap 81920 2009-06-14 17:39 id2entry.bdb -rw------- 1 openldap openldap 142289 2009-06-14 17:39 log.0000000001 -rw------- 1 openldap openldap 8192 2009-06-14 17:08 objectClass.bdb -rw------- 1 openldap openldap 8192 2009-06-14 17:08 uid.bdb Problems rose when I tried to test some 'tweaks' with DB_CONFIG file. In particular, I was trying to store log files and data files in separate directories, thinking this would greatly simplify the db backup process. First thing I did, was adding some lines to DB_CONFIG, in order to specify data and log dirs (I also tweaked default values for log files and cache): root@bob:/var/lib/ldap# cat DB_CONFIG # Directory for the data files set_data_dir /var/lib/ldap/bdbdata set_cachesize 0 2097152 0 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500 # Logging settings # Max memory cache for db file name caching set_lg_regionmax 1048576 # Size of memory cache to log data set_lg_bsize 32768 # Maximum size of logfile set_lg_max 262144 # Directory for the logfiles set_lg_dir /var/lib/ldap/bdblogs After that, I created the new dirs in /var/lib/ldap and set the ownerships: root@bob:/var/lib/ldap# ls -l | grep bdb drwxr-xr-x 2 openldap openldap 4096 2009-06-14 16:59 bdbdata drwxr-xr-x 2 openldap openldap 4096 2009-06-14 17:07 bdblogs Finally, changed loglevel from 'stats' to 'any' in slapd.conf, and restarted slapd: here comes the problems! slapd couldn't restart and syslog shows problems regarding permissions to write: Jun 14 18:10:43 bob slapd[9624]: slapd startup: initiated. Jun 14 18:10:43 bob slapd[9624]: backend_startup_one: starting "cn=config" Jun 14 18:10:43 bob slapd[9624]: config_back_db_open Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn=config" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn=module{0}" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn=schema" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={0}core" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={1}cosine" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={2}nis" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={3}inetorgperson" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "olcDatabase={-1}frontend" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "olcDatabase={0}config" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "olcDatabase={1}hdb" Jun 14 18:10:43 bob slapd[9624]: backend_startup_one: starting "dc=springfield,dc=edu" Jun 14 18:10:43 bob slapd[9624]: hdb_db_open: "dc=springfield,dc=edu" Jun 14 18:10:43 bob slapd[9624]: hdb_db_open: database "dc=springfield,dc=edu": dbenv_open(/var/lib/ldap). Jun 14 18:10:43 bob kernel: [36914.145407] audit(1244995843.179:55): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/var/lib/ldap/bdbdata/__db.1.22d19" pid=9624 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:10:43 bob kernel: [36914.146448] audit(1244995843.179:56): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/var/lib/ldap/bdbdata/__db.1.22d19" pid=9624 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:10:43 bob kernel: [36914.147356] audit(1244995843.179:57): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/var/lib/ldap/bdbdata/__db.1.22d19" pid=9624 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:10:43 bob slapd[9624]: hdb_db_open: database "dc=springfield,dc=edu": db_open(/var/lib/ldap/id2entry.bdb) failed: Permission denied (13). Jun 14 18:10:43 bob slapd[9624]: ====> bdb_cache_release_all Jun 14 18:10:43 bob slapd[9624]: bdb(dc=springfield,dc=edu): dn2id.bdb: unable to flush: No such file or directory Jun 14 18:10:43 bob slapd[9624]: bdb(dc=springfield,dc=edu): id2entry.bdb: unable to flush: No such file or directory Jun 14 18:10:43 bob slapd[9624]: bdb(dc=springfield,dc=edu): txn_checkpoint: failed to flush the buffer cache No such file or directory Jun 14 18:10:43 bob slapd[9624]: bdb_db_close: database "dc=springfield,dc=edu": txn_checkpoint failed: No such file or directory (2). Jun 14 18:10:43 bob slapd[9624]: backend_startup_one: bi_db_open failed! (13) Jun 14 18:10:43 bob slapd[9624]: slapd shutdown: initiated Jun 14 18:10:43 bob slapd[9624]: ====> bdb_cache_release_all Jun 14 18:10:43 bob slapd[9624]: bdb_db_close: database "dc=springfield,dc=edu": alock_close failed Jun 14 18:10:43 bob slapd[9624]: slapd destroy: freeing system resources. Jun 14 18:10:43 bob slapd[9624]: slapd stopped. Jun 14 18:10:43 bob slapd[9624]: connections_destroy: nothing to destroy. Fortunately, I previously made a backup of my BDB data files and logs; I followed the procedures stated in the Berkeley DB Reference Guide: 1. stop slapd 2. force a checkpoint with db4.2_checkpoint -1v 3. copy all .bdb files returned by db4.2_archive -s to backup location /backup (cp -p) 4. copy all log.XXXXXXXXXX files returned by db4.2_archive -l to backup location /backup (cp -p) So, I tried another approach. I assumed that, in case I had to do a recovery, I could do the following: A. ensure slapd is stopped by issuing /etc/init.d/slapd stop B. remove all .bdb, alock, __db.XXX and log.XXXXXXXXXX files from /var/lib/ldap C. copy .bdb files from /backup to /var/lib/ldap/bdbdata (cp -p) D. copy log.XXXXXXXXXX file from /backup to /var/lib/ldap/bdblogs (cp -p) Now, the structure of my /var/lib/ldap dir is: root@bob:/var/lib/ldap# ls -lR .: total 16 drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:25 bdbdata drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:25 bdblogs -rw-r--r-- 1 openldap openldap 412 2009-06-14 18:09 DB_CONFIG ./bdbdata: total 116 -rw------- 1 openldap openldap 8192 2009-06-14 15:30 cn.bdb -rw------- 1 openldap openldap 8192 2009-06-14 15:34 dn2id.bdb -rw------- 1 openldap openldap 81920 2009-06-14 15:34 id2entry.bdb -rw------- 1 openldap openldap 8192 2009-06-14 15:30 objectClass.bdb -rw------- 1 openldap openldap 8192 2009-06-14 15:30 uid.bdb ./bdblogs: total 144 -rw------- 1 openldap openldap 141201 2009-06-14 15:35 log.0000000001 E. Finally, cd to /var/lib/ldap and issue the recovery command (as root): root@bob:/var/lib/ldap# db4.2_recover -cv -h /var/lib/ldap db_recover: Finding last valid log LSN: file: 1 offset 141201 db_recover: Recovery starting from [1][28] db_recover: Recovery complete at Sun Jun 14 18:27:17 2009 db_recover: Maximum transaction ID 80000044 Recovery checkpoint [1][141201] Started slapd again but got the following error logs in syslog: Jun 14 18:28:44 bob slapd[9676]: slapd startup: initiated. Jun 14 18:28:44 bob slapd[9676]: backend_startup_one: starting "cn=config" Jun 14 18:28:44 bob slapd[9676]: config_back_db_open Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn=config" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn=module{0}" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn=schema" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={0}core" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={1}cosine" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={2}nis" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={3}inetorgperson" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "olcDatabase={-1}frontend" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "olcDatabase={0}config" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "olcDatabase={1}hdb" Jun 14 18:28:44 bob slapd[9676]: backend_startup_one: starting "dc=springfield,dc=edu" Jun 14 18:28:44 bob slapd[9676]: hdb_db_open: "dc=springfield,dc=edu" Jun 14 18:28:44 bob slapd[9676]: hdb_db_open: database "dc=springfield,dc=edu": dbenv_open(/var/lib/ldap). Jun 14 18:28:45 bob kernel: [37994.300390] audit(1244996925.048:58): type=1503 operation="inode_permission" requested_mask="r::" denied_mask="r::" name="/var/lib/ldap/bdblogs/" pid=9676 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): /var/lib/ldap/bdblogs/log.0000000001: Permission denied Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): PANIC: Permission denied Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Jun 14 18:28:45 bob slapd[9676]: hdb_db_open: database "dc=springfield,dc=edu" cannot be opened, err -30978. Restore from backup! Jun 14 18:28:45 bob slapd[9676]: ====> bdb_cache_release_all Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 14 18:28:45 bob slapd[9676]: bdb_db_close: database "dc=springfield,dc=edu": txn_checkpoint failed: Invalid argument (22). Jun 14 18:28:45 bob slapd[9676]: backend_startup_one: bi_db_open failed! (-30978) Jun 14 18:28:45 bob slapd[9676]: slapd shutdown: initiated Jun 14 18:28:45 bob slapd[9676]: ====> bdb_cache_release_all Jun 14 18:28:45 bob slapd[9676]: bdb_db_close: database "dc=springfield,dc=edu": alock_close failed Jun 14 18:28:45 bob slapd[9676]: slapd destroy: freeing system resources. Jun 14 18:28:45 bob slapd[9676]: slapd stopped. Jun 14 18:28:45 bob slapd[9676]: connections_destroy: nothing to destroy. Thanks in advance for your patience. I hope to hear from somebody willing to help me out of this situation. P.S.: please note that, if I comment the set_data_dir and set_lg_dir in DB_CONFIG, place log.XXXXXXXXXX and .bdb files in /var/lib/ldap and run db4.2_recover -cv -h /var/lib/ldap again, I'm able to get slapd running.

2 1

slapd + tls problem
by Alessandro Baggi 14 Jun '09

14 Jun '09

Hi there. I've problem setting up SLAPD + TLS and libnss-ldap. When I try to get the passwd entry with getent passwd I get the following error: TLS: can't accept: A record packet with illegal version was received.. connection_read(13): TLS accept failure error=-1 id=18, closing This is a certificate problem or libnss-ldap configuration problem? I've also tested slapd and tls with gnutls-cli and openssl s_client and they complete test successfully. I've also tested my certificate with openssl verify, and also this test has been completed successfully. My nsswitch.conf is configured with files and ldap. Then, i've created my certificate with the following command: # /usr/lib/ssl/misc/CA.pl -newca /* to create the ca certificate and key*/ # openssl req -newkey rsa:1024 -nodes -keyout key.pem -out newreq.pem /*for server/client certificate building and sing*/ # /usr/lib/ssl/misc/CA.pl -sign I've tried using only openssl with slapd and all work very good, but not with GnuTLS. My system is Debian Lenny. There's something that is wrong in certificate creation? What is the meaning of "A record packet with illegal version was received"? This is a bug or a mismatch configuration? Thanks in advance.

1 0

TLS certificates
by Matthew Edlefsen 13 Jun '09

13 Jun '09

Hello, I'm trying to get TLS setup with openldap and am having some issues. I have a CA signed certificate (not self-signed) and have created a chain with my CA cert and the root CA cert. I've verified that it works with openssl verify -CAfile on both the client and server but then when I try to connect using ldaps I get the following error on the client: TLS certificate verification: depth: 2, err: 19, subject: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root, issuer: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. I assume it's saying that the root CA is self signed, but if I don't include it in the chain it says it can't trust the CA. Anybody have any ideas? Thanks, Matt Edlefsen Earlham Computing Services

2 1

Re: OpenLDAP and AD integration
by Santosh Balan 12 Jun '09

12 Jun '09

Hi, I didn't mean "urgent" and "expecting a reply" as a demanding request. However I would like a voluntary reply at the earliest so that I can go ahead with my work. Sorry for a demanding request, however would like your support and reply in current and future issues. Thanks and Regards, Santosh Balan _+91-9819419509 ----- Original Message ----- From: "Michael Ströder" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: OpenLDAP and AD integration Date: Fri, 12 Jun 2009 13:33:40 +0200 Santosh Balan wrote: > > I am newbee to this community and want to know how I can integrate an > OpenLdap Server with MS Active Directory. Such that I create a user in > LDAP it reflects in AD as well and vice-a-versa. Similarly any changes > should effect on both AD and LDAP. Also I want to know how this can be > done with a technical documentation. This is not possible just by OpenLDAP and AD server configuration. You need a custom sync process for that. There might be already some implementations available but most times they won't fit exactly your requirements. So I'd recommend to write your own custom script to do it. > Also a user incase AD is not available gets authenticated using LDAP > and vice-a-versa. Authenticated at which client component? E.g. it does not make sense to authenticate the user during Windows logon directly against the OpenLDAP user account since there's a bit more done during a Windows domain logon. > Your urgent help on this issue will be highly appreciated. Expecting a > reply from you at the earliest. Well, "urgent" and "expecting a reply" is a little bit demanding on a mailing list where volunteers are answering in their spare time. You might wanna hire a consultancy company: http://www.openldap.org/support/ Ciao, Michael. -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com

1 0

installation query
by ashok kumar 12 Jun '09

12 Jun '09

Hi, I am trying to install openldap 2.4.16 and bdb 4.7.25 on my CentOS linux OS 64bit. I was wondering that the setups available on websites use 32bit libraries or 64 bit libraries. If they use 32bit libraries by default then how do i make them use 64 bit libraries. Regards, Ashok Kumar

1 0

Translucent Proxy & Schemas
by Stéphane Jeanjean 12 Jun '09

12 Jun '09

Hello, I would like to know if it's possible to add a schema in the local database which is not in the remote one with Translucent Proxy. Is it possible to add objects in local database without adding the schema to the remote db ? It looks ok when the attributes of the new class are added to the entries in the local db but when a search request is done, only atttributes from the classes declared in the remote db are returned :( Thanks for your help, Stéphane

2 2

count the number of registered users in ldap
by KALPANA ANANTH 11 Jun '09

11 Jun '09

Hi , Is there any specific command to count the number of registered entries/users in ldapserver todate? This will help with us with the statitistics of how many users are registered? Thanks! Kalpana _________________________________________________________________ Windows Live™: Keep your life in sync. http://windowslive.com/explore?ocid=TXT_TAGLM_WL_BR_life_in_synch_062009

3 2

Chain overlay and ACLs
by John Kane 11 Jun '09

11 Jun '09

Noob question: I've set up chaining from my slave LDAP to the master. It seemed everything was working fine, until I realize that ANY user can now make modifications in the LDAP DB if it is done from the slave. My ALCs allow full write access to the chain binddn. If I don't set this, chaining fails. But with it set, any valid, authenticated user can make DB changes (full write access). I am confused as to why this is happening. Info is below. Thanks in advance, John Version: openldap-2.3.43 ACLs on master (and slave): # Who has access to read or change the password attribute access to attrs=userPassword,shadowLastChange by self write by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous auth by * none # Keep partners out of mycompany db access to dn.sub="o=mycompany,dc=example,dc=net" by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by dn.sub="o=partner_x,dc=example,dc=net" none by anonymous none by * none # Allow the tool access to add and modify ToolAccessLevel, etc access to filter="(|(objectClass=DiagnosticsPerson)(objectClass=ToolsAccess))" by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read # Finally, allow the main LDAP users access to everything else access to * by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read And the LDIFs: # admin_partner_x, partner_x, example.net dn: cn=admin_partner_x,o=partner_x,dc=example,dc=net cn: admin_partner_x objectClass: groupOfNames description: Group of Admins with full access member: cn=ldapChain,o=partner_x,dc=example,dc=net member: cn=ldapEditor,o=partner_x,dc=example,dc=net # admin_partner_x_RO, partner_x, example.net dn: cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net cn: admin_partner_x_RO objectClass: groupOfNames description: Group of Admins with readonly access member: cn=simpleBind,o=partner_x,dc=example,dc=net member: cn=syncRepl,o=partner_x,dc=example,dc=net # tooladmin, partner_x, example.net dn: cn=tooladmin,o=partner_x,dc=example,dc=net sn: tooladmin cn: tooladmin userPassword:: dG9vbGFkbWlu description: To allow access for tools. Per ACLs, this guy has write access to passwords and tool levels objectClass: person # jkane2, people, partner_x, example.net dn: uid=jkane2,ou=people,o=partner_x,dc=example,dc=net objectClass: person objectClass: posixAccount objectClass: DiagnosticsPerson objectClass: ToolsAccess cn: jkane2 loginShell: /bin/bash uidNumber: 3805 uid: jkane2 homeDirectory: /jkane2 sn: jkane2 gidNumber: 950 ToolAccessLevel: subinfo ToolDomain: example.net DiagAccessLevel: DIAG_USER_T1 DiagGroup: partner_x userPassword:: xxxxxxxxxxx From the master, using some arbitrary user: [jkane2@master]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" ldapadd: Insufficient access (50) additional info: no write access to parent From the slave: [jkane2@slave]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" [jkane2@slave]$ ldapsearch -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' uid=testauserC -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: uid=testauserC # requesting: ALL # # testauserC, people, partner_x, example.net dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net uid: testauserC description: asdf objectClass: account objectClass: simpleSecurityObject # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 4

slapadd speed
by ashok kumar 11 Jun '09

11 Jun '09

Hi, I am new to openldap and I am trying to use it for 50 million records. I am using slapadd to add this data but it is processing around 1 million records in 5 hour. So this will take days to stage properly. I will have to update database every 20 days with about 10 million records. I wish to know what enhancements I have to do in my setup considering following configurations. I am using openldap 2.4.16 with Berkley DB 4.5.20 on CentOS linux OS 32 bit machine with 4GB RAM. slapd.conf : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/xyz.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args backend bdb database bdb suffix "o=sgi,c=us" rootdn "o=sgi,c=us" checkpoint 128 15 rootpw xyz directory /usr/local/var/openldap-data index objectClass eq index attribute1 eq index attribute2 eq DBCONFIG: set_cachesize 1 268435456 1 set_flags DB_LOG_AUTOREMOVE Regards, Ashok Kumar

4 5

Re: hardware requirement
by Quanah Gibson-Mount 11 Jun '09

11 Jun '09

--On Thursday, June 11, 2009 9:19 PM +0530 mukim pathan <mukim.iitkgp(a)gmail.com> wrote: > I will be using latest openldap release with Berkley database. If 32 bit > is not capable of it then please tell me the resource requirement for 64 > bit. Keep replies on the list if you want answers. The technical limitations of 32-bit OSes are well documented. Since I have no idea how large your database is when fully loaded, I can not say for certain that you'll hit (or have hit) those limits, but I find it *highly* likely. In any case, in this day and age, there is really no excuse to be running 32-bit OSes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical