- openldap-technical - openldap.org

SASL LDAP binding over IPv6
by Xu, Qiang (FXSGSC) 07 Aug '09

07 Aug '09

Hi, all: In using ldapsearch to bind to a server with IPv6 address, some error pops up: =========================================================== qxu@durian(pts/3):/etc[133]$ kinit XCTEST100(a)XCIPV6.COM Password for XCTEST100(a)XCIPV6.COM: qxu@durian(pts/3):/etc[134]$ klist Ticket cache: FILE:/tmp/krb5cc_20153 Default principal: XCTEST100(a)XCIPV6.COM Valid starting Expires Service principal 06/09/09 17:35:18 06/10/09 03:34:41 krbtgt/XCIPV6.COM(a)XCIPV6.COM renew until 06/10/09 17:35:18 qxu@durian(pts/3):/etc[135]$ ldapsearch -Y GSSAPI -H 'ldap://3ffe:2000:0:1:e0be:1872:d4f8:6b2c' -b 'dc=xcipv6,dc=com' -s sub -LLL 'cn=XCTEST100' mail Could not create LDAP session handle for URI=ldap://3ffe:2000:0:1:e0be:1872:d4f8:6b2c (-9): Bad parameter to an ldap routine qxu@durian(pts/3):/etc[136]$ ldapsearch -Y GSSAPI -H 'ldap://[3ffe:2000:0:1:e0be:1872:d4f8:6b2c]' -b 'dc=xcipv6,dc=com' -s sub -LLL 'cn=XCTEST100' mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) =========================================================== Shall I add the brackets [] around the IPv6 address? DNS server has been correctly set up, because sasl binding over IPv4 address is good. Any possible reason for the failure of ldapsearch? Thanks, Xu Qiang

3 20

Secret not in database
by Seau Yeen Su 06 Aug '09

06 Aug '09

Hi everyone, I have successfully installed cyrus-sasl-2.1.23 and openldap-2.3.27 plus BerkeleyDB.4.3 in my RHEL5.2 server. After the installation, i used saslpasswd2 -c to create an admin user: saslpasswd2 -c admin After that, I thought of doing a search on the database with the command : ldapsearch -H ldap:///localhost -Y DIGEST-MD5 -d 2 -U admin but it returned an error of : ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database When i did a check on /etc/, the sasldb2 file is there. I do not know and understand why it cannot find this user. Did i miss out anything. Below is excerpt from my slapd.conf file password-hash {CLEARTEXT} authz-regexp uid=(.*),cn=synabase-dev5.synamatixdev.com,cn=DIGEST-MD5,cn=auth ldap:///dc=synamatixdev,dc=com??sub?uid=$1 authz-regexp uid=(.*),cn=synabase-dev5.synamatixdev.com,cn=DIGEST-MD5,cn=auth uid=$1 Under rootpw, i typed the password in clear text, for eg, the password i create for admin was root. Hence it looks like: rootpw root Did i do anything wrong? Where is the error? Hope to receive some help. I have been trying to install openldap with cyrus for 4 months but to no avail :( -- Warmest Regards, Seau Yeen

4 5

Possible workaround to slapo-ppolicy sync limitations
by Jordi Espasa Clofent 06 Aug '09

06 Aug '09

Hi, This post is because of: http://www.openldap.org/lists/openldap-technical/200906/msg00221.html http://www.openldap.org/lists/openldap-technical/200908/msg00028.html So, if you're using ppolicy-slapo in a load-balanced environment, you pool servers never will be sync completely; at least, the ppolicy state atributes will be not replicated. I know isn't really a slapo-ppolicy limitation rather than RFC especification consequence. Well... I want my load-balancing environment and I want also the ppolicy overlay. So ¿how to make an effective workaround? At first, I've thinked in next scenario: * 1 provider and 2 consumers * every 5 minutes the consumers rsync the contents of master ddbb (/var/lib/ldap/* in my case, Debian Lenny boxes) ¿It will be enough? I wonder if consumers slapd can accept these data change "on the fly" or maybe restarting the service is mandatory. -- Thanks, Jordi Espasa Clofent

3 2

Problems with heimdal ldap backend
by Andreas Roth 06 Aug '09

06 Aug '09

Hello, i've a heimdal (1.2) server which uses the OpenLDAP (2.4.15) directory for data storage. When i run the following script: #!/bin/sh for i in `seq 1 10000`; do kinit --password-file=passwd && echo "ok $i" || break; done At some point the kinit fails, because heimdal cannot connect to the LDAP server. heimdal-kdc server fails at ldap_sasl_bind_s with 'Can't contact LDAP server'. Heimdal access the LDAP directory is using the ldapi:///. When i 'slow-down' the LDAP server with strace or by enable debug log to console the number of successful kinit runs increase. It seems to be a some kind of timing problem, but i don't have a clue to find out what's the reason for it. Maybe someone here on the list can help me. Thanks in advance, Andreas

1 0

error when setting an alias entry.. (ldap_add: Naming violation (64))
by Michael March 05 Aug '09

05 Aug '09

I'm following this: http://www.openldap.org/faq/data/cache/1111.html I'm getting this error: ldap_add: Naming violation (64) additional info: value of naming attribute 'uid' is not present in entry Here are the sample ldif entries: dn: uid=luzer,ou=main,dc=acme,dc=com uid: luzer objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash userPassword: {SSHA}8Sz/X2Fv1S1COqD46K5kEwFS2Lyj4h2I shadowWarning: 7 uidNumber: 1000 shadowMax: 99999 gidNumber: 1000 sn: De Torre homeDirectory: /home/luzer mail: luzer givenName: Bob shadowLastChange: 14007 cn: luzer dn: uid=luzer,ou=alternate,dc=acme,dc=com objectclass: alias objectclass: extensibleObject uid: alias aliasedobjectname: uid=luzer,ou=main,dc=acme,dc=com -- <admiral> Michael F. March

4 7

How to detect a corrupt database?
by Jordi Espasa Clofent 05 Aug '09

05 Aug '09

Hi folks, I've experienced some problems in one of my 3 OpenLDAP servers. First glance suggests a ppolicy overlay problem, but, at the end, the problem was resolved, simply, deleting the bbdd (BDB4) and restarting the system (is a consumer server, so the ddbb was automatically regenerated). So, my questions are * ¿How I can detect a corrupt database? * ¿Is there any tool/command to check the ddbb health (DBD4)? * ¿What can I do if the corrupted database is the provider database? -- Thanks, Jordi Espasa Clofent

4 5

ldap database directory permission denied
by yilmaz 05 Aug '09

05 Aug '09

Hello, I have a problem to run openldap in a different directory other than /var/lib/ldap I am using Redhat AS 4 (update 4) with selinux disabled. Openldap version is 2.4.13 . The message written into syslog is "line 24: invalid path: Permission denied " . Line 24 specifies is a different directory than /var/lib/ldap and directory has the 755 permission of the user running ldap daemon. Google search has revealed some issues on ubuntu and on redhat with selinux enabled but I have neither of these. If I change the directory to /var/lib/ldap everything works fine. I hope someone could shed me light on this issue. thanks a lot.

2 1

objectclass glue problem
by Steinmetz, Robin 05 Aug '09

05 Aug '09

Hi, I created some records with phpldapadmin but now they look like this: dn: ozsSys=aaaaa,o=bbbb,ozsDir=APO-patient,o=ozs,c=nl objectClass: top objectClass: glue structuralObjectClass: glue ozsSys=aaaaa instead of dn: ozsSys=aaaaa,o=bbbb,ozsDir=APO-patient,o=ozs,c=nl objectClass: ozsSystem structuralObjectClass: ozsSystem ozsSys=aaaaa Is There a way to change these glue entries without reloading a complete tree? The normal ldapmodify doesn't allow to change this and ldapsearch can't find these records. Ldapdelete won't delete them either. Entries loaded under this dn can be found/modifies/deleted as normal Regards, Robin

1 0

value-based modify operation on binary attribute fails
by Kay.Kirchhoefer＠t-systems.com 05 Aug '09

05 Aug '09

Hi, I´m trying to remove the attribute "userCertificate;binary" from an entry, if it (attr) contains a special value (certificate). I´m trying this operation with perl ldap modules and also with Gawojar ldap browser. Both were working for me when I was using OpenLDAP 2.3.20. Now I´m using OpenLDAP 2.4.12 and I get an error message MOD attr=userCertificate;binary RESULT tag=103 err=16 text=modify/delete: userCertificate;binary: no such value but I send the modify request by using exactly the same value as I get from the ldap server (I compared the bytes sent across the network with wireshark) when requesting it with a ldapsearch. As I already wrote the same function worked for me with the older OpenLDAP version. I also tried to modify text attributes; that´s working. I didn´t found anything in the change log which is pointing to a fix regarding the comparison mechanism. Has anybody else had that problem ? Yours sincerely, Kay

2 2

Re: ldap PDC -- Failed to issue the StartTLS instruction
by Quanah Gibson-Mount 05 Aug '09

05 Aug '09

--On August 4, 2009 4:20:06 PM -0700 Ivan Ordonez <iordonez(a)nature.berkeley.edu> wrote: > Sorry Quanah, I am not following you on what you want me to do. Can you > please elaborate? > > Thank you for all your help. Keep replies on the list please. I was saying, I would have kept the ldaps:// URI in your config file, and drop the start TLS bit, and seen whether or not that works. In either case, I would use the ldapsearch binary to test against your server, both with ldaps:// URIs, and with ldap:// URIs using the -ZZ or -ZZZ flags to ldapsearch. ldapsearch with ldap:/// and -ZZ(Z) will use startTLS. ldapsearch with ldaps:// will try an SSL connection to the LDAP server. This way, you can hopefully get more meaningful error messages. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ldap PDC -- Failed to issue the StartTLS instruction
by Ivan Ordonez 05 Aug '09

05 Aug '09

Hello, We've been using an ldap based PDC from quite a while. Now we're suddenly having trouble getting our main fileserver to talk with the PDC. samba-3.2.13 on solaris 10. Here is our smb.conf global defs: Server role: ROLE_DOMAIN_MEMBER [global] workgroup = CNRDOM server string = nature (Samba %v) security = DOMAIN passdb backend = ldapsam:ldaps://169.229.xxx.yyy log level = 5 log file = /var/log/samba/log.%m name resolve order = wins host lmhosts os level = 65 local master = No domain master = No dns proxy = No wins support = Yes ldap ssl = start tls When we start up samba, we see many lines like these in log.smbd: [2009/08/03 15:40:40, 1] lib/smbldap.c:another_ldap_try(1170) Connection to LDAP server failed for the 4 try! and these: [2009/08/03 15:51:56, 0] lib/smbldap.c:smb_ldap_start_tls(595) Failed to issue the StartTLS instruction: Can't contact LDAP server [2009/08/03 15:51:56, 5] lib/smbldap.c:smbldap_search_ext(1199) smbldap_search_ext: base => [], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-22-1-97)(sambaSIDList=S-1-22-2-97)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2] [2009/08/03 15:51:56, 5] lib/smbldap.c:smbldap_close(1103) The connection to the LDAP server was closed But over on the PDC (gentoo linux 2.6.29, samba-3.2.13 , openldap-2.4.27) we see this in tcpdump: $ tcpdump -vv -c 4 port ldaps tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 15:51:29.736629 IP (tos 0x0, ttl 61, id 60609, offset 0, flags [DF], proto TCP (6), length 52) nature.Berkeley.EDU.56299 > xxxyyy.CNR.Berkeley.EDU.ldaps: S, cksum 0x6a18 (correct), 1637042825:1637042825(0) win 49640 <mss 1380,nop,wscale 0,nop,nop,sackOK> 15:51:29.736651 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) xxxyyy.CNR.Berkeley.EDU.ldaps > nature.Berkeley.EDU.56299: R, cksum 0x6c68 (correct), 0:0(0) ack 1637042826 win 0 15:51:30.746803 IP (tos 0x0, ttl 61, id 60610, offset 0, flags [DF], proto TCP (6), length 52) nature.Berkeley.EDU.56302 > xxxyyy.CNR.Berkeley.EDU.ldaps: S, cksum 0xa6d9 (correct), 2235230749:2235230749(0) win 49640 <mss 1380,nop,wscale 0,nop,nop,sackOK> 15:51:30.746827 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) xxxyyy.CNR.Berkeley.EDU.ldaps > nature.Berkeley.EDU.56302: R, cksum 0xa929 (correct), 0:0(0) ack 2235230750 win 0 It appears that there is indeed an ldaps conversation going on. We created new certificate on the PDC to see if certificate is the problem to no avail. Same message, and same problem. We disable firewall on the PDC as well and make sure that LDAP ports are all open. The Solaris 10 machine (ROLE_DOMAIN_MEMBER) and the PDC are on two different subnets. We're hoping someone will recognize this behavior and reveal our mistake to us. Or perhaps point out where we should check/debug/RTFM next.

2 3

olcDbConfig: value #14 provided more than once
by Matthew Edlefsen 04 Aug '09

04 Aug '09

Hello, I'm trying to do multi-master replication and after following the directions in the User Guide I came across the error: Aug 3 20:21:38 gabbro slapd[81578]: syncrepl_message_to_entry: rid=001 mods check (olcDbConfig: value #14 provided more than once) This is from the logs when it is syncing the cn=config tree. The especially odd thing about this error is that olcDbConfig is one of the numbered entries (the ones with {#} prepending each value), not to mention that the line is question is blank. This isn't the first time I've encountered this error when trying to do this type of thing (alas, I never got around to trying to fix it before :) ), so I'm hoping that means either I'm doing something obviously wrong or somebody has seen this before. Both servers are freebsd jails running FreeBSD 7.2 Stable. Here are some of the relevant configs. These are not the full entries, just the important bits. They are identical on both servers and they do sync parts of the config (everything up to the value that fails). dn: cn=config olcServerID: 1 ldap://rock.earlham.edu/ olcServerID: 2 ldap://gabbro.earlham.edu/ dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=dap://rock.earlham.edu/ binddn="<snip>" bindmethod=simple credentials=<snip> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://gabbro.earlham.edu/ binddn="<snip>" bindmethod=simple credentials=<snip> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcDatabase={1}bdb,cn=config olcDbConfig: {0}# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/12/18 11:53:27 ghenry Exp $ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co…> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig: {8}# <http://www.openldap.org/faq/index.cgi?file=2> olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon rebuilding olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 1 GB cache olcDbConfig: {16}set_cachesize 0 1073741824 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 104857600 olcDbConfig: {24}set_lk_max_locks 100000 olcDbConfig: {25}#set_lg_dir logs olcDbConfig: {26} olcDbConfig: {27}# Note: special DB_CONFIG flags are no longer needed for "quick" olcDbConfig: {28}# slapadd(8) or slapindex(8) access (see their -q option). Thanks! Matt Edlefsen Earlham College

5 8

slapd + TLS + SAMBA
by Alessandro Baggi 02 Aug '09

02 Aug '09

Hi there. I've another problem with TLS slapd and samba. For each operation with slapd (ldapsearch -x -ZZ, getent, or samba tls connection) I receive from slapd: Aug 2 11:31:05 PDC slapd[1709]: connection_read(23): unable to get TLS client DN, error=49 id=4 What's the problem? My certificate? Certificate's creation is: /usr/lib/ssl/misc/CA.pl -newca openssl req -newkey rsa:1024 -nodes -keyout key.pem -out newreq.pem /usr/lib/ssl/misc/CA.pl -sign Then another problem is when I start slapd on the boot, after slapd startup, samba , that try to connect to ldap with tls, could not connect to slapd and give me: 2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_parse_extended_result [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_parse_result [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_msgfree [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] TLS: can't connect: Error in the push function.. [2009/08/01 17:45:15, 0] lib/smbldap.c:smb_ldap_start_tls(596) [2009/08/01 17:45:15, 10] lib/ldap_debug_handler.c:samba_ldap_log_print_fn(26) [LDAP] ldap_err2string Failed to issue the StartTLS instruction: Connect error This only if I put in slapd.conf TLSClientVerify demand, if I put TLSClientVerify never, samba connect to it, under TLS without problems. Another issue is that, if i run slapd on startup and run samba after login with /etc/init.d/samba start, it makes the connection successfully without error. In the same script of slapd boot I set an "ldapsearch -x -ZZ -d -1" I receive: TLS: can't connect: Error in the push function.. the same of samba. Anyone has ideas? The problem is in certificates? thanks in advance

1 0

force creation of a "glue" node in the database?
by Robert Hanson 31 Jul '09

31 Jul '09

Using 2.4.16 on RedHat Linux. Does anyone know of a way to force the creation of a "glue" node in ldap? Here is the scenario: For some (as yet unknown) reason, our database sometimes has "glue" nodes. I'm suspecting this relates to syncrepl, but have not been able to diagnose the problem yet. I'm working on adding the manageDSAit control to our server requests (using the c client interface). I'd like a way to test this automatically. One way to do that would be to have the test program create a "glue" node and see that it can be found by the client code. I can't find a way to get the glue node created; I'm always getting a error 65 invalid structural object class chain.

1 0

lastmod in slapd.conf
by Srinidhi Sharma 31 Jul '09

31 Jul '09

Hi, Is it possible to detect using JNDI api's if the lastmod is turned on in Open-ldap slapd.conf file ? any pointers would be helpful. -- Thanks, Srinidhi

2 1

RE: entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16)
by Robert Hanson 31 Jul '09

31 Jul '09

What I need is to have the "glue" items returned as part of the search. It looks to me like I can get nodes that are "glue" nodes to be part of the results by commenting out these lines: in src\servers\slapd\back-bdb\search.c, lilnes 908-91 if ( !manageDSAit && is_entry_glue( e )) { goto loop_continue; } If I comment out these lines, then I get the results I'm looking for. Are there any other implications to the "glue" nodes? It looks like I'm able to edit and delete these nodes as well. But there is code in delete.c, modify.c, modrdn.c that worry about glue nodes. Another option would be to redefine the is_entry_glue macro to always return false. Is that a better approach? ________________________________ From: Robert Hanson Sent: Thursday, July 30, 2009 11:08 AM To: 'openldap-technical(a)openldap.org' Subject: entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16) Is this bug ITS#4626? Or is there a workaround? ==== Using a build of 2.4.16 on RedHat linux; in a multi-master environment with 2 nodes. On both nodes, I have a tree that has a node "ou=Company, o=MyCompanyName". Under that are several nodes that are "glue" nodes. Following those is a actual data node. Slapd 2.4.16, built from source, running on redhat linux) I have seen this occur several times on various test systems with similar configurations. The data in these nodes is inserted, in the proper order, (parent then children) using ldap client calls (ldap_add_s). Later, when I go to look at the output of slapcat, I see that some nodes are replaced with "glue" nodes. Questions: 1) Why are these glue nodes created? Is there a known bug that will cause existing nodes to be deleted without the children being deleted? Is this an issue in replication? (where syncrepl needs to create a node where the parent does not exist). Is that why the glue nodes are created later? 2) How can I change the "glue" to some other class? Can that be done programmatically? 3) ======== This is a dump of slapcat (with unnecessary nodes removed) dn: o=MyCompanyName objectClass: organization o: MyCompanyName structuralObjectClass: organization entryUUID: feb5b352-2eb7-102d-8c1f-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.418938Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z contextCSN: 20090728202448.877262Z#000000#001#000000 contextCSN: 20090728202123.336320Z#000000#002#000000 dn: ou=Company,o=MyCompanyName ou: Company description: 3.0.0 objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: feb7a41e-2eb7-102d-8c28-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.432024Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z dn: lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 0136f8e0-0ff7-102e-8da5-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Servers,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 014e7632-0ff7-102e-8db3-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Application Data,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: e5a152de-0fff-102e-923c-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: appName=Configurations,ou=Application Data,lcc=Call Center 1,ou=Company,o= MyCompanyName entryUUID: e5a299f0-0fff-102e-923d-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z structuralObjectClass: applicationUnit appName: Configurations objectClass: applicationUnit entryCSN: 20090728202143.649526Z#000000#001#000000 modifiersName: cn=Client,ou=People,o=MyCompanyName modifyTimestamp: 20090728202143Z

3 3

entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16)
by Robert Hanson 30 Jul '09

30 Jul '09

Is this bug ITS#4626? Or is there a workaround? ==== Using a build of 2.4.16 on RedHat linux; in a multi-master environment with 2 nodes. On both nodes, I have a tree that has a node "ou=Company, o=MyCompanyName". Under that are several nodes that are "glue" nodes. Following those is a actual data node. Slapd 2.4.16, built from source, running on redhat linux) I have seen this occur several times on various test systems with similar configurations. The data in these nodes is inserted, in the proper order, (parent then children) using ldap client calls (ldap_add_s). Later, when I go to look at the output of slapcat, I see that some nodes are replaced with "glue" nodes. Questions: 1) Why are these glue nodes created? Is there a known bug that will cause existing nodes to be deleted without the children being deleted? Is this an issue in replication? (where syncrepl needs to create a node where the parent does not exist). Is that why the glue nodes are created later? 2) How can I change the "glue" to some other class? Can that be done programmatically? 3) ======== This is a dump of slapcat (with unnecessary nodes removed) dn: o=MyCompanyName objectClass: organization o: MyCompanyName structuralObjectClass: organization entryUUID: feb5b352-2eb7-102d-8c1f-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.418938Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z contextCSN: 20090728202448.877262Z#000000#001#000000 contextCSN: 20090728202123.336320Z#000000#002#000000 dn: ou=Company,o=MyCompanyName ou: Company description: 3.0.0 objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: feb7a41e-2eb7-102d-8c28-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.432024Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z dn: lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 0136f8e0-0ff7-102e-8da5-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Servers,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 014e7632-0ff7-102e-8db3-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Application Data,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: e5a152de-0fff-102e-923c-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: appName=Configurations,ou=Application Data,lcc=Call Center 1,ou=Company,o= MyCompanyName entryUUID: e5a299f0-0fff-102e-923d-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z structuralObjectClass: applicationUnit appName: Configurations objectClass: applicationUnit entryCSN: 20090728202143.649526Z#000000#001#000000 modifiersName: cn=Client,ou=People,o=MyCompanyName modifyTimestamp: 20090728202143Z

1 0

Radius authentication and storing passwords in cleartext
by Eric Bourkland 30 Jul '09

30 Jul '09

I have zimbra openLDAP v2.3.43 running on RHEL4.7 ES and I am trying to connect our freeRadius server to authenitcate against LDAP. I have also being trying to stand up plane openLDAP v2.4.17 to see if I can get that to work. Free Radius requires PEAP/CHAPv2 to authenticate, which means it needs to be handed a clear text password in order to work. Yes, I know in general this is not a good idea. How can I configure openLDAP to store passwords (userpassword attribute) in cleartext. Or at the very least create a script that will be able to take the encrypted password and store it in cleartext as another attribute. Thanks,

5 4

Member-of plugin support for nested membership
by Mathias Gug 30 Jul '09

30 Jul '09

Hi, While discussing the possibility of using openldap in place of 389 directory in the FreeIPA project [1] the following technical detail was mentioned. [1]: https://www.redhat.com/archives/freeipa-devel/2009-July/msg00333.html According to the memberof overlay man page: The memberof overlay to slapd(8) allows automatic reverse group member‐ ship maintenance. Any time a group entry is modified, its members are modified as appropriate in order to keep a DN-valued "is member of" attribute updated with the DN of the group. Does the memberOf overlay deal with nested membership? Or is it strictly a 1:1 relationship (forward pointer, reverse pointer)? The 389 memberOf plug-in maintains reverse pointers for inherited membership which IPA takes advantage of. -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

1 0

Re: get_ava: illegal value with translucent proxy
by Petteri Heinonen 29 Jul '09

29 Jul '09

Pierangelo Masarati [masarati(a)aero.polimi.it] kirjoitti: > Petteri Heinonen wrote: > > Pierangelo Masarati [masarati(a)aero.polimi.it] wrote: > >> Petteri Heinonen wrote: > >> > Hi, I've setup a translucent proxy. Now, I have tried to do some > >> test > searches. For example this works ok: > >> > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > >> "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" > >> > > Search is proxied through proxy to the actual server, and correct > >> result > is returned. However, if I try this: > >> > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > >> "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" > >> > > I get no results. I have monitored the traffic between proxy and > >> backend > server, and the query is not even sent there. In OpenLDAP > >> log there is: > >> > > Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for > > >> attributeType objectClass > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 > >> > > What would be the problem here? > >> > >> The objectClass "User" is not defined in the proxy's schema? > >> > >> p. > >> > > > > That's correct. But in translucent overlay's documentation, there is: > > > > "Note: The Translucent Proxy overlay will disable schema checking in the > > local database, so that an entry consisting of overlay attributes need > > not adhere to the complete schema." > > > > But it seems that schema checking is still in affect when doing > > searches. Is there a way to disable local schema checking altogether? Or > > do I have to build some dummy schema so that OpenLDAP is aware about > > objectClasses I want to search for? > > What happens is that you use unknown schema items in the *filter*, which > requires it to be known in order to apply appropriate matching rules and > so. The schema relaxation in the documentation refers to enforcing > adherence with allowed and required attributes of an objectclass, and > with stored objectclasses complying with structural inheritance > relationship. Schema items need to be known anyway. > > p. > Ok, thanks for the clarification. I guess that my goal to have an Active Directory proxied properly is not going to happen. I would need a complete AD schema for OpenLDAP, and that's probably now available anywhere.

2 1

Mirror mode with additional consumer
by Jens Thomas 29 Jul '09

29 Jul '09

Hi, i am new at this list, please forgive me my broken english. I have two questions, first, is it possible to setup two slapd (2.4.x) in mirror mode and add later one or more additional consumer slapd with syncrepl? The goal is to have a 2-server-HA system (where one server is always writeable) and distributed cache slapd's. Are there theoretical issues? A second problem, maybe you can give me a pointer: I would like to assign the right to add, modify and delete an object to an attribute inside the same object (and necessarily to the container object). Maybe ACI and the corresponding overlay is what i need. Or can this be solved by using regex? Thanks a lot, with kind regards Jens -- linux systeme thomas Jens Thomas Völklinger Straße 9 42285 Wuppertal Telefon: +49.202.3097507 Mobil: +49.177.9301386 eFax: +49.202.85064329 Web: http://linux-systeme-thomas.de USt-ID: DE250711901

3 3

Re: get_ava: illegal value with translucent proxy
by Petteri Heinonen 28 Jul '09

28 Jul '09

Pierangelo Masarati [masarati(a)aero.polimi.it] wrote: > Petteri Heinonen wrote: > > Hi, I've setup a translucent proxy. Now, I have tried to do some test > > searches. For example this works ok: > > > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" > > > > Search is proxied through proxy to the actual server, and correct result > > is returned. However, if I try this: > > > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" > > > > I get no results. I have monitored the traffic between proxy and backend > > server, and the query is not even sent there. In OpenLDAP log there is: > > > > Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter > > Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY > > Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for > > attributeType objectClass > > Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 > > > > What would be the problem here? > > The objectClass "User" is not defined in the proxy's schema? > > p. > That's correct. But in translucent overlay's documentation, there is: "Note: The Translucent Proxy overlay will disable schema checking in the local database, so that an entry consisting of overlay attributes need not adhere to the complete schema." But it seems that schema checking is still in affect when doing searches. Is there a way to disable local schema checking altogether? Or do I have to build some dummy schema so that OpenLDAP is aware about objectClasses I want to search for? -Petteri Heinonen --

2 1

send_search_entry: conn 9279837 ber write failed
by jakjr 27 Jul '09

27 Jul '09

Hello, some time ago I upgraded our server to version 2.4.16. Since then, for 3 times, the server hangs with this message: Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 fd=110 ACCEPT from IP=XXX.XXX.XXX.XX:41577 (IP=0.0.0.0:389) Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 BIND dn="cn=admin" method=128 Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 BIND dn="cn=admin" mech=SIMPLE ssf=0 Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 RESULT tag=97 err=0 text= Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=1 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=2 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=3 SRCH base="ou=seed" scope=2 deref=0 filter="(uidNumber=12916)" Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=4 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=5 SRCH base="ou=seed" scope=2 deref=0 filter="(&(gidNumber=20877)(phpgwAccountType=g))" Jul 27 09:32:33 sseed0013 slapd[22555]: conn=9279837 op=6 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=20877)(phpgwAccountType=u))" Jul 27 09:32:36 sseed0013 slapd[22555]: conn=9279837 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= *Jul 27 09:32:42 sseed0013 slapd[22555]: send_search_entry: conn 9279837 ber write failed.* The config and load of this server is almost the same of the old version (2.3.30) Thanks for any tip, Regards, João Alfredo

2 2

ACL on referral object (chaining) does not work
by Kay.Kirchhoefer＠t-systems.com 27 Jul '09

27 Jul '09

Hi, I have a question regarding ACL used together with chaining overlay configuration. I´m building several ldap servers which should chain each other, based on the selected path. I now wanted to prevent a chaining loop by using ACLs, but that doesn´t work for me. It seems like the ACL is not used for the referral objects. sample referral object: dn: o=testldap2,c=de objectClass: referral objectClass: extensibleObject o=testldap2 ref: ldap://testldap2/c=de <ldap://testldap2/c=de> chaining config: overlay chain chain-uri ldap://testldap2 <ldap://testldap2> chain-rebind-as-user yes chain-idassert-bind bindmethod="simple" binddn="cn=xxxxxx" credentials="yyyy" mode="self" chain-max-depth 1 chain-return-error TRUE ACL config: access to dn.base="o=testldap2,c=de" by peername.ip=192.168.1.1 none by * read 192.168.1.1 is the ip address of "testldap2". Everytime a request from this ip occurs, the server should block the access to the (referral) object because it must be a "chained" request But that doesn´t work. Also the parameter "chain-max-depth" seems not to work. I´m currently using OpenLDAP version 2.3.20 (but I also tried the latest one). Yours sincerely, Kay

2 1

get_ava: illegal value with translucent proxy
by Petteri Heinonen 27 Jul '09

27 Jul '09

Hi, I've setup a translucent proxy. Now, I have tried to do some test searches. For example this works ok: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" Search is proxied through proxy to the actual server, and correct result is returned. However, if I try this: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" I get no results. I have monitored the traffic between proxy and backend server, and the query is not even sent there. In OpenLDAP log there is: Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for attributeType objectClass Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 What would be the problem here? Regards, Petteri Heinonen

2 1

Problem - ldapadd invalid syntex (21)
by Bruno Steven 24 Jul '09

24 Jul '09

Hello I am newbie in use OpenLdap , I have simple problem I can´t add structure of tree directory, the file org.lidf show my structure dn: dc=labcom,dc=factory objectClass: top objectClass: dcObject #objectClass: organization dc: labcom o : Linuxtech When I type this command ldapadd -f /etc/openldap/lidfs/org.ldif -x -D "cn=adm,dc=labcom,dc=factory" -W Show this message error Enter LDAP Password: adding new entry "dc=labcom,dc=factory " ldapadd: Invalid syntax (21) Why this message error ? I have include the follow schemas include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema The process slapd have been started by user root, so haven´t problem of permission That is ... Thanks -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx

4 5

syncrepl and "no equality matching rule"
by Alain ZAMBONI 24 Jul '09

24 Jul '09

Hello, I run an LDAP directory on 3 servers : one master, and two slaves, synchronised with syncrepl. The 3 servers are running FreeBSD 7.0 and openLDAP 2.4.13. I encountered yesterday an issue with syncrepl that should have been solved with openLDAP 2.4.13 http://www.openldap.org/lists/openldap-software/200812/msg00040.html The synchronisation was blocking on the deletion of a facsimileTelephoneNumber. When the problem occured, the master entry was (only showing the facsimileTelephoneNumber attribute) : dn: uid=veinantep,ou=uds,ou=people,o=annuaire facsimileTelephoneNumber: 0388613347 And the slave entry was : dn: uid=veinantep,ou=uds,ou=people,o=annuaire facsimileTelephoneNumber: 0388612908 facsimileTelephoneNumber: 0388613347 The application doing the modification on the master is always using a "replace" operation, to avoid the "no equality matching rule" problem. It seems that syncrepl tries to synchronise the slave by generating the forbidden operation of deleting a precise facsimileTelephoneNumber. Is this problem known ? the release between 2.4.13 and 2.4.16 don't mentionned something about it. I managed to unlock the situation by completely deleting the "facsimileTelephoneNumber" on the master, then adding it again. The big problem of this little issue is that it is blocking all the synchronisation process between master and slaves ... By the way, is there a way to check the good state of the synchronisation with syncrepl (besides parsing the sync logs or doing recurring diff between the servers) ? I must admit that I miss slurpd's .rej files. Just in case, here are the log of one of the slaves : syncrepl_entry: rid=101 be_search (0) syncrepl_entry: rid=101 uid=veinantep,ou=uds,ou=people,o=annuaire bdb_modify: uid=veinantep,ou=uds,ou=people,o=annuaire bdb_dn2entry("uid=veinantep,ou=uds,ou=people,o=annuaire") bdb_modify_internal: 0x0001fc23: uid=veinantep,ou=uds,ou=people,o=annuaire <= acl_access_allowed: granted to database root bdb_modify_internal: delete facsimileTelephoneNumber bdb_modify_internal: 18 modify/delete: facsimileTelephoneNumber: no equality matching rule bdb_modify: modify failed (18) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=18 matched="" text="modify/delete: facsimileTelephoneNumber: no equality matching rule" null_callback : error code 0x12 syncrepl_entry: rid=101 be_modify (18) syncrepl_entry: rid=101 be_modify failed (18) Thanks, -- Alain ZAMBONI Direction Informatique Université de Strasbourg

2 2

access control
by Darryl Moore 24 Jul '09

24 Jul '09

I'm trying to set up access controls for the server. Here are the rules I am trying to impliment olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none olcAccess: {1}to dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none olcAccess: {2}to dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none olcAccess: {3}to dn.regex="cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=Admin,cn=$1,ou=Groups,dc=moores,dc=ca" write by group="cn=Management,ou=Groups,dc=moores,dc=ca" write by users read olcAccess: {4}to dn.base="ou=Groups,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {5}to dn.base="ou=People,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {6}to * by users read by * none - Basically I have groups, and within those groups I have Contact lists and administrators. I want the administrator to have write access, other members to have read access, and non members to have none. This rule is what I think should work for that: dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none I know this rule works for individual user contact lists: dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none I think the problem I am running into is having the <who> field as group.exact,expand Can I not do this? If not, is there any way to acheive the same result? thanks, darryl

3 5

Dying LDAP process and TLS
by Florian Götz 24 Jul '09

24 Jul '09

Hello everybody, I got some two serious problems with my LDAP, maybe you got a hint for it. Problem 1 might have a connection to nr 2, but I´m not sure. I use OpenLDAP 2.4.12 on a SLES11 system. The initscript to start/stop the service called "rcldap" know 3 states: unused, running and dead. When I startup the LDAP it´s in state running. It takes about 10-15min, the LDAP doesn´t respond anymore and a "rcldap status" tells me that the service is dead. I have no clue why it behaves this way. The logs tell me, that the Backup-System fetches some data and then the log ends without any further notice. The pid file still exists, but the process is gone. Problem 2 has to do with TLS. I got the CA of our (sub)company, a certificate for the ldap-machine and the associated private key file. The certificate chain is: Deutsche Telekom Root CA -> Company CA -> Subcompany CA -> Certificate of LDAP machine. The certificate for the ldap machine seems to be generated with/by the Company CA. If I put these files into the slapd config with: TLSCACertificateFile /etc/openldap/certs/SubcompanyCA.pem TLSCertificateFile /etc/openldap/certs/ldapcert.pem TLSCertificateKeyFile /etc/openldap/certs/ldapprivkey.pem TLSVerifyClient demand and the following lines in the /etc/ldap.conf: TLS_CACERT /etc/openldap/certs/SubcompanyCA.pem TLS_REQCERT demand it crashes at the TLS certificate verification, because he can´t get the local issuer certificate. If I use the Company CAs in both places instead of the Subcompany CA it´s failing too. If I mix it up with the SubcompanyCA in the slapd.conf and the CompanyCA in the ldap.conf, the certificate verification succeeds, but I get a TLS trace: SSL3 alert read:fatal:handshake failure I don´t know how to handle that problem. -- Best regards, Florian Götz -----

2 1

Propagation of proxyAuthz control
by Javier Manteiga 24 Jul '09

24 Jul '09

Hi all, We are trying to set a system with the DIT split in several servers, using the Meta backend to proxy the LDAP requests among them. In the remote servers we would like to check the ACLs using the identity of the client that sent the request, instead of the identity used to create the proxy connections. For this we have configured the idassert parameters in the meta targets as follows: idassert-bind bindmethod=simple binddn="cn=manager,dc=operator,dc=com" (root user of the backend receiving the proxied query) credentials="manager" mode=self iddassert-authzFrom "dn:*" When the first proxy is made everything is OK. The proxyAuthz extension control is added to the LDAP message and the remote server behaves as expected. Our problem is that in some cases we have requests that must be proxied several times. E.g: consider a scenario with three servers in A, B and C. in which the LDAP request sent by the external client is received in A, this server proxies it to B. Finally B proxies it to C. When B tries to set the proxyAuthz control it detects that there is already one and it returns the error "proxyAuthz not allowed within namingContext". Is there anyway in which we can avoid this error and propagate the credentials of the external client to the last server?. Thank you very much for your help. Best regards. Javier Manteiga

2 1

ACL processing performance
by Christian Manal 24 Jul '09

24 Jul '09

Hi, I've got a question regarding ACLs and their processing performance. I use the NIS-schema to store userinformation and the likes in OpenLDAP (using the maps passwd, group, services, ethers, hosts, automount stuff etc.) plus samba-schema plus some self defined stuff. I have ACLs defined for some special attributes, like userPassword, and for each OU (People, Groups, ...). If I start multiple searches without a filter (so everythin accessible will be displayed) anonymously or with some user, I can get the CPU load of my servers up to 80-90%. It's definitely the ACLs, since I have no problems when using the rootDN or if I reduce the ACLs. What I'd like to know now is, what is so damn expensive in my ACLs and how I could reduce the cost without lessening the access restrictions... OpenLDAP version is 2.4.17 using back-hdb with BDB 4.4 from opencsw respository on Solaris 10 (SunOS 5.10 Generic_139556-08). There are around 30k entries in my database. I have one master and four slaves using delta-syncrepl for replication. Configuration files can be found here: http://www.informatik.uni-bremen.de/~moenoel/ldap/ Thanks in advance. Regards, Christian Manal

3 2

Use of syncprov overlay in slave
by rommel＠buxit.nl 24 Jul '09

24 Jul '09

I am wondering whether it is possible to use the syncprov overlay in the slave database? The configuration at hand consists of two masters in mirror-mode and n-replica's in syncrepl-mode. The client application connects to one of the replica's and attempt to use the SyncControl to monitor the replica for changes. Both the master's and replica's have been configured with 'overlay syncprov'. When the client application connects to one of the masters and a changes in made in the other master, the application gets notified about the change through the SyncControl. However when I connect the client application to one of the replica's and make a change in one of the master's the client does not get notified about the change. When I look into the replica database directly the change made on the master is visible though. So I'm wondering is it possible to use the syncprov overlay in the slave database? And what would be the correct configuration to achieve this? The version of openldap I'm using is 2.4.13 Any help is appreciated. /Rob

3 2

openldap and dadlauthd
by Olivier Nicole 24 Jul '09

24 Jul '09

Hi, I have problems to get saslauthd to work with my openldap server: - saslauthd binds/autneticates if I connect to the non SSL port ldap://ldap.cs.ait.ac.th/ - saslauthd fails to bind/autneticate if I connect to the SSL port ldaps://ldap.cs.ait.ac.th/ Jul 23 12:02:00 ldap slapd[41289]: conn=22 fd=19 ACCEPT from IP=192.41.170.50:62502 (IP=192.41.170.6:636) Jul 23 12:02:00 ldap slapd[41289]: connection_closing: readying conn=22 sd=19 for close Jul 23 12:02:00 ldap slapd[41289]: connection_close: conn=22 sd=-1 Jul 23 12:02:00 ldap slapd[41289]: conn=22 fd=19 closed (TLS negotiation failure) I really don't know where to look. TIA, Olivier

2 7

Help with slurpd referral error
by phamp008＠yahoo.com 23 Jul '09

23 Jul '09

Hi, I am new to Openldap + Keberos project. I am setting up slurpd from ldap1(master) to ldap2(replica). I am hopping someone can give me some suggestion to troubleshoot this. I ran into this error when slurpd attempt to add new DN to ldap2. This is the error when I run slurpd -d 4 begin replication thread for ldap2.test.domain:389 Initializing session to ldap2.test.domain:389 request done: ld 0x9b27778 msgid 1 bind to ldap2.test.domain as host/krbmaster.test.domain(a)TEST.DOMAIN via GSSAPI (SASL) request done: ld 0x9b27778 msgid 2 request done: ld 0x9b27778 msgid 3 request done: ld 0x9b27778 msgid 4 replica ldap2.test.domain:389 - add dn "uid=ppham4,ou=people,dc=test,dc=domain" request done: ld 0x9b27778 msgid 5 Error: ldap_add_s failed adding DN "uid=ppham4,ou=people,dc=test,dc=domain": Referral Error: ldap operation failed, data written to "/var/lib/ldap/replica/ldap2.test.domain:389.rej Here's the slapd.conf on ldap1(master) include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org disallow bind_simple #security tls=1 #require authc # Create a replication log in /var/lib/ldap for use by slurpd. # REPLICA: Comment this out on the replicas replogfile /var/lib/ldap/master-slapd.replog TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd1-cert.pem TLSCertificateKeyFile /etc/openldap/slapd1.key sasl-secprops noanonymous,noplain,noactive # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=domain # This should be a ^ plus, not a star, but slapd won't accept it # REPLICA: # On replica servers replace the first line of each section below (the # line that allows /admin principals to write to things) with the # following line (allowing the primary server to write instead). Thus # admins can make changes on the primary server, and the primary # server can push changes to the replicas. #by dn.exact="uid=host/foo.example.com,cn=GSSAPI,cn=auth" write # Users with /admin principals can change anything # Users can change their shell, anyone else can see it access to attrs=loginShell by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self read by * none # Default read access for everything else access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read sizelimit 5000 threads 8 loglevel 256 # Allow LDAPv2 for Mozilla's address book #allow bind_v2 database bdb suffix "dc=test,dc=domain" cachesize 10000 checkpoint 256 15 # Uncomment these only for the initial load, then comment them back # out and restart slapd. rootdn "cn=Manager,dc=test,dc=domain" rootpw Secret! # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial # REPLICA: Comment this out on replicas replica host=ldap2.test.domain:389 tls=critical bindmethod=sasl saslmech=GSSAPI authcId=host/krbmaster.test.domain(a)TEST.DOMAIN Here's the copy of my slapd.conf on replica ldap2 server: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema #referral ldap://root.openldap.org #pidfile /var/run/slapd.pid #argsfile /var/run/slapd.args # Create a replication log in /var/lib/ldap for use by slurpd. # REPLICA: Comment this out on the replicas #replogfile /var/lib/ldap/master-slapd.replog TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd1-cert.pem TLSCertificateKeyFile /etc/openldap/slapd1.key sasl-secprops noanonymous,noplain,noactive saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=domain access to attrs=loginShell by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write by self read by * none # Default read access for everything else access to * by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write sizelimit 5000 threads 8 idletimeout 14400 loglevel 256 # Allow LDAPv2 for Mozilla's address book allow bind_v2 database bdb suffix "dc=test,dc=domain" # Increase the size of slapd's entry cache. Note that this is a cachesize 10000 checkpoint 256 15 # Uncomment these only for the initial load, then comment them back # out and restart slapd. rootdn "cn=Manager,dc=test,dc=domain" rootpw Secret! # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial # The purpose of the updatedn is to tell slapd not to send the updateref # if that DN tries to make changes. Any other user which attempts to # submit a change will be refered to the master LDAP server found in # updateref. # REPLICA: Uncomment these on replicas updatedn "uid=host/krbmaster.test.domain" updateref ldaps://ldap1.test.domain/ Greatly appreciate any help. Thanks Phil

2 1

error in SSLv3 read client certificate
by Jittinan Suwanrueangsri 23 Jul '09

23 Jul '09

Dear all After I execute command " ldapsearch -x -W -D 'cn=admin,dc=example,dc=com' -ZZ '(uid=david)' " I get following log portion(debug at level 1): slapd starting slap_listener_activate(8): >>> slap_listener(ldap:///) connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 29 contents: ber_get_next conn=0 op=0 do_extended ber_scanf fmt ({m) ber: send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush2: 14 bytes to sd 13 connection_get(13): got connid=0 connection_read(13): checking for input on id=0 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A TLS trace: SSL_accept:SSLv3 flush data /TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A/ connection_get(13): got connid=0 connection_read(13): checking for input on id=0 TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data /connection_read(13): unable to get TLS client DN, error=49 id=0/ connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 44 contents: ber_get_next conn=0 op=1 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=admin,dc=example,dc=com> <<< dnPrettyNormal: <cn=admin,dc=example,dc=com>, <cn=admin,dc=example,dc=com> do_bind: version=3 dn="cn=admin,dc=example,dc=com" method=128 do_bind: v3 bind: "cn=admin,dc=example,dc=com" to "cn=admin,dc=example,dc=com" send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=97 err=0 ber_flush2: 14 bytes to sd 13 connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 55 contents: ber_get_next conn=0 op=2 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <dc=example,dc=com> <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: => hdb_search bdb_dn2entry("dc=example,dc=com") => hdb_dn2id("dc=example,dc=com") <= hdb_dn2id: got id=0x1 entry_decode: "" <= entry_decode() search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 => hdb_dn2idl("dc=example,dc=com") => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 => bdb_equality_candidates (uid) <= bdb_equality_candidates: (uid) not indexed bdb_search_candidates: id=-1 first=1 last=11 hdb_search: 1 does not match filter entry_decode: "" <= entry_decode() hdb_search: 2 does not match filter entry_decode: "" <= entry_decode() hdb_search: 3 does not match filter entry_decode: "" <= entry_decode() hdb_search: 4 does not match filter entry_decode: "" <= entry_decode() hdb_search: 5 does not match filter entry_decode: "" <= entry_decode() hdb_search: 6 does not match filter entry_decode: "" <= entry_decode() hdb_search: 7 does not match filter entry_decode: "" <= entry_decode() hdb_search: 8 does not match filter entry_decode: "" <= entry_decode() hdb_search: 9 does not match filter entry_decode: "" <= entry_decode() => send_search_entry: conn 0 dn="uid=david,ou=Users,dc=example,dc=com" ber_flush2: 199 bytes to sd 13 <= send_search_entry: conn 0 exit. entry_decode: "" <= entry_decode() hdb_search: 11 does not match filter send_ldap_result: conn=0 op=2 p=3 send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 13 connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify ber_get_next on fd 13 failed errno=0 (Success) conn=0 op=3 do_unbind connection_close: conn=0 sd=13 TLS trace: SSL3 alert write:warning:close notify What cause these errors? ,What do these errors mean? /TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A //connection_read(13): unable to get TLS client DN, error=49 id=0 /How can I fix these problems? Thankyou Jittinan Suwanrueangsri/ /

2 1

adding/modifying local attributes with translucent overlay
by Hart, Brian R. 22 Jul '09

22 Jul '09

Hey everyone - I have an openldap server setup using the translucent overlay and pulling entries from a remote ldap server (running Fedora DS). I seem to have gotten the translucent overlay configured correctly as I can perform searches and obtain entries from the remote ldap server by way of the local one. I can even add local attributes for users and groups in the local server and perform searches and obtain the results with the local attributes. However when I try to change or modify anything that has been stored in the local ldap server I either get 'ldapadd: already exists (68)' or 'ldapmodify: no such object (32)'. I'm using openldap 2.4.16 on RHEL5. When I'm trying to make these changes I'm using an ldif file just like I did when I added the attributes to begin with. I've tried just modifying the ldif file and re-adding as if it didn't already exist and I've tried writing the ldif as if it was for a modify with a changetype: modify line in the file. If I need to post the configuration file I can I just thought I'd hold off on putting all of that here if it wasn't necessary. I hope somebody can help - thanks in advance! Sincerely, Brian Hart

1 0

slow search and connection problem
by mukim pathan 22 Jul '09

22 Jul '09

Hi, I am using openldap2.4.16 with bdb 4.5. I am doing search in database using java. When I am doing search for first time, it is connecting and giving response in 4-5 milliseconds. But then its is taking around 100-150ms for search.I don't know what might be the problem. I searched online for this but could not find any solution. Following are my ldap configuration files. slapd.conf : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/xxx.schema allow bind_v2 concurrency 3 threads 3 database bdb suffix "dc=xxx,dc=com" rootdn "cn=Manager,dc=xxx,dc=com" rootpw xxx directory /usr/local/var/openldap-data index objectClass eq index attr1 eq index attr2 eq index attr3 eq checkpoint 1024 60 cachesize 1000000 DBCONFIG: set_cachesize 2 268435456 1 set_lg_dir /opt2/logs set_data_dir /opt2/db set_flags DB_LOG_AUTOREMOVE Please help me with any improvements i must do to get fast search result. Regards, Mukim Pathan

3 3

LdapErr: DSID-0C090627 with translucent proxy and AD
by Petteri Heinonen 22 Jul '09

22 Jul '09

Hello list, I've been trying to setup a translucent proxy to display a modified version of our ActiveDirectory (Server 2003) to Linux clients. The ultimate goal is to be able to transparently add UID, default shell etc. parameters missing in AD by default. Usage of Services for Unix is not possible this time because of "company policies". Config file is like this: # Default realm sasl-realm company.com # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 504 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload accesslog moduleload translucent # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 backend hdb database hdb # The base of your directory in database #1 suffix "dc=company,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=company,dc=com" rootpw {SSHA}blaablaa # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod off overlay translucent uri ldap://ad1.company.com:389 acl-bind binddn="CN=ldapuser,OU=tools,DC=company,DC=com" credentials="verysecure" Now, if I do a search with rootdn cn=admin,dc=company,dc=com, proxy binds to AD as ldapuser and search is successful. But, if I use a user existing in AD only, for example like this: ldapsearch -x -W -D "CN=Some User,OU=Users,DC=company,DC=com" -b "CN=Some User,OU=Users,DC=company,DC=com" I get: # extended LDIF # # LDAPv3 # base <CN=Some User,OU=Users,DC=company,DC=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1 I monitored the traffic using wireshark, and from there I can see that binding is actually successful. What fails is the search request after that: 0.000361 10.65.31.26 -> 10.65.26.34 LDAP bindRequest(1) "cn=Some User,ou=Users,dc=company,dc=com" simple 0.002285 10.65.26.34 -> 10.65.31.26 LDAP bindResponse(1) success 0.002297 10.65.31.26 -> 10.65.26.34 TCP 43898 > ldap [ACK] Seq=79 Ack=23 Win=5888 Len=0 TSV=67497094 TSER=69277767 0.003840 10.65.31.26 -> 10.65.26.34 LDAP searchRequest(4) "Some User,ou=Users,dc=company,dc=com" wholeSubtree 0.004067 10.65.26.34 -> 10.65.31.26 LDAP searchResDone(4) operationsError (00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece) OpenLDAP version is the one with Debian Lenny: slapd/lenny uptodate 2.4.11-1 Any suggestions how to continue? Is this some AD related quirk or possibly a problem problem related to how OpenLDAP does binding? Regards, Petteri Heinonen

1 0

Fwd: OpenLdap manual howto available
by Gavin Henry 21 Jul '09

21 Jul '09

Will take a look too. ---------- Forwarded message ---------- From: Lukasz Szybalski <szybalski(a)gmail.com> Date: Mon, 20 Jul 2009 11:45:15 -0500 Subject: OpenLdap manual howto available To: Debian User List <debian-user(a)lists.debian.org> Just an FYI. I'm working on openldap howto for Debian. http://lucasmanual.com/mywiki/OpenLdap This manual shows how to setup openldap and gives a workaround to some of the known bugs that prevent openldap to be reconfigured, and migration tools from finish migration. The setting up of openldap is fairly easy, but without few key instructions that I've listed its almost impossible for new user to finish. Took me 2 weeks but after reading above OpenLdap Manual howto you will setup ldap server in as little as 10minutes. Enjoy. (More content coming as days go by) Contents 1. OpenLDAP 1. What is required 2. Install 3. Authentication 4. Connect to openldap 5. Simple addressbook 1. Thunderbird 2. Outlook 2. Linux integration with LDAP 1. libnss-ldap 1. migrationtools 2. libpam 3. Troubleshooting 1. result: 32 No such object 4. References -- To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/ http://www.suretectelecom.com

1 0

Suggestion for 2 domains samba+ldap and Windows AD
by Alberto Moreno 21 Jul '09

21 Jul '09

Hi people. I want to know if this is possible. I have right now 3 domains in my network. Dom A = Samba 3.0.33 Gentoo + LDAP. This serve to a domain of 10 users at location 1. Dom B = Windows 2003 AD serving 8 users at location 2. Dom C = WinNT + samba as client serving most of the users(35) at location 2. As u can see, the NT is the most busy, I need to remove that domain, is in the same location as "Dom B", my path is to move all the users from "Dom C" to "Dom B" most of the machines are windows boxes. This is easy, the only issue I was having before is my 2 samba boxes, I could not make possible to be part of the "Dom B", but last week I made that possible, them I can make this move. Well, the main reason of this email is because, after I remove the NT server, at location 2 I would just have a Window 2k3 AD domain working, on the other site (location 1) I would have a domain running samba+ldap working. Right now, if I'm at location 1 I cannot see location 2 the "Dom B"(Win 2k3), the same thing happen at location 2. There is a way to make this possible, can a domain with samba+ldap see a domain with win 2k3? Is possible to share users? I was think to setup another server at location 2 with samba+ldap and sync users but I still have the users of the win 2k3 domain...? Hope to be clear, if someone have some experience here at will appreciated, thanks for your time!!! P.S. my samba serves at location 2 are Centos 5.x Samba 3.0.33. -- LIving the dream...

2 2

on-the-fly tweaking of AccessControl (be_acl)
by Daniel 20 Jul '09

20 Jul '09

Dear slapd-Experts, I've a perhaps slightly strange question regarding tweaking of be_acl from within an overlay and would be very happy if you could please help me. I'm looking after a possibility to change AccessControl struct's content on "overlay-operation-basis": For each processed Operation within my test overlay I want to modify this sample ACL from a) into b): a) cn=config initially stores: access to filter=(x=*) by users read by * none b) overlay has detected operation "z" ==> the acl should be tuned into: access to filter=(y=*) by users read by * none I think I've already found the concerned structs and I'm able to get the above modification done in theory, but I'm a little bit afraid/unsure regarding side effects, e.g thread locking and so on. I could imagine that in general be_acl is not intend to be changed from one operation to another...?! What would be the "best" pseudo-code-style way to achive the above a-b-transition in a safe/consistent way from within an overlay? Many thanks for your advice! Cheers Daniel

1 0

add and modify
by mukim pathan 20 Jul '09

20 Jul '09

Hi, I was just wondering if there is any command like ldapadd/ldapmodify or any configuration parameter in this commands which will add an entry in database if its not present like ldapadd and modify that entry if its there in database like ldapmodify?? Regards, Mukim Pathan

2 1

Problem with new writetimeout
by Christian Manal 20 Jul '09

20 Jul '09

Hi everyone, I have noticed a problem regarding the new writetimeout feature in OpenLDAP 2.4.17. I have a setup with one master and four replicas running on Solaris 10, using the hdb-backend with BDB 4.4 from the opencsw repository. Clients are Sun, Linux and Mac boxes in every possible variation. I updated my servers last Friday from version 2.4.15 and now some cronjobs accessing the directory were sporadically failing over the weekend. I monitored the server logs (log level 'stats') while running the involved scripts repeatedly and got something like the following results after fail-runs on all servers: (IPs and DNs altered) > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 848112 local4.debug] conn=12479 fd=79 ACCEPT from IP=192.168.1.1:50210 (IP=0.0.0.0:389) > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 270379 local4.debug] conn=12479 op=0 EXT oid=1.3.6.1.4.1.1466.20037 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 560212 local4.debug] conn=12479 op=0 STARTTLS > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 875301 local4.debug] conn=12479 op=0 RESULT oid= err=0 text= > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 105384 local4.debug] conn=12479 fd=79 TLS established tls_ssf=256 ssf=256 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 215403 local4.debug] conn=12479 op=1 BIND dn="uid=dummyuser,ou=System,dc=example,dc=com" method=128 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 600343 local4.debug] conn=12479 op=1 BIND dn="uid=dummyuser,ou=System,dc=example,dc=com" mech=SIMPLE ssf=0 > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 588225 local4.debug] conn=12479 op=1 RESULT tag=97 err=0 text= > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 469902 local4.debug] conn=12479 op=2 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=2 filter="(objectClass=posixAccount)" > Jul 20 11:42:43 ldapserver slapd[9053]: [ID 744844 local4.debug] conn=12479 op=2 SRCH attr=uid userpassword uidnumber gidnumber gecos homedirectory loginshell > Jul 20 11:43:00 ldapserver slapd[9053]: [ID 485650 local4.debug] conn=12479 fd=79 closed (writetimeout) I don't have the writetimeout keyword configured on any of the boxes and the affected script doesn't do any writes anyway. Also, the problem only seems to arise if the client takes a while to process a search result. The failing scripts are Net::LDAP based Perl scripts running on some old SPARC boxes, so it took them up to half a minute and more to complete. Setting writetimeout to a high enough value seems solve the problem, but referring to the docs, this shouldn't happen with the keyword unset or set to 0. Is this a bug or did I miss something? Did anyone else encounter this so far? Regards, Christian Manal

2 1

how to uninstall openldap
by mukim pathan 20 Jul '09

20 Jul '09

Hi, I wish uninstall openldap-2.4.16 from my linux system and install it again. I tried uninstalling it using make uninstall but it's not working. Can you please tell me how to uninstall openldap?? Regards, Mukim Pathan

2 1

Extend Schema correctly
by Techie 17 Jul '09

17 Jul '09

Hello List, I want to correctly extend schema but I have a question regarding the OID assignment of the custom objectClass and attributes I have created. I want to know if the OID number is absolutely necessary and if I do not use an OID number, what are the repercussions if any. For example will it cause any issues say with syncing with Active Directory or any other directory down the line if I go that route , I created a custom schema extension file to extend my schema so I can associate server names containing resources to my user accounts in LDAP. This schema file has a single auxiliary objectClasses entry and three (MAY) attributeTypes entries. I added the schema file to my Directory with schema checking on and it starts up correctly. I can add this objectClass and the 3 associated attributes to any account in my directory with no issue. I have not assigned an OID to these entries only names. Does this mean the OID is not necessary? Is there a suggested base OID I can use without requesting a company specific OID from IANA? Would be for for inter company use only. My company has an OID name space through IANA but the people that managed that are long gone and I do not want to overlap anything or cause issues. So basically I am looking to give this object class and associated attributes OID numeric assignments and am unsure how to do that. Thank you

1 0

syncrepl configuration possibilities
by Laurence Field 15 Jul '09

15 Jul '09

Hi, I am investigating the use of syncrepl to improve the efficiency of the transport mechanism that we are currently using in a world-wide distributed OpenLDAP deployment. If LDAP server A has information under "cn=my_resource,dc=example,dc=com" is it possible to replicate this information to LDAP server B but slightly modify the DN so that this becomes a sub tree of a larger tree eg. "cn=my_resource,cn=my_group,dc=example,dc=com"? Alternative suggestions are welcome and I would be happy to explain what we are trying to do in more detail if anyone is interested. Thanks, Laurence

2 3

auth works with cn=My Name but not with uid=myname
by Arne Schirmacher 15 Jul '09

15 Jul '09

This is probably trivial but I can't figure it out: my OpenLDAP entry has an attribute of cn=My Name, an attribute of uid=myname and a password. I can successfully log in using JXplorer using cn=My Name,ou=people,o=my company but not using uid=myname,ou=people,o=my company (error code 49 - Invalid Credentials) However searching with that dn is successful and returns 1 entry, so the uid attribute is in fact there. Please advise how I could enable the second login method which I need for exim authentication. Thanks!

3 2

Re: Multi master topology.
by Gavin Henry 14 Jul '09

14 Jul '09

----- "Alejandro Leyva" <alex.leyva(a)gmail.com> wrote: > Hi all. > > We are implementing a solution with multi master LDAP, we have 11 > instances at different locations, and maybe we will grow to 21 or 31 > instances before the end of the year, expecting to hold something > like > 200,000 or 300,000 user entries. What topology would be the best? > Right now each server synch to all the other servers, is it possible > to configure each server to synch only to a central LDAP? is it > convenient? Then that is not Multi-Master, but normal Provider/Consumer replication. Depending on your client requirements for writing, you may be better served using MirrorMode and numerous consumers/slaves with the chaining overlay to push writes back to the master. This would be simpler for monitoring write propagation. See the diagram here http://www.openldap.org/doc/admin24/replication.html#MirrorMode -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 2

slapd proxy
by Sergio Cioban Filho 13 Jul '09

13 Jul '09

Hi all, I'm trying to configurate an OpenLdap proxy for high availability, with ldap backend. My problem is the timeout. When the first server in URI is gone down, my ldapsearch delay 3 minutes, how do I change this timeout? Server 192.168.166.171 UP TIME: real 0m0.036s user 0m0.002s sys 0m0.003s Server 192.168.166.171 DOWN TIME: real 3m8.957s user 0m0.003s sys 0m0.004s I want the ldap-proxy immediately redirect the ldapsearch to the server 192.168.166.172 when server 192.168.166.172 gone down. My back-ldap configuration:* database ldap suffix "dc=digitro,dc=com,dc=br" rootdn "cn=axs,dc=digitro,dc=com,dc=br" uri "ldap://192.168.166.171/ ldap://192.168.166.172/" conn-ttl 0 idle-timeout 0 timeout 1 * Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

1 0

syncrepl randomly failing to sync
by Jay Christopherson 13 Jul '09

13 Jul '09

Hi- First of all, I hope I am not rehashing a topic that has been endlessly discussed. I know that syncrepl gets discussed a lot from my searches, but I have not found a specific topic on my issue. I started out with OpenLDAP 2.3, with a single provider and two consumers doing syncrepl using a refreshAndPersist type of replication. Periodically, I would see that one or more of the consumers would fail to synchronize a change made to the provider. A restart of the consumer would fix this and we could move on. It was annoying, but not critical at this point. Since then, I have become more dependent on OpenLDAP and syncrepl. I have upgraded to 2.4 to try to fix the replication issue, but it seems worse than ever. I now have one provider and six consumers. The consumers randomly fail to synchronize (as evidences by contextCSN monitoring). This happens several times a day. I'm thinking that maybe there is something wrong with my configuratiuon. This is what I am using: Provider: overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replica,o=users,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Consumers (all consumers have the exact same config): syncrepl rid=123 provider=ldap://ldap.sea.corp.domain.com:389 binddn="uid=replica,o=users,dc=domain,dc=com" bindmethod=simple retry="10 +" credentials=secret searchbase="dc=domain,dc=com" schemachecking=off type=refreshAndPersist interval=00:00:00:05 updateref ldap://ldap.sea.corp.domain.com A few "weird" things: * After the upgrade, I notice that the Directory Type on the Root DSE is still OpenLDAP 2.3 * I notice that where previously I could simple create a new consumer by installing a fresh copy of openldap, copying the config from another consumer over, and starting up to get a full copy of the directoy, it now fails to completely replicate and I have to do a full slapcat/slapadd to do the initial population. Like I said, I hope it's just something stupid I am doing...

3 2

Problem with unusual tree structure ...
by Garry Glendown 11 Jul '09

11 Jul '09

Hi, I'm trying to authenticate users against an LDAP database ... now, I already have that running on several servers that use the "normal" tree setup, something like "cn=username,ou=somebranch,ou=domain,ou=tld", with a search_base of ou=domain,ou=tld. The place I'm trying to configure it for now is using a - AFAICT - rather unusal schema, as they have a tree that uses multiple top level o=, and start underneath there, so there may by user entries like cn=user1,ou=USERS,o=branch1 and cn=user2,ou=USERS,o=branch2 (historically, ldap trees from several locations were just merged together, which led to this) How can I get SASL to search in such a configuration? I already tried a "ou=USERS,o=*" syntax, which I didn't expect to work (and it didn't) Also, I know that saslauthd or other apps will need to check the resulting username/pw, so I tried binding with the DN and PW of an account, resulting in a "Confidentiality required" ... using ldaps:// notation didn't work, as the remote server (Novell eDirectory) probably isn't configured for that, and -Z for TLS also fails with ldap_start_tls: Server is unavailable (52) additional info: TLS services are not available >From what I can find, the message should come up if the server is configured for requiring secure queries, but then I would expect it to also be configured to SUPPORT either one of the methods ... Help appreciated, -garry

1 0

Multi master topology.
by Alejandro Leyva 11 Jul '09

11 Jul '09

Hi all. We are implementing a solution with multi master LDAP, we have 11 instances at different locations, and maybe we will grow to 21 or 31 instances before the end of the year, expecting to hold something like 200,000 or 300,000 user entries. What topology would be the best? Right now each server synch to all the other servers, is it possible to configure each server to synch only to a central LDAP? is it convenient? Thanks in advance.

1 0

bindmethod and credentials in slurpd replication.
by Sai 10 Jul '09

10 Jul '09

Hi All - Our server team does not want to update our openldap version beyond 2.2 because redhat supports 2.2 as the latest and greatest for RHEL4. So I am trying to configure slurpd replication for them. I got the replication to work. But when defining "replica", I got the following questions. 1) For credentials, can I use hashed password like for rootpw 2) If we could use hashed password, what should the bindmethod be? replica uri=<URL> binddn=<Bind DN> bindmethod=simple --> ??? credentials=XXXXXXXXX Thanks in advance. -Sai

3 5

ldapmodify is modifying my code
by Darryl Moore 10 Jul '09

10 Jul '09

HELP I've been able to replace nis.schema with rfc2307bis.schema so that I can have groups with both member and memberUID attributes. when I try using ldapmodify to add members to the group such as: echo "dn: cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid=newuser1,ou=People,dc=moores,dc=ca" | /usr/bin/ldapmodify -v -y /etc/ldap.secret -D cn=admin,dc=moores,dc=ca -xH ldap://localhost it returns the following error message: ldap_initialize( ldap://localhost:389/??base ) modifying entry "cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid=newuser1,ou=People,dc=moores,dc=ca" ldap_modify: No such object (32) matched DN: ou=People,dc=moores,dc=ca The group and the user both exist. What is most interesting is that ldapmodify appears to modify my request because slapd itself gives this message: hdb_referrals: tag=102 target="cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid\3Dnewuser1,ou=People,dc=moores,dc=ca" matched="ou=People,dc=moores,dc=ca" bdb_dn2entry("cn=newgrou1,ou=groups,dc=moores,dc=ca changetype: modify add: memberuid memberuid: newuser1 replace: member member: uid\3Dnewuser1,ou=people,dc=moores,dc=ca") => hdb_dn2id("dc=ca changetype: modify add: memberuid memberuid: newuser1 replace: member member: uid\3Dnewuser1,ou=people,dc=moores,dc=ca") <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) notice that the "uid=newuser" part of my request has been changed to "uid\3Dnewuser". I've tried a number of different combinations and it appears to me that the first '=' is always replace with \3D and then the silly thing tries to look up that element, and low and behold it does not exist. If I can make this work, then I think I will have group permissions for unix groups working on LDAP. Does anybody have any idea why ldapmodify would be doing this??????

3 6

integrate motd on openldap
by Alejandro Feijoo Fraga 10 Jul '09

10 Jul '09

Hi. i have a large number of users... from diferent language (spanish,english,etc...) all under the same ldap directory and i need change de /etc/motd if user speak spanish or english. I not found info if ldap can do that, i think put a new entry at ldap (like lenguage:es/en/ga/..) and de /etc/bashrc or similar make a if and compare that entry... any diferent idea? or any method more easy? thanks!

2 1

Re: slapd + tls problem
by Alessandro Baggi 10 Jul '09

10 Jul '09

Gavin Henry wrote: > > # openssl req -newkey rsa:1024 -nodes -keyout key.pem -out > >> newreq.pem /*for server/client certificate building and >> sing*/ >> # /usr/lib/ssl/misc/CA.pl -sign >> >> I've tried using only openssl with slapd and all work very good, but not >> with GnuTLS. My system is Debian Lenny. >> >> > > What version of OpenLDAP? > > > Hi there. The problem was solved. It works fine with tls, the problem was that TLS works on port 389 not 636 (ldaps). This is the first time for me to use openldap with gnutls support. With OpenSSL works very good. Then, there was an configuration mismatch. Thanks

1 0

Query several LDAP servers
by tmp123＠menta.net 10 Jul '09

10 Jul '09

Hello, Please, are you so kind of provide me a hint about how to configure or develop the following feature?: A proxy LDAP, like the ones with slapd-ldap, must forward all received queries to a LDAP server1. If this server contains the requested item, the answer is send backward and handling stops. If the server doesn't contains the requested item, the query must be sent to a second LDAP server2. In the worst case, a maximum of 5 different servers should be queried in sequence. Initially, any server can contain any item. Nowadays, there are no tree estructure. Thanks a lot.

1 0

Solaris LDAP Mapping
by Matthew.GARRETT＠external.total.com 09 Jul '09

09 Jul '09

Folks I hope this is the right list for this. I am trying to get our Solaris Machine use LDAP for automounts. Under Solaris the file I would normally change is /var/ldap/ldap_client_file for Solaris using Ldap Version 2.0 But I am not 100% sure what I need to get LDAP automount to work. The OpenLdap Server has the following entries dn: ou=auto.apps,dc=unix,dc=total objectClass: top objectClass: automountMap ou: auto.apps A typical Map entry is dn: cn=acrobat,ou=auto.apps,dc=unix,dc=total objectClass: automount cn: acrobat automountInformation: uk-abz-vgl:/apps/acrobat Can anybody suggest suitable entries for the above ? Thanks Matthew Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

2 1

replicating cn=config
by Matthew Edlefsen 09 Jul '09

09 Jul '09

Hi, I've been trying to use syncrepl to replicate my cn=config tree and have been running into some issues. After running into a number of things not working I completely stripped everything down and attempted to follow test049 by building it from scratch. I've gotten it to work by running two instances of slapd on the same machine, on both machines, but I still can't get it to work between the two machines. System info Provider: FreeBSD 7.1-PRERELEASE FreeBSD 7.1-PRERELEASE #0: Sat Nov 15 18:38:32 EST 2008 OpenLDAP 2.4.16 Consumer: FreeBSD 7.2-STABLE FreeBSD 7.2-STABLE #1: Mon Jun 1 12:29:14 EDT 2009 OpenLDAP 2.4.16 My process is this: First I create slapd.d directories for both servers and populate them with a basic config mkdir slapd.d slapadd -n 0 -F slapd.d <<END dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: Trace olcLogLevel: Config olcLogLevel: Stats olcLogLevel: Sync olcLogLevel: Args olcLogLevel: Conns dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcRootDN: $MANAGER olcRootPW: $CONFIGPW olcDatabase: {0}config dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov END chown -R ldap:ldap slapd.d Then I launch slapd with: /usr/local/libexec/slapd -h $URI -u ldap -g ldap on both machines. At this point I can do ldapsearch on both servers and get back the correct results. I then do: ldapmodify -D "$MANAGER" -x -w "$CONFIGPW" <<END dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$PROVIDER_URI binddn="$MANAGER" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="3 5 300 5" timeout=3 - add: olcUpdateRef olcUpdateRef: $PROVIDER_URI END At this point I start logging the same error over and over. Here are the log messages I get: Consumer: Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: >>> dnPrettyNormal: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPrettyNormal: <cn=config>, <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=subschema> Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 3 19:55:35 jet slapd[51003]: dn_callback : entries have identical CSN cn=config 20090603203325.264042Z#000000#000#000000 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=0 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_search (0) Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 cn=config Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 entry unchanged, ignored (cn=config) Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrepl rid=001 Jun 3 19:55:35 jet slapd[51003]: =>do_syncrep2 rid=001 Jun 3 19:55:35 jet slapd[51003]: >>> dnPrettyNormal: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPrettyNormal: <cn=schema,cn=config>, <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=schema,cn=config> Jun 3 19:55:35 jet slapd[51003]: >>> dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnPretty: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: >>> dnNormalize: <cn=Subschema> Jun 3 19:55:35 jet slapd[51003]: <<< dnNormalize: <cn=subschema> Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=0 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_search (0) Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 cn=schema,cn=config Jun 3 19:55:35 jet slapd[51003]: conn=-1 op=0: config_add_internal: DN="cn=schema,cn=config" already exists Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=68 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_add cn=schema,cn=config (68) Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=0 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: conn=-1 op=0 p=0 Jun 3 19:55:35 jet slapd[51003]: send_ldap_result: err=1 matched="" text="" Jun 3 19:55:35 jet slapd[51003]: null_callback : error code 0x1 Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_modify cn=schema,cn=config (1) Jun 3 19:55:35 jet slapd[51003]: syncrepl_entry: rid=001 be_modify failed (1) Jun 3 19:55:35 jet slapd[51003]: connection_get(7) Jun 3 19:55:35 jet slapd[51003]: connection_get(7): got connid=0 Jun 3 19:55:35 jet slapd[51003]: do_syncrepl: rid=001 rc 1 retrying (4 retries left) Provider: Jun 3 17:02:36 rock slapd[75268]: slap_listener_activate(6): Jun 3 17:02:36 rock slapd[75268]: >>> slap_listener($PROV_URI) Jun 3 17:02:36 rock slapd[75268]: conn=391 fd=8 ACCEPT from IP=$CONS_IP:56003 (IP=$PROV_IP:389) Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_read(8): checking for input on id=391 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 do_bind Jun 3 17:02:36 rock slapd[75268]: >>> dnPrettyNormal: <cn=manager,cn=config> Jun 3 17:02:36 rock slapd[75268]: <<< dnPrettyNormal: <cn=manager,cn=config>, <cn=manager,cn=config> Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 BIND dn="cn=manager,cn=config" method=128 Jun 3 17:02:36 rock slapd[75268]: do_bind: version=3 dn="cn=manager,cn=config" method=128 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 BIND dn="cn=manager,cn=config" mech=SIMPLE ssf=0 Jun 3 17:02:36 rock slapd[75268]: do_bind: v3 bind: "cn=manager,cn=config" to "cn=manager,cn=config" Jun 3 17:02:36 rock slapd[75268]: send_ldap_result: conn=391 op=0 p=3 Jun 3 17:02:36 rock slapd[75268]: send_ldap_response: msgid=1 tag=97 err=0 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=0 RESULT tag=97 err=0 text= Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_read(8): checking for input on id=391 Jun 3 17:02:36 rock slapd[75268]: conn=391 op=1 do_search Jun 3 17:02:36 rock slapd[75268]: >>> dnPrettyNormal: <cn=config> Jun 3 17:02:36 rock slapd[75268]: <<< dnPrettyNormal: <cn=config>, <cn=config> Jun 3 17:02:36 rock slapd[75268]: => get_ctrls Jun 3 17:02:36 rock slapd[75268]: => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) Jun 3 17:02:36 rock slapd[75268]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) Jun 3 17:02:36 rock slapd[75268]: <= get_ctrls: n=2 rc=0 err="" Jun 3 17:02:36 rock slapd[75268]: conn=391 op=1 SRCH base="cn=config" scope=2 deref=0 filter="(objectClass=*)" Jun 3 17:02:36 rock slapd[75268]: conn=391 op=1 SRCH attr=* + Jun 3 17:02:36 rock slapd[75268]: send_ldap_result: conn=391 op=1 p=3 Jun 3 17:02:36 rock last message repeated 2 times Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_write(8): waking output for id=391 Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={0}core,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_write(8): waking output for id=391 Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={1}cosine,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_write(8): waking output for id=391 Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={2}inetorgperson,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="cn={3}nis,cn=schema,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="olcDatabase={-1}frontend,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="olcDatabase={0}config,cn=config" Jun 3 17:02:36 rock slapd[75/: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: => send_search_entry: conn 391 dn="olcOverlay={0}syncprov,olcDatabase={0}config,cn=config" Jun 3 17:02:36 rock slapd[75268]: <= send_search_entry: conn 391 exit. Jun 3 17:02:36 rock slapd[75268]: send_ldap_result: conn=391 op=1 p=3 Jun 3 17:02:36 rock slapd[75268]: send_ldap_intermediate: err=0 oid=1.3.6.1.4.1.4203.1.9.1.4 len=56 Jun 3 17:02:36 rock slapd[75268]: send_ldap_response: msgid=2 tag=121 err=0 Jun 3 17:02:36 rock slapd[75268]: connection_get(8): got connid=391 Jun 3 17:02:36 rock slapd[75268]: connection_read(8): checking for input on id=391 Jun 3 17:02:36 rock slapd[75268]: ber_get_next on fd 8 failed errno=0 (Undefined error: 0) Jun 3 17:02:36 rock slapd[75268]: conn=391 op=2 do_unbind Jun 3 17:02:36 rock slapd[75268]: conn=391 op=2 UNBIND Jun 3 17:02:36 rock slapd[75268]: connection_close: conn=391 sd=8 Jun 3 17:02:36 rock slapd[75268]: conn=391 fd=8 closed As I said it works perfectly if it's two slapd instances on the same machine on different ports. The machines can talk to each other and can both ldapsearch the other one. Also the firewall is reporting no blocks. If anybody has seen this before or has some insight into what the problem might be it would be very much apprectiated. Thank you in advance, Matt Edlefsen Earlham College

2 1

LDAP Access controls
by Darryl Moore 09 Jul '09

09 Jul '09

Hi all, I've installed a LDAP server on my network against which all my users can authenticate. They can even change their passwords via GUI or CLI without any issue. What I am trying to do now is allow each one of them to have an address book in their subtree. I created a subtree in each authentication relm that looks like this ou=Contacts,uid=user,ou=People,dc=domain,dc=ca Their is no problem with the rootdn adding entries below this, but I am unable to get the user to be able to. In fact I can't seem to allow the user to write anywhere. Even with the lone access rule: access to * by * write in the /etc/ldap/ldap.conf file (and yes I restart slapd everytime I change this file) I beleive the correct access rule for what I want is: access to dn.children="ou=People,dc=domain,dc=ca" by self write but that doesn't work either and I figured I'd ruduce the number of unknowns by trying to give global write permission first. A commandline test to create an entry yields this result: darryl@bison:~$ ldapadd -w ${NETPASS} -x -D "uid=darryl,ou=People,dc=domain,dc=ca" -f ~/tmp adding new entry "cn=test_test1,ou=Contacts,uid=darryl,ou=People,dc=domain,dc=ca" ldap_add: Insufficient access (50) additional info: no write access to parent ~/tmp looks like this: dn: cn=test_test1,ou=Contacts,uid=darryl,ou=People,dc=domain,dc=ca cn: test_test1 objectClass: inetOrgPerson sn: testestestets It's not an authentication issue because if NETPASS is wrong it returns: ldap_bind: Invalid credentials (49) Anyone have any ideas? There must be somthing simple I am missing, but I'm stumped! cheers, darryl

2 8

Delete operation is delayed...
by Bad Guy 09 Jul '09

09 Jul '09

Dear all, I have a 4 way Multi-master LDAP synchronization version 2.4.11 configured to run in refreshonly mode, config is below : # syncrepl directives syncrepl rid=001 provider=ldap://ldap01 bindmethod=simple binddn="cn=Manager" credentials=xxxxx searchbase="o=ABCDE" schemachecking=off type=refreshOnly interval="00:00:00:30" attrs="*,+" retry="5 5 300 +" #syncrepl rid=002 # provider=ldap://ldap02 # bindmethod=simple # binddn="cn=Manager" # credentials=xxxxx # searchbase="o=ABCDE" # schemachecking=off # type=refreshOnly # interval="00:00:00:30" # attrs="*,+" # retry="5 5 300 +" syncrepl rid=003 provider=ldap://ldap03 bindmethod=simple binddn="cn=Manager" credentials=xxxxx searchbase="o=ABCDE" schemachecking=off type=refreshOnly interval="00:00:00:30" attrs="*,+" retry="5 5 300 +" syncrepl rid=004 provider=ldap://ldap04 bindmethod=simple binddn="cn=Manager" credentials=xxxxx searchbase="o=ABCDE" schemachecking=off type=refreshOnly interval="00:00:00:30" attrs="*,+" retry="5 5 300 +" #overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 16 idletimeout 0 cachesize 10000 checkpoint 256 15 We will do add/modify/delete operation daily and I have a script to check record by record of the sync status. From time to time, there is some records deleted in one of the LDAP server will not be replicated to the other servers occasionaly. But it will eventually deleted after long random time. (may be 1-2 days) Any idea ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

5 11

syncrepl consumer process
by Allan Lyons 09 Jul '09

09 Jul '09

Hi, I'm looking at developing a simple internal app that is supposed to do things based on changes to our directory. One solution would be to periodically poll the directory. A seemingly better solution would be to have some client watch for changes using the refreshAndPersist mode of syncrepl. Does anyone know of any example code that connects to the directory as a syncrepl consumer? Python examples would be preferred. Thanks, Allan.

2 2

Max number of attributes in entry
by Patric 09 Jul '09

09 Jul '09

Hi all, I am attempting to add an entry to my directory with a large number of mail attributes. This works fine until I have more than 51 mail attributes. Any more than that and the add fails with the following: Error 80 - Unknown error What I find strange is that if I add the entry with up to 51 mail attributes, I can then go and add individual mail attributes to the existing entry. If I attempt to delete the entry when it has more than 51 mail attributes I get the same error: Error 80 - Unknown error But if I remove individual mail attributes until there are only 51 then I am able to remove the entire entry. Is there some limitation that I am not aware of, and could any body suggest a method for me to get around this? Any advice would be much appreciated! Regards, Patric

1 0

Checkpointing and syncrepl
by John Kane 08 Jul '09

08 Jul '09

I am a bit confused with the difference between the slapd.bdb 'checkpoint' option and the syncprov overlay option 'syncprov-checkpoint'. On the provider, will these basically do the same thing? If so, is there an advantage to using one over the other? Also, should we do checkpointing on the consumers as well? Thanks, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 1

Text files or text on OpenLdap
by Sergio Cioban Filho 08 Jul '09

08 Jul '09

Hi all, How I do to store text files or text on OpenLdap? I'm trying with octetString, but the line termination do not respected. I want store openssh Keys (Public and Private) on OpenLdap. ** Sorry for my por english.. ;) Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

2 1

Openldap 2.3 syncrepl filter problem
by Lanfeust troy 08 Jul '09

08 Jul '09

Hi list, In configuration of provider and consumer server with syncrepl is possible to modify the replication filter for add new user in replica. In fisrt time the replica is : syncrepl rid=123 provider=ldap://rh-test3.kvm.rla:389 type=refreshOnly interval=00:00:01:00 retry="30 10 600 20" searchbase="dc=local" filter="(|(objectClass=sambaGroupMapping)(uid=user1))" scope=sub schemachecking=off bindmethod=simple binddn="uid=syncrepl,ou=sysusers,dc=local" credentials=pwdsyncrepl # BEGIN Session TLS starttls="critical" tls_cacert=__CACERTFILE__ # End Session TLS When start the replica server it doing an ldapsearch and retrieve my data in replica. So now we modify the filter as the following : filter="(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Now when the replica doing the ldapsearch request it do with the new filter but returning numentrie to 0 like this in the log of master LDAP server: Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=1 BIND dn="uid=syncrepl,ou=sysusers,dc=local" mech=SIMPLE ssf=0 Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=1 RESULT tag=97 err=0 text= Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=2 SRCH base="dc=local" scope=2 deref=0 filter="(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=2 SRCH attr=* + Jun 24 22:40:40 rh-test3 slapd[28012]: conn=83 op=2 SEARCH RESULT tag=101 err=0 *nentries=0* text= And when i do ldapsearch manually : ldapsearch -x -b dc=local -H ldap://rh-test3.kvm.rla "(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=1 BIND dn="" method=128 Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=1 RESULT tag=97 err=0 text= Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=2 SRCH base="dc=local" scope=2 deref=0 filter="(|(objectClass=sambaGroupMapping)(uid=user1)(uid=user2))" Jun 24 23:40:38 rh-test3 slapd[28012]: conn=133 op=2 SEARCH RESULT tag=101 err=0 *nentries=13* text= I don't understand why my new user is not sync !! thanks for your help,

2 1

Maximum uidNumber (posix / ldap).
by Alejandro Leyva 08 Jul '09

08 Jul '09

Hi all, we are looking at the maximum uidNumber, we need to know the maximum allowed uidNumber for LDAP / POSIX accounts. The schema definition for uidNumber says that it is defined with syntax 1.3.6.1.4.1.1466.115.121.1.27, which is an LDAP number / integer, in http://www.zytrax.com/books/ldap/apa/types.html#numbers the range is defined as 2,147,483,648 to 2,147,483,647, did somebody know if this range is common to LDAP and POSIX? Could we have a user with uidNumber 2,147,483,646 without any problem? Thanks in advance.

2 2

slapd-ldap proxy
by Sergio Cioban Filho 07 Jul '09

07 Jul '09

Hi all, I'm trying to configurate an OpenLdap proxy for high availability, with ldap backend. My problem is the timeout. When the first server in URI is gone down, my ldapsearch delay 3 minutes, how do I change this timeout? Server 192.168.166.171 UP TIME: real 0m0.036s user 0m0.002s sys 0m0.003s Server 192.168.166.171 DOWN TIME: real 3m8.957s user 0m0.003s sys 0m0.004s I want the ldap-proxy immediately redirect the ldapsearch to the server 192.168.166.172 when server 192.168.166.172 gone down. My back-ldap configuration:* database ldap suffix "dc=digitro,dc=com,dc=br" rootdn "cn=axs,dc=digitro,dc=com,dc=br" uri "ldap://192.168.166.171/ ldap://192.168.166.172/" conn-ttl 0 idle-timeout 0 timeout 1 * Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

1 0

Ubuntu Jaunty Certificate Issue Solved
by gruntler-ldap＠yahoo.com 07 Jul '09

07 Jul '09

Hi, Ubuntu distributes a patched version of GNUtls 2.6.x. Run: gnutls-cli -VV --print-cert -p 636 my-ldap-server.com 2>&1 | egrep 'RSA-MD5|warning' See no output. Using "-d 4711" instead of "-VV" doesn't show any problems either. Download the real GNUtls 2.8.1 and build it and try again: Run: /opt/gnutls/bin/gnutls-cli -VV --print-cert -p 636 my-ldap-server.com 2>&1 | egrep 'RSA-MD5|warning' Signature Algorithm: RSA-MD5 warning: signed using a broken signature algorithm that can be forged. Note that the CA cert is secure, it's the LDAP server's cert that was weak. -Ken

1 0

Virtual List View
by Patrick Patterson 07 Jul '09

07 Jul '09

Hello All: I am trying to debug a problem with an Outlook 2003 client querying an OpenLDAP 2.4.11 server. The Outlook client is returning from the lookup with an "unavailable critical extension" error. Looking at : http://support.microsoft.com/default.aspx?scid=kb;en-us;555536&sd=rss&spid=… It appears that Outlook may be trying to perform a search using the Virtual List View extension. Since this is on a large corporate network, I am loath to just apply the registry fix to every workstation as suggested by the Microsoft KB article, if there is a way to either enable or configure this extension on the server. Is this extension supported on OpenLDAP? Thanks. -- Personal Mail from Patrick Patterson No company affiliation

2 1

OpenLDAP as an anonymous bind proxy for Active Directory
by jjeffery＠sp.com.au 07 Jul '09

07 Jul '09

I have been attempting to configure openldap to act as a proxy for our corporate Active Directory installation. The idea is, of course, that users of linux workstations can use their AD credentials. While we are also experimenting with AD integration using winbind, we also want the option to use standard LDAP, as it means that the linux workstations do not have to be joined to the Active Directory domain. Many previous posts on this forum have been most helpful, (as have posts to the openldap-software list), and I have our setup working, but there is one strange problem. I prefer that our linux workstations can connect to the openldap anonymously, as it means we do not have to have credentials stored in /etc/ldap.conf. This should not be a problem as our openldap proxy can have credentials stored for connecting to the AD server. But what I find is that when I start the slapd, none of the linux workstations can connect until I first issue a query to the slapd using valid credentials. Eg: 1. Start slapd /usr/local/libexec/slapd 2. Linux workstations cannot bind anonymously 3. Issue query against slapd /usr/bin/ldapsearch -H ldap://localhost \ -D "cn=someuser,ou=Accounts,dc=example,dc=com" \ -w "secret" -x -s base "(objectclass=*)" namingContext 4. Linux workstations can now bind anonymously Although there is the obvious work-around that after starting the slapd, we issue the query above, I would kind of like to know why this is happening. Maybe there is a better way? I am using openldap 2.4.16, with ldap and bdb backends, and all overlays. Operating system is CentOS 5. Any pointers on how to improve my config would be most welcome. My slapd.conf: ==== BEGIN slapd.conf ==== include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel 256 monitoring on defaultsearchbase "dc=example,dc=com" database ldap suffix "dc=example,dc=com" uri "ldap://adserver.example.com" # Not sure why, but when this is not set, the JDK LDAP browser # will not connect anonymously about one time in four. chase-referrals no # If this is not set, the user cannot connect anonymously. # The first connection must be bound, but subsequent connections can # be anonymous. (More investigation required) rebind-as-user yes acl-bind bindmethod=simple binddn="cn=username,ou=Accounts,dc=example,dc=com" credentials="secret" idassert-bind bindmethod=simple binddn="cn=username,ou=Accounts,dc=example,dc=com" credentials="secret" mode=none flags=non-prescriptive overlay rwm # Because posixAccount does not exist in the Active Directory schema, we need # to map to an objectclass that does exist. We could use user, but at this # time we don't have a schema for the AD 'user' objectclass. It just happens # that organizationalPerson is defined in our AD. rwm-map objectclass posixAccount organizationalPerson rwm-map attribute homeDirectory unixHomeDirectory access to dn.subtree="dc=example,dc=com" by * read ==== END slapd.conf ====

1 0

Unable to retrieve the authFilterId attribute from the openldap server
by Navin 06 Jul '09

06 Jul '09

Hi, I am new to LDAP. Hence kindly do excuse if any of my terminology is different. Issue: ----- I installed the openldap server through debian package. ie. did NOT get the source. Was able to add the record and display them. ie. the slaptest worked fine and also could able to search the database with ldapsearch command also. Also able to start and stop the daemon. But i am having an issue regarding the retrieval of authFilterId attribute stored in the LDAP database. Is authFilterId and FilterId attribute same?? Tried to retrieve both of them but unable to get the values of the attribute. Added a schema by name auth.schema in the slapd.conf. This file was not present in the default installation of the openldap. The below are the details of the configuration: openldap server version: OpenLDAP: slapd 2.4.9 Operating System: Ubuntu 8.04 slapd.conf: # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema #auth.schema added by me. Did not get installed by default include /etc/ldap/schema/auth.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel none # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=example,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=example,dc=com" rootpw secret123 # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=nodomain" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=nodomain" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=nodomain" write # by dnattr=owner write ####################################################################### end of slapd.conf Auth.schema File Auth.schema: Manually included by me in the slapd.conf. This schema file added by me. It did not come in the default installation. This is required as my proprietary ldap client needs it. I am not sure of its exact use. but i guess its related to radius. attributetype ( 1.3.6.1.4.1.3317.4.3.1.9 NAME ( 'authFilterId' ) DESC 'radiusSchema: authFilterId' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) objectclass ( 2.16.840.1.113730.3.2.222 NAME 'auth' DESC 'Authentication database' SUP top STRUCTURAL MUST ( uid $ userPassword $ authFilterId)) ######################################################## end of auth.schema LDAP ldif file: init.ldif dn: dc=example,dc=com objectClass: dcObject objectClass: organizationalUnit dc: example ou: Example Dot Com dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: secret123 dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=fsmith,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile uid: fsmith sn: Smith givenName: Fred cn: Fred Smith displayName: Fred Smith uidNumber: 1001 gidNumber: 1001 userPassword: secret123 gecos: Fred Smith loginShell: /bin/bash homeDirectory: /home/fsmith shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: fsmith(a)example.com authFilterId: fsmith initials: FS Added the above records using the command: $ slapadd -l init.ldif Added successfully no errors on the command line. When i searched the database using the command $ ldapsearch -xLLL -b "dc=example,dc=com" '(objectclass=*)' I was able to see all the details present in the init.ldif file except the FilterId field: authFilterId: fsmith When i issue the command, $ ldapsearch -xLLL -b "dc=example,dc=com" '(objectclass=*)' '(authFilterId=*)' then also it does not display the authFilterId attribute. The slaptest when run in the debug level 16783 does not show any errors. The tail message of the slaptest o/p is: .... slaptest startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=module{0}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}nis" config_build_entry: "cn={3}inetorgperson" config_build_entry: "cn={4}auth" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}hdb" backend_startup_one: starting "dc=example,dc=com" hdb_db_open: "dc=example,dc=com" hdb_db_open: database "dc=example,dc=com": dbenv_open(/var/lib/ldap). config file testing succeeded slaptest shutdown: initiated ====> bdb_cache_release_all slaptest destroy: freeing system resources. Kindly do suggest of how to retrieve the authFilterId attribute value. have a nice day, navin

3 2

Max number of failed attempts to connect
by Sergiy Milko 06 Jul '09

06 Jul '09

Hi guys, Is anyone aware of a configuration parameter (in slapd.conf or OpenLDAP back-end database) that specifies a maximum number of unsuccessful attempts to connect to the LDAP before any further attempts are blocked? Is there a possibility to impose this logic at all? I am using JNDI library to bind to the LDAP using 'Simple' authentication. I would appreciate any related information! Many thanks! Sergiy

2 1

how to get the source of jldap
by owen nirvana 03 Jul '09

03 Jul '09

I can't login cvs of openldap-jdap by anonymous in cvsnt, and I have not account of openldap how to get the source of jldap gtalk:freeespeech@gmail.com

5 5

Re :Re: how to get the source of jldap
by Santosh Kumar 03 Jul '09

03 Jul '09

Cheers, Santosh Kumar Sr Software Engineer Cell:09881481468 Computers can never replace human stupidity.

1 0

Re: how to get the source of jldap
by Michael Ströder 03 Jul '09

03 Jul '09

Please stay on the mailing list (Cc:-ed again). owen nirvana wrote: > cvs -d :pserver@cvs.openldap.org:/repo/JLDAP login > or cvs -d :pserver@cvs.openldap.org:/repo/OpenLDAP-JLDAP login > password: OpenLDAP > > error : No Such Repository > gtalk:freeespeech@gmail.com What's the reason you don't do *exactly* what I've posted? Please have a closer look at the commands I sent since before answering your question I've spend my spare time to test it. Basically you're using the wrong CVSROOT. Ciao, Michael. >> 2009/7/3 Michael Ströder <michael(a)stroeder.com>: >>> owen nirvana wrote: >>>> I can't login cvs of openldap-jdap by anonymous in cvsnt, and I have >>>> not account of openldap >>>> >>>> how to get the source of jldap >>> The description on this web page works for me at least on Linux: >>> >>> http://www.openldap.org/software/repo.html#AnonCVS >>> >>> $ export CVSROOT=":pserver:anonymous@cvs.OpenLDAP.org:/repo/OpenLDAP" >>> $ cvs login >>> Password: (enter OpenLDAP) >>> $ cvs co openldap-jldap >>> >>> I don't have cvsnt though. Can you please elaborate on the specific >>> problem you see? Probably it's just a cvsnt usage issue. >>> >>> Ciao, Michael.

1 0

Proxying AD : troubles with the comma character
by Emmanuel Lesouef 03 Jul '09

03 Jul '09

Hello, I'm new to openldap's meta backend and I get a strange issue. I'm able to proxy active directory via openldap using meta backend. It works well except that in my user's DN, I have a comma character which is translated with the following "\2C". How can I handle that ? Thanks. -- Emmanuel Lesouef

3 4

Prb: UID Fields Over 7 Chars - add transaction hangs
by David.CTR.Muench＠faa.gov 02 Jul '09

02 Jul '09

All, I have a problem with a new OpenLDAP configuration that is likely my own doing, but I am unable to discern the cause. Environment: Solaris 9, OpenLDAP 2.4.16, Berkeley DB 4.7.25 I installed the OpenLDAP software from the stable release at the openldap.org site. After some basic configuration and very basic tests, I did the "full" slapd.conf and DB_CONFIG configurations using various resources, including the Admin Guide and the FAQ-o-matic. All seemed to be going well until I tried to add (ldapmodify -a w/ldif files) some new "person" entries based on data I want to migrate. The first one was OK, but subsequent ones never completed. When the problem occurs, there's no return from the ldapmodify command and likewise any "db_stat" commands that I attempt. When I look at the log (local4.debug) entries, the last entry is for the "ADD dn="uid=DCM...". The daemon is *not* looping, there's just never a response. [I need to break to get my prompt back.] When I attempt to stop the daemon, I get "waiting for 1 operations/tasks to finish" and I have to kill the daemon to get it to stop. When I restart, it goes through DB recovery and everything is as it was before the ldapmodify -a started. A colleague suggested something that seems to be an indicator: - an add of "dn: uid=DCM11,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM1123,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM11234,ou=People,o=USNS" does *not* work So it seems that "uid" values with lengths over 7 characters fail. Yeah, this seems plenty odd to me, but I've created\tested\deleted DBs multiple times over and this still happens consistently. I have tried multiple levels of "debug", down to "488" anyway, but still no message that seems like an error. Not wanting to swamp anyone, here's some basic config extracts: ===DB_CONFIG=== set_cachesize 0 67108864 1 set_lg_bsize 2097152 set_lg_max 10485760 set_lg_regionmax 262144 === ===slapd_t10.conf=== [obviously stripped] ... backend bdb database bdb suffix "o=XXXX" checkpoint 128 15 index objectClass eq index uid pres,eq [Have tried taking this out & re-creating - no difference] lastmod on monitoring on ... === Anyone have any ideas? I have spent many hours looking at this, but I'm willing to believe it's something simple I can't see. Thanks in advance for you help. DCM

4 7

Re: TLS init def ctx failed: -1
by gruntler-ldap＠yahoo.com 02 Jul '09

02 Jul '09

--- On Thu, 7/2/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: TLS init def ctx failed: -1 > To: "François Mehault" <Francois.Mehault(a)netplus.fr> > Cc: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Date: Thursday, July 2, 2009, 7:02 AM > François Mehault wrote: > > > > |*openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout > > server.pem -days 365*| > > This is a terrible way to generate a server certificate. > Instead you should generate a CA, following the steps in > (the current) section 4.2. What document is being referred to here? It can't be http://www.openldap.org/doc/admin/ because section 4.2. there is "Prerequisite software". Thanks, Ken

2 1

TLS init def ctx failed: -1
by François Mehault 02 Jul '09

02 Jul '09

Hi all I contact you because I don't succeed to configure my OpenLDAP with TLS. First I create self signed certificate server.pem like I read on this page http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#5.1.1 in /usr/local/etc/openldap/tls. openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 Then I add this line in slapd.conf : TLSCertificateFile /usr/local/etc/openldap/tls/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/tls/server.pem TLSCACertificateFile /usr/local/etc/opendldap/tls/server.pem TLSVerifyClient never Then I restart slapd. /usr/local/etc/rc.d/slapd stop , start. And in my /var/log/debug.log I have Jul 2 12:18:39 labobe2 slapd[97816]: main: TLS init def ctx failed: -1 Jul 2 12:18:39 labobe2 slapd[97816]: slapd destroy: freeing system resources. Jul 2 12:18:39 labobe2 slapd[97816]: syncinfo_free: rid=001 Jul 2 12:18:39 labobe2 slapd[97816]: slapd stopped. I use FreeBSD 7. If someone can help me, I appreciate, thanks in advance Regards, François

3 4

RE: monitor mirror mode
by François Mehault 02 Jul '09

02 Jul '09

Thanks for your response. ContextCSN seems perfect but, I try on my two OpenLDAP: <10:13>[labobe2:~]# ldapsearch -x -LLL -H ldap://openldapID1:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 <10:07>[labobe1:~]# ldapsearch -x -LLL -H ldap:// openldapID2:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 As you can see I have two results by request. And I have effectively the same result on each server. Can I conclude just with this results that the replication works well ? I though I would have one contextCSN for each request instead of two. Thanks for your help. Regards, François De : Gavin Henry [mailto:ghenry@OpenLDAP.org] Envoyé : vendredi 26 juin 2009 17:14 À : François Mehault Cc : openldap-technical(a)openldap.org Objet : Re: monitor mirror mode You can use: http://blog.suretecsystems.com/archives/146-OpenLDAP-Quick-Tips-Checking-th… ----- "François Mehault" <Francois.Mehault(a)netplus.fr> wrote: > > Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found
by Andreas Krummrich 01 Jul '09

01 Jul '09

Hi all, I'm running OpenLDAP 2.4.11 on a debian lenny box and it seems that I'm having trouble with the log files. I had a corrupt database some days ago and needed to restore the database from the backup. The log said: Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": unclean shutdown detected; attempting recovery. Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": dbenv_open(/var/lib/ldap). Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Ignoring log file: /var/lib/ldap/log.0000000005: magic number 0, not 40988 Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Invalid log file: log.0000000005: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de" cannot be recovered, err -30978. Restore from backup! Jun 28 01:16:59 old slapd[17374]: ====> bdb_cache_release_all Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 28 01:16:59 old slapd[17374]: bdb_db_close: database "dc=intern,dc=domain,dc=de": txn_checkpoint failed: Invalid argument (22). Jun 28 01:16:59 old slapd[17374]: backend_startup_one: bi_db_open failed! (-30978) So I installed a new OpenLDAP server with the same versions and the same configuration. The first thing what I found out was that db_archive has some trouble: On the new box I get the following results from db_archive: root@new:/var/lib/ldap# db4.2_archive -sa /var/lib/ldap/cn.bdb /var/lib/ldap/dn2id.bdb /var/lib/ldap/gidNumber.bdb /var/lib/ldap/givenName.bdb /var/lib/ldap/id2entry.bdb /var/lib/ldap/loginShell.bdb /var/lib/ldap/objectClass.bdb /var/lib/ldap/sn.bdb /var/lib/ldap/uid.bdb /var/lib/ldap/uidNumber.bdb root@new:/var/lib/ldap# db4.2_archive -la /var/lib/ldap/log.0000000001 root@new:/var/lib/ldap# Looks good so far. On the old box I get the following results (there are the same databases) root@new:/var/lib/ldap# db4.2_archive -sa root@new:/var/lib/ldap# db4.2_archive -la db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found root@new:/var/lib/ldap# I searched the archive and googled this message, but found nothing that fits my case. Hope that someone can give me a hint, solving this issue. Thanks and kind regards, Andreas

4 6

LDAP user cannot login
by Richard Gillman 01 Jul '09

01 Jul '09

Hi, I'm moving an LDAP server from one system to another. Data I copied using slapcat -l ldapdata; slapadd -c -q -l ldapdata on new system, then start ldap. But I can't log in as an ordinary user. I've tried resetting the user password using JXplorer, but no luck. Can anyone spot something wrong in what I'm trying to do? Suggestions appreciated. thanks in advance, Dick slapd.conf contains access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.exact="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.exact="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read slapd -d acl gives at startup (#) $OpenLDAP: slapd 2.3.43 (Jan 21 2009 03:59:37) $ mockbuild@builder10.centos.org:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd Backend ACL: access to attrs=SambaLMPassword,SambaNTPassword by dn.base="cn=manager,dc=nerc-sf,dc=ac,dc=uk" write by * none Backend ACL: access to dn.base="" by * read Backend ACL: access to dn.base="cn=subschema" by * read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword,sambaLMPassword,sambaNTPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="ou=admins,dc=nerc-sf,dc=ac,dc=uk" by dn.regex="cn=[^,]+,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by anonymous auth Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" by peername.ip="192.171.172.0%255.255.255.0" read by peername.ip="192.171.159.192%255.255.255.192" read by peername.ip="127.0.0.1" read => bdb_entry_get: found entry: "dc=nerc-sf,dc=ac,dc=uk" => access_allowed: search access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "entryCSN" requested <= root access granted slapd starting When I try to login, slapd gives => access_allowed: read access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "userPassword" requested => dn: [1] dc=nerc-sf,dc=ac,dc=uk => acl_get: [1] matched => acl_get: [1] attr userPassword access_allowed: no res from state (userPassword) => acl_mask: access to entry "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: anonymous <= acl_mask: [1] applying auth(=xd) (stop) <= acl_mask: [1] mask: auth(=xd) => access_allowed: read access denied by auth(=xd) send_search_entry: conn 1 access to attribute userPassword, value #0 not allowed -- Richard Gillman ITC UNIX Systems Group, Maclean Building, Wallingford OX10 8BB Tel: 01491 - 692 339 Fax: 01491 - 692 424

1 0

RE: MirrorMode VS load balancing
by Brett Maxfield 30 Jun '09

30 Jun '09

Yes simple is a good thing, but you have to decide for yourself what risk and downtime is acceptable, how long to recover and how many writes is acceptable to lose. E.g. Is a one daily backup acceptable for recovery (and you lose changes since then), or do you need every single write to the hour/minute ? The more continously/frequently you write to both nodes, the more likely are sync errors, and also less recoverability of your bdb logs in the event of catastrophic power failure or inproper shutdown. I dont think anyone can decide this for you.. You need to evaluate your level of risk and what loss / downtime is acceptable to you / your employer / your customers etc., Cheers Brett -----Original Message----- From: Hideo NAKAMITSU <nomo(a)bluecoara.net> Sent: Monday, 29 June 2009 11:51 AM To: openldap-technical(a)openldap.org Subject: Re: MirrorMode VS load balancing and how about 1write/sec, 10writes/sec, 50writes/sec, 100writes/sec... I want to know this threshold like, - if writes happen 0-5/sec, it's 99% safe (at the worst unlucky case, only 2writes at the same time may break something) - 6-50/sec, may safe or not. - more than 50/sec, danger.

5 4

ppolicy and syncrepl aclaration
by Jordi Espasa Clofent 30 Jun '09

30 Jun '09

Hi, According to http://www.openldap.org/lists/openldap-software/200701/msg00149.html, the "In general, ppolicy related state values are not replicated; each replica is on its own as far as state-related attributes in enforcing password policy." ¿Is it means that of I've one provider and two consumers, the changes made in ppolicy statements in provider are not sync againt the consumers as other kind entries/attributes are? I need to know because of I've change my userPassword in provider and: * I can use without problems the new password using the provider * I cannot use the new password against the two consumers. I use LVS balancer in front of the 3 openldap servers (one provider and two consumers), so it's important that ANY change made in provider will be always synced. -- Thanks, Jordi Espasa Clofent

3 5

openldap+sasl confusion
by Seau Yeen Su 30 Jun '09

30 Jun '09

Hi, I am trying to install OpenLdap with SASL. The version of openldap i installed is openldap-2.4.16 whereas the cyrus-sasl version installed is cyrus-sasl-2.1.23. The BerkeleyDB version installed is 4.4. I followed the guidance in this link to do the installation : http://tldp.org/HOWTO/LDAP-HOWTO/sasl.html However, when i tried to add users defined in ldif file, I received ldap_sasl_interactive_bind_s: Invalid credentials (49) error when i keyed in the password generated for admin using saslpasswd2 command. I have a few questions: 1. After using saslpasswd2 to create the username and password in sasl database, do i need to add the entry into ldap database with slappasswd command? When i used slapadd command and it prompts for password, does it authenticate against sasl database or ldap database? 2. Do i need to issue saslpasswd2 for each and every user that i want to add into ldap database and to be authenticated via ldap? 3. In the slapd.conf file, under rootpw, am i supposed to use the word "secret" or the cleartext password that i keyed in using saslpasswd2 or some encrypted password? 4. What is the difference between sasl-regexp and authz-regexp? 5. Let's say i issued saslpasswd2 -c admin to create admin as the LDAP administrator. Does this mean in the slapd.conf, the rootdn should be admin or can it be another name, that will be mapped via sasl-regexp/authz-regexp? (Which does it use anyway between these 2 : sasl-regexp & authz-regexp?) 6. Previously I set up without sasl and it was rather straightforward, merely using slappasswd and save the encyrpted pasword into slapd.conf. Now, i am totally lost with its concept. I do know that names in ldap database has to be mapped to the names in sasl database. Hopefully you can enlighten me on the whole concept and how the configuration should be done. Thank you. Hope to receive some advice and guidance. -- Warmest Regards, Seau Yeen

3 5

MirrorMode VS load balancing
by Hideo NAKAMITSU 29 Jun '09

29 Jun '09

Guys, I've already read this, and understand the difference between MirrorMode and Multi Master. http://www.openldap.org/doc/admin24/replication.html Actually, when I setup 2-nodes MirrorMode and add too much entries to both nodes, at the same time, sometimes both databases weren't syncrhonized correctly. (I made a script to add 10,000 entries, and run it on both nodes at the same time.) In this case, we shouldn't update both nodes at the same time. and of course this is already discribed in the document as following. -------------------------------------------------------- MirrorMode is not what is termed as a Multi-Master solution. This is because writes have to go to just one of the mirror nodes at a time -------------------------------------------------------- but on some cases(including my environment), UPDATE happens 3-10 times in a day. it's much less than SEARCH. in this case, I think we can just put loadbalancer, and enable "load balancing" and "redundancy" (I understand UPDATE isn't load balanced.) -------------------------------------------------------- CLIENT | SLB(RoundRobin) | +-----+ SRV1 SRV2 * MirrorMode is enabled on SRV1 and SRV2 -------------------------------------------------------- My question is, MirrorMode document says "writes have to go to just one of the mirror nodes at a time." but if the writes don't happen very often, I think "writes can be done on every nodes at a time." When I did some tests, it could be done. but I'm not sure developer's thoughts. How do you think guys ?

5 9

Re: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 29 Jun '09

29 Jun '09

> Hi ! > > We are trying to define (in our own ldap schema) an IA5String attribute > type that > is required to be managed (from our ldap clients) as "case insensitive" > > "greaterOrEqual" and "lessOrEqual" filters are required to be managed > over this > attribute, so we wanted to assigne (in its attribute type definition) an > ORDERING > matching requesting "case insensitive" behaviour > > According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO > any > ordering Matching Rule for IA5String syntax AND case insensitive support. > We > tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error > (at schema > loading) as attribute type syntax (IA5String) is not allowed for this > "ordering match rule" Correct. > We checked that defining the attribute as "PrintableString" works (as > "caseIgnoreOrderingMatch" > is a valid matching rule for that sysntax according to RFC4517) ... but we > are really interested in > IA5String syntax .... > > Does openLDAP server technolgy provide a "case insensitive ordering > match" method > for IA5String syntax ? No. It doesn't because there's no standard track definition for it. However, there's nothing preventing OpenLDAP software from supporting this non-standard track feature. Adding custom matching rules is relatively "trivial". p.

2 2

ldappasswd use for admin
by Gustavo Mendes de Carvalho 29 Jun '09

29 Jun '09

Hi there, Does anybody know which parameters to use in ldappasswd command when admin user (cn=admin,dc=domain,dc=com) has to reset user's password ? The situation is: LDAP user forgot his/her password and LDAP Admin has to reset it, allowing his/her to login and then to change his/her password. Thanks in advance --- Gustvo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 2

monitor mirror mode
by François Mehault 26 Jun '09

26 Jun '09

Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François

2 1

RE: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 26 Jun '09

26 Jun '09

> Hi ! > > OK ... we will check that approach. > > Do you know if it was something forgotten in the RFC4517 ?... it > sounds > really odd (to me) that PrintableString (that is a subset of IA5String) > and DirectoryString (that is a superset) are allowed syntaxis for > "caseIgnoreOrderingMatch" ... but IA5String is not allowed to use it > (maybe I am missunderstanding/mixing things ....???) I do not recall in detail, but this or something related should have already been discussed (I'd let others step in if they know the story in more detail). Basically, it should be something like the caseIgnore stuff for IA5 was absent in the RFC 225* series, and it was not added to the RFC 451* series because IA5 is essentially obsolete, directoryString should be used instead. p.

5 4

ldap auth from external application
by Zdenek Styblik 26 Jun '09

26 Jun '09

Hi, I'd like to ask why is auth from external applications like eg. ftp server done via proxy user, and not straight with user provided credentials. The only thing I came up with is that there is possible risk with hi-jacking session due to flaw in application, still- I'm missing the big picture here. Or return code 49 is not enough for failed auth? Could somebody, please, clarify this for me? I'm sure there are really good reasons no to so (straight auth), still I've "found" pros in not having additional user which is capable to read others (even hashed) passwords, and probably no need to be password hash dependent as whole auth would be LDAPs domain. Thanks, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 6

openldap search configuration
by mukim pathan 26 Jun '09

26 Jun '09

Hi, I am using openldap 2.4.16 with bdb-4.5. This database has to give response to around 200 search queries at a time. I wish to know what my configuration of ldap should be so that this search queries will be answered in milliseconds. Any help will be appreciated. Regards, Mukim Pathan

1 0

Case Ignore Ordering matching rule for IA5 String sysntax ?
by Antonio Alonso 25 Jun '09

25 Jun '09

Hi ! We are trying to define (in our own ldap schema) an IA5String attribute type that is required to be managed (from our ldap clients) as "case insensitive" "greaterOrEqual" and "lessOrEqual" filters are required to be managed over this attribute, so we wanted to assigne (in its attribute type definition) an ORDERING matching requesting "case insensitive" behaviour According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO any ordering Matching Rule for IA5String syntax AND case insensitive support. We tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error (at schema loading) as attribute type syntax (IA5String) is not allowed for this "ordering match rule" We checked that defining the attribute as "PrintableString" works (as "caseIgnoreOrderingMatch" is a valid matching rule for that sysntax according to RFC4517) ... but we are really interested in IA5String syntax .... Does openLDAP server technolgy provide a "case insensitive ordering match" method for IA5String syntax ? Thanks in advance BR / Antonio Antonio Alonso Alarcón CUDB System Engineer Ericsson España, S.A. Phone: +34 91 339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) (Millenium building, Fax: +34 91 339 1636 5th floor, B1 side, desk 61) 28033 Madrid, Spain E-mail: antonio.alonso(a)ericsson.com

1 0

Re: OpenLDAP Mirror Mode configuration
by Mathieu MILLET 25 Jun '09

25 Jun '09

On Thu, 25 Jun 2009 07:41:42 -0600, Matt Kassawara <battery(a)writeme.com> wrote: > I'm running mirror mode on a pair of VMs and haven't noticed any issues > with > replication. If you're using VMware ESX/ESXi 3.5, I recommend configuring > Linux guests with the kernel boot parameter "clocksource=acpi_pm" and > configuring VMware Tools to handle clock management in the guest. Verify > NTP isn't running in the guest. Also, making sure the Linux kernel > periodic > interrupt timer runs at 100 Hz instead of 250 or 1000 Hz can reduce timing > issues. VMware provides some documentation on best practices for > performance tuning I'd recommend reading. Yes, I have read these (but was using VM workstation). Also, My experimentation was during last summer 2008 and at the same period VMWare switch from "DO NOT USE NTP in Guest, instead VmwareTools" to "Use NTP" without any explanation ... The main trouble was when modifying on both side "too quickly". Other testings with differents applications show up that virtualization is no good for timing-picky application (but it is going off-topic ;) Thanks for the sharing. Sincerely yours, Mathieu. > On Thu, Jun 25, 2009 at 12:16 AM, Mathieu MILLET <ldap(a)htam.net> wrote: > >> On Tue, 23 Jun 2009 09:36:23 +0100, Fernando Silva >> <fernandolrsilva(a)gmail.com> wrote: >> > Hi all, >> >> Hi >> >> > I'm trying to setup a Mirror Mode configuration using 2 machines >> > running >> > OpenLDAP v2.4.11 on both. To make things easy both machines are on the >> > same (private) network. >> > >> > [snip] >> > mirrormode on >> > >> > I'm using Ubuntu 8.10 inside a VMWare image, but both images are >> > running >> > on independent machines and the network on both is Bridge Mode. >> >> >From previous experiment, especially with OpenLDAP 2.4.11, I have very >> hard >> time with making OpenLDAP N-way replication working on VM, especially >> VMWare-based ones. >> >> The main problem was with the management of the system clock, where >> VMWare >> was making the clock slower and then make a "jump" to compensate the >> slowiness. So, I got a lot of line "new modification with older timer >> value" (can't remember the precise log line, though). >> >> I had to switch to plain physical server (which was my target by then). >> >> > All >> > seems well according to OpenLDAP manual, but maybe I'm missing >> > something. I start both servers using "slapd -d sync" in order to >> > filter >> > only the sync part. >> > >> > I created a script to insert 200 employees in my directory, to force >> > the >> > servers to sync up. When I start both servers and insert the employees >> > in machine 1, I get this too much lines with this sample: >> > slap_queue_csn: queing 0xb6851b4a >> 20090623082909.571025Z#000000#000#000000 >> > slap_graduate_commit_csn: removing 0xb82165c8 >> > 20090623082909.571025Z#000000#000#000000 >> > >> > So the CSN is being created (I think), but there's no sync to machine >> > 2, >> > which makes me frustated. . . >> > >> > I'd appreciate any comments you can have, especially if you already >> > have >> > this kind of setup running. >> > >> > Best regards, >> > Fernando >> >> Hope it can help. >> Sincerely yours, Mathieu MILLET. >> >>

1 0

getnetbyaddr not working with LDAP
by Eric Ritchie 25 Jun '09

25 Jun '09

I'm running 2.3.39 under Redhat 4.0. I'm transitioning my Redhat clients from NIS to LDAP. It seems that getnetbyaddr doesn't work under LDAP. The following perl code shows the problem: #!/usr/local/bin/perl -w use Socket; $n = getnetbyname ( "nasd" ); $name = getnetbyaddr($n, AF_INET); print "$name\n"; exit 0; Host running NIS: # ./eric.pl nasd Host running LDAP: # ./eric.pl Use of uninitialized value in concatenation (.) or string at ./eric.pl line 9. The getnetbyname call works and I can print out the network IP. Can anyone help with this? Thanks -- Eric Ritchie Interactive Brokers LLC 203-618-5868

1 1

OpenLDAP Mirror Mode configuration
by Fernando Silva 25 Jun '09

25 Jun '09

Hi all, I'm trying to setup a Mirror Mode configuration using 2 machines running OpenLDAP v2.4.11 on both. To make things easy both machines are on the same (private) network. Here's a sample of both my slapd.conf: Machine 1: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 001 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.2 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on Machine 2: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 002 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.1 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on I'm using Ubuntu 8.10 inside a VMWare image, but both images are running on independent machines and the network on both is Bridge Mode. All seems well according to OpenLDAP manual, but maybe I'm missing something. I start both servers using "slapd -d sync" in order to filter only the sync part. I created a script to insert 200 employees in my directory, to force the servers to sync up. When I start both servers and insert the employees in machine 1, I get this too much lines with this sample: slap_queue_csn: queing 0xb6851b4a 20090623082909.571025Z#000000#000#000000 slap_graduate_commit_csn: removing 0xb82165c8 20090623082909.571025Z#000000#000#000000 So the CSN is being created (I think), but there's no sync to machine 2, which makes me frustated. . . I'd appreciate any comments you can have, especially if you already have this kind of setup running. Best regards, Fernando

3 3

RHEL 5 rpms
by Adam Leach 25 Jun '09

25 Jun '09

Anyone know where to find RHEL 5 rpms that are higher than 2.4.11? -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 2

How to backup/restore on remote servers
by Josir Gomes 24 Jun '09

24 Jun '09

Hi folks, I just installed a openldap server and I want to test backup/restore routines. I have two machines, one is a clone of the second one.The first one I add several users and then my test is to restore those users in the new machine. To backup, it was easy: slapcat -l /path/to/your/backup.ldif But when I tried to restore, I shutdown the samba/ldap service with: /etc/init.d/ebox samba stop /etc/init.d/ebox slapd stop And then I issue: slapadd -l /path/to/your/backup.ldif => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=ebox" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) I understand that there are other records and I can't replace them. Do I have to erase everything ? Or is there a merge option ? I know that there is a replication service but those two servers will not be on the same network (ie. one server will not communicate with the other) so I think this approach does not apply. Any tip or suggestion will be very welcome. Thanks in advance, Josir Gomes

4 5

Re: ldap not finding internal CA?
by gruntler-ldap＠yahoo.com 23 Jun '09

23 Jun '09

--- On Wed, 6/17/09, Mathias Gug <mathiaz(a)ubuntu.com> wrote: > From: Mathias Gug <mathiaz(a)ubuntu.com> > Subject: Re: ldap not finding internal CA? > To: "Kurt Yoder" <ktyopenldap(a)yoderhome.com> > Cc: openldap-technical(a)openldap.org > Date: Wednesday, June 17, 2009, 9:13 PM > > [...] > >> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I >> had the same message about self-signed certificates on previous >> Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works >> fine. > > As Howard mentioned this should have been fixed in 2.4.16. However > could you try to put both the CA certificate *and* the server > certificate in the cert.file used by the slapd server - (that way > the whole CA chain is sent to the client by gnutls) ? Hi Mathias, How exactly does one do that? I've tried simply appending the contents of the CA file to the server certificate file and restarting slapd and it has no effect. I've tried other various combinations as well but testing against Jaunty still fails while Intrepid works. Meanwhile I built OpenLDAP 2.4.16 on Jaunty with no Ubuntu patches added to OpenLDAP and it works: gruntler@jaunty-64:~/src/openldap-2.4.16/clients/tools$ ./ldapsearch -x -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.16 (Jun 22 2009 17:04:33) $ gruntler@jaunty-64:/home/gruntler/src/openldap-2.4.16/clients/tools (LDAP library: OpenLDAP 20416) # extended LDIF # # LDAPv3 # base <dc=abcd, dc=efgh, dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # ... snip ... ldap.conf settings: BASE dc=abcd, dc=efgh, dc=com URI ldaps://auth01-test ldaps://auth02-test TLS_CACERT /etc/ssl/cacerts/my-org.cert.pem TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 ----- Meanwhile... gruntler@jaunty-64:~/src/openldap-2.4.16/clients/tools$ /usr/bin/ldapsearch -x -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.15 (Mar 19 2009 10:07:04) $ buildd@yellow:/build/buildd/openldap-2.4.15/debian/build/clients/tools (LDAP library: OpenLDAP 20415) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

1 0

proxy cache not really caching?
by Tyler Gates 23 Jun '09

23 Jun '09

Hello, I've been running my openldap 2.4 proxy directory server using back_ldap and pcache in front of two masters for a few days and have been a little confused about why I'm not getting more "QUERY ANSWERED" messages in the logs considering all the "QUERY CACHED" messages. According to the script I wrote to parse the log file for certain key words, I'm seeing data like this: ******************************* QUERIES ANSWERED: 26901 QUERIES NOT ANSWERED: 142386 QUERIES CACHEABLE: 114491 QUERIES NOT CACHEABLE: 27895 ------------------------------- TOTAL QUERIES: 169287 QUERIES ADDED: 114080 QUERIES STORED: 7 QUERY HIT: %15.8907653866 ******************************* As you can see my templates are catching a good majority of the queries and they appear to be added to cache. For example I see messages like this: 'Added query expires at 1244899436 (NEGATIVE)' But even though I've tried bumping the ttl up, I'm still seeing a lot of QUERY NOT ANSWERABLE messages fly by about queries that should have been in cache before. For example, this snippet below appears to cache querystr '(&(objectClass=posixGroup)(memberUid=xfs))' but then one query later the exact same query comes up and it says its not answerable and adds it to cache again. Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SRCH attr=gidNumber Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(memberUid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Entering QC, querystr = (&(objectClass=posixGroup)(memberUid=xfs)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock QC index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Not answerable: Unlock QC index=0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Added query expires at 1244899436 (NEGATIVE) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: TEMPLATE 0x8354560 QUERIES++ 1 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Unlock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1661 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(uid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1661 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1662 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1662 SRCH attr=gidNumber Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(memberUid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Entering QC, querystr = (&(objectClass=posixGroup)(memberUid=xfs)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock QC index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Not answerable: Unlock QC index=0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Added query expires at 1244899436 (NEGATIVE) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: TEMPLATE 0x8354560 QUERIES++ 1 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Unlock AQ index = 0x8354560 According to the logs I currently have 7 cached queries and about a %15.8 hit rate which seems ridiculous given all the 'added query' messages I'm getting. Is there something wrong with my caching engine on the directory server or am I missing something with how the caching mechanism works? Thanks, Tyler

2 5

Howto setup OpenLDAP as ACL for Servers?
by openbsd shen 23 Jun '09

23 Jun '09

I have many Windows 2003/Linux Server, and a OpenLDAP server as auth server, I want setup ACL in OpenLDAP server, maybe user A allowed to login in windows-1 server and Linux-1 server, and user B allowed to login in windows-2 server and Linux-2 server. How to setup it in OpenLDAP server?

3 2

Database error 22
by Olivier Nicole 23 Jun '09

23 Jun '09

Hi, After a reboot this morning I had the error: Jun 23 06:47:47 ldap slapd[512]: @(#) $OpenLDAP: slapd 2.3.40 (Jan 29 2008 12:27:46) $ root@fbsd35.cs.ait.ac.th:/usr/ports/net/openldap23-server/work/openldap-2.3.40/servers/slapd Jun 23 06:47:49 ldap slapd[522]: bdb_db_open: Database cannot be opened, err 22. Restore from backup! Jun 23 06:47:49 ldap slapd[522]: bdb(dc=cs,dc=ait,dc=ac,dc=th): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem Jun 23 06:47:49 ldap slapd[522]: bdb(dc=cs,dc=ait,dc=ac,dc=th): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 23 06:47:49 ldap slapd[522]: bdb_db_close: txn_checkpoint failed: Invalid argument (22) Jun 23 06:47:49 ldap slapd[522]: backend_startup_one: bi_db_open failed! (22) Jun 23 06:47:49 ldap slapd[522]: bdb_db_close: alock_close failed Jun 23 06:47:49 ldap slapd[522]: slapd stopped. Jun 23 06:47:49 ldap slapd[522]: connections_destroy: nothing to destroy. Yesterday I think I cleanly halted the LDAP server before the UPS ran out of battery (major power failure). This morning when I restarted the machine I find the above error. 1) What could cause this error? 2) How to do clean and regular backups? Best regards, Olivier

2 1

(no subject)
by Sai 22 Jun '09

22 Jun '09

Hi all, You can consider I am fairly new to LDAP Server, let alone OPENLDAP. But I went through most of the documentation and configured openldap for our Web Site almost year and half to 2 ago. Now I am required to configure passive fail over for this. I am trying to understand and weigh my options. 1) What I want to configure? Two LDAP servers, with their content being in sync at all times. 2) What should I use? Slurpd or syncrepl or some other configuration. 3) What version we are running on? 2.2.13. Sadly but truly, the project does not have the time and resources to update to the latest one. 4) How are we going to use this replication configuration? a. Currently the Web App points to server A. b. In case of a catastrophic failure of server A (Machine down, power plug pulled, disk failure, etc), they will point the Web App to server B. c. Fix server A. d. Point Web App back to server A (I know there is no harm in leaving it pointed to B but that is the way they want. "Return every thing back to how it was"). I think in order to satisfy 4.b (any updates while pointed to server B while server A is down), both the servers should be Master-Master (N-Way master). What I am trying to understand is question 2. I am currently going through chapter 14 and 15 of openldap documentation. I noticed there are some slight differences and I want to get your expert opinion so that I am on the right track and not doing my own little weird configuration. Any help in helping me understand this and decide what to use is much appreciated. Thanks, -Sai

2 3

control rules
by olivier morel 19 Jun '09

19 Jun '09

hy when I try to find a contact with outlook I see all computeur of my area of the ou=machines i would like to ban the route of the ou=machines for just to see the people how can i do . thank you very mutch for your help ------------------------- Olivier Morel - Service Informatique 4 allée de Seine - 93285 Saint Denis Cedex E-mail : olivier.morel(a)panoranet.com

3 2

Mirror Mode question
by Ivan Ordonez 19 Jun '09

19 Jun '09

Hi, I am trying to setup mirror mode on two identical machines. Previously, these two machine were setup as PDC and BDC, using syncrepl provider and comsumer method. All changes are done through the PDC, and will sync to BDC. We decided to use mirror mode for high availability but having issue getting it to work. When I try to create an account, I will get an error message regarding smbldap-tools. See below. Error: shadow context; no update referral at /usr/sbin//smbldap_tools.pm line 1083, <DATA> line 466. Is there anything on smbldap.conf that I need to change? I made sure that the master were pointing to each other. Below is my mirror mode configuration. Machine 1 - IP Address 192.0.0.201 ServerID 1 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.0.0.202:389 type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" searchbase="dc=my,dc=domain,dc=com" scope=sub schemachecking=on bindmethod=simple binddn="cn=Manager,dc=my,dc=domain,dc=com" credentials=mypassword mirrormode on Machine 2 - IP Address 192.0.0.202 ServerID 2 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.0.0.201:389 type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" searchbase="dc=my,dc=domain,dc=com" scope=sub schemachecking=on bindmethod=simple binddn="cn=Manager,dc=my,dc=domain,dc=com" credentials=mypassword mirrormode on Thanks in advance.

4 11

Update schema
by Olivier Nicole 19 Jun '09

19 Jun '09

Hi, I have an openldap server running and being used day to day for authentication. I developped a small schema, and all is working fine. Only I just noticed that in the definition of the object class, I ussed the OID 9999 instead of my own enterprise number: objectclass ( 1.3.6.1.4.1.9999.2.1.1 Should be objectclass ( 1.3.6.1.4.1.26754.4.1.1 I beleive I cannot just stop slapd, correct the schema and restart slapd. What would be the clean way to proceed to a schema upgrade? As this is a production server, I cannot afford to break it. Bestregards, Olivier

2 3

puzzling Open LDAP dn errors
by Frizzell, Ryan 19 Jun '09

19 Jun '09

Hi all, I'm trying to setup and ldap proxy and I'm running into a bunch of bad dn errors in my endeavors. Currently, my slapd.conf file looks like: Database ldap Suffix "" Uri "ldap://myLdapIP:389" Idassert-bind bindmethod=simple Binddn="cn=privilagedAcct" Credentials="privPass" Trying to keep it simple as this is only a sandbox setup. The issues I'm running into are when I try to change the suffix dn to something useful like Suffix "dc=mydomain,dc=net" Changing suffix to that will produce slaptest errors of "<suffix> invalid DN 21 (invalid syntax)" I can connect to my ldap server and perform searchs with: Ldapsearch -LLL "uid=mytestuser" -x -H "ldap://myLdapIP:389" -D "cn=privilagedAcct,OU=test,dc=mydomain,dc=net" -b "dc=mydomain,dc=net" -W I've also tired to change the binddn to cn=privilagedAcct,OU=test,dc=mydomain,dc=net slaptest will then produce Invalid bind config value binddn=cn=privilagedAcct,OU=test,dc=mydomain,dc=net I've worked quite a bit with DNs in the past and I can't seem to see anything wrong with the DNs especially since the ldapsearch commands will complete on the running ldap server. I'm guessing I'm overlooking something very simple. Any ideas? Thanks, Ryan

2 2

Re: ldap not finding internal CA?
by gruntler-ldap＠yahoo.com 18 Jun '09

18 Jun '09

--- On Wed, 6/17/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: ldap not finding internal CA? > To: "Kurt Yoder" <ktyopenldap(a)yoderhome.com> > Cc: openldap-technical(a)openldap.org > Date: Wednesday, June 17, 2009, 8:55 PM > Kurt Yoder wrote: [... skip ...] > > My openldap is version 2.4.15 on Ubuntu Jaunty. [... skip ...] > The GnuTLS issues with X.509v1 certs were fixed in 2.4.16, > so you need to upgrade. Sorry about any confusion but Jaunty doesn't actually have 2.4.15 but a custom version ("2.4.15-1ubuntu3") from Ubuntu: https://launchpad.net/ubuntu/jaunty/amd64/slapd The diff for ITS#5992 is in Jaunty $ cat gnutls-enable-v1-ca-certs ## Mathias Gug <mathiaz-at-ubuntu.com> ## Enable V1 CA certs to be trusted. ## ITS: 5992 - http://www.openldap.org/its/index.cgi?findid=5992 ## LP: https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/305264 ## Fixed in > 2.4.15 ## Patch: http://bazaar.launchpad.net/%7Evcs-imports/openldap/main-src/diff/17238 --- openldap.orig/libraries/libldap/tls_g.c 2009-03-02 02:01:41 +0000 +++ openldap/libraries/libldap/tls_g.c 2009-03-05 03:35:49 +0000 @@ -1,5 +1,5 @@ /* tls_g.c - Handle tls/ssl using GNUTLS. */ -/* $OpenLDAP: pkg/ldap/libraries/libldap/tls_g.c,v 1.6.2.2 2009/02/10 16:41:01 quanah Exp $ */ +/* $OpenLDAP: pkg/ldap/libraries/libldap/tls_g.c,v 1.9 2009/03/05 03:35:49 hyc Exp $ */ /* This work is part of OpenLDAP Software <http://www.openldap.org/>. * * Copyright 2008-2009 The OpenLDAP Foundation. @@ -349,6 +349,13 @@ if ( rc < 0 ) return -1; rc = 0; } + + /* FIXME: ITS#5992 - this should go be configurable, + * and V1 CA certs should be phased out ASAP. + */ + gnutls_certificate_set_verify_flags( ctx->cred, + GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT ); + if ( is_server ) { gnutls_dh_params_init(&ctx->dh_params); gnutls_dh_params_generate2(ctx->dh_params, DH_BITS); However: Jaunty does not appear to contain the diff for ITS#5991. Both ITS#5991 and ITS#5992 are squashed into the same CVS delta for: openldap-*/libraries/libldap/tls_g.c diffs between version 1.6.2.3 and 1.6.2.4 of tls_g.c http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_g.c.diff?r1=… Mathias Gug writes in ITS#5991: << Thanks for the workaround. It works as expected. I haven't tested the patch applied to CVS and thus haven't included it in Ubuntu yet. >> Link to ITS#5991 - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5991;selectid=5991… On a related note, Jaunty vs. pre-Jaunty does this: $ gnutls-cli -p 636 XXXX.XXX.XXX -d 4711 --x509cafile /etc/ldap/cacerts/my-ca.cert.pem --print-cert On Jaunty the output contains: - Peer's certificate is NOT trusted On previous Ubuntu releases (Intrepid, Hardy): - Peer's certificate is trusted Same certificate, same command line arguments, same /etc/ldap/ldap.conf file. Thanks, Ken

1 0

LDAP Sync Replication with Active Directory
by mailings＠atlantismedia.de 18 Jun '09

18 Jun '09

Hi, I have a Win 2k3 SBS and I want to replicate the users into my OpenLDAP 2.4.11. When I start slapd, I can see that one entry of a user is being sent, but after that I get the message "got search entry without Sync State control". I had hoped that replication not only works with OpenLDAP as a master, but also with Active Directory. Is it possible to get this to work? Lars

4 5

Cosine schema - RFC 4524
by Zdenek Styblik 18 Jun '09

18 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, my question is regarding updated Cosine schema [RFC 4524] which has been accepted in March 1991 by IANA. This obsoletes previous Cosine schema [RFC 1274]. OpenLDAP has support for RFC 4524, yet it comes with pre-defined older RFC 1274. So, I'm wondering, is there reason for keep using RFC 1274, or is it safe to define/create new Cosine schema by RFC 4524? Note: I've found ldif file which corresponds with RFC 4524, but no schema file. But I think [believe] it won't be that hard to define schema by published RFC. But, if somebody knows where I can get those files for OpenLDAP, I would be really happy. Thank you for your reply. Regards, Zdenek Styblik - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkoeUiMACgkQ8MreUbSH7ilMtACgwoLkn1KtS/D84yxCRrRfZHHv F9IAnjl8PNOaJ3P6Wm783u9c/J3reit4 =EtIk -----END PGP SIGNATURE-----

2 4

Re: Are hyphens in attribute names supported when using sql backend?
by Grzesiek K 18 Jun '09

18 Jun '09

> > > Thanks for the prompt answer. > > I tried to perform queries in the database using AS 'attr-name' and AS > > "attr-name" - both don't work. > > OK, then you need to figure out a normalization rule that replaces "-" > with an acceptable character, possibly not allowed by LDAP, so that > bidirectional translation is possible. Yes, the other option is to change database because it looks that PostgreSQL DB doesn't support hyphens in aliases nor in table names. Thanks, greg

1 0

Are hyphens in attribute names supported when using sql backend?
by Greg K 18 Jun '09

18 Jun '09

Hi, I use OpenLDAP + PostgreSQL as a sql backend. Just for tests if hyphens are supported I defined object class and attribute having hyphen in the names: Schema: attributetype ( 1.3.6.1.4.1.3814.4.4 NAME ( 'person-type' ) SUP name) objectClass ( 1.3.6.1.4.1.3814.3.5 NAME 'person-oc' DESC 'Test Person' SUP ( inetOrgPerson ) MAY ( person-type) ) insert into ldap_oc_mappings (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) values (4,'person-oc','persons','id',NULL,NULL,0); insert into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) values (10,4,'person-type','persons.name','persons',NULL,NULL,NULL,3,0); When I search for object having this object class and attribute I get the following in debug from slapd: <= ldap_dn2bv(cn=kori hutton,o=sql,c=ru)=0 Success <<< dnPrettyNormal: <cn=Kori Hutton,o=sql,c=RU>, <cn=kori hutton,o=sql,c=ru> backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="person-oc" attr="ref" keyval=12478 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person-oc" attr="objectClass" keyval=12478 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person-oc" attr="person-type" keyval=12478 backsql_get_attr_values(): error executing attribute query "SELECT persons.name AS person-type FROM persons WHERE persons.id=? ORDER BY persons.name" Return code: -1 Native error code: 7 SQL engine state: 42601 Message: ERROR: syntax error at or near "-"; Error while executing the query Looks that hyphen is not allowed in attribute name. Is it any workaround for this to support "-" in attribute names? Thank you, greg

3 3

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by mukim pathan 18 Jun '09

18 Jun '09

Hi, I have installed ldap 2.4.16 with bdb 4.5. When I am doing ldapsearch or ldapadd i am getting error "ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)". I tried searching for the answers but it seems none of them applies in this case, like permission to ldap, ldap server running on 389, configuration file is good without any spaces in rootdn and suffix. is there any solution to this?? Regards, Mukim Pathan

4 4

ldap not finding internal CA?
by Kurt Yoder 18 Jun '09

18 Jun '09

Hello all, On Ubuntu, I have set up an LDAP server and am authenticating to it over SSL for my LDAP queries. I had it working on previous Ubuntu releases, but something seems to have changed in the newest release (maybe this: http://www.debian-administration.org/users/dkg/weblog/ 42). I am having trouble figuring out exactly what is breaking. Some background: I have set up my own CA and generated a certificate for it, which the LDAP server is using. Without specifying this CA, I get "self-signed certificate" errors when connecting: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts CONNECTED(00000003) <... trimmed certificate information ...> verify error:num=19:self signed certificate in certificate chain verify return:0 <... trimmed more certificate information ...> If I specify the path to my internal CA file, I receive no errors: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts - CAfile /path/to/my/ca/file CONNECTED(00000003) <... trimmed certificate and internal CA information ...> verify return:1 <... trimmed more certificate information ...> That being said, I manually specified the path to my internal CA file in /etc/ldap/ldap.conf: BASE dc=my, dc=search, dc=base URI ldaps://my.ldap.server TLS_CACERT /path/to/my/ca/file TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 This still allows no secure ldap queries: root@host:# ldapsearch -x -d1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP my.ldap.server:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying my.ldap.server.ip:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) TLS: can't connect: (unknown error code). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Just to prove that the above configuration is the one being used, if I switch the above configuration to "TLS_REQCERT allow", the ldap queries bypass this issue: root@myhost:# ldapsearch -x -d1 > /dev/null ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP auth01.rdc.internal:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.41:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) ldap_open_defconn: successful <... trimmed rest of results ...> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I had the same message about self-signed certificates on previous Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works fine. So what is the solution to this problem? Do I switch to "TLS_REQCERT allow"? Or perhaps there's some way to debug why openldap is not seeing the internal CA file even though I've told it where to look? Thanks for any pointers... -Kurt

3 2

N-way Master synchronization
by Bad Guy 17 Jun '09

17 Jun '09

Dear all, I am using a 4-way LDAP servers version 2.4.11. (type=refreshOnly, interval="00:00:00:30",attrs="*,+") Everyday, there will be some records updated in any of the servers. >From time to time, I will dump the records in all 4 servers and checked the modifyTimestamp attribute. I find that there is some records where the modifyTimestamp attribute value are different from other 3 servers. But the other content seems synced. Only differ by the modifyTimestamp attribute. Any idea of how come such situation occur ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

3 2

Check ppolicy
by Jordi Espasa Clofent 17 Jun '09

17 Jun '09

Hi folks, I use a OpenLDAP as a central accounting servers through the sshd service and I use sudo also. All works like a charm. However I wanto to use SLAPO_PPOLICY(5). Well, I think I've implemented it correctly: xen-ldap01:~# ldapsearch -x -b 'cn=DefaultPassword,ou=Policies,dc=company,dc=com' # extended LDIF # # LDAPv3 # base <cn=DefaultPassword,ou=Policies,dc=company,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # DefaultPassword, Policies, company.com dn: cn=DefaultPassword,ou=Policies,dc=company,dc=com cn: DefaultPassword objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15552000 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 3 pwdMinLength: 8 pwdMaxFailure: 5 pwdLockout: TRUE pwdInHistory: 5 pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The main problem is I don't know how to ckeck it. I mean, when a user connects to a machine (a box which is OpenLDAP client) using sshd, sshd goes to OpenLDAP and query about the user and his password. But I don't see anymore that the classical "Password:" prompt. So ¿how can I check if ppolicy is really working? I want to test it, changing the password for example or blocking a user who type wrong their password for more tant 5 times. I suspect a PAM issue (after all, the sshd service goes to LDAP using PAM modules), but I'm not sure. ¿Any clue? -- Thanks, Jordi Espasa Clofent

2 3

ldap_bind: Invalid credentials (49)
by J. Bakshi 17 Jun '09

17 Jun '09

Hello list, Here is a very typical problem. I have already done some googling but I am more confused now. I like to query a user information with his own id and password. When I do this as cn=Manager the there is no problem ```````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: (&(objectclass=inetOrgPerson)(cn=test2)) # requesting: uid # # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com uid: rbilly # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ``````````````````````````````````````````````````````````````````` Now if I search with the user credential the problem starts `````````````````````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "uid=rbilly,ou=people,dc=example,dc=com" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) ```````````````````````````````````````````````` I have typed the correct password and repeated the above command a no. of times. But the same error. why Invalid credentials ? Any clue please ? Thanks

3 3

Re: password change and ppolicy
by Gustavo Mendes de Carvalho 17 Jun '09

17 Jun '09

Hi Tizo, Suposed that your users has to login in some linux/Unix machine using their LDAP accounts, I sugest you to create some binary or script to allow your users to change their passwords invoking ldappasswd command. I mean, you can create a C program or shell script or even a PHP page, to validate some weaks in their passwords, like min length, capital letters, numbers, and so on. After that, you can call ldappasswd command with all parameters (using system() call in a C source code) to change it. I know that this is not an elegant option, but it works. Let me know if it works for you that I can post my C source code here to help you there. See you Gustavo Date: Wed, 10 Jun 2009 18:54:14 -0300 From: tizo <tizone(a)gmail.com> Subject: Re: password change and ppolicy To: openldap-technical(a)openldap.org Message-ID: <e55f48520906101454i3e5b4b59v2b755278cd34437(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" On Tue, Jun 9, 2009 at 12:12 PM, tizo <tizone(a)gmail.com> wrote: > > Before starting this, I have been testing password changing with > phpLDAPAdmin. The fact is that I could only change a user password with > clear text. I guess that this behaviour happens because we have > pwdCheckQulity setting in 2 in our default password policy. So, when the > client (phpLDAPAdmin) tries to modify the password enconding it, the server > (OpenLDAP) cannot check the min length of the password, as it is encoded, > and then fails. I am guessing too, that phpLDAPAdmin is performing a simple > modify operation to change the password, as it is stored in clear text. On > the other hand, I could change passwords with ldappasswd withouth problem, > and they are stored with SSHA. I know that this command uses RFC 3062. > > tizo > >

3 2

slapd-config(5) Disaster Recovery - Best Practices?
by gruntler-ldap＠yahoo.com 16 Jun '09

16 Jun '09

Hi, I am considering migrating from a monolithic slapd.conf file to the newer DIT slapd-config(5). My primary concern is how to recover if a dynamic change brings down slapd so it becomes difficult to recover since the configuration is in a database and slapd will not start. Is it as simple as making a slapcat backup of the configuration database (or some other backup of the configuration database that resides in the slapd.d directory) prior to making changes so that a roll-back would consist of replacing the contents of the slapd.d directory? Or is there some other recovery method that is preferred? Thanks, Ken

2 1

pwdFailureTime not being deleted
by Adam Leach 16 Jun '09

16 Jun '09

I'm having a problem with the pwdFailureTime entries not being deleted after a successful login. What steps could I take to see if there is an error occurring? I'm running openldap 2.4.11 RHEL5, rpms came from http://staff.telkomsa.net/packages/rhel5/openldap/i386/ Thanks -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 1

LDAP search question
by Tihomir Culjaga 16 Jun '09

16 Jun '09

Hello, maybe it is a dummy question but i'd like to know why i have so big discrepancy in execution between two apparently identical ldapsearch ? The 1st search takes 94 ms while the 2nd one only 7 ms. It doesn't matter how many times i execute the 1st search (meaning everytihng should be already cached) .. it is always the same. Does anyone know why? ~$ time ldapsearch -h localhost -x -b ou=redirecting,ou=Dir,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w **** uniqueID=38512303736 # extended LDIF # # LDAPv3 # base <ou=redirecting,ou=Dir,dc=ot,dc=hr> with scope subtree # filter: uniqueID=38512303736 # requesting: ALL # # 38512303736, redirecting, Dir, ot.hr dn: uniqueID=38512303736,ou=redirecting,ou=Dir,dc=ot,dc=hr objectClass: top objectClass: uniqueID Prefix: 68A10 uniqueID: 38512303736 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 *real 0m0.094s* user 0m0.004s sys 0m0.000s ~$ time ldapsearch -h localhost -x -b ou=redirecting,ou=Dir,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w **** uniqueID=38515000400 # extended LDIF # # LDAPv3 # base <ou=redirecting,ou=Direktor,dc=ot,dc=hr> with scope subtree # filter: uniqueID=38515000400 # requesting: ALL # # 38515000400, redirecting, Dir, ot.hr dn: uniqueID=38515000400,ou=redirecting,ou=Dir,dc=ot,dc=hr objectClass: top objectClass: uniqueID Prefix: 68B99 uniqueID: 38515000400 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 *real 0m0.007s* user 0m0.000s sys 0m0.004s tculjaga@l01sipindir2:~$

3 5

How to temporarily downgrade to LDAPv2 ?
by J. Bakshi 16 Jun '09

16 Jun '09

Dear all, I like to downgrade the ldap communication protocol to do some experiments. An api which has been designed in 2005 can not work with my ldap server ( suse 11.1) as the log reports ````````````````````````` historical protocol version requested, use LDAPv3 instead ````````````````````````````````````` so i need to temporarily allow the old v2 protocol so that the api can communicate with the ldap server. How can i do this ? Thanks

3 6

RE: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Brett Maxfield 16 Jun '09

16 Jun '09

I checked ownership and permissions on /var/lib/ldap: francesco@bob:/var/lib$ ls -l | grep ldap drwxr-xr-x 5 openldap openldap 4096 2009-06-15 17:03 ldap --=-- Have you run the process under strace(linux) or truss (solaris) as that will give you the exact file/path failing.. Perhaps it is writing files outside the directories you have prepared?

1 0

Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG - SOLVED
by Francesco Cicolani 15 Jun '09

15 Jun '09

You got it Matt! I really missed the point that an apparmor profile for slapd is generated by default in Ubuntu during openldap installation. I did a test putting slapd apparmor profile in compliant-mode and all went well this time! Now, time for a resume of the steps I eventually made to successfully change Berkeley DB data and log file directories, integrated with a BDB backup and recovery, on Ubuntu 8.04.2 with Apparmor framework enabled, just in case it could also help someone else having similar problems in the future: 1. Make a standard BDB backup (see Berkeley DB Reference Guide, in particular: http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/…): 1.1. stop slapd 1.2. force a checkpoint with db4.2_checkpoint -1v 1.3. copy all .bdb files returned by db4.2_archive -s to backup location /backup (cp -p) 1.4. copy all log.XXXXXXXXXX files returned by db4.2_archive -l to backup location /backup (cp -p) 2. Update apparmor profile for slapd (/etc/apparmor.d/usr.sbin.slapd): ## customized bdb data and log files: /new/path/to/bdbdata/ r, /new/path/to/bdbdata/* rw, /new/path/to/bdblogs/ r, /new/path/to/bdblogs/* rw, ## lock file in customized bdbdata dir /new/path/to/bdbdata/alock kw, 3. Parse updated apparmor profile for slapd: apparmor_parser -r < /etc/apparmor.d/usr.sbin.slapd 4. Update bdb data 'directory' directive in slapd.conf directory "/new/path/to/bdbdata" 5. remove all .bdb, alock, __db.XXX and log.XXXXXXXXXX files from /var/lib/ldap (old default location) 6. edit DB_CONFIG file with new directives set_data_dir and set_lg_dir: # Directory for the data files set_data_dir /new/path/to/bdbdata [...] # Directory for the logfiles set_lg_dir /new/path/to/bdblogs 7. move DB_CONFIG file to /new/path/to/bdbdata and verify ownerships are preserved: -rw-r--r-- 1 openldap openldap 410 2009-06-15 22:00 DB_CONFIG 8. copy .bdb files from backup location /backup to /new/path/to/bdbdata (cp -p) 9. copy log.XXXXXXXXXX file from backup location /backup to /new/path/to/bdblogs (cp -p) 10. Finally, cd to /new/path/to/bdbdata and issue the recovery command (as root): root@bob:/new/path/to/bdbdata# db4.2_recover -cv db_recover: Finding last valid log LSN: file: 1 offset 141201 db_recover: Recovery starting from [1][28] db_recover: Recovery complete at Mon Jun 15 22:14:04 2009 db_recover: Maximum transaction ID 80000044 Recovery checkpoint [1][141201] 11. Restart slapd and force a checkpoint just to keep things clean on db side: root@bob:/new/path/to/bdbdata# /etc/init.d/slapd start root@bob:/new/path/to/bdbdata# db4.2_checkpoint -1v db_checkpoint: checkpoint: Mon Jun 15 22:18:03 2009 Note1: doing a backup and recovery of bdb could not be strictly required, but I thought that removing the bdb data and log files from the old path would contribute to keep things cleaner. Note2: putting slapd logging level to 'any' prior to restarting slapd would help to troubleshoot startup problems and verify that bdb starts cleanly. Thank you again guys!... and see you to the next 'mayday' thread! =) fra --- On Mon, 6/15/09, Matt Kassawara <battery(a)writeme.com> wrote: > From: Matt Kassawara <battery(a)writeme.com> > Subject: Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG > To: "Klaus Lemkau" <klaus.lemkau(a)tu-berlin.de> > Cc: "Francesco Cicolani" <francescocicolani(a)yahoo.it>, openldap-technical(a)openldap.org > Date: Monday, June 15, 2009, 6:40 PM > By default, the Ubuntu AppArmor > profile for slapd prevents it from writing databases to > anywhere but /var/lib/ldap. You'll need to modify the > usr.sbin.slapd profile in /etc/apparmor.d to correct the > problem. > > Matt

1 0

Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Francesco Cicolani 15 Jun '09

15 Jun '09

Hi Klaus, thx for your reply. I checked ownership and permissions on /var/lib/ldap: francesco@bob:/var/lib$ ls -l | grep ldap drwxr-xr-x 5 openldap openldap 4096 2009-06-15 17:03 ldap while the two subdirs I'm trying to place bdb data files and logs have: francesco@bob:/var/lib$ ls -l ldap [...] drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:39 bdbdata drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:39 bdblogs [...] During test, I also tried to change permissions on bdbdata and bdblogs to 775 and even 777: but I had no success in getting bdb log.0000000001 accessible when placed in bdblogs. I'm running short of ideas... I'm even wondering if someone else had similar problems when trying to set different dir for data files and logs... see you fra --- On Sun, 6/14/09, Klaus Lemkau <klaus.lemkau(a)tu-berlin.de> wrote: From: Klaus Lemkau <klaus.lemkau(a)tu-berlin.de> Subject: Re: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG To: "Francesco Cicolani" <francescocicolani(a)yahoo.it> Cc: openldap-technical(a)openldap.org Date: Sunday, June 14, 2009, 9:03 PM Hi Francesco, likely the files in /var/lib/ldap/ have the wrong owner (root?). chown -R openldap:openldap /var/lib/ldap should solve Your problem. Greetings Klaus

3 2

Re: TLS certificates
by Michael Ströder 15 Jun '09

15 Jun '09

Matthew, please stay on the mailing list (Cc:-ed) when answering so others can answer and learn as well. Matthew Edlefsen wrote: > 2009/6/13 Michael Ströder <michael(a)stroeder.com>: >> Matthew Edlefsen wrote: >>> Hello, I'm trying to get TLS setup with openldap and am having some >>> issues. I have a CA signed certificate (not self-signed) and have >>> created a chain with my CA cert and the root CA cert. I've verified >>> that it works with openssl verify -CAfile on both the client and >>> server but then when I try to connect using ldaps I get the following >>> error on the client: >>> >>> TLS certificate verification: depth: 2, err: 19, subject: >>> /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust >>> External CA Root, issuer: /C=SE/O=AddTrust AB/OU=AddTrust External TTP >>> Network/CN=AddTrust External CA Root >>> TLS certificate verification: Error, self signed certificate in >>> certificate chain >>> TLS trace: SSL3 alert write:fatal:unknown CA >>> TLS trace: SSL_connect:error in SSLv3 read server certificate B >>> TLS trace: SSL_connect:error in SSLv3 read server certificate B >>> TLS: can't connect. >>> >>> I assume it's saying that the root CA is self signed, but if I don't >>> include it in the chain it says it can't trust the CA. >> Could you please elaborate on how you configured TLS settings on your >> LDAP client? I assume that your OpenLDAP build was linked to OpenSSL >> libs. Is that right? > > I did not configure my client at all. I confirmed it is linked to > OpenSSL though. I'm hoping to not have to do any client configuration > (other than turning it on obviously) because we would like end users > to be able to use ldaps without any hassle. You have to configure each LDAP client to trust the CA cert. For OpenLDAP command-line clients or derived clients you should consult the man page ldap.conf(5) about how to place system-wide or specific configuration files and the client-side (TLS-related) configuration options. Ciao, Michael.

1 0

OpenLDAP and AD integration
by Santosh Balan 15 Jun '09

15 Jun '09

Hi Friends, I am newbee to this community and want to know how I can integrate an OpenLdap Server with MS Active Directory. Such that I create a user in LDAP it reflects in AD as well and vice-a-versa. Similarly any changes should effect on both AD and LDAP. Also I want to know how this can be done with a technical documentation. Also a user incase AD is not available gets authenticated using LDAP and vice-a-versa. Your urgent help on this issue will be highly appreciated. Expecting a reply from you at the earliest. Thanks and Regards Santosh Balan +91-9819419509 -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com

4 3

ldpsearch filter showing all records.
by J. Bakshi 15 Jun '09

15 Jun '09

Hello list, My filter on ldapsearch is not working as expected but showing all the records. If I simply do an search on object class like below it shows all records belong to that object ```````````````````````````````````````````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "objectclass=inetOrgPerson" -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: objectclass=inetOrgPerson # requesting: ALL # # test1, people, example.com dn: cn=test1,ou=people,dc=example,dc=com objectClass: inetOrgPerson cn: test1 sn: smith uid: rjsmith userPassword:: MTIzNDU2 carLicense: HISCAR 123 homePhone: 555-111-2222 description: swell guy ou: Human Resources mail: r.smith(a)example.com # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com objectClass: inetOrgPerson cn: test2 sn: Billy uid: rbilly userPassword:: MTIzNDU2 carLicense: HISCAR 123 homePhone: 555-111-2222 mail: billy(a)example.com description: sales guy ou: Sales # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 `````````````````````````````````````````````````````````````````````````````````````` Now to redifine the filter. Want to result where gid=rjsmith ` ` ` ` ` ` ` ` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "objectclass=inetOrgPerson" uid=rjsmith -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: objectclass=inetOrgPerson # requesting: uid=rjsmith # # test1, people, example.com dn: cn=test1,ou=people,dc=example,dc=com # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 ` ` ` ` ` ` Again both the results are showing. something wrong in my filter ? Please enlighten me. Thanks

3 4

openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Francesco Cicolani 14 Jun '09

14 Jun '09

Hi everybody, sorry for the long post, but I'm new to openLDAP, and I wish to provide as much information as possible in order to pinpoint the troublesome issue that is driving me nuts. First of all, I installed openLDAP server with Berkeley DB on a machine running Ubuntu 8.04.2, using available packages from certified sources. Following some details I think might be useful: root@bob:/etc/ldap# uname -a Linux bob 2.6.24-24-generic #1 SMP Wed Apr 15 15:54:25 UTC 2009 i686 GNU/Linux These are slapd and bdb version info I get from syslog when starting slapd: Jun 14 17:08:19 bob slapd[9475]: @(#) $OpenLDAP: slapd 2.4.9 (Aug 5 2008 20:18:55) $ ^Ibuildd@palmer:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd [...] Jun 14 17:08:19 bob slapd[9475]: hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) After installation everything seemed to work fine, and I could populate and browse my LDAP directory with no problems. Following some details I think may be useful to know: some directives in slapd.conf: [...] loglevel stats # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb [...] # Specific Backend Directives for hdb: backend hdb [...] # Specific Directives for database #1, of type hdb: database hdb [...] # Where the database file are physically stored for database #1 directory "/var/lib/ldap" [...] # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. [...] dbconfig set_cachesize 0 2097152 0 [...] # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 [...] # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 this was the content of DB_CONFIG file after installation and first start of slapd: root@bob:/var/lib/ldap# cat DB_CONFIG set_cachesize 0 2097152 0 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500 this was the structure of /var/lib/ldap (the timestamps refer to the last successful working recovery I made): root@bob:/var/lib/ldap# l total 816 -rw-r--r-- 1 openldap openldap 2048 2009-06-14 17:09 alock -rw------- 1 openldap openldap 8192 2009-06-14 17:08 cn.bdb -rw------- 1 openldap openldap 8192 2009-06-14 17:39 __db.001 -rw------- 1 openldap openldap 2629632 2009-06-14 17:39 __db.002 -rw------- 1 openldap openldap 1081344 2009-06-14 17:39 __db.003 -rw------- 1 openldap openldap 565248 2009-06-14 17:09 __db.004 -rw------- 1 openldap openldap 24576 2009-06-14 17:39 __db.005 -rw-r--r-- 1 openldap openldap 383 2009-06-14 17:07 DB_CONFIG -rw------- 1 openldap openldap 8192 2009-06-14 17:39 dn2id.bdb -rw------- 1 openldap openldap 81920 2009-06-14 17:39 id2entry.bdb -rw------- 1 openldap openldap 142289 2009-06-14 17:39 log.0000000001 -rw------- 1 openldap openldap 8192 2009-06-14 17:08 objectClass.bdb -rw------- 1 openldap openldap 8192 2009-06-14 17:08 uid.bdb Problems rose when I tried to test some 'tweaks' with DB_CONFIG file. In particular, I was trying to store log files and data files in separate directories, thinking this would greatly simplify the db backup process. First thing I did, was adding some lines to DB_CONFIG, in order to specify data and log dirs (I also tweaked default values for log files and cache): root@bob:/var/lib/ldap# cat DB_CONFIG # Directory for the data files set_data_dir /var/lib/ldap/bdbdata set_cachesize 0 2097152 0 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500 # Logging settings # Max memory cache for db file name caching set_lg_regionmax 1048576 # Size of memory cache to log data set_lg_bsize 32768 # Maximum size of logfile set_lg_max 262144 # Directory for the logfiles set_lg_dir /var/lib/ldap/bdblogs After that, I created the new dirs in /var/lib/ldap and set the ownerships: root@bob:/var/lib/ldap# ls -l | grep bdb drwxr-xr-x 2 openldap openldap 4096 2009-06-14 16:59 bdbdata drwxr-xr-x 2 openldap openldap 4096 2009-06-14 17:07 bdblogs Finally, changed loglevel from 'stats' to 'any' in slapd.conf, and restarted slapd: here comes the problems! slapd couldn't restart and syslog shows problems regarding permissions to write: Jun 14 18:10:43 bob slapd[9624]: slapd startup: initiated. Jun 14 18:10:43 bob slapd[9624]: backend_startup_one: starting "cn=config" Jun 14 18:10:43 bob slapd[9624]: config_back_db_open Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn=config" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn=module{0}" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn=schema" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={0}core" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={1}cosine" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={2}nis" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "cn={3}inetorgperson" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "olcDatabase={-1}frontend" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "olcDatabase={0}config" Jun 14 18:10:43 bob slapd[9624]: config_build_entry: "olcDatabase={1}hdb" Jun 14 18:10:43 bob slapd[9624]: backend_startup_one: starting "dc=springfield,dc=edu" Jun 14 18:10:43 bob slapd[9624]: hdb_db_open: "dc=springfield,dc=edu" Jun 14 18:10:43 bob slapd[9624]: hdb_db_open: database "dc=springfield,dc=edu": dbenv_open(/var/lib/ldap). Jun 14 18:10:43 bob kernel: [36914.145407] audit(1244995843.179:55): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/var/lib/ldap/bdbdata/__db.1.22d19" pid=9624 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:10:43 bob kernel: [36914.146448] audit(1244995843.179:56): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/var/lib/ldap/bdbdata/__db.1.22d19" pid=9624 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:10:43 bob kernel: [36914.147356] audit(1244995843.179:57): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/var/lib/ldap/bdbdata/__db.1.22d19" pid=9624 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:10:43 bob slapd[9624]: hdb_db_open: database "dc=springfield,dc=edu": db_open(/var/lib/ldap/id2entry.bdb) failed: Permission denied (13). Jun 14 18:10:43 bob slapd[9624]: ====> bdb_cache_release_all Jun 14 18:10:43 bob slapd[9624]: bdb(dc=springfield,dc=edu): dn2id.bdb: unable to flush: No such file or directory Jun 14 18:10:43 bob slapd[9624]: bdb(dc=springfield,dc=edu): id2entry.bdb: unable to flush: No such file or directory Jun 14 18:10:43 bob slapd[9624]: bdb(dc=springfield,dc=edu): txn_checkpoint: failed to flush the buffer cache No such file or directory Jun 14 18:10:43 bob slapd[9624]: bdb_db_close: database "dc=springfield,dc=edu": txn_checkpoint failed: No such file or directory (2). Jun 14 18:10:43 bob slapd[9624]: backend_startup_one: bi_db_open failed! (13) Jun 14 18:10:43 bob slapd[9624]: slapd shutdown: initiated Jun 14 18:10:43 bob slapd[9624]: ====> bdb_cache_release_all Jun 14 18:10:43 bob slapd[9624]: bdb_db_close: database "dc=springfield,dc=edu": alock_close failed Jun 14 18:10:43 bob slapd[9624]: slapd destroy: freeing system resources. Jun 14 18:10:43 bob slapd[9624]: slapd stopped. Jun 14 18:10:43 bob slapd[9624]: connections_destroy: nothing to destroy. Fortunately, I previously made a backup of my BDB data files and logs; I followed the procedures stated in the Berkeley DB Reference Guide: 1. stop slapd 2. force a checkpoint with db4.2_checkpoint -1v 3. copy all .bdb files returned by db4.2_archive -s to backup location /backup (cp -p) 4. copy all log.XXXXXXXXXX files returned by db4.2_archive -l to backup location /backup (cp -p) So, I tried another approach. I assumed that, in case I had to do a recovery, I could do the following: A. ensure slapd is stopped by issuing /etc/init.d/slapd stop B. remove all .bdb, alock, __db.XXX and log.XXXXXXXXXX files from /var/lib/ldap C. copy .bdb files from /backup to /var/lib/ldap/bdbdata (cp -p) D. copy log.XXXXXXXXXX file from /backup to /var/lib/ldap/bdblogs (cp -p) Now, the structure of my /var/lib/ldap dir is: root@bob:/var/lib/ldap# ls -lR .: total 16 drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:25 bdbdata drwxr-xr-x 2 openldap openldap 4096 2009-06-14 18:25 bdblogs -rw-r--r-- 1 openldap openldap 412 2009-06-14 18:09 DB_CONFIG ./bdbdata: total 116 -rw------- 1 openldap openldap 8192 2009-06-14 15:30 cn.bdb -rw------- 1 openldap openldap 8192 2009-06-14 15:34 dn2id.bdb -rw------- 1 openldap openldap 81920 2009-06-14 15:34 id2entry.bdb -rw------- 1 openldap openldap 8192 2009-06-14 15:30 objectClass.bdb -rw------- 1 openldap openldap 8192 2009-06-14 15:30 uid.bdb ./bdblogs: total 144 -rw------- 1 openldap openldap 141201 2009-06-14 15:35 log.0000000001 E. Finally, cd to /var/lib/ldap and issue the recovery command (as root): root@bob:/var/lib/ldap# db4.2_recover -cv -h /var/lib/ldap db_recover: Finding last valid log LSN: file: 1 offset 141201 db_recover: Recovery starting from [1][28] db_recover: Recovery complete at Sun Jun 14 18:27:17 2009 db_recover: Maximum transaction ID 80000044 Recovery checkpoint [1][141201] Started slapd again but got the following error logs in syslog: Jun 14 18:28:44 bob slapd[9676]: slapd startup: initiated. Jun 14 18:28:44 bob slapd[9676]: backend_startup_one: starting "cn=config" Jun 14 18:28:44 bob slapd[9676]: config_back_db_open Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn=config" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn=module{0}" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn=schema" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={0}core" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={1}cosine" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={2}nis" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "cn={3}inetorgperson" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "olcDatabase={-1}frontend" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "olcDatabase={0}config" Jun 14 18:28:44 bob slapd[9676]: config_build_entry: "olcDatabase={1}hdb" Jun 14 18:28:44 bob slapd[9676]: backend_startup_one: starting "dc=springfield,dc=edu" Jun 14 18:28:44 bob slapd[9676]: hdb_db_open: "dc=springfield,dc=edu" Jun 14 18:28:44 bob slapd[9676]: hdb_db_open: database "dc=springfield,dc=edu": dbenv_open(/var/lib/ldap). Jun 14 18:28:45 bob kernel: [37994.300390] audit(1244996925.048:58): type=1503 operation="inode_permission" requested_mask="r::" denied_mask="r::" name="/var/lib/ldap/bdblogs/" pid=9676 profile="/usr/sbin/slapd" namespace="default" Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): /var/lib/ldap/bdblogs/log.0000000001: Permission denied Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): PANIC: Permission denied Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Jun 14 18:28:45 bob slapd[9676]: hdb_db_open: database "dc=springfield,dc=edu" cannot be opened, err -30978. Restore from backup! Jun 14 18:28:45 bob slapd[9676]: ====> bdb_cache_release_all Jun 14 18:28:45 bob slapd[9676]: bdb(dc=springfield,dc=edu): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 14 18:28:45 bob slapd[9676]: bdb_db_close: database "dc=springfield,dc=edu": txn_checkpoint failed: Invalid argument (22). Jun 14 18:28:45 bob slapd[9676]: backend_startup_one: bi_db_open failed! (-30978) Jun 14 18:28:45 bob slapd[9676]: slapd shutdown: initiated Jun 14 18:28:45 bob slapd[9676]: ====> bdb_cache_release_all Jun 14 18:28:45 bob slapd[9676]: bdb_db_close: database "dc=springfield,dc=edu": alock_close failed Jun 14 18:28:45 bob slapd[9676]: slapd destroy: freeing system resources. Jun 14 18:28:45 bob slapd[9676]: slapd stopped. Jun 14 18:28:45 bob slapd[9676]: connections_destroy: nothing to destroy. Thanks in advance for your patience. I hope to hear from somebody willing to help me out of this situation. P.S.: please note that, if I comment the set_data_dir and set_lg_dir in DB_CONFIG, place log.XXXXXXXXXX and .bdb files in /var/lib/ldap and run db4.2_recover -cv -h /var/lib/ldap again, I'm able to get slapd running.

2 1

slapd + tls problem
by Alessandro Baggi 14 Jun '09

14 Jun '09

Hi there. I've problem setting up SLAPD + TLS and libnss-ldap. When I try to get the passwd entry with getent passwd I get the following error: TLS: can't accept: A record packet with illegal version was received.. connection_read(13): TLS accept failure error=-1 id=18, closing This is a certificate problem or libnss-ldap configuration problem? I've also tested slapd and tls with gnutls-cli and openssl s_client and they complete test successfully. I've also tested my certificate with openssl verify, and also this test has been completed successfully. My nsswitch.conf is configured with files and ldap. Then, i've created my certificate with the following command: # /usr/lib/ssl/misc/CA.pl -newca /* to create the ca certificate and key*/ # openssl req -newkey rsa:1024 -nodes -keyout key.pem -out newreq.pem /*for server/client certificate building and sing*/ # /usr/lib/ssl/misc/CA.pl -sign I've tried using only openssl with slapd and all work very good, but not with GnuTLS. My system is Debian Lenny. There's something that is wrong in certificate creation? What is the meaning of "A record packet with illegal version was received"? This is a bug or a mismatch configuration? Thanks in advance.

1 0

TLS certificates
by Matthew Edlefsen 13 Jun '09

13 Jun '09

Hello, I'm trying to get TLS setup with openldap and am having some issues. I have a CA signed certificate (not self-signed) and have created a chain with my CA cert and the root CA cert. I've verified that it works with openssl verify -CAfile on both the client and server but then when I try to connect using ldaps I get the following error on the client: TLS certificate verification: depth: 2, err: 19, subject: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root, issuer: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. I assume it's saying that the root CA is self signed, but if I don't include it in the chain it says it can't trust the CA. Anybody have any ideas? Thanks, Matt Edlefsen Earlham Computing Services

2 1

Re: OpenLDAP and AD integration
by Santosh Balan 13 Jun '09

13 Jun '09

Hi, I didn't mean "urgent" and "expecting a reply" as a demanding request. However I would like a voluntary reply at the earliest so that I can go ahead with my work. Sorry for a demanding request, however would like your support and reply in current and future issues. Thanks and Regards, Santosh Balan _+91-9819419509 ----- Original Message ----- From: "Michael Ströder" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: OpenLDAP and AD integration Date: Fri, 12 Jun 2009 13:33:40 +0200 Santosh Balan wrote: > > I am newbee to this community and want to know how I can integrate an > OpenLdap Server with MS Active Directory. Such that I create a user in > LDAP it reflects in AD as well and vice-a-versa. Similarly any changes > should effect on both AD and LDAP. Also I want to know how this can be > done with a technical documentation. This is not possible just by OpenLDAP and AD server configuration. You need a custom sync process for that. There might be already some implementations available but most times they won't fit exactly your requirements. So I'd recommend to write your own custom script to do it. > Also a user incase AD is not available gets authenticated using LDAP > and vice-a-versa. Authenticated at which client component? E.g. it does not make sense to authenticate the user during Windows logon directly against the OpenLDAP user account since there's a bit more done during a Windows domain logon. > Your urgent help on this issue will be highly appreciated. Expecting a > reply from you at the earliest. Well, "urgent" and "expecting a reply" is a little bit demanding on a mailing list where volunteers are answering in their spare time. You might wanna hire a consultancy company: http://www.openldap.org/support/ Ciao, Michael. -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com

1 0

installation query
by ashok kumar 12 Jun '09

12 Jun '09

Hi, I am trying to install openldap 2.4.16 and bdb 4.7.25 on my CentOS linux OS 64bit. I was wondering that the setups available on websites use 32bit libraries or 64 bit libraries. If they use 32bit libraries by default then how do i make them use 64 bit libraries. Regards, Ashok Kumar

1 0

Translucent Proxy & Schemas
by Stéphane Jeanjean 12 Jun '09

12 Jun '09

Hello, I would like to know if it's possible to add a schema in the local database which is not in the remote one with Translucent Proxy. Is it possible to add objects in local database without adding the schema to the remote db ? It looks ok when the attributes of the new class are added to the entries in the local db but when a search request is done, only atttributes from the classes declared in the remote db are returned :( Thanks for your help, Stéphane

2 2

count the number of registered users in ldap
by KALPANA ANANTH 12 Jun '09

12 Jun '09

Hi , Is there any specific command to count the number of registered entries/users in ldapserver todate? This will help with us with the statitistics of how many users are registered? Thanks! Kalpana _________________________________________________________________ Windows Live™: Keep your life in sync. http://windowslive.com/explore?ocid=TXT_TAGLM_WL_BR_life_in_synch_062009

3 2

Chain overlay and ACLs
by John Kane 11 Jun '09

11 Jun '09

Noob question: I've set up chaining from my slave LDAP to the master. It seemed everything was working fine, until I realize that ANY user can now make modifications in the LDAP DB if it is done from the slave. My ALCs allow full write access to the chain binddn. If I don't set this, chaining fails. But with it set, any valid, authenticated user can make DB changes (full write access). I am confused as to why this is happening. Info is below. Thanks in advance, John Version: openldap-2.3.43 ACLs on master (and slave): # Who has access to read or change the password attribute access to attrs=userPassword,shadowLastChange by self write by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous auth by * none # Keep partners out of mycompany db access to dn.sub="o=mycompany,dc=example,dc=net" by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by dn.sub="o=partner_x,dc=example,dc=net" none by anonymous none by * none # Allow the tool access to add and modify ToolAccessLevel, etc access to filter="(|(objectClass=DiagnosticsPerson)(objectClass=ToolsAccess))" by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read # Finally, allow the main LDAP users access to everything else access to * by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read And the LDIFs: # admin_partner_x, partner_x, example.net dn: cn=admin_partner_x,o=partner_x,dc=example,dc=net cn: admin_partner_x objectClass: groupOfNames description: Group of Admins with full access member: cn=ldapChain,o=partner_x,dc=example,dc=net member: cn=ldapEditor,o=partner_x,dc=example,dc=net # admin_partner_x_RO, partner_x, example.net dn: cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net cn: admin_partner_x_RO objectClass: groupOfNames description: Group of Admins with readonly access member: cn=simpleBind,o=partner_x,dc=example,dc=net member: cn=syncRepl,o=partner_x,dc=example,dc=net # tooladmin, partner_x, example.net dn: cn=tooladmin,o=partner_x,dc=example,dc=net sn: tooladmin cn: tooladmin userPassword:: dG9vbGFkbWlu description: To allow access for tools. Per ACLs, this guy has write access to passwords and tool levels objectClass: person # jkane2, people, partner_x, example.net dn: uid=jkane2,ou=people,o=partner_x,dc=example,dc=net objectClass: person objectClass: posixAccount objectClass: DiagnosticsPerson objectClass: ToolsAccess cn: jkane2 loginShell: /bin/bash uidNumber: 3805 uid: jkane2 homeDirectory: /jkane2 sn: jkane2 gidNumber: 950 ToolAccessLevel: subinfo ToolDomain: example.net DiagAccessLevel: DIAG_USER_T1 DiagGroup: partner_x userPassword:: xxxxxxxxxxx From the master, using some arbitrary user: [jkane2@master]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" ldapadd: Insufficient access (50) additional info: no write access to parent From the slave: [jkane2@slave]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" [jkane2@slave]$ ldapsearch -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' uid=testauserC -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: uid=testauserC # requesting: ALL # # testauserC, people, partner_x, example.net dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net uid: testauserC description: asdf objectClass: account objectClass: simpleSecurityObject # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 4

slapadd speed
by ashok kumar 11 Jun '09

11 Jun '09

Hi, I am new to openldap and I am trying to use it for 50 million records. I am using slapadd to add this data but it is processing around 1 million records in 5 hour. So this will take days to stage properly. I will have to update database every 20 days with about 10 million records. I wish to know what enhancements I have to do in my setup considering following configurations. I am using openldap 2.4.16 with Berkley DB 4.5.20 on CentOS linux OS 32 bit machine with 4GB RAM. slapd.conf : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/xyz.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args backend bdb database bdb suffix "o=sgi,c=us" rootdn "o=sgi,c=us" checkpoint 128 15 rootpw xyz directory /usr/local/var/openldap-data index objectClass eq index attribute1 eq index attribute2 eq DBCONFIG: set_cachesize 1 268435456 1 set_flags DB_LOG_AUTOREMOVE Regards, Ashok Kumar

4 5

Re: hardware requirement
by Quanah Gibson-Mount 11 Jun '09

11 Jun '09

--On Thursday, June 11, 2009 9:19 PM +0530 mukim pathan <mukim.iitkgp(a)gmail.com> wrote: > I will be using latest openldap release with Berkley database. If 32 bit > is not capable of it then please tell me the resource requirement for 64 > bit. Keep replies on the list if you want answers. The technical limitations of 32-bit OSes are well documented. Since I have no idea how large your database is when fully loaded, I can not say for certain that you'll hit (or have hit) those limits, but I find it *highly* likely. In any case, in this day and age, there is really no excuse to be running 32-bit OSes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

hardware requirement
by mukim pathan 11 Jun '09

11 Jun '09

Hi, I have to setup a database for storing 100million entries, each entry with 4 columns. I will be using centOS linux OS for this. I checked previous queries regarding hardware, I found that with 32 bit machine, processing might get slow for 20million above records. I want to ask what should be the hardware configuration for this? Thank you in advance. Regards, Mukim Pathan

2 1

some thoughts about RDN
by Paweł Madej 11 Jun '09

11 Jun '09

Hello, I have such RDN cn=user1,dc=example,dc=com but my webmail software knows users only by emails (which is attribute to cn=user1,dc=example,dc=com) My question is how can i authenticate in LDAP using provided email? I tried sth like mail=test(a)example.com,dc=example,dc=com but ldap refuses such login. Thanks in advance for help Greets Pawel

4 9

Howto synchronization the username and password between windows AD and OpenLDAP server?
by openbsd shen 11 Jun '09

11 Jun '09

I hve Windows AD server and OpenLDAP server, may I synchronization username and passport between them?

1 0

solaris patch vs. linux patch
by Brett ＠Google 11 Jun '09

11 Jun '09

Hello, Just wondering if anybody knows why solaris patch refuses to process the bdb 4.7 patch files, where the patch command on linux works perfectly. Ie: on solaris : patch -p0 <patch.4.7.25.1 Looks like a context diff to me... Hunk #1 failed at line 187. Hunk #3 failed at line 296. 2 out of 4 hunks failed: saving rejects to sequence/sequence.c.rej done Works fine on a linux machine ? Have tried patch 2.5.9 built from soruce on gnu.org, this fails also. (i usually end up patching on linux, and then copying the patched tarball back to solaris.. but just wondering?) Cheers Brett

4 6

password change and ppolicy
by tizo 11 Jun '09

11 Jun '09

Hi there, We are using OpenLDAP 2.4.16 with ppolicy, to authenticate users for a JEE application. Authentication works great (with JNDI), and we are receiving ppolicy response controls without problem. In that way, the user knows when the password is about to expired, when the password have been reseted, etc. Now we want to offer users to change passwords from the application. Before starting this, I have been testing password changing with phpLDAPAdmin. The fact is that I could only change a user password with clear text. I guess that this behaviour happens because we have pwdCheckQulity setting in 2 in our default password policy. So, when the client (phpLDAPAdmin) tries to modify the password enconding it, the server (OpenLDAP) cannot check the min length of the password, as it is encoded, and then fails. I am guessing too, that phpLDAPAdmin is performing a simple modify operation to change the password, as it is stored in clear text. On the other hand, I could change passwords with ldappasswd withouth problem, and they are stored with SSHA. I know that this command uses RFC 3062. So, I am wondering which is the best way to change the password from a Java application. I guess that, if I have pwdCheckQulity setting in 2, the password should travel in clear text, so that ppolicy can check its min lenght for example. But I would like it to be stored encoded. How could I do that?. Do I have to use RFC 3062?. Do you know any Java implementation of the client side for that RFC?. Thanks very much, tizo

2 2

problem in my mirrormode
by Wissem BARAKET 10 Jun '09

10 Jun '09

Hello : i would like install a mirrormode in my ldap but i don t can make fonction : my OS debian lenny and mu open ldap 2.4.16 can you help me this my config in my first server : # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: serverID 1 # Features to permit allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema TLSCertificateFile /etc/ldap/tls/ldap_bdc_cert.pem TLSCertificateKeyFile /etc/ldap/tls/ldap_bdc_key.pem # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel sync # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb #moduleload syncprov # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=xxx,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=xxx,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,ou=Users,dc=xxx,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read access to dn.base="cn=Subschema" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,dc=xxx,dc=com" read by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=xxx,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" rootdn "cn=admin,dc=xxx,dc=com" moduleload syncprov index entryCSN,entryUUID eq lastmod on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE syncrepl rid=001 provider=ldaps://debian.xxx.com:636 type=refreshAndPersist credentials=mirrormode searchbase="dc=xxx,dc=com" filter="(objectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com" binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy syncrepl rid=002 provider=ldaps://debian1.xxx.com:636 type=refreshAndPersist credentials=mirrormode searchbase="dc=luniweb,dc=com" filter="(objectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com"binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy mirrormode on the second server : # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: serverID 1 # Features to permit allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema TLSCertificateFile /etc/ldap/tls/ldap_pdc_cert.pem TLSCertificateKeyFile /etc/ldap/tls/ldap_pdc_key.pem # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel sync # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=xxx,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=xxx,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,ou=Users,dc=xxx,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read #access to dn.base="cn=Subschema"by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,dc=xxx,dc=com" read by * read #defaultsearchbase dc=xxx,dc=com #sasl_host localhost #sasl_secprops none password-hash {MD5} # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=xxx,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" rootdn "cn=admin,dc=xxx,dc=com" index entryCSN,entryUUID eq lastmod on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE syncrepl rid=002 provider=ldaps://debian1.xxx.com:636 type=refreshAndPersistcredentials=mirrormode searchbase="dc=xxx,dc=com" filter="(objectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com"binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy syncrepl rid=001 provider=ldaps://debian.xxx.com:636 type=refreshAndPersist credentials=mirrormode searchbase="dc=xxx,dc=com" filter="(obj#ectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com" binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy mirrormode on thanks

2 1

Re: UCARP setup
by Ivan Ordonez 10 Jun '09

10 Jun '09

Matt Kassawara wrote: > I don't see why not... you'll just need to configure it to use the > hostname/IP pointing to the active server. > > On Jun 9, 2009, at 4:39 PM, Ivan Ordonez wrote: > >> >> >> Matt Kassawara wrote: >>> >>> I'd recommend looking at mirror mode. >>> http://www.openldap.org/doc/admin24/replication.html >>> >>> On Tue, Jun 9, 2009 at 2:40 PM, Ivan Ordonez >>> <iordonez(a)nature.berkeley.edu> wrote: >>> Hi, >>> >>> Has anyone here have any experience using UCARP with openldap? >>> >>> http://www.ucarp.org/project/ucarp >>> >>> Our department want to use UCARP to provide automatic failover but >>> I'm at lost on how to make two machines replicate openldap data. If >>> you have a better suggestion, or ideas on how to make it work, >>> please let me know. >>> >>> Thanks in advance. >>> >>> -Ivan >>> >> >> Can you do a mirror mode and at the same time, have a consumer, for >> example, a BDC sitting on a different subnet? I'll give it a shot. Thanks for all the help. -Ivan

1 0

Error while using relay
by venish khant 10 Jun '09

10 Jun '09

Hi all, I am trying to access LDAP search using email address instead of DN. For that I am using overlay rwm, and relay. When I gave relay "dc=example,dc=com", slapd give me error like(unknown directive <relay> inside backend database definition). I all ready enabled modules for relay(back_relay.so) and rwm(rwm.so). openLDAP => 2.4.15 Backend => bdb (Berkeley Database) Regards -- Venish Khant www.deeproot.co.in

5 11

CRL question
by joakim＠comex.se 10 Jun '09

10 Jun '09

Hi, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all". When the CRL has expired the client is not allowed to make a TLS connection. My question is whether it is possible to configure openldap to let the client connect to the server (possibly with a warning) even when the CRL has expired. Does anyone know if that is possible? /Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

2 3

UCARP setup
by Ivan Ordonez 10 Jun '09

10 Jun '09

Hi, Has anyone here have any experience using UCARP with openldap? http://www.ucarp.org/project/ucarp Our department want to use UCARP to provide automatic failover but I'm at lost on how to make two machines replicate openldap data. If you have a better suggestion, or ideas on how to make it work, please let me know. Thanks in advance. -Ivan

2 2

using search filter for operational attributes (pwdAccountLockedTime)
by Tyler Gates 09 Jun '09

09 Jun '09

Hey guys, From my understanding pwdAccountLockedTime is an operational attribute and by ldap v3 definition it must be 'requested' to obtain the value. However, when I include this attribute as part of a search filter against one of my master servers I get results back but when I run it against my proxy (back_ldap) ldap server, I get nothing. Only when I request the attribute do I get something off the proxy. If operational attributes should not be seen unless requesting them then how come on my master servers it returns fine but not on the proxy? Is there a way to make the proxy behave the same as the master's in this regard? Or do I possible have some ACL issues? Thanks, Tyler

2 2

make test problem during openldap 2.4.16 installation
by mukim pathan 09 Jun '09

09 Jun '09

Hi, I am trying to install new release of openldap 2.4.16. I have installed Berkley DB 4.7. ./configure went normally but "make test" got hang. Following is the message it showed... >>>>> Test succeeded >>>>> ./scripts/test000-rootdse completed OK. >>>>> Starting test001-slapadd ... running defines.sh Running slapadd to build slapd database... Is there any solution to this? Regards, Mukim Pathan

3 2

Practices : DN filtering alternatives
by Lorenzo Pastrana 09 Jun '09

09 Jun '09

I've been reading (and actually experienced) that DN, not being a full class attribute, is not filterable (read : with wildcards / patterns). I've been thinking about 'duplicating' the DN in an attribute since the hidden 'entryDN' attribute is not accessible either but that sounds ugly and redundant to me. If there is a commonly used alternative to filtering DNs I'd be glad to hear. Thanks. Lorenzo Pastrana R&D Head @ Happy End -------------------------- Web Shop Multimédia Design Visual Communication & Publishing -------------------------- Tél.: +33 1 42 47 83 09 Fax.: +33 1 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

4 4

Problems with replication (syncrepl, syncprov)
by Florian Götz 09 Jun '09

09 Jun '09

Hi everybody, i got two OpenLDAPs (2.4.12) running. One providing the syncrepl Overlay and one the syncprov. The LDAP system is used for user authentication over a samba server. I created a user "backup" with all the rights to see all parts of the DIT of the primary ldap. If I connect to the primary with this user I can see all entries. The sync-configuration used on both machines is attached at the end of this mail. Now I got the following problem that only the ou´s group and users get syncronized on the backup machine. The rest like "computers" and other ou´s don´t get replicated, so I don´t get a full backup of the primary LDAP. Can someone help me with the config? I think the one attached should work, but ... :) Mit freundlichen Grüßen Florian Götz Primary LDAP ===================== # Provide Backupdata for second machine overlay syncprov syncprov-checkpoint 10 2 syncprov-sessionlog 100 Backup LDAP ====================== # Backup from primary LDAP syncrepl rid=1 provider=ldap://x.x.x.x binddn="uid=backup,ou=Users,dc=example,dc=de" bindmethod=simple credentials="*********" searchbase="dc=example,dc=de" filter="objectClass=*" type=refreshAndPersist retry="5 10 30 +" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6569 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Uncategorized exception
by mukim pathan 09 Jun '09

09 Jun '09

Hi, I am getting following exception while i am doing search using spring-ldap. org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' Caused by: javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at javax.naming.directory.InitialDirContext.search(Unknown Source) at org.springframework.ldap.core.LdapTemplate$4.executeSearch(LdapTemplate.java:230) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:272) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:234) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:548) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:532) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:383) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:406) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:424) I don't see any reason for this as everything was working fine and suddenly this exception came. Can you tell me any reason for this? Regards, Mukim Pathan

2 1

Newbie question about ldif
by J. Bakshi 09 Jun '09

09 Jun '09

Dear all, greetings to all. Hope I have joined the right list to discuss about openldap technology. I am working with typo3 and openldap. Typo3 is a CMS ( content management system ) just like Drupal, Joomla etc.. I like to implement an openldap based system where I can have a organization based structure like department, company etc and can store persons with their name, address, contact along with userid/password which will be used to authenticate the front end user login in typo3. To start with I need a well designed ldif file. I have already get some example ldif from internet but those are missing the useris/password authentication. More over the " objectclass: organizationalPerson " " objectclass: inetOrgPerson " "objectClass: dcObject" "objectClass: organization" are very much confusing :-( Could any one kindly enlighten me a little about those "objectcalss" and which one is best suited for my requirement ? A sample ldif file with little explanation will help me a great. Thanks

3 5

Help with ACL's
by Tyler Gates 08 Jun '09

08 Jun '09

Hello, I'm having a hard time setting some ACL's for my particular setup. I have a structure as follows: dn: uid=*,ou=people,dc=example,dc=com # uid contains several unix/linux user ids dn: cn=*,ou=groups,dc=example,dc=com # cn contains several unix/linux groups. uid's (not the complete dn) are supplied to the memberUid fields What I would like to do is place an organizationalRole in each group and have ACL's setup so that it's uniqueMembers have access to certain attrs (say for example sn) for the uid's (which correspond to those in ou=people) specified in the memberUid fields of the group in which the organizationalRole is placed. psuedo code would be something as follows: access to group/posixAccount/memberUid.regex("cn=(.*),ou=groups,dc=example,dc=com") attrs sn by group/organizationalRole/uniqueMembers/.regex("cn=admin,cn=$1,ou=groups,dc=example,dc=com") write Thanks, Tyler

3 9

ldapi -> "Confidentiality required" problem
by Gunnar Frenzel 08 Jun '09

08 Jun '09

Hello, I've configured openldap (v2.4.16 on FreeBSD 7.2) to listen on ldaps (with self signed certificate) as well as ldapi. rc.cof: slapd_enable="YES" slapd_flags='-h "ldapi:///var/run/openldap/ldapi/ ldaps:///"' slapd_owner="ldap:ldap" slapd_sockets="/var/run/openldap/ldapi" slapd.conf: database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Manager,dc=mydomain,dc=com" rootpw password directory /var/db/openldap-data index objectClass eq security ssf=128 TLSCACertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/ssl/cert.key TLSVerifyClient never Connecting to ldaps (port 636) with clients such as Thunderbird, Apache Directory Studio works fine. But when I try to connect via ldapi (port 389) from a webmail tool on the same server I always get the error "Confidentiality required" from openldap. I want to connect to ldapi (as it is local on the server) without TLS or other encryption but openldap doesn't seem to allow that in my configuration. I tried localSSF set to 0 which doesn't make any difference... I'd be thankful for any advice with this issue. Best regards, Gunnar

3 6

openldap, bdb versions and performance issue
by jakjr 08 Jun '09

08 Jun '09

Hello Guys, Last week I upgraded our openldap server to 2.4.16 and we had terrible performance problems. Quanah suggested me to use this options with bdb compilation: --enable-posixmutexes --with-mutex=POSIX/pthreads I compiled and tested openldap with different versions of BDB and the results are odd: OpenLDAP version BDB version Test time 1 (seconds) Test time 2 (seconds) Test time 3 (seconds) 2.4.16 BDB 4.5.20 256.2008 260.5799 273.933 2.4.16 BDB 4.6.21 265.428 260.2496 255.0599 2.4.16 BDB 4.7.25 261.5573 254.2001 259.9456 2.3.30-5 (debian package) BDB 4.2.52 257.7173 251.3512 250.8456 The test consist on make some operations: for ($i=0; $i<=1; $i++) { make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); } Like you can see, the best result was using to old version of openldap server with the old version of BDB. Even more odd was the use of CPU. Using these old versions, the consume of CPU was half then using the new ones. The slapd.conf and DB_CONFIG were the same on all tests. Here are the compilation lines: BDB: CFLAGS="-Wall -g -O2" CPPFLAGS="-I/usr/include/tcl8.5" LDFLAGS="-lpthread" ../dist/configure --enable-cxx --enable-compat185 --enable-rpc --enable-tcl --enable-posixmutexes --with-uniquename --with-tcl=/usr/lib/tcl8.5 --with-mutex=POSIX/pthreads --enable-test Openldap: CFLAGS="-Wall -g -D_FILE_OFFSET_BITS=64 -O2" ./configure --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc --localstatedir=/var --mandir=/usr/share/man --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --enable-spasswd --enable-modules --enable-rewrite --enable-slp --enable-wrappers --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-meta=mod --enable-monitor=mod --enable-relay=mod --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc DB_CONFIG: set_cachesize 0 524288000 0 set_lk_max_objects 15000 set_lk_max_locks 15000 set_lk_max_lockers 15000 set_shm_key 5 slapd.conf: some index and cachesize 10000 idlcachesize 10000 Is there some wrong or these are the expected results ? I appreciate any tip. Best regards, João Alfredo

1 0

slapcat unable to make ldif file with size > 2GB
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am trying to create backup of database using slapcat. But as soon as .ldif file reaches size of 2GB, it is giving me an error of File Size Limit Exceeded and quitting the process. I am using bdb 2.3.43. Is there anything I can do about it? Regards, Mukim Pathan

3 4

CRL expired
by joakim＠comex.se 08 Jun '09

08 Jun '09

Hello, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all" in it. When the CRL has expired the client is not allowed to make an TLS connect. My question is whether it is possible to configure openldap to still let the client connect to the server (possibly with a warning) when the CRL has expired. Does anyone know if it is possible and of it can be achieved in that case? Regards, Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

1 0

Bind/search more than one tree and server
by Schneider, Thomas-P65851 05 Jun '09

05 Jun '09

I am seeking a solution to be able to bind to, and search more than one tree and server per request using Linux. My goal is to maintain separate groups of user accounts on an OpenLDAP server -- e.g. local and network. The groups of users can have overlapping posixAccount uid attributes, but will have unique uidNumber attributes. My main use case is authentication, which requires checking a remote LDAP server first -- currently AD which requires attribute re-mapping), then network tree on the local LDAP (openldap) if not in remote server, then the local tree on local server if not in the first tree. I have tried referrals and rewrites, but nothing I've tried worked. It looks like the creation of a custom overlay will work, but I'd rather not go down that path. I have also tried using PAM, but pam_ldap is limited to one configuration per service (modifying pam_ldap is an option at this point). Thanks, Craig

2 2

pool of Ldap-Directories
by alois blasbichler 05 Jun '09

05 Jun '09

Hello list I have this question - maybe somebody can give me a hint : I need a pool of Ldap-Directories (possible openldap, AD and other) where i can search for. The reason is : there are a lot of applications where can i get my users from one Ldap but where i cant define more Ldaps with different search bases. Is this possible for example with 2 different Openldap-Directories ? Thank you luis

3 3

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 05 Jun '09

05 Jun '09

Thanks for answer, With updateref after syncrepl slave slapd.conf syncrepl rid=000 provider=ldap://ldap-v000 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=mydomain,dc=mydomain2,dc=fr" attrs="*,+" bindmethod=simple binddn="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" credentials=secret updateref "ldap://ldap-v000/" master slapd.conf access to attrs=userPassword by dn="cn=Manager,dc=mydomain,dc=mydomain2,dc=fr" write by dn="cn=samba,dc=mydomain,dc=mydomain2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" write by self write by * none I have LDAP password information update failed: Referral passwd Changing password for user paul-pierre.brun. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Referral passwd: Permission denied Nothing in master ldap log In slave ldap log Jun 5 12:51:34 ldap-v002 slapd[18734]: conn=2 op=2 SRCH base="dc=mydomain,dc=mydomain2,dc=fr" scope=2 deref=0 filter="(&(objectClass=ipHost)(cn=ldap-v000))" Jun 5 12:51:35 ldap-v002 slapd[18734]: conn=2 op=2 SRCH attr=cn ipHostNumber Jun 5 12:51:35 ldap-v002 slapd[18734]: ==> limits_get: conn=2 op=2 self="[anonymous]" this="dc=mydomain,dc=mydomain2,dc=fr" Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_search Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_dn2entry("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access to "dc=mydomain,dc=mydomain2,dc=fr" "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_get: [1] attr entry Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: result not in cache (entry) Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: access to entry "dc=mydomain,dc=mydomain2,dc=fr", attr "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: to all values by "", (=0) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=manager,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=samba,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: self Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: * Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] applying read(=rscxd) (stop) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] mask: read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: search_candidates: base="dc=mydomain,dc=mydomain2,dc=fr" (0x00000001) scope=2 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_dn2idl("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: OR Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa1 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [b49d1940] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read: failed (-30989) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=0, first=0, last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=0 first=0 last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [7ec2180d] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read 6 candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=6, first=15, last=21 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=6 first=15 last=21 Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:36 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_equality_candidates (cn) Regards ----- Mail Original ----- De: masarati(a)aero.polimi.it À: "paulpierre brun" <paulpierre.brun(a)free.fr> Cc: openldap-technical(a)openldap.org Envoyé: Jeudi 4 Juin 2009 17h03:05 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral > > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

create new ldap database query
by mukim pathan 04 Jun '09

04 Jun '09

Hi, I am trying to create new ldap database on new machine and I want to transfer full ldap database from old machine to new machine. Can I just transfer all the database files (.bdb,_db,alock) and expect new database to be at the same stage of old database?? Thanks in advance. Regards, Mukim Pathan

5 6

log files and recovery
by mukim pathan 04 Jun '09

04 Jun '09

Hi all, I am unable to understand the answers for following question which i got on net. This might be naive questions but I really need to know the answers. 1. why does ldap write log files and what are its content? 2. why does ldap go through all log files during recovery? Thank you in advance. Regards, Mukim pathan

2 2

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by masarati＠aero.polimi.it 04 Jun '09

04 Jun '09

> > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 04 Jun '09

04 Jun '09

Objet: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral Hello, I try to change password on customer, to a referal thru a overlay chain config. I have answer LDAP password information update failed: Server is unwilling to perform. OS REDHAT 5.2. openldap openldap-2.4.16 could you help me ? Thanks Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral passwd: Permission denied Master conf ldap-v000 ---------------------- overlay syncprov syncprov-checkpoint 100 10 # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none Slave conf ---------- overlay chain chain-uri ldap://ldap-v000/ chain-idassert-bind bindmethod=simple binddn="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" credentials=secret mode=self flags=non-prescriptive # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user #access to dn.subtree="ou=Aliases,dc=mydomaine,dc=mydomaine2,dc=fr" by * read access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none

1 0

openldap login issues
by Serge Fonville 04 Jun '09

04 Jun '09

Hi, I'm new to ldap, so please be gentle ;-) I have a box running CentOS 5.3 wit OpenLDAP 2.3.43. When I run getent passwd fo0072 (which is my username), this was advised as a check I get nothing. when I su - fo0072 as root, it logs in as expected, when I try to login trough GDM I get a invalid username/passwd error when I press CTRL-F1 and login to the console it logs on without any trouble. This suggests to me thatt there is something wrong in my config, but I checked everything, but could not find it. I'll post the necessary config files and ldifs when requested Any help is greatly appreciated. Thanks in advance. Regards, Serge Fonville

2 3

OpenLDAP support for DIT Structure Rules
by James Lentini 04 Jun '09

04 Jun '09

The OpenLDAP FAQ http://www.openldap.org/faq/index.cgi?_highlightWords=structure&file=1474 and TODO file http://www.openldap.org/devel/cvsweb.cgi/doc/devel/todo?hideattic=1&sortbyd… indicate that OpenLDAP does not currently support DIT Structure Rules. Is this correct? -james

7 11

LDAP service doesn't start
by Emanuele Gesuato 03 Jun '09

03 Jun '09

Hi there, We are using OpenLDAP 2.2.29 (the full name of the setup is "openldap-2.2.29-db-4.3.29-openssl-0.9.8a-win32_Setup.exe") for a large number of Windows 2000 oses with service pack 4. Often, it happens that the openldap service doesn't start and in the event log i can see the error code "21". Right now i can solve the problem reinstalling openldap and it works but i would like to know the cause of the problem (if any) and if there is another way to solve it. Maybe it is a dumb question but is it possible to retrieve the dump of ldap if the service doesn't start ? Thanks for any help, Emanuele Gesuato

3 2

Adding a attribute of a new schema to an existing entry
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Hi everyone. I'm trying to add a attribute of a new schema to an existing entry. I've created the schema called 'owlco' (I've remove almost fields to concision): ---------------------------------------------------------------------- attributetype ( 1.3.6.1.4.1.4203.666.0.1 NAME 'owlChurchNumber' DESC 'Church Number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) attributetype ( 1.3.6.1.4.1.4203.666.0.2 NAME 'owlSupernatural' DESC 'You wouldn't understand' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) ... objectclass ( 1.3.6.1.4.1.4203.666.1.1 NAME 'owlco' DESC 'Classe utilizada pela Owl Corporation' SUP inetOrgPerson STRUCTURAL MUST ( owlChurchNumber ) MAY ( owlDevotes $ owlSupernatural ) ) ---------------------------------------------------------------------- And I've added the schema: ---------------------------------------------------------------------- include /etc/openldap/schema/owlco.schema ---------------------------------------------------------------------- So, before all that actions I've created my whole directory and now I have all the entries without some mandatory owlco's fields (mandatory not to LDAP but to my business). So, now I'm trying: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber owlChurchNumber: 3212 And I've got: ---------------------------------------------------------------------- ldap_modify: Object class violation (65) additional info: attribute 'owlChurchNumber' not allowed ---------------------------------------------------------------------- Ok, absolutely normal. My schema depends on inetorgperson. So... ---------------------------------------------------------------------- dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: owlco # ldapmodify: wrong attributeType at line 4, entr ---------------------------------------------------------------------- I didn't stop on that try, I've tried a lot more combinations without success. I've read the 'http://www.zytrax.com/books/ldap/ch5/', specially the topic 'To add a new AUXILIARY objectclass to an existing entry requires'. dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify objectclass: inetorgperson objectclass: owlco But all I get is: ldapmodify: modify operation type is missing at line I'm stuck on that... Yep, I've tried too: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: inetorgperson objectclass: owlco And: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber objectclass: inetorgperson objectclass: owlco owlChurchNumber: 2342 But... got nothing... []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Adding a attribute of a new schema to an existing entry - FIXED
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Ok, I think I got it. I was using a 'SUP inetOrgPerson STRUCTURAL' to my new scheme. So, when I've changed to 'SUP top AUXILIARY' I finally could add my new attributes. I think it's because ldapmodify was trying to modify the structural object to my entry and it's impossible (just at creation time). So, here's my ldif (it's working): dn: uid=unicorn,ou=ground,dc=dinosaurs,dc=jurassic,dc=history changetype: modify add: objectClass objectClass: oilCorporation - add: oilCorporationTypeOfThing oilCorporationTypeOfThing: withcandle []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

'unary operator expected' error when TLS turned on
by John Kane 02 Jun '09

02 Jun '09

I've also posted this message on the OpenSSL forum: I just turned on TLS on my LDAP (per instructions on http://www.openldap.org/faq/data/cache/185.html). Now all of my Linux servers (RH EL5) give the following error on login: -bash: [: =: unary operator expected The error goes away when I turn TLS off. I cannot determine what is causing this error, or even which file contains the error. I've gone through my LDAP config files, cannot find an issue in any of these. Other than my cacert.pem, and the LDAP config files, are there other files that are read only when TLS is turned on? Thanks, John I am running Openldap 2.3.43-2.el5 & OpenSSL 0.9.8b-10.el5 (RPMs from Red Hat, which I am required to use unless I put up a BIG fight). ++++ Here's my configs ++++ I turn on TLS by adding the following in my /etc/ldap.conf (pam/nss file): ssl start_tls tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts/ and have the following in my /etc/openldap/ldap.conf (openldap file): HOST 172.25.3.97 BASE dc=example,dc=net TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow and my (self-signed) cacert: [root@serverx cacerts]# openssl x509 -text -in /etc/openldap/cacerts/cacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Validity Not Before: May 28 04:37:13 2009 GMT Not After : May 27 04:37:13 2012 GMT Subject: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b3:bf:f0:18:5d:7e:57:0a:ce:15:3c:28:2a:81: 6d:e6:c5:31:98:7e:cc:09:03:d2:28:f2:33:3e:88: 11:5f:7d:e1:18:33:38:7d:f5:fa:9d:89:a8:95:16: 08:00:81:08:29:ac:37:b3:b1:2b:f3:20:52:15:d7: 19:44:92:9c:45:e7:2e:58:fe:7e:07:d4:1f:5a:ad: 59:91:37:84:14:a8:4e:df:54:a2:62:66:38:9b:f0: cf:48:01:68:0d:3a:7c:93:83:02:48:e0:76:a1:5c: f9:05:3b:49:1e:03:9a:fd:ea:ee:79:f7:87:66:96: b0:69:39:e1:e6:1a:bd:9e:0d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C X509v3 Authority Key Identifier: keyid:0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C Signature Algorithm: sha1WithRSAEncryption 28:52:3d:9c:90:d1:89:00:d7:9d:3b:06:a6:32:28:e8:c0:8d: 9d:5a:0b:79:bb:1a:c9:1a:8d:c6:3a:a5:ec:5d:4c:9f:20:4c: c6:1e:41:df:7d:d5:fc:45:09:2b:4b:7c:ff:38:aa:ea:33:a0: 4a:be:7c:84:7c:58:e8:98:9b:c9:0e:4b:5b:11:c6:28:84:b1: 3f:bb:30:03:f6:38:40:9f:2d:32:bc:3a:97:b8:6f:fd:aa:9f: 67:a6:27:07:53:b2:40:41:86:b7:02:f2:6b:07:6f:1b:74:87: 63:3b:1b:89:13:08:cb:32:f0:3c:3b:5e:d6:df:e3:91:19:86: 7a:d4 -----BEGIN CERTIFICATE----- MIIDDzCCAnigAwIBAgIBADANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UERhMCVVMx DjAMBgNVBAgTBVRleGFzMRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdT aWduZXJzMRwwGgYDVQQDExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcN AQkBFhtqb2huLmthbmVAcHJvZGVhc3lzdGV3cy5jb20wHhcNMDkwNTI4MDQzNzEz WhcNMTIwNTI3MDQzNzEzWjCBjjELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFz MRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdTaWduZXJzMRwwGgYDVQQD ExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcNAQkBFhtqb2huLmthbmVA cHJvZGVhc3lzdGVtcy5jb20wgZ8wDQYJKoZIhvcNAQE1BQADgY0AMIGJAoGBALO/ 8BhdflcKzhU8KCqBbebFMZh+xAkD0ijyMz6IEV994RgzNX31+p2JqJUWCACBCCms N7OxK/MgUhXXGUSSnEXnLlj+fgfUH1qtWZE3hBSoTd9UomJmOJvwz0gBaA06fJOD AkjgdqFc+QU7SR4Dmv3q7nn3h2aWsGl54eYavZ4NAgMBAAGjezB5MAkGA1UdEwQC MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl MB0GA1UdDgQWBBQL+30LDRejzXkCo6OSVxVv3jgHPfAfBgNVHSMEGDAWgBQL+30L DRejzXkCo6OSVxVv3jgHPDANBgkqhkiG9w0BAQUFAAOBgQAoUj2ckOGJANedOwam MijowI2dWgt5uxrJGo3GOqXsXUyfIEzGHkHffdD8RQkrS3z/OKrqM6BKvnyEfFjo mJ7JDktbEcYohLE/uzAD9jhAny0yvDqXuG/9qp9npicHU7JAQYa3AvJrB28bdIdo OxuJEwjLNvA8O17W3+ORGYZ61A== -----END CERTIFICATE----- This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 5

Re: 2.4.16 performance issues
by jakjr 02 Jun '09

02 Jun '09

Thanks again, just one more question. Openldap 2.4.16 depends on BDB 4.4 or higher, right ? ( http://www.openldap.org/doc/admin24/appendix-recommended-versions.html) Best Regards, João Alfredo On Mon, Jun 1, 2009 at 4:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 3:50 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling >> options: >> >> >> --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do >> not use these options. >> >> Correct ? >> > > With the exception of BDB 4.3, which should never be used, yes, that is > correct. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 2

Re: 2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Thanks for your reply, Quanah I red some links: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421946 http://www.mail-archive.com/openldap-software@openldap.org/msg15013.html http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg627930.html So, the abstract is: bdb 4.2 is good. bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling options: --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do not use these options. Correct ? Thanks again. On Mon, Jun 1, 2009 at 2:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 12:11 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > > My suspecion is about debian etch and its packages version (berkley db, >> gcc). >> > > Rebuild BDB with the correct mutex options, since Debian refuses to do > this. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Hello Guys, Last week we upgraded our openldap server from version 2.3.30-5 (debian lenny package) to 2.4.16 (compilation). There wasn't any big changes on config files (slapd.conf and DB_CONFIG). Our server is heavily used (samba + webservices + web applications) in a total of 15 millions operations per day. After the upgrade the new openldap server presented some strange behavior. The ports (389 and 636) sometimes were in a filtered state, denying any new connections and the load of the server was incredibly high. No index or memory problem was detected. My suspecion is about debian etch and its packages version (berkley db, gcc). Any tips ? Best regards, João Alfredo

2 1

server redundancy setup
by Rex Roof 01 Jun '09

01 Jun '09

I'm migrating our existing openLDAP 2.3 servers into a new setup running openLDAP 2.4. I will eventually have 4 or 5 servers, hopefully all having the same synchronized data, and all accepting writes, if need be. Can anyone suggest a configuration where I have 4 servers, all keeping themselves in sync, and all accepting writes? Can multimaster replication work with more than two servers? Is that the right solution here? -Rex

2 3

using -y option for ldapsearch
by Sai 01 Jun '09

01 Jun '09

Hi All, I am trying and writing a script to use ldapsearch. But I want to create a password file and use the "-y" option. I am unable to figure out how to create one. ================================== ldapsearch -x -h <Machine> -p <port> -s one -D <CN> -b <BASE_DN> -y pwdfile -v "(&(cn=fm*))" cn ================================== I tried the following. 1) I tried putting the plaintext password for <CN> in the file and it did not work. 2) I ran slappasswd to generate the hashed password for <CN> and directed the output to this file and it did not work. 3) The file permissions I tried are 700 and 600. What is this "-y" option and am I interpreting it correctly? Is there a specific format that this file should be in? Version Info: ================================== $ rpm -qa|egrep openldap openldap-clients-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 $ ================================== Any help is greatly appreciated. -Sai

2 3

Deleting records while iterating through ldap_result
by Stephen 31 May '09

31 May '09

Hi everyone, I'm using the C SDK and writing a program to prune old directory records. The core logic of the program could go something like this:- rc = ldap_search_ext( ld, .. <rest of parameters> ); while (!done) { rc = ldap_result( ld, .. <rest of parameters>, &searchResult) ; //Delete records matching criteria dn = ldap_get_dn( ld, searchResult ); rc = ldap_delete_ext_s( ld, dn, .. <rest of parameters>); } ------- I have two questions and they are probably related:- Firstly: Can I delete records while iterating through the results of the ldap search? (In higher level languages deleting an item from a collection while navigating through a collection is often bad form. Is that the case here?) Secondly: Can I use the same session handle to delete the records as is used for the search? In the logic above, the session handle is ld, and ld is used for both the search and for the deletion. (I'm expecting I would need to use a different session handle for the logic above to work. Alternatively one could save all the records to be deleted in an array and then after the search loop, the same session handle can be used for all the deletes). Thank you Stephen

2 1

Cannot bind/connect to server outside the LAN
by Stelios A. 28 May '09

28 May '09

Hello all, I need help in three problems that I'm facing with my OpenLDAP implementation please. First problem: I'm able to connect to my LDAP server on 636 port without a problem from the same subnet but not outside the Internet. What I want to achieve is to be able to connect from a particular range of static IP's. The ACL part of my slapd.conf is: access to attrs=userPassword,shadowLastChange by dn="uid=authenticate,ou=System,dc=example.com" read by dn="uid=myusername,ou=Users,ou=bca,dc=example.com" read by anonymous auth by self write access to attrs=givenName,sn,cn,mail by dn="uid=syncrepl,ou=system,dc=example.com" read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by self read by users auth by anonymous auth access to attrs=uid by anonymous read by users read access to dn.regex="^.*,uid=([^,]+),ou=Users,dc=example.com$" by dn.exact,expand="uid=$1,ou=Users,dc=example.com" write access to * by dn.exact="uid=authenticate,ou=System,dc=example.com" none by users none break by self read by users read by * none 2nd problem: The following ACL does not work at all or I'm doing something wrong: access to attrs=givenName,sn,cn,mail by dn="uid=syncrepl,ou=system,dc=example.com" read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by self read by users auth by anonymous auth I can't bind as anonymous from 'some_static_ip' in order to fetch the mail, givenName etc into the Thunderbird address book for example. 3rd problem and last! If I reboot the master server then the slave does not bind correctly and email etc does not work at all even though it is configured on that server (slave). Also when I reboot the servers, master must come up first as otherwise I'm not able to connect until I reboot the slave server. Both servers running on Ubuntu 9.04 if that matters in any way. See output: root@masterldap:/etc/ldap# dpkg -l slapd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Cfg-files/Unpacked/Failed-cfg/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad) ||/ Name Version Description +++-==============-==============-============================================ ii slapd 2.4.15-1ubuntu OpenLDAP server (slapd) I have also attached the whole slapd.conf file of my master server in case that helps more. Any help, suggestion is much appreciated.

1 0

Host and group of users authentication
by Tech Only 28 May '09

28 May '09

Hello, I am trying to make group of users to log on to a particular server depending on LDAP credentials. Telnet , ssh work just fine to the host with out any issues. Once I make changes to the ldap.conf file on the client to use the base dc=test,dc=org uri ldap://1.1.1.1 pam_groupdn cn=ldap,ou=hosts,dc=test,dc=org pam_member_attribute member The server is Debian Openldap and the client is Centos 5.* I get You must be a memeber of cn=ldap,ou=hosts,dc=test,dc=org to login And here are the ldif files I used to create the entries. users.ldif dn: cn=Test1 User1,ou=people,dc=test,dc=org givenName: Test1 sn: User1 cn: Test1 User1 userPassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA== uidNumber: 1001 gidNumber: 1000 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uid: test1 homeDirectory: /home/users/test1 dn: cn=Test2 User2,ou=people,dc=test,dc=org givenName: Test2 sn: User2 cn: Test2 User2 userPassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA== uidNumber: 1002 gidNumber: 1000 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uid: test2 homeDirectory: /home/users/test2 Hosts.ldif dn: cn=ldap,ou=hosts,dc=test,dc=org objectclass: ipHost objectclass: device objectclass: extensibleObject ipHostnumber: 1.1.1.2 cn: ldap member: uid=test1,ou=people,dc=test,dc=org member: uid=test2,ou=people,dc=test,dc=org

1 0

Recommendations for adding "MUST" attribute to in-production objectclass?
by Christopher DeMarco 28 May '09

28 May '09

Greetings, list! I have a custom schema, which defines an objectclass to which all of my "users" belong. I'd like to add a required ("MUST") attribute to that objectclass, but I'm frightened of destroying my users :-) Is the following procedure safe? 1. Add the desired attribute as optional ("MAY") to the objectclass in my schema. Restart slapd. 2. Apply an LDIF change to every node with that particular objectclass, setting that new attribute to some acceptable value. 3. Ensure that my "create a new user" tools will set that attribute. 4. Change my schema to require ("MUST") that attribute within that objectclass. Restart slapd. If not, what is the safe procedure? Is there a better way of adding a required attribute to an in-production objectclass? Thanks! -- Christopher DeMarco <demarco(a)maya.com> IT Director MAYA Group +1-412-708-9660

6 8

ACI and OpenLdap 2.4.11 un debian lenny
by Sebastien Cramatte 27 May '09

27 May '09

Hello How can I use ACI with Openldap 2.4.11 ? I'm running debian lenny and seems that debian package by default has the option --enable-aci I don't have any OpenLDAPAci attribute and OpenLDAPAcl object in core.schema Thank your help Best regards

2 1

Problems with openLDAP and Samba
by Matt Burkhardt 25 May '09

25 May '09

Hope this is the right list - Anyway, I've got openLDAP 2.4.9 on Ubuntu 8.04 along with Samba 3.028 I've got it all installed and used the slapd.d (cn=config) capabilities. I get no errors on start up or stop, can create, modify and delete users and groups. However, I cannot create a user in openLDAP that is usable with Samba. If I go back in and create a Unix user, it will work. I've installed libnss-lapd and configured it - but is this the way it's supposed to work? What should I be looking at? Thanks and sorry for the noob question... -- Matt Burkhardt, M.Sci. Technology Management mlb(a)imparisystems.com (301) 682-7901 502 Fairview Avenue Frederick, MD 21701 http://www.imparisystems.com

3 5

hostObject, host attribute
by François Mehault 25 May '09

25 May '09

Hi all I use the primitive pam_check_host_attr in pam_ldap to filter my users. In OpenLDAP I add the attribute host for each users. I can write « host = hostlab.netplus.fr (fqdn) » to allow just one host for my user, or « host = * » to allow all hosts. But if I write host = 192.168.57.48 (the IP of hostlab.netplus.fr), my user is not able to authenticate on the host, Why I have to write the FQDN and not the IP address. Isn't possible ? And Is it possible to use regexp with the host attribute? Like host = 192.168.45.* ? Regards, François

2 1

Re: Host based authentication using OpenLDAP
by Gavin Henry 25 May '09

25 May '09

----- "Per Kristiansen" <perk(a)funcom.com> wrote: > Hello, I've been working on implementing a LDAP solution for the last > 8 > months (in-between task, you know how it is :D ) Time flies! > I now have a working LDAP directory, have all my users imported, > things > actually work! :D..(jinx!) Excellent work, well done! > But now I wanna get fancy.. > > I've been googeling for some sort of clear description on how I can > set > up a system using groups of hosts and user groups to create a > selective > ACL for ssh'ing to a set of servers based on group membership. > It sounds to me like you are almost here and just need help creating the LDAP groups, ACLs and LDAP search/filters for use with nss_ldap on RHEL 4/5 and Centos? Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

5 12

OpenLDAP 23 client with 24 server?
by Matt Juszczak 25 May '09

25 May '09

Hi All, Most of our boxes are FreeBSD. FreeBSD has ports for openldap22, openldap23, and openldap24. Not using slurpd much anymore in my setups, I decided to run with openldap24 in our recent setup. Setup openldap24 server, and all the FreeBSD clients have openldap24 clients. Everything is working well. Recently, we had to introduce a few RHEL boxes into our setup. We're pointing to the redhat repositories, but they seem to only have openldap23-* client packages. I know I could potentially make my own packages, or perhaps get RPM's from the Internet, but I was wondering if by some chance openldap23 clients (and pam_ldap/nss_ldap libraries) are compatible with openldap24 servers? I would assume the other way around (openldap24 clients with openldap23 servers) would work fine. Thanks! -Matt

3 2

Najmuddin C has sent you a private message
by Najmuddin C 24 May '09

24 May '09

1 0

Matthew GARRETT is out of the office.
by Matthew GARRETT 23 May '09

23 May '09

I will be out of the office starting 22/05/2009 and will not return until 27/05/2009. I will respond to your message when I return. For IT issues please see Drew Harvey Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

1 0

freeBSD 7.0 + passwd + openldap
by François Mehault 22 May '09

22 May '09

Hi all Maybe it's not the good mailing list (sorry !)to post my question, but I hope someone can help me. I use OpenLDAP to authenticate some users. Then I want my users are able to change their passwords themselves with the command passwd. But I have this message : <14:59>[labobe1:~]$ passwd passwd: Sorry, `passwd' can only change passwords for local or NIS users. I read that I have to modify passwd.c in /usr/src/usr.bin/passwd but I can't find this path, I just have /usr/src/sys Is-there another way to change users's password ? Thanks for your help, Regards, François

2 1

Re: Host based authentication using OpenLDAP
by Gavin Henry 22 May '09

22 May '09

> And fyi, here's an example... For a given host: > > dn: cn=hostX,ou=hosts,dc=example,dc=com > objectClass: ipHost > objectClass: authorizedServiceObject > cn: hostX > ipHostNumber: 192.168.1.127 > authorizedService: sshd > authorizedService: ftp > > you use the authorizedService attribute to list the PAM services that > are > available. Then you set ACLs to control who can access each service, > like so: > > access to dn.subtree=ou=hosts,dc=example,dc=com > attrs=authorizedService val.exact=sshd > by group.exact="cn=admins,ou=groups,dc=example,dc=com" write > by peername.ip=192.168.2.0%255.255.255.0 read > by * search > > The overlay performs a Compare operation to check for the required > service, so > if you deny Compare access to a particular service, then users aren't > allowed > to use that service. Very nice! We did something like this for a hosting company that had users accounts with the services that the user was allowed to access and the specific apps had the appropriate filters in the authz/auth searches. Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

MirrorMode and Failover
by Mike A Meyer 22 May '09

22 May '09

1 0

Re: Deleting hundreds of Entry under a OU
by Daniel Spannbauer 22 May '09

22 May '09

Rein Tollevik schrieb: > Michael Ströder wrote: >> Daniel Spannbauer wrote: > >>> I have to deleted abount 500 Entrys under a OU in my LDAP-Tree cause I >>> have to change the objectClass from "account" to "inetorgPerson". >>> Can I do this with ldapdelete? I always used that tool only to delete >>> one entry. >> >> Yes. But you have to provide a file with a list of the DNs of the >> entries to be deleted. >> >> $ ldapdelete -h >> usage: ldapdelete [options] [dn]... >> dn: list of DNs to delete. If not given, it will be readed from stdin >> or from the file specified with "-f file". > > Or you could try to simply change the objectclass and all required > attribute values in one operation using ldapmodify with the "-e relax" > control. It should allow you to replace the structural objectclass, > which otherwise is forbidden. > Hmm, my ldapmodify don't know this switch. How can I delete all entrys under an OU? If this works I delete all entrys and add them with the right ObjectClass. Regards Daniel > Rein -- Daniel Spannbauer Software Entwicklung marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

1 0

Newbie planning for the future
by Alex Moen 21 May '09

21 May '09

Hi all, I am a newbie to LDAP, and have just gotten my first directory server up and running, using openldap. I have been researching and reading a lot of material for quite a while about schema design and planning, and haven't found much pertaining to what I want to do. We have 50+ servers, serving thousands of customers. I want to migrate those servers to LDAP authentication and authorization, but have not found the proper design for multiple servers and duplicated users. Most references just do the basic "example.com" example and never expand on it from there. Ultimately, I would like to allow my admins to have a single account across multiple servers (kind of "authorization account merging"), but still allot the schema to be "separate" enough that duplicated usernames on different machines, corresponding to different people, still exist. Are there any really good references out there that do step-by-step walk throughs of the type of schema designing that I am thinking of? Or is it impossible? Or am I just really making too much of this? :) Thanks for any insights... Alex

3 2

unable to add certain entries
by Andrew Zirkel 19 May '09

19 May '09

I'm having a growing problem where certain entries won't add and I get these errors in slapd stats output: conn=7 op=160 MODRDN dn="cn=Untitled_1,cn=computer_groups,dc=chetwood,dc=local" => bdb_dn2id_add: subtree (cn=mslib,cn=computer_groups,dc=chetwood,dc=local) put failed: -30996 conn=7 op=160 RESULT tag=109 err=80 text=DN index add failed conn=7 op=161 MOD dn="cn=Untitled_1,cn=computer_groups,dc=chetwood,dc=local" conn=7 op=161 MOD attr=cn entry failed schema check: value of naming attribute 'cn' is not present in entry conn=7 op=161 RESULT tag=103 err=64 text=value of naming attribute 'cn' is not present in entry conn=7 op=162 MODRDN dn="cn=Untitled_1,cn=computer_lists,dc=chetwood,dc=local" => bdb_dn2id_add: subtree (cn=mslib,cn=computer_lists,dc=chetwood,dc=local) put failed: -30996 conn=7 op=162 RESULT tag=109 err=80 text=DN index add failed conn=7 op=163 MOD dn="cn=Untitled_1,cn=computer_lists,dc=chetwood,dc=local" conn=7 op=163 MOD attr=cn entry failed schema check: value of naming attribute 'cn' is not present in entry conn=7 op=163 RESULT tag=103 err=64 text=value of naming attribute 'cn' is not present in entry conn=7 op=164 SRCH base="cn=computer_groups,dc=chetwood,dc=local" scope=2 deref=0 filter="(&(objectClass=posixGroup)(objectClass=apple- group)(objectClass=extensibleObject)(|(cn=untitled_1)))" conn=7 op=164 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=7 op=165 ABANDON msg=165 This is slapd 2.3.27, which is included in Apple OSX 10.5. This particular entry is for a computer group called mslib, and I'm using Apple's workgroup manager tool to add it. Other names will add, it seems to be entries that were created before but aren't showing up now. This is also happening for other object classes, like computer entires. slapcat and the other tools I use don't show an existing entry for mslib or the other names that won't add. Any advise on where to go from here would be appreciated. Thanks, Andy Zirkel.

2 5

Host based authentication using OpenLDAP
by Per Kristiansen 19 May '09

19 May '09

Hello, I've been working on implementing a LDAP solution for the last 8 months (in-between task, you know how it is :D ) I now have a working LDAP directory, have all my users imported, things actually work! :D..(jinx!) But now I wanna get fancy.. I've been googeling for some sort of clear description on how I can set up a system using groups of hosts and user groups to create a selective ACL for ssh'ing to a set of servers based on group membership. One of my primary goals is to have it work as much "out of the box" as possible for RHEL4 and 5 (and CentOS ) That means I want to avoid having to make changes to hosts (I have around 60-80 linux servers today that I want over on LDAP) So I try to avoid the solutions involving /etc/security/* I have it working with the ldapns schema with no changes to PAM. But this means I have to enter the specific host into each user record. But I'm a contrary and difficult guy, and love making problems for my self so I want to assign groups of users to groups of servers. Oh..and SSH keys :D..but that is for when life looks sunny and I need to be reminded that the world is a bad place. is there anyone that can point me towards resources that are written on this?..I already have a list of links I've been reading, and are adding those here in case other people want to look at them: https://help.ubuntu.com/community/LDAPClientAuthentication http://www.redhat.com/f/pdf/rhas/NetgroupWhitepaper.pdf http://www.padl.com/OSS/nss_ldap.html http://www.padl.com/OSS/pam_ldap.html http://quark.humbug.org.au/publications/ldap/system_auth/sage-au/system_aut… Thanks for taking the time to read this :) -- Per

1 0

Jabber and LDAP
by Gavin Henry 19 May '09

19 May '09

Hi All, Does anyone have any recommendations on Jabber servers that have great LDAP support and a small-ish footprint (i.e. not OpenFire)? I've been looking at http://xmpp.org/software/servers.shtml eJabberd and jabberd2 are the ones I've once used. Thanks.

2 1

Migration Lotus Notes
by Clenio W. e Silva 19 May '09

19 May '09

Lotus Notes Migration to OpenLDAP. Any tips on how to start? -- Clenio W. e Silva (62) 8414-5089 Gtalk: cleniogyn(a)gmail.com Jabber: cleniogyn(a)casabrasil.gov.br MSN: cleniogyn(a)hotmail.com -------------------------------------------------------------------- Ter Jesus como amigo é melhor do que qualquer outra conquista na vida!

2 1

MMR get inconsistent when updating entries concurrently to both Masters(2-masters configuration)
by hu zhang 18 May '09

18 May '09

Hi, all, I set up a testing environment for the MMR(2 master server), it did work well when I tested it in a "test050" style, that was, send updated requests to one of the master server, waited for seconds, then send update requests to another master server. All updates could be properly replicated among both servers. However, when I tried to update entries in an interleave style to these servers, I mean, like, the first update request was sent to server A, and the second request was sent to server B, then A, then B, .... there was no waitting between the update requests, and all requests were differnt. >From my understanding of the MMR, I hoped all updated in server A would be finally replicated to server B, and same to server B. But, the real test result was, I could see all updates in one of the server, but only partial updates in another server, the partial updates were exactly made by the requests directly comes to that sever, that is to say, the replication samed to be *monodirectional *in this situation. My question, is this scenario a bug for current openLdap, or, it is just not a supported use case ?* * I've been trying to find an answer in past mail threads, but I failed. Hope you guys can help me out from this confusion about MMR, if you need any further information, like configuration, I'll put them on, but I don't think that's a configuration problem, because the "test050" style testing works. Thanks! Hu

2 2

authenticate group of hosts
by François Mehault 18 May '09

18 May '09

Hi All, I have install openldap to authenticate users on system Unix. So, I use the module pam_ldap / nss_ldap with primitive pam_check_host_attr yes, and I have the attribute host for each person in my LDAP. I want to have 3 levels of authentication : - First level : a person have numerous attributes « host » so he is able to authenticate on these hosts - Second level : a person could be able to authenticate on a group of host - Third level : a person is able to authenticate on all hosts For the first level, for each host I declare one primitive « host » for my user in openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/fmehault loginShell: /usr/local/bin/sh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: hostObject userPassword: {MD5}9x2+UmKKP4OnerSUgXUlxg== host: labobe1 host: labobe2 For the third level, I put just the primitive « host : * » But I don't know how i could do the second level. I would like something like groupRadiusName, I want to define numerous group with host primitive, and each users can be in one group or plus. The goal is that my user have his host primitive plus the host primitive of his group. Is it possible ? Thanks for your help, Regards, François

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical