- openldap-technical - openldap.org

hardware requirement
by mukim pathan 11 Jun '09

11 Jun '09

Hi, I have to setup a database for storing 100million entries, each entry with 4 columns. I will be using centOS linux OS for this. I checked previous queries regarding hardware, I found that with 32 bit machine, processing might get slow for 20million above records. I want to ask what should be the hardware configuration for this? Thank you in advance. Regards, Mukim Pathan

2 1

some thoughts about RDN
by Paweł Madej 11 Jun '09

11 Jun '09

Hello, I have such RDN cn=user1,dc=example,dc=com but my webmail software knows users only by emails (which is attribute to cn=user1,dc=example,dc=com) My question is how can i authenticate in LDAP using provided email? I tried sth like mail=test(a)example.com,dc=example,dc=com but ldap refuses such login. Thanks in advance for help Greets Pawel

4 9

Howto synchronization the username and password between windows AD and OpenLDAP server?
by openbsd shen 11 Jun '09

11 Jun '09

I hve Windows AD server and OpenLDAP server, may I synchronization username and passport between them?

1 0

solaris patch vs. linux patch
by Brett ＠Google 11 Jun '09

11 Jun '09

Hello, Just wondering if anybody knows why solaris patch refuses to process the bdb 4.7 patch files, where the patch command on linux works perfectly. Ie: on solaris : patch -p0 <patch.4.7.25.1 Looks like a context diff to me... Hunk #1 failed at line 187. Hunk #3 failed at line 296. 2 out of 4 hunks failed: saving rejects to sequence/sequence.c.rej done Works fine on a linux machine ? Have tried patch 2.5.9 built from soruce on gnu.org, this fails also. (i usually end up patching on linux, and then copying the patched tarball back to solaris.. but just wondering?) Cheers Brett

4 6

password change and ppolicy
by tizo 10 Jun '09

10 Jun '09

Hi there, We are using OpenLDAP 2.4.16 with ppolicy, to authenticate users for a JEE application. Authentication works great (with JNDI), and we are receiving ppolicy response controls without problem. In that way, the user knows when the password is about to expired, when the password have been reseted, etc. Now we want to offer users to change passwords from the application. Before starting this, I have been testing password changing with phpLDAPAdmin. The fact is that I could only change a user password with clear text. I guess that this behaviour happens because we have pwdCheckQulity setting in 2 in our default password policy. So, when the client (phpLDAPAdmin) tries to modify the password enconding it, the server (OpenLDAP) cannot check the min length of the password, as it is encoded, and then fails. I am guessing too, that phpLDAPAdmin is performing a simple modify operation to change the password, as it is stored in clear text. On the other hand, I could change passwords with ldappasswd withouth problem, and they are stored with SSHA. I know that this command uses RFC 3062. So, I am wondering which is the best way to change the password from a Java application. I guess that, if I have pwdCheckQulity setting in 2, the password should travel in clear text, so that ppolicy can check its min lenght for example. But I would like it to be stored encoded. How could I do that?. Do I have to use RFC 3062?. Do you know any Java implementation of the client side for that RFC?. Thanks very much, tizo

2 2

problem in my mirrormode
by Wissem BARAKET 10 Jun '09

10 Jun '09

Hello : i would like install a mirrormode in my ldap but i don t can make fonction : my OS debian lenny and mu open ldap 2.4.16 can you help me this my config in my first server : # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: serverID 1 # Features to permit allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema TLSCertificateFile /etc/ldap/tls/ldap_bdc_cert.pem TLSCertificateKeyFile /etc/ldap/tls/ldap_bdc_key.pem # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel sync # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb #moduleload syncprov # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=xxx,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=xxx,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,ou=Users,dc=xxx,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read access to dn.base="cn=Subschema" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,dc=xxx,dc=com" read by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=xxx,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" rootdn "cn=admin,dc=xxx,dc=com" moduleload syncprov index entryCSN,entryUUID eq lastmod on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE syncrepl rid=001 provider=ldaps://debian.xxx.com:636 type=refreshAndPersist credentials=mirrormode searchbase="dc=xxx,dc=com" filter="(objectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com" binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy syncrepl rid=002 provider=ldaps://debian1.xxx.com:636 type=refreshAndPersist credentials=mirrormode searchbase="dc=luniweb,dc=com" filter="(objectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com"binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy mirrormode on the second server : # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: serverID 1 # Features to permit allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema TLSCertificateFile /etc/ldap/tls/ldap_pdc_cert.pem TLSCertificateKeyFile /etc/ldap/tls/ldap_pdc_key.pem # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel sync # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=xxx,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=xxx,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,ou=Users,dc=xxx,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read #access to dn.base="cn=Subschema"by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=xxx,dc=com" write by dn="uid=mirrormode,dc=xxx,dc=com" read by * read #defaultsearchbase dc=xxx,dc=com #sasl_host localhost #sasl_secprops none password-hash {MD5} # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=xxx,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" rootdn "cn=admin,dc=xxx,dc=com" index entryCSN,entryUUID eq lastmod on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE syncrepl rid=002 provider=ldaps://debian1.xxx.com:636 type=refreshAndPersistcredentials=mirrormode searchbase="dc=xxx,dc=com" filter="(objectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com"binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy syncrepl rid=001 provider=ldaps://debian.xxx.com:636 type=refreshAndPersist credentials=mirrormode searchbase="dc=xxx,dc=com" filter="(obj#ectClass=*)" scope=sub schemachecking=on bindmethod=simple binddn="uid=mirrormode,ou=Users,dc=xxx,dc=com" binddn="cn=syncrepl,dc=xxx,dc=com" credentials=yyy mirrormode on thanks

2 1

Re: UCARP setup
by Ivan Ordonez 10 Jun '09

10 Jun '09

Matt Kassawara wrote: > I don't see why not... you'll just need to configure it to use the > hostname/IP pointing to the active server. > > On Jun 9, 2009, at 4:39 PM, Ivan Ordonez wrote: > >> >> >> Matt Kassawara wrote: >>> >>> I'd recommend looking at mirror mode. >>> http://www.openldap.org/doc/admin24/replication.html >>> >>> On Tue, Jun 9, 2009 at 2:40 PM, Ivan Ordonez >>> <iordonez(a)nature.berkeley.edu> wrote: >>> Hi, >>> >>> Has anyone here have any experience using UCARP with openldap? >>> >>> http://www.ucarp.org/project/ucarp >>> >>> Our department want to use UCARP to provide automatic failover but >>> I'm at lost on how to make two machines replicate openldap data. If >>> you have a better suggestion, or ideas on how to make it work, >>> please let me know. >>> >>> Thanks in advance. >>> >>> -Ivan >>> >> >> Can you do a mirror mode and at the same time, have a consumer, for >> example, a BDC sitting on a different subnet? I'll give it a shot. Thanks for all the help. -Ivan

1 0

Error while using relay
by venish khant 10 Jun '09

10 Jun '09

Hi all, I am trying to access LDAP search using email address instead of DN. For that I am using overlay rwm, and relay. When I gave relay "dc=example,dc=com", slapd give me error like(unknown directive <relay> inside backend database definition). I all ready enabled modules for relay(back_relay.so) and rwm(rwm.so). openLDAP => 2.4.15 Backend => bdb (Berkeley Database) Regards -- Venish Khant www.deeproot.co.in

5 11

CRL question
by joakim＠comex.se 10 Jun '09

10 Jun '09

Hi, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all". When the CRL has expired the client is not allowed to make a TLS connection. My question is whether it is possible to configure openldap to let the client connect to the server (possibly with a warning) even when the CRL has expired. Does anyone know if that is possible? /Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

2 3

UCARP setup
by Ivan Ordonez 09 Jun '09

09 Jun '09

Hi, Has anyone here have any experience using UCARP with openldap? http://www.ucarp.org/project/ucarp Our department want to use UCARP to provide automatic failover but I'm at lost on how to make two machines replicate openldap data. If you have a better suggestion, or ideas on how to make it work, please let me know. Thanks in advance. -Ivan

2 2

using search filter for operational attributes (pwdAccountLockedTime)
by Tyler Gates 09 Jun '09

09 Jun '09

Hey guys, From my understanding pwdAccountLockedTime is an operational attribute and by ldap v3 definition it must be 'requested' to obtain the value. However, when I include this attribute as part of a search filter against one of my master servers I get results back but when I run it against my proxy (back_ldap) ldap server, I get nothing. Only when I request the attribute do I get something off the proxy. If operational attributes should not be seen unless requesting them then how come on my master servers it returns fine but not on the proxy? Is there a way to make the proxy behave the same as the master's in this regard? Or do I possible have some ACL issues? Thanks, Tyler

2 2

make test problem during openldap 2.4.16 installation
by mukim pathan 09 Jun '09

09 Jun '09

Hi, I am trying to install new release of openldap 2.4.16. I have installed Berkley DB 4.7. ./configure went normally but "make test" got hang. Following is the message it showed... >>>>> Test succeeded >>>>> ./scripts/test000-rootdse completed OK. >>>>> Starting test001-slapadd ... running defines.sh Running slapadd to build slapd database... Is there any solution to this? Regards, Mukim Pathan

3 2

Practices : DN filtering alternatives
by Lorenzo Pastrana 09 Jun '09

09 Jun '09

I've been reading (and actually experienced) that DN, not being a full class attribute, is not filterable (read : with wildcards / patterns). I've been thinking about 'duplicating' the DN in an attribute since the hidden 'entryDN' attribute is not accessible either but that sounds ugly and redundant to me. If there is a commonly used alternative to filtering DNs I'd be glad to hear. Thanks. Lorenzo Pastrana R&D Head @ Happy End -------------------------- Web Shop Multimédia Design Visual Communication & Publishing -------------------------- Tél.: +33 1 42 47 83 09 Fax.: +33 1 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

4 4

Problems with replication (syncrepl, syncprov)
by Florian Götz 08 Jun '09

08 Jun '09

Hi everybody, i got two OpenLDAPs (2.4.12) running. One providing the syncrepl Overlay and one the syncprov. The LDAP system is used for user authentication over a samba server. I created a user "backup" with all the rights to see all parts of the DIT of the primary ldap. If I connect to the primary with this user I can see all entries. The sync-configuration used on both machines is attached at the end of this mail. Now I got the following problem that only the ou´s group and users get syncronized on the backup machine. The rest like "computers" and other ou´s don´t get replicated, so I don´t get a full backup of the primary LDAP. Can someone help me with the config? I think the one attached should work, but ... :) Mit freundlichen Grüßen Florian Götz Primary LDAP ===================== # Provide Backupdata for second machine overlay syncprov syncprov-checkpoint 10 2 syncprov-sessionlog 100 Backup LDAP ====================== # Backup from primary LDAP syncrepl rid=1 provider=ldap://x.x.x.x binddn="uid=backup,ou=Users,dc=example,dc=de" bindmethod=simple credentials="*********" searchbase="dc=example,dc=de" filter="objectClass=*" type=refreshAndPersist retry="5 10 30 +" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6569 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Uncategorized exception
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am getting following exception while i am doing search using spring-ldap. org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' Caused by: javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at javax.naming.directory.InitialDirContext.search(Unknown Source) at org.springframework.ldap.core.LdapTemplate$4.executeSearch(LdapTemplate.java:230) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:272) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:234) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:548) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:532) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:383) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:406) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:424) I don't see any reason for this as everything was working fine and suddenly this exception came. Can you tell me any reason for this? Regards, Mukim Pathan

2 1

Newbie question about ldif
by J. Bakshi 08 Jun '09

08 Jun '09

Dear all, greetings to all. Hope I have joined the right list to discuss about openldap technology. I am working with typo3 and openldap. Typo3 is a CMS ( content management system ) just like Drupal, Joomla etc.. I like to implement an openldap based system where I can have a organization based structure like department, company etc and can store persons with their name, address, contact along with userid/password which will be used to authenticate the front end user login in typo3. To start with I need a well designed ldif file. I have already get some example ldif from internet but those are missing the useris/password authentication. More over the " objectclass: organizationalPerson " " objectclass: inetOrgPerson " "objectClass: dcObject" "objectClass: organization" are very much confusing :-( Could any one kindly enlighten me a little about those "objectcalss" and which one is best suited for my requirement ? A sample ldif file with little explanation will help me a great. Thanks

3 5

Help with ACL's
by Tyler Gates 08 Jun '09

08 Jun '09

Hello, I'm having a hard time setting some ACL's for my particular setup. I have a structure as follows: dn: uid=*,ou=people,dc=example,dc=com # uid contains several unix/linux user ids dn: cn=*,ou=groups,dc=example,dc=com # cn contains several unix/linux groups. uid's (not the complete dn) are supplied to the memberUid fields What I would like to do is place an organizationalRole in each group and have ACL's setup so that it's uniqueMembers have access to certain attrs (say for example sn) for the uid's (which correspond to those in ou=people) specified in the memberUid fields of the group in which the organizationalRole is placed. psuedo code would be something as follows: access to group/posixAccount/memberUid.regex("cn=(.*),ou=groups,dc=example,dc=com") attrs sn by group/organizationalRole/uniqueMembers/.regex("cn=admin,cn=$1,ou=groups,dc=example,dc=com") write Thanks, Tyler

3 9

ldapi -> "Confidentiality required" problem
by Gunnar Frenzel 08 Jun '09

08 Jun '09

Hello, I've configured openldap (v2.4.16 on FreeBSD 7.2) to listen on ldaps (with self signed certificate) as well as ldapi. rc.cof: slapd_enable="YES" slapd_flags='-h "ldapi:///var/run/openldap/ldapi/ ldaps:///"' slapd_owner="ldap:ldap" slapd_sockets="/var/run/openldap/ldapi" slapd.conf: database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Manager,dc=mydomain,dc=com" rootpw password directory /var/db/openldap-data index objectClass eq security ssf=128 TLSCACertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/ssl/cert.key TLSVerifyClient never Connecting to ldaps (port 636) with clients such as Thunderbird, Apache Directory Studio works fine. But when I try to connect via ldapi (port 389) from a webmail tool on the same server I always get the error "Confidentiality required" from openldap. I want to connect to ldapi (as it is local on the server) without TLS or other encryption but openldap doesn't seem to allow that in my configuration. I tried localSSF set to 0 which doesn't make any difference... I'd be thankful for any advice with this issue. Best regards, Gunnar

3 6

openldap, bdb versions and performance issue
by jakjr 08 Jun '09

08 Jun '09

Hello Guys, Last week I upgraded our openldap server to 2.4.16 and we had terrible performance problems. Quanah suggested me to use this options with bdb compilation: --enable-posixmutexes --with-mutex=POSIX/pthreads I compiled and tested openldap with different versions of BDB and the results are odd: OpenLDAP version BDB version Test time 1 (seconds) Test time 2 (seconds) Test time 3 (seconds) 2.4.16 BDB 4.5.20 256.2008 260.5799 273.933 2.4.16 BDB 4.6.21 265.428 260.2496 255.0599 2.4.16 BDB 4.7.25 261.5573 254.2001 259.9456 2.3.30-5 (debian package) BDB 4.2.52 257.7173 251.3512 250.8456 The test consist on make some operations: for ($i=0; $i<=1; $i++) { make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); } Like you can see, the best result was using to old version of openldap server with the old version of BDB. Even more odd was the use of CPU. Using these old versions, the consume of CPU was half then using the new ones. The slapd.conf and DB_CONFIG were the same on all tests. Here are the compilation lines: BDB: CFLAGS="-Wall -g -O2" CPPFLAGS="-I/usr/include/tcl8.5" LDFLAGS="-lpthread" ../dist/configure --enable-cxx --enable-compat185 --enable-rpc --enable-tcl --enable-posixmutexes --with-uniquename --with-tcl=/usr/lib/tcl8.5 --with-mutex=POSIX/pthreads --enable-test Openldap: CFLAGS="-Wall -g -D_FILE_OFFSET_BITS=64 -O2" ./configure --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc --localstatedir=/var --mandir=/usr/share/man --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --enable-spasswd --enable-modules --enable-rewrite --enable-slp --enable-wrappers --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-meta=mod --enable-monitor=mod --enable-relay=mod --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc DB_CONFIG: set_cachesize 0 524288000 0 set_lk_max_objects 15000 set_lk_max_locks 15000 set_lk_max_lockers 15000 set_shm_key 5 slapd.conf: some index and cachesize 10000 idlcachesize 10000 Is there some wrong or these are the expected results ? I appreciate any tip. Best regards, João Alfredo

1 0

slapcat unable to make ldif file with size > 2GB
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am trying to create backup of database using slapcat. But as soon as .ldif file reaches size of 2GB, it is giving me an error of File Size Limit Exceeded and quitting the process. I am using bdb 2.3.43. Is there anything I can do about it? Regards, Mukim Pathan

3 4

CRL expired
by joakim＠comex.se 08 Jun '09

08 Jun '09

Hello, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all" in it. When the CRL has expired the client is not allowed to make an TLS connect. My question is whether it is possible to configure openldap to still let the client connect to the server (possibly with a warning) when the CRL has expired. Does anyone know if it is possible and of it can be achieved in that case? Regards, Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

1 0

Bind/search more than one tree and server
by Schneider, Thomas-P65851 05 Jun '09

05 Jun '09

I am seeking a solution to be able to bind to, and search more than one tree and server per request using Linux. My goal is to maintain separate groups of user accounts on an OpenLDAP server -- e.g. local and network. The groups of users can have overlapping posixAccount uid attributes, but will have unique uidNumber attributes. My main use case is authentication, which requires checking a remote LDAP server first -- currently AD which requires attribute re-mapping), then network tree on the local LDAP (openldap) if not in remote server, then the local tree on local server if not in the first tree. I have tried referrals and rewrites, but nothing I've tried worked. It looks like the creation of a custom overlay will work, but I'd rather not go down that path. I have also tried using PAM, but pam_ldap is limited to one configuration per service (modifying pam_ldap is an option at this point). Thanks, Craig

2 2

pool of Ldap-Directories
by alois blasbichler 05 Jun '09

05 Jun '09

Hello list I have this question - maybe somebody can give me a hint : I need a pool of Ldap-Directories (possible openldap, AD and other) where i can search for. The reason is : there are a lot of applications where can i get my users from one Ldap but where i cant define more Ldaps with different search bases. Is this possible for example with 2 different Openldap-Directories ? Thank you luis

3 3

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 05 Jun '09

05 Jun '09

Thanks for answer, With updateref after syncrepl slave slapd.conf syncrepl rid=000 provider=ldap://ldap-v000 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=mydomain,dc=mydomain2,dc=fr" attrs="*,+" bindmethod=simple binddn="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" credentials=secret updateref "ldap://ldap-v000/" master slapd.conf access to attrs=userPassword by dn="cn=Manager,dc=mydomain,dc=mydomain2,dc=fr" write by dn="cn=samba,dc=mydomain,dc=mydomain2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" write by self write by * none I have LDAP password information update failed: Referral passwd Changing password for user paul-pierre.brun. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Referral passwd: Permission denied Nothing in master ldap log In slave ldap log Jun 5 12:51:34 ldap-v002 slapd[18734]: conn=2 op=2 SRCH base="dc=mydomain,dc=mydomain2,dc=fr" scope=2 deref=0 filter="(&(objectClass=ipHost)(cn=ldap-v000))" Jun 5 12:51:35 ldap-v002 slapd[18734]: conn=2 op=2 SRCH attr=cn ipHostNumber Jun 5 12:51:35 ldap-v002 slapd[18734]: ==> limits_get: conn=2 op=2 self="[anonymous]" this="dc=mydomain,dc=mydomain2,dc=fr" Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_search Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_dn2entry("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access to "dc=mydomain,dc=mydomain2,dc=fr" "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_get: [1] attr entry Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: result not in cache (entry) Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: access to entry "dc=mydomain,dc=mydomain2,dc=fr", attr "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: to all values by "", (=0) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=manager,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=samba,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: self Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: * Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] applying read(=rscxd) (stop) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] mask: read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: search_candidates: base="dc=mydomain,dc=mydomain2,dc=fr" (0x00000001) scope=2 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_dn2idl("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: OR Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa1 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [b49d1940] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read: failed (-30989) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=0, first=0, last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=0 first=0 last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [7ec2180d] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read 6 candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=6, first=15, last=21 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=6 first=15 last=21 Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:36 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_equality_candidates (cn) Regards ----- Mail Original ----- De: masarati(a)aero.polimi.it À: "paulpierre brun" <paulpierre.brun(a)free.fr> Cc: openldap-technical(a)openldap.org Envoyé: Jeudi 4 Juin 2009 17h03:05 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral > > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

create new ldap database query
by mukim pathan 04 Jun '09

04 Jun '09

Hi, I am trying to create new ldap database on new machine and I want to transfer full ldap database from old machine to new machine. Can I just transfer all the database files (.bdb,_db,alock) and expect new database to be at the same stage of old database?? Thanks in advance. Regards, Mukim Pathan

5 6

log files and recovery
by mukim pathan 04 Jun '09

04 Jun '09

Hi all, I am unable to understand the answers for following question which i got on net. This might be naive questions but I really need to know the answers. 1. why does ldap write log files and what are its content? 2. why does ldap go through all log files during recovery? Thank you in advance. Regards, Mukim pathan

2 2

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by masarati＠aero.polimi.it 04 Jun '09

04 Jun '09

> > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 04 Jun '09

04 Jun '09

Objet: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral Hello, I try to change password on customer, to a referal thru a overlay chain config. I have answer LDAP password information update failed: Server is unwilling to perform. OS REDHAT 5.2. openldap openldap-2.4.16 could you help me ? Thanks Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral passwd: Permission denied Master conf ldap-v000 ---------------------- overlay syncprov syncprov-checkpoint 100 10 # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none Slave conf ---------- overlay chain chain-uri ldap://ldap-v000/ chain-idassert-bind bindmethod=simple binddn="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" credentials=secret mode=self flags=non-prescriptive # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user #access to dn.subtree="ou=Aliases,dc=mydomaine,dc=mydomaine2,dc=fr" by * read access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none

1 0

openldap login issues
by Serge Fonville 04 Jun '09

04 Jun '09

Hi, I'm new to ldap, so please be gentle ;-) I have a box running CentOS 5.3 wit OpenLDAP 2.3.43. When I run getent passwd fo0072 (which is my username), this was advised as a check I get nothing. when I su - fo0072 as root, it logs in as expected, when I try to login trough GDM I get a invalid username/passwd error when I press CTRL-F1 and login to the console it logs on without any trouble. This suggests to me thatt there is something wrong in my config, but I checked everything, but could not find it. I'll post the necessary config files and ldifs when requested Any help is greatly appreciated. Thanks in advance. Regards, Serge Fonville

2 3

OpenLDAP support for DIT Structure Rules
by James Lentini 03 Jun '09

03 Jun '09

The OpenLDAP FAQ http://www.openldap.org/faq/index.cgi?_highlightWords=structure&file=1474 and TODO file http://www.openldap.org/devel/cvsweb.cgi/doc/devel/todo?hideattic=1&sortbyd… indicate that OpenLDAP does not currently support DIT Structure Rules. Is this correct? -james

7 11

LDAP service doesn't start
by Emanuele Gesuato 03 Jun '09

03 Jun '09

Hi there, We are using OpenLDAP 2.2.29 (the full name of the setup is "openldap-2.2.29-db-4.3.29-openssl-0.9.8a-win32_Setup.exe") for a large number of Windows 2000 oses with service pack 4. Often, it happens that the openldap service doesn't start and in the event log i can see the error code "21". Right now i can solve the problem reinstalling openldap and it works but i would like to know the cause of the problem (if any) and if there is another way to solve it. Maybe it is a dumb question but is it possible to retrieve the dump of ldap if the service doesn't start ? Thanks for any help, Emanuele Gesuato

3 2

Adding a attribute of a new schema to an existing entry
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Hi everyone. I'm trying to add a attribute of a new schema to an existing entry. I've created the schema called 'owlco' (I've remove almost fields to concision): ---------------------------------------------------------------------- attributetype ( 1.3.6.1.4.1.4203.666.0.1 NAME 'owlChurchNumber' DESC 'Church Number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) attributetype ( 1.3.6.1.4.1.4203.666.0.2 NAME 'owlSupernatural' DESC 'You wouldn't understand' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) ... objectclass ( 1.3.6.1.4.1.4203.666.1.1 NAME 'owlco' DESC 'Classe utilizada pela Owl Corporation' SUP inetOrgPerson STRUCTURAL MUST ( owlChurchNumber ) MAY ( owlDevotes $ owlSupernatural ) ) ---------------------------------------------------------------------- And I've added the schema: ---------------------------------------------------------------------- include /etc/openldap/schema/owlco.schema ---------------------------------------------------------------------- So, before all that actions I've created my whole directory and now I have all the entries without some mandatory owlco's fields (mandatory not to LDAP but to my business). So, now I'm trying: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber owlChurchNumber: 3212 And I've got: ---------------------------------------------------------------------- ldap_modify: Object class violation (65) additional info: attribute 'owlChurchNumber' not allowed ---------------------------------------------------------------------- Ok, absolutely normal. My schema depends on inetorgperson. So... ---------------------------------------------------------------------- dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: owlco # ldapmodify: wrong attributeType at line 4, entr ---------------------------------------------------------------------- I didn't stop on that try, I've tried a lot more combinations without success. I've read the 'http://www.zytrax.com/books/ldap/ch5/', specially the topic 'To add a new AUXILIARY objectclass to an existing entry requires'. dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify objectclass: inetorgperson objectclass: owlco But all I get is: ldapmodify: modify operation type is missing at line I'm stuck on that... Yep, I've tried too: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: inetorgperson objectclass: owlco And: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber objectclass: inetorgperson objectclass: owlco owlChurchNumber: 2342 But... got nothing... []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Adding a attribute of a new schema to an existing entry - FIXED
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Ok, I think I got it. I was using a 'SUP inetOrgPerson STRUCTURAL' to my new scheme. So, when I've changed to 'SUP top AUXILIARY' I finally could add my new attributes. I think it's because ldapmodify was trying to modify the structural object to my entry and it's impossible (just at creation time). So, here's my ldif (it's working): dn: uid=unicorn,ou=ground,dc=dinosaurs,dc=jurassic,dc=history changetype: modify add: objectClass objectClass: oilCorporation - add: oilCorporationTypeOfThing oilCorporationTypeOfThing: withcandle []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

'unary operator expected' error when TLS turned on
by John Kane 02 Jun '09

02 Jun '09

I've also posted this message on the OpenSSL forum: I just turned on TLS on my LDAP (per instructions on http://www.openldap.org/faq/data/cache/185.html). Now all of my Linux servers (RH EL5) give the following error on login: -bash: [: =: unary operator expected The error goes away when I turn TLS off. I cannot determine what is causing this error, or even which file contains the error. I've gone through my LDAP config files, cannot find an issue in any of these. Other than my cacert.pem, and the LDAP config files, are there other files that are read only when TLS is turned on? Thanks, John I am running Openldap 2.3.43-2.el5 & OpenSSL 0.9.8b-10.el5 (RPMs from Red Hat, which I am required to use unless I put up a BIG fight). ++++ Here's my configs ++++ I turn on TLS by adding the following in my /etc/ldap.conf (pam/nss file): ssl start_tls tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts/ and have the following in my /etc/openldap/ldap.conf (openldap file): HOST 172.25.3.97 BASE dc=example,dc=net TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow and my (self-signed) cacert: [root@serverx cacerts]# openssl x509 -text -in /etc/openldap/cacerts/cacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Validity Not Before: May 28 04:37:13 2009 GMT Not After : May 27 04:37:13 2012 GMT Subject: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b3:bf:f0:18:5d:7e:57:0a:ce:15:3c:28:2a:81: 6d:e6:c5:31:98:7e:cc:09:03:d2:28:f2:33:3e:88: 11:5f:7d:e1:18:33:38:7d:f5:fa:9d:89:a8:95:16: 08:00:81:08:29:ac:37:b3:b1:2b:f3:20:52:15:d7: 19:44:92:9c:45:e7:2e:58:fe:7e:07:d4:1f:5a:ad: 59:91:37:84:14:a8:4e:df:54:a2:62:66:38:9b:f0: cf:48:01:68:0d:3a:7c:93:83:02:48:e0:76:a1:5c: f9:05:3b:49:1e:03:9a:fd:ea:ee:79:f7:87:66:96: b0:69:39:e1:e6:1a:bd:9e:0d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C X509v3 Authority Key Identifier: keyid:0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C Signature Algorithm: sha1WithRSAEncryption 28:52:3d:9c:90:d1:89:00:d7:9d:3b:06:a6:32:28:e8:c0:8d: 9d:5a:0b:79:bb:1a:c9:1a:8d:c6:3a:a5:ec:5d:4c:9f:20:4c: c6:1e:41:df:7d:d5:fc:45:09:2b:4b:7c:ff:38:aa:ea:33:a0: 4a:be:7c:84:7c:58:e8:98:9b:c9:0e:4b:5b:11:c6:28:84:b1: 3f:bb:30:03:f6:38:40:9f:2d:32:bc:3a:97:b8:6f:fd:aa:9f: 67:a6:27:07:53:b2:40:41:86:b7:02:f2:6b:07:6f:1b:74:87: 63:3b:1b:89:13:08:cb:32:f0:3c:3b:5e:d6:df:e3:91:19:86: 7a:d4 -----BEGIN CERTIFICATE----- MIIDDzCCAnigAwIBAgIBADANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UERhMCVVMx DjAMBgNVBAgTBVRleGFzMRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdT aWduZXJzMRwwGgYDVQQDExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcN AQkBFhtqb2huLmthbmVAcHJvZGVhc3lzdGV3cy5jb20wHhcNMDkwNTI4MDQzNzEz WhcNMTIwNTI3MDQzNzEzWjCBjjELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFz MRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdTaWduZXJzMRwwGgYDVQQD ExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcNAQkBFhtqb2huLmthbmVA cHJvZGVhc3lzdGVtcy5jb20wgZ8wDQYJKoZIhvcNAQE1BQADgY0AMIGJAoGBALO/ 8BhdflcKzhU8KCqBbebFMZh+xAkD0ijyMz6IEV994RgzNX31+p2JqJUWCACBCCms N7OxK/MgUhXXGUSSnEXnLlj+fgfUH1qtWZE3hBSoTd9UomJmOJvwz0gBaA06fJOD AkjgdqFc+QU7SR4Dmv3q7nn3h2aWsGl54eYavZ4NAgMBAAGjezB5MAkGA1UdEwQC MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl MB0GA1UdDgQWBBQL+30LDRejzXkCo6OSVxVv3jgHPfAfBgNVHSMEGDAWgBQL+30L DRejzXkCo6OSVxVv3jgHPDANBgkqhkiG9w0BAQUFAAOBgQAoUj2ckOGJANedOwam MijowI2dWgt5uxrJGo3GOqXsXUyfIEzGHkHffdD8RQkrS3z/OKrqM6BKvnyEfFjo mJ7JDktbEcYohLE/uzAD9jhAny0yvDqXuG/9qp9npicHU7JAQYa3AvJrB28bdIdo OxuJEwjLNvA8O17W3+ORGYZ61A== -----END CERTIFICATE----- This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 5

Re: 2.4.16 performance issues
by jakjr 02 Jun '09

02 Jun '09

Thanks again, just one more question. Openldap 2.4.16 depends on BDB 4.4 or higher, right ? ( http://www.openldap.org/doc/admin24/appendix-recommended-versions.html) Best Regards, João Alfredo On Mon, Jun 1, 2009 at 4:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 3:50 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling >> options: >> >> >> --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do >> not use these options. >> >> Correct ? >> > > With the exception of BDB 4.3, which should never be used, yes, that is > correct. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 2

Re: 2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Thanks for your reply, Quanah I red some links: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421946 http://www.mail-archive.com/openldap-software@openldap.org/msg15013.html http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg627930.html So, the abstract is: bdb 4.2 is good. bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling options: --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do not use these options. Correct ? Thanks again. On Mon, Jun 1, 2009 at 2:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 12:11 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > > My suspecion is about debian etch and its packages version (berkley db, >> gcc). >> > > Rebuild BDB with the correct mutex options, since Debian refuses to do > this. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Hello Guys, Last week we upgraded our openldap server from version 2.3.30-5 (debian lenny package) to 2.4.16 (compilation). There wasn't any big changes on config files (slapd.conf and DB_CONFIG). Our server is heavily used (samba + webservices + web applications) in a total of 15 millions operations per day. After the upgrade the new openldap server presented some strange behavior. The ports (389 and 636) sometimes were in a filtered state, denying any new connections and the load of the server was incredibly high. No index or memory problem was detected. My suspecion is about debian etch and its packages version (berkley db, gcc). Any tips ? Best regards, João Alfredo

2 1

server redundancy setup
by Rex Roof 01 Jun '09

01 Jun '09

I'm migrating our existing openLDAP 2.3 servers into a new setup running openLDAP 2.4. I will eventually have 4 or 5 servers, hopefully all having the same synchronized data, and all accepting writes, if need be. Can anyone suggest a configuration where I have 4 servers, all keeping themselves in sync, and all accepting writes? Can multimaster replication work with more than two servers? Is that the right solution here? -Rex

2 3

using -y option for ldapsearch
by Sai 01 Jun '09

01 Jun '09

Hi All, I am trying and writing a script to use ldapsearch. But I want to create a password file and use the "-y" option. I am unable to figure out how to create one. ================================== ldapsearch -x -h <Machine> -p <port> -s one -D <CN> -b <BASE_DN> -y pwdfile -v "(&(cn=fm*))" cn ================================== I tried the following. 1) I tried putting the plaintext password for <CN> in the file and it did not work. 2) I ran slappasswd to generate the hashed password for <CN> and directed the output to this file and it did not work. 3) The file permissions I tried are 700 and 600. What is this "-y" option and am I interpreting it correctly? Is there a specific format that this file should be in? Version Info: ================================== $ rpm -qa|egrep openldap openldap-clients-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 $ ================================== Any help is greatly appreciated. -Sai

2 3

Deleting records while iterating through ldap_result
by Stephen 31 May '09

31 May '09

Hi everyone, I'm using the C SDK and writing a program to prune old directory records. The core logic of the program could go something like this:- rc = ldap_search_ext( ld, .. <rest of parameters> ); while (!done) { rc = ldap_result( ld, .. <rest of parameters>, &searchResult) ; //Delete records matching criteria dn = ldap_get_dn( ld, searchResult ); rc = ldap_delete_ext_s( ld, dn, .. <rest of parameters>); } ------- I have two questions and they are probably related:- Firstly: Can I delete records while iterating through the results of the ldap search? (In higher level languages deleting an item from a collection while navigating through a collection is often bad form. Is that the case here?) Secondly: Can I use the same session handle to delete the records as is used for the search? In the logic above, the session handle is ld, and ld is used for both the search and for the deletion. (I'm expecting I would need to use a different session handle for the logic above to work. Alternatively one could save all the records to be deleted in an array and then after the search loop, the same session handle can be used for all the deletes). Thank you Stephen

2 1

Cannot bind/connect to server outside the LAN
by Stelios A. 28 May '09

28 May '09

Hello all, I need help in three problems that I'm facing with my OpenLDAP implementation please. First problem: I'm able to connect to my LDAP server on 636 port without a problem from the same subnet but not outside the Internet. What I want to achieve is to be able to connect from a particular range of static IP's. The ACL part of my slapd.conf is: access to attrs=userPassword,shadowLastChange by dn="uid=authenticate,ou=System,dc=example.com" read by dn="uid=myusername,ou=Users,ou=bca,dc=example.com" read by anonymous auth by self write access to attrs=givenName,sn,cn,mail by dn="uid=syncrepl,ou=system,dc=example.com" read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by self read by users auth by anonymous auth access to attrs=uid by anonymous read by users read access to dn.regex="^.*,uid=([^,]+),ou=Users,dc=example.com$" by dn.exact,expand="uid=$1,ou=Users,dc=example.com" write access to * by dn.exact="uid=authenticate,ou=System,dc=example.com" none by users none break by self read by users read by * none 2nd problem: The following ACL does not work at all or I'm doing something wrong: access to attrs=givenName,sn,cn,mail by dn="uid=syncrepl,ou=system,dc=example.com" read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by self read by users auth by anonymous auth I can't bind as anonymous from 'some_static_ip' in order to fetch the mail, givenName etc into the Thunderbird address book for example. 3rd problem and last! If I reboot the master server then the slave does not bind correctly and email etc does not work at all even though it is configured on that server (slave). Also when I reboot the servers, master must come up first as otherwise I'm not able to connect until I reboot the slave server. Both servers running on Ubuntu 9.04 if that matters in any way. See output: root@masterldap:/etc/ldap# dpkg -l slapd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Cfg-files/Unpacked/Failed-cfg/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad) ||/ Name Version Description +++-==============-==============-============================================ ii slapd 2.4.15-1ubuntu OpenLDAP server (slapd) I have also attached the whole slapd.conf file of my master server in case that helps more. Any help, suggestion is much appreciated.

1 0

Host and group of users authentication
by Tech Only 28 May '09

28 May '09

Hello, I am trying to make group of users to log on to a particular server depending on LDAP credentials. Telnet , ssh work just fine to the host with out any issues. Once I make changes to the ldap.conf file on the client to use the base dc=test,dc=org uri ldap://1.1.1.1 pam_groupdn cn=ldap,ou=hosts,dc=test,dc=org pam_member_attribute member The server is Debian Openldap and the client is Centos 5.* I get You must be a memeber of cn=ldap,ou=hosts,dc=test,dc=org to login And here are the ldif files I used to create the entries. users.ldif dn: cn=Test1 User1,ou=people,dc=test,dc=org givenName: Test1 sn: User1 cn: Test1 User1 userPassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA== uidNumber: 1001 gidNumber: 1000 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uid: test1 homeDirectory: /home/users/test1 dn: cn=Test2 User2,ou=people,dc=test,dc=org givenName: Test2 sn: User2 cn: Test2 User2 userPassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA== uidNumber: 1002 gidNumber: 1000 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uid: test2 homeDirectory: /home/users/test2 Hosts.ldif dn: cn=ldap,ou=hosts,dc=test,dc=org objectclass: ipHost objectclass: device objectclass: extensibleObject ipHostnumber: 1.1.1.2 cn: ldap member: uid=test1,ou=people,dc=test,dc=org member: uid=test2,ou=people,dc=test,dc=org

1 0

Recommendations for adding "MUST" attribute to in-production objectclass?
by Christopher DeMarco 28 May '09

28 May '09

Greetings, list! I have a custom schema, which defines an objectclass to which all of my "users" belong. I'd like to add a required ("MUST") attribute to that objectclass, but I'm frightened of destroying my users :-) Is the following procedure safe? 1. Add the desired attribute as optional ("MAY") to the objectclass in my schema. Restart slapd. 2. Apply an LDIF change to every node with that particular objectclass, setting that new attribute to some acceptable value. 3. Ensure that my "create a new user" tools will set that attribute. 4. Change my schema to require ("MUST") that attribute within that objectclass. Restart slapd. If not, what is the safe procedure? Is there a better way of adding a required attribute to an in-production objectclass? Thanks! -- Christopher DeMarco <demarco(a)maya.com> IT Director MAYA Group +1-412-708-9660

6 8

ACI and OpenLdap 2.4.11 un debian lenny
by Sebastien Cramatte 27 May '09

27 May '09

Hello How can I use ACI with Openldap 2.4.11 ? I'm running debian lenny and seems that debian package by default has the option --enable-aci I don't have any OpenLDAPAci attribute and OpenLDAPAcl object in core.schema Thank your help Best regards

2 1

Problems with openLDAP and Samba
by Matt Burkhardt 25 May '09

25 May '09

Hope this is the right list - Anyway, I've got openLDAP 2.4.9 on Ubuntu 8.04 along with Samba 3.028 I've got it all installed and used the slapd.d (cn=config) capabilities. I get no errors on start up or stop, can create, modify and delete users and groups. However, I cannot create a user in openLDAP that is usable with Samba. If I go back in and create a Unix user, it will work. I've installed libnss-lapd and configured it - but is this the way it's supposed to work? What should I be looking at? Thanks and sorry for the noob question... -- Matt Burkhardt, M.Sci. Technology Management mlb(a)imparisystems.com (301) 682-7901 502 Fairview Avenue Frederick, MD 21701 http://www.imparisystems.com

3 5

hostObject, host attribute
by François Mehault 25 May '09

25 May '09

Hi all I use the primitive pam_check_host_attr in pam_ldap to filter my users. In OpenLDAP I add the attribute host for each users. I can write « host = hostlab.netplus.fr (fqdn) » to allow just one host for my user, or « host = * » to allow all hosts. But if I write host = 192.168.57.48 (the IP of hostlab.netplus.fr), my user is not able to authenticate on the host, Why I have to write the FQDN and not the IP address. Isn't possible ? And Is it possible to use regexp with the host attribute? Like host = 192.168.45.* ? Regards, François

2 1

Re: Host based authentication using OpenLDAP
by Gavin Henry 25 May '09

25 May '09

----- "Per Kristiansen" <perk(a)funcom.com> wrote: > Hello, I've been working on implementing a LDAP solution for the last > 8 > months (in-between task, you know how it is :D ) Time flies! > I now have a working LDAP directory, have all my users imported, > things > actually work! :D..(jinx!) Excellent work, well done! > But now I wanna get fancy.. > > I've been googeling for some sort of clear description on how I can > set > up a system using groups of hosts and user groups to create a > selective > ACL for ssh'ing to a set of servers based on group membership. > It sounds to me like you are almost here and just need help creating the LDAP groups, ACLs and LDAP search/filters for use with nss_ldap on RHEL 4/5 and Centos? Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

5 12

OpenLDAP 23 client with 24 server?
by Matt Juszczak 25 May '09

25 May '09

Hi All, Most of our boxes are FreeBSD. FreeBSD has ports for openldap22, openldap23, and openldap24. Not using slurpd much anymore in my setups, I decided to run with openldap24 in our recent setup. Setup openldap24 server, and all the FreeBSD clients have openldap24 clients. Everything is working well. Recently, we had to introduce a few RHEL boxes into our setup. We're pointing to the redhat repositories, but they seem to only have openldap23-* client packages. I know I could potentially make my own packages, or perhaps get RPM's from the Internet, but I was wondering if by some chance openldap23 clients (and pam_ldap/nss_ldap libraries) are compatible with openldap24 servers? I would assume the other way around (openldap24 clients with openldap23 servers) would work fine. Thanks! -Matt

3 2

Najmuddin C has sent you a private message
by Najmuddin C 24 May '09

24 May '09

1 0

Matthew GARRETT is out of the office.
by Matthew GARRETT 23 May '09

23 May '09

I will be out of the office starting 22/05/2009 and will not return until 27/05/2009. I will respond to your message when I return. For IT issues please see Drew Harvey Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

1 0

freeBSD 7.0 + passwd + openldap
by François Mehault 22 May '09

22 May '09

Hi all Maybe it's not the good mailing list (sorry !)to post my question, but I hope someone can help me. I use OpenLDAP to authenticate some users. Then I want my users are able to change their passwords themselves with the command passwd. But I have this message : <14:59>[labobe1:~]$ passwd passwd: Sorry, `passwd' can only change passwords for local or NIS users. I read that I have to modify passwd.c in /usr/src/usr.bin/passwd but I can't find this path, I just have /usr/src/sys Is-there another way to change users's password ? Thanks for your help, Regards, François

2 1

Re: Host based authentication using OpenLDAP
by Gavin Henry 22 May '09

22 May '09

> And fyi, here's an example... For a given host: > > dn: cn=hostX,ou=hosts,dc=example,dc=com > objectClass: ipHost > objectClass: authorizedServiceObject > cn: hostX > ipHostNumber: 192.168.1.127 > authorizedService: sshd > authorizedService: ftp > > you use the authorizedService attribute to list the PAM services that > are > available. Then you set ACLs to control who can access each service, > like so: > > access to dn.subtree=ou=hosts,dc=example,dc=com > attrs=authorizedService val.exact=sshd > by group.exact="cn=admins,ou=groups,dc=example,dc=com" write > by peername.ip=192.168.2.0%255.255.255.0 read > by * search > > The overlay performs a Compare operation to check for the required > service, so > if you deny Compare access to a particular service, then users aren't > allowed > to use that service. Very nice! We did something like this for a hosting company that had users accounts with the services that the user was allowed to access and the specific apps had the appropriate filters in the authz/auth searches. Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

MirrorMode and Failover
by Mike A Meyer 22 May '09

22 May '09

1 0

Re: Deleting hundreds of Entry under a OU
by Daniel Spannbauer 22 May '09

22 May '09

Rein Tollevik schrieb: > Michael Ströder wrote: >> Daniel Spannbauer wrote: > >>> I have to deleted abount 500 Entrys under a OU in my LDAP-Tree cause I >>> have to change the objectClass from "account" to "inetorgPerson". >>> Can I do this with ldapdelete? I always used that tool only to delete >>> one entry. >> >> Yes. But you have to provide a file with a list of the DNs of the >> entries to be deleted. >> >> $ ldapdelete -h >> usage: ldapdelete [options] [dn]... >> dn: list of DNs to delete. If not given, it will be readed from stdin >> or from the file specified with "-f file". > > Or you could try to simply change the objectclass and all required > attribute values in one operation using ldapmodify with the "-e relax" > control. It should allow you to replace the structural objectclass, > which otherwise is forbidden. > Hmm, my ldapmodify don't know this switch. How can I delete all entrys under an OU? If this works I delete all entrys and add them with the right ObjectClass. Regards Daniel > Rein -- Daniel Spannbauer Software Entwicklung marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

1 0

Newbie planning for the future
by Alex Moen 21 May '09

21 May '09

Hi all, I am a newbie to LDAP, and have just gotten my first directory server up and running, using openldap. I have been researching and reading a lot of material for quite a while about schema design and planning, and haven't found much pertaining to what I want to do. We have 50+ servers, serving thousands of customers. I want to migrate those servers to LDAP authentication and authorization, but have not found the proper design for multiple servers and duplicated users. Most references just do the basic "example.com" example and never expand on it from there. Ultimately, I would like to allow my admins to have a single account across multiple servers (kind of "authorization account merging"), but still allot the schema to be "separate" enough that duplicated usernames on different machines, corresponding to different people, still exist. Are there any really good references out there that do step-by-step walk throughs of the type of schema designing that I am thinking of? Or is it impossible? Or am I just really making too much of this? :) Thanks for any insights... Alex

3 2

unable to add certain entries
by Andrew Zirkel 19 May '09

19 May '09

I'm having a growing problem where certain entries won't add and I get these errors in slapd stats output: conn=7 op=160 MODRDN dn="cn=Untitled_1,cn=computer_groups,dc=chetwood,dc=local" => bdb_dn2id_add: subtree (cn=mslib,cn=computer_groups,dc=chetwood,dc=local) put failed: -30996 conn=7 op=160 RESULT tag=109 err=80 text=DN index add failed conn=7 op=161 MOD dn="cn=Untitled_1,cn=computer_groups,dc=chetwood,dc=local" conn=7 op=161 MOD attr=cn entry failed schema check: value of naming attribute 'cn' is not present in entry conn=7 op=161 RESULT tag=103 err=64 text=value of naming attribute 'cn' is not present in entry conn=7 op=162 MODRDN dn="cn=Untitled_1,cn=computer_lists,dc=chetwood,dc=local" => bdb_dn2id_add: subtree (cn=mslib,cn=computer_lists,dc=chetwood,dc=local) put failed: -30996 conn=7 op=162 RESULT tag=109 err=80 text=DN index add failed conn=7 op=163 MOD dn="cn=Untitled_1,cn=computer_lists,dc=chetwood,dc=local" conn=7 op=163 MOD attr=cn entry failed schema check: value of naming attribute 'cn' is not present in entry conn=7 op=163 RESULT tag=103 err=64 text=value of naming attribute 'cn' is not present in entry conn=7 op=164 SRCH base="cn=computer_groups,dc=chetwood,dc=local" scope=2 deref=0 filter="(&(objectClass=posixGroup)(objectClass=apple- group)(objectClass=extensibleObject)(|(cn=untitled_1)))" conn=7 op=164 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=7 op=165 ABANDON msg=165 This is slapd 2.3.27, which is included in Apple OSX 10.5. This particular entry is for a computer group called mslib, and I'm using Apple's workgroup manager tool to add it. Other names will add, it seems to be entries that were created before but aren't showing up now. This is also happening for other object classes, like computer entires. slapcat and the other tools I use don't show an existing entry for mslib or the other names that won't add. Any advise on where to go from here would be appreciated. Thanks, Andy Zirkel.

2 5

Host based authentication using OpenLDAP
by Per Kristiansen 19 May '09

19 May '09

Hello, I've been working on implementing a LDAP solution for the last 8 months (in-between task, you know how it is :D ) I now have a working LDAP directory, have all my users imported, things actually work! :D..(jinx!) But now I wanna get fancy.. I've been googeling for some sort of clear description on how I can set up a system using groups of hosts and user groups to create a selective ACL for ssh'ing to a set of servers based on group membership. One of my primary goals is to have it work as much "out of the box" as possible for RHEL4 and 5 (and CentOS ) That means I want to avoid having to make changes to hosts (I have around 60-80 linux servers today that I want over on LDAP) So I try to avoid the solutions involving /etc/security/* I have it working with the ldapns schema with no changes to PAM. But this means I have to enter the specific host into each user record. But I'm a contrary and difficult guy, and love making problems for my self so I want to assign groups of users to groups of servers. Oh..and SSH keys :D..but that is for when life looks sunny and I need to be reminded that the world is a bad place. is there anyone that can point me towards resources that are written on this?..I already have a list of links I've been reading, and are adding those here in case other people want to look at them: https://help.ubuntu.com/community/LDAPClientAuthentication http://www.redhat.com/f/pdf/rhas/NetgroupWhitepaper.pdf http://www.padl.com/OSS/nss_ldap.html http://www.padl.com/OSS/pam_ldap.html http://quark.humbug.org.au/publications/ldap/system_auth/sage-au/system_aut… Thanks for taking the time to read this :) -- Per

1 0

Jabber and LDAP
by Gavin Henry 19 May '09

19 May '09

Hi All, Does anyone have any recommendations on Jabber servers that have great LDAP support and a small-ish footprint (i.e. not OpenFire)? I've been looking at http://xmpp.org/software/servers.shtml eJabberd and jabberd2 are the ones I've once used. Thanks.

2 1

Migration Lotus Notes
by Clenio W. e Silva 18 May '09

18 May '09

Lotus Notes Migration to OpenLDAP. Any tips on how to start? -- Clenio W. e Silva (62) 8414-5089 Gtalk: cleniogyn(a)gmail.com Jabber: cleniogyn(a)casabrasil.gov.br MSN: cleniogyn(a)hotmail.com -------------------------------------------------------------------- Ter Jesus como amigo é melhor do que qualquer outra conquista na vida!

2 1

MMR get inconsistent when updating entries concurrently to both Masters(2-masters configuration)
by hu zhang 18 May '09

18 May '09

Hi, all, I set up a testing environment for the MMR(2 master server), it did work well when I tested it in a "test050" style, that was, send updated requests to one of the master server, waited for seconds, then send update requests to another master server. All updates could be properly replicated among both servers. However, when I tried to update entries in an interleave style to these servers, I mean, like, the first update request was sent to server A, and the second request was sent to server B, then A, then B, .... there was no waitting between the update requests, and all requests were differnt. >From my understanding of the MMR, I hoped all updated in server A would be finally replicated to server B, and same to server B. But, the real test result was, I could see all updates in one of the server, but only partial updates in another server, the partial updates were exactly made by the requests directly comes to that sever, that is to say, the replication samed to be *monodirectional *in this situation. My question, is this scenario a bug for current openLdap, or, it is just not a supported use case ?* * I've been trying to find an answer in past mail threads, but I failed. Hope you guys can help me out from this confusion about MMR, if you need any further information, like configuration, I'll put them on, but I don't think that's a configuration problem, because the "test050" style testing works. Thanks! Hu

2 2

authenticate group of hosts
by François Mehault 18 May '09

18 May '09

Hi All, I have install openldap to authenticate users on system Unix. So, I use the module pam_ldap / nss_ldap with primitive pam_check_host_attr yes, and I have the attribute host for each person in my LDAP. I want to have 3 levels of authentication : - First level : a person have numerous attributes « host » so he is able to authenticate on these hosts - Second level : a person could be able to authenticate on a group of host - Third level : a person is able to authenticate on all hosts For the first level, for each host I declare one primitive « host » for my user in openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/fmehault loginShell: /usr/local/bin/sh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: hostObject userPassword: {MD5}9x2+UmKKP4OnerSUgXUlxg== host: labobe1 host: labobe2 For the third level, I put just the primitive « host : * » But I don't know how i could do the second level. I would like something like groupRadiusName, I want to define numerous group with host primitive, and each users can be in one group or plus. The goal is that my user have his host primitive plus the host primitive of his group. Is it possible ? Thanks for your help, Regards, François

1 0

getting rid of "request done" messages
by Heiko Petzsch 18 May '09

18 May '09

Hi, I've tried to ask the following question in the openldap-software mailing list: > I have a beginners question: when I log in as root on one of my systems, I > get quite a lot of messages of the form > > request done: ld 0x5654f0 msgid 1 > request done: ld 0x5654f0 msgid 2 > ... > > on the console. I assume that they originate from my openldap installation > - but I don't even understand the mechanism how they are send to me > (openldap was installed by my predecessor). Could someone please tell me > how to get rid of these messages ? The moderator rejected my question, giving as his reason: (I hope he doesn't mind being quoted with this) "Given these messages occurred when you "log in", it is likely that issue relates to LDAP client software you are using to manage system log ins. Your question of "how to get rid of these" is likely lead to off-topic discussion of that LDAP client software. However, your message does at seem to relate to the use of OpenLDAP Software, hence it suggested you submit your submission to the OpenLDAP-technical list." I must admit that I had and have have no certainty at all which software produces these messages - I only searched the internet, and saw the same messages in connection with questions other people asked about openldap. They are, though, not a direct result of me logging in - they arrive continously and even after hours of being logged on. Could anybody tell me where these messages originate from, and how I can disable them ? Any help will be appreciated. Heiko -- Heiko Petzsch GTS Systems and Consulting GmbH D-52134 Herzogenrath

3 3

SDK: ldap_simple_bind gives Protocol error
by Stephen 17 May '09

17 May '09

Hi everyone, I'm trying to work out why some sample code doesn't work against a Centos 5 system (Centos being a RedHat Enterprise clone). Client is Mac OS X 10.5, and server is Centos 5.3, OpenDLAP 2.3.43. The sample code is from http://docs.sun.com/source/816-5616-10/example.htm#13303. (Am not using the Sun SDK, it was just a convenient place to find sample code. If there are OpenLDAP sample code resources, a link is welcome.) In particular the problem occurs at this piece of code: /* Bind anonymously to the LDAP server. */ rc = ldap_simple_bind_s( ld, NULL, NULL ); if ( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_simple_bind_s: %s\n", ldap_err2string(rc)); return( 1 ); } The resultant output is an error, namely; 'ldap_simple_bind_s: Protocol error' In comparison, if I run the same code against a Gentoo Linux system that also has OpenLDAP 2.3.43 the sample code works just fine. If I do an ldapsearch from the Mac OS X client with the query below, it succeeds. ldapsearch -x -h remoteCentosldapsvr -b basedn Can anyone suggest why the Centos 5 system is showing the protocol error? Thanks Regards Stephen

2 2

New DC
by Tech Only 16 May '09

16 May '09

Hello, I am new to LDAP. I have a basic question. How do I delete the default domain which is in the slapd.conf file and create my own? I have suffix "dc=example, dc=com" in slapd.conf file and if i chnge the above line and other lines where dc=example, dc=com to dc=test, dc=com I am not able to connect to it. Pelase let me know how to get rid of default dc and create my own domain. Thanks

2 3

replication between different slapds versions
by jakjr 15 May '09

15 May '09

Hello, Is there any problem to use the syncprov (refreshAndPersist) between a ldap master version 2.3.30 and a consumer version 2.4.16 ? I did some tests and couldn't find any problem. Best regards, João Alfredo

1 0

OpenLDAP 2.1 High Availability
by Kukkala Prasad 15 May '09

15 May '09

Hi All, We are planning to configure High Availability for OpenLDAP 2.1 on Linux CentOS. We are looking at following options and we want to check our understanding about corresponding options and looking for your valuable suggestions. 1. Using Replica Service a. This is not enough because if master machine goes down then LDAP updates will not be possible. 2. Migrating to OpenLDAP2.4 a. Master-Master solution looks promising but in our current project time line it is not possible to migrate. 3. Sharing LDAP file system on NFS a. After going through the thread http://www.openldap.org/lists/openldap-software/200209/msg00256.html it is understood that OpenLDAP does not support GFS or NFS. b. But the thread discussion happened very long back around in 2000 to 2002. ????Is that conclusion applicable to OpenLDAP 2.1???? 4. Hosting LDAP Service on CentOS Cluster Suite a. ????Is it possible to configure "Active-Passive" setup using CentOS Cluster Suite???? 5. H/W based clustering a. We don't know what are the possible solutions in this approach and cost incurred. !!!!Please share your ideas.!!!! 6. NetApp2020 a. We have NetApp 2020 Appliance http://www.b2net.co.uk/netapp/network_appliance_netapp_fas2020.htm with us. ????Does this any way help us???? 7. Other alternatives a. !!!!We need your valuable ideas and suggestions.!!!! Please help me in this regard. Regards, Prasad. ________________________________ The information contained in this communication is confidential, intended solely for the use of the individual or entity to whom it is addressed and may be legally privileged and protected by professional secrecy. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. This email does not constitute any commitment from Cordys Holding BV or any of its subsidiaries except when expressly agreed in a written agreement between the intended recipient and Cordys Holding BV or its subsidiaries. Cordys is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt. Cordys does not guarantee that the integrity of this communication has been maintained nor that the communication is free of viruses, interceptions or interference. If you are not the intended recipient of this communication please return the communication to the sender and delete and destroy all copies.

6 13

database size
by Marcel Berteler 14 May '09

14 May '09

Our current database size is 7GB and we are wondering how big we can grow until we run into LDAP / BDB constrains. Are there others on the list that have extremely large databases? Any pointers to ensure we can grow our DB even further without issues? Marcel

3 2

openldap, proxy, round robin?
by Nathan Lager 14 May '09

14 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am attempting to setup an openldap proxy, which i'd like to connect to a number of openldap directories in a round-robin fashion. There are currently 2 ldap servers, with a round-robin DNS hostname pointing to them. I setup openldap to proxy to this hostname, but it seems that when i actually connect to the proxy, it picks one of the addresses, and holds on to it. If it gets the second server on its first connection, it then continues to use that server. Is there a way to make openldap connect to each server? Whether it uses the round robin hostname or not is irrelevant. Two methods I can think of would be to somehow keep slapd from caching the dns name. Or if I can specify each server separately in the slapd.conf on the proxy. Thanks! - -- - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nathan Lager System Administrator 11 Pardee Hall Lafayette College, Easton, PA 18042 610-330-5907 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkoLLmsACgkQsZqG4IN3sumf4gCeJ3tOzX5Mk8ddbgvkg7TASbUH d9MAn3U+B8uYIj6eQy+yAHitV9Cqij/K =gFcb -----END PGP SIGNATURE-----

2 2

Re: Deleting hundreds of Entry under a OU
by Michael Ströder 11 May '09

11 May '09

Daniel, please keep responses on the list so others can comment and learn as well. Daniel Spannbauer wrote: > > Michael Ströder schrieb: >> Daniel Spannbauer wrote: >>> Hello, >>> >>> I have to deleted abount 500 Entrys under a OU in my LDAP-Tree cause I >>> have to change the objectClass from "account" to "inetorgPerson". >>> Can I do this with ldapdelete? I always used that tool only to delete >>> one entry. >> Yes. But you have to provide a file with a list of the DNs of the >> entries to be deleted. >> >> $ ldapdelete -h >> usage: ldapdelete [options] [dn]... >> dn: list of DNs to delete. If not given, it will be readed from stdin >> or from the file specified with "-f file". >> >> (You could also use some of the GUI LDAP clients for that. E.g. my >> web2ldap supports recursive deletion of all entries below an entry.) > > Thats a posibility. But the ldap-Entries are genarated by a Script. So I > have to delete it also by this script. So a gui is not the solution that > I prefer. In this case I'd prefer to use a full-featured scripting language with a decent LDAP module to do the job. You have more control in the case of an error than with invoking command-line tools from a shell script. Ciao, Michael.

1 0

Deleting hundreds of Entry under a OU
by Daniel Spannbauer 11 May '09

11 May '09

Hello, I have to deleted abount 500 Entrys under a OU in my LDAP-Tree cause I have to change the objectClass from "account" to "inetorgPerson". Can I do this with ldapdelete? I always used that tool only to delete one entry. Regards Daniel -- Daniel Spannbauer Software Entwicklung marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

2 2

OpenLDAP server and OS X clients
by Arne Schmitz 11 May '09

11 May '09

Hi! We are running an OpenLDAP server on Debian Stable. It works very well so far, using more than 20 Linux clients. However, we now also have got a couple of Mac clients that are supposed to use the server. I have set the Mac clients (OS X 10.5.6) to use our LDAP server, using the Directory Utility. That utility is set to use a RFC 2307 server, with our LDAP's IP and the correct base name. After that I can "sudo su" to any LDAP user, also call "id" for any LDAP user, log in via SSH + key to LDAP user, but NOT authenticate via password. I.e. interactive logins or password based SSH logins are NOT possible. It seems the password authentication against LDAP is not working. What I find in /var/log/secure.log is the following: May 6 17:46:38 mymac authorizationhost[70401]: Failed to authenticate user MyLDAPUser (tDirStatus: -14090). Any ideas what might be going wrong here? Where should I look? Cheers, Arne -- Dipl.-Inform. Arne Schmitz Phone +49 (0)241 80-21817 Computer Graphics Group Fax +49 (0)241 80-22899 RWTH Aachen University http://www.rwth-graphics.de Ahornstrasse 55, 52074 Aachen, Germany

2 3

LDIF, userCertificate; and missing "binary" option
by Erwann ABALEA 07 May '09

07 May '09

Hello, Hoping it's the right list to ask for it. I'm facing a "cross-recommendations" problem. Here it is. I'm downloading an LDIF containing some inetOrgPerson and cRLDistributionPoint entries, in order to have a replication site to develop on. Those entries have userCertificate or certificateRevocationList , but not stored with the "binary" option (only the "::" indicating it's Base64-encoded). When trying to import this file with ldapadd on my directory, it failed, telling me that those attributes need to be transfered with the binary option. Right. I'm searching RFCs 2252 and 2256 (and their replacement as well), and find that effectively, those attributes *MUST* be transfered as binary ones. I told the directory maintainer that the LDIF wasn't correct according to these RFCs, and he replied that it was correct regarding RFC2849, which is the only one defining the LDIF format. Finally, that's right. And this RFC doesn't tell anything about certificates or binary option. And I can't find an obvious link between RFC2849 and RFC2252/2256. I know I can just do a 'sed s/userCertificate::/userCertificate;binary::/' of the file, but modifying something defined to be a standard for interchange doesn't seem to be a good solution. Do you have some ideas? Regards. -- Erwann.

2 1

OpenLDAP multi master replication
by Bujji S 07 May '09

07 May '09

Hi, i have openldap(2.4.9) installed in ubuntu 8.04 server. i want to create a multi master set up with two such servers(2 or more than 2) first i tried to follow http://www.openldap.org/doc/admin24/replication.htmlto form n-way master setup. but in starting only i got a problem saying database(dc=mytest,dc=com) is not configured to hold "cn=config" then i tried setting up cn=config using http://www.zytrax.com/books/ldap/ch6/slapd-config.html but that doesn't help me meaning even after configuring that cn=config as he mentioned in the site i got the same error so i removed everything(slapd.d) what i did earlier so now i have slapd.conf in both of my servers finally i found one more link http://itsecureadmin.com/wiki/index.php/OpenLDAP_Multi-Master_Replication that displays sample config file so i followed that you can check the slapd.conf below so now i set up the same configuration in the second server too. after writing these slapd.conf i just restared slapd on both servers. for the first time when i add some data the first server it got replicated on the other server only when restart slapd on second server. that is fine. when i tried to add some other data on second server its not getting replicated on the other server even if i restart slapd. after that wherever i add data not getting replicated adding locally only. what could be the problem. plz check my slapd.conf file and suggetst me how to do multi master replication on ubuntu 8.04 server. so my slapd.conf is below. # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel none # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload ppolicy.la moduleload syncprov.la moduleload back_monitor.la # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> database config rootdn "cn=admin,cn=config" rootpw admin123 database monitor rootdn cn=monitor rootpw admin123 ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=mytest,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=mytest,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" serverid 3 ldap://192.168.7.88:389 serverid 4 ldap://192.168.7.89:389 cachesize 1000 checkpoint 256 5 syncrepl rid=003 provider=ldap://192.168.7.88:389 binddn="cn=admin,dc=mytest,dc=com" bindmethod=simple credentials=admin123 searchbase="dc=mytest,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 syncrepl rid=004 provider=ldap://192.168.7.89:389 binddn="cn=admin,dc=mytest,dc=com" bindmethod=simple credentials=admin123 searchbase="dc=mytest,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode true overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq index cn,mail,surname,givenname eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mytest,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=mytest,dc=com" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=mytest,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be hdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" --------------------------------------------------------------------- so now i set up the same configuration in the second server too. after writing these slapd.conf i just restared slapd on both servers. for the first time when i add some data the first server it got replicated on the other server only when restart slapd on second server. that is fine. when i tried to add some other data on second server its not getting replicated on the other server even if i restart slapd. after that wherever i add data not getting replicated adding locally only. what could be the problem. plz check my slapd.conf file and suggetst me how to do multi master replication on ubuntu 8.04 server. Thanks Visu

2 1

ldap users in local groups
by Justin Lintz 06 May '09

06 May '09

Hi, I'm running into an interesting problem in that when I try to add more than one ldap account to a local group, both users of that group no longer show membership in that group when running "groups" or "id". If I just add one of the users to the group, it works without a problem. I apologize if this is not the correct list of this issue. Does anyone have any ideas on what may be causing this? - Justin Lintz

3 2

Occasional corrupt DN in be_add logs under 2.4.16
by Sean Burford 06 May '09

06 May '09

Hi, As an interim measure while deploying 2.4.16 I am canarying 2.3.43 on a replication provider. As a result the current replication path is: master (2.3.39) -> provider (2.3.43) -> replica (2.4.16) The master will be upgraded in short order once the 2.3.43 canary is successful. I've been seeing occasional corrupt DNs in some be_add log lines on the 2.4.16 replica: May 5 09:35:46 host slapd[31817]: syncrepl_message_to_op: rid=100 be_add <90>Y1 ntry,ou=subtree,dc=example,dc=com (0) I've modified the DN in this log line. The missing text is "cn=l" in this example. The original DN was 65 characters long. I have performed the following search against each host with the following results. It shows that the entry replicated fine but capitalisation of the DN differs (which may be a red herring since I was already aware that DN capitalisation differed across servers): $ ldapsearch -x -b cn=lntry,ou=subtree,dc=example,dc=com -s base dn master: dn is cn=lntry,ou=Subtree,dc=example,dc=com provider: dn is cn=lntry,ou=subtree,dc=example,dc=com replica: dn is cn=lntry,ou=Subtree,dc=example,dc=com slapcat shows no problems with the entry on the 2.4.16 host. Since the database looks fine I wonder if this is just a logging issue. Should this Debug statement in syncrepl.c actually use op->ora_e->e_name.bv_val or some other attribute? rc = op->o_bd->be_add( op, &rs ); Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s be_add %s (%d)\n", si->si_ridtxt, op->o_req_dn.bv_val, rc ); With the exception of si->si_rid becoming si->si_ridtxt (and %d->%s) this Debug statement has not changed since 2.3. -- Thanks, Sean Burford

3 5

slapd-meta and paged results control
by Lajos Boróczki 06 May '09

06 May '09

Hi, I'm trying to set up an openldap proxy server using slapd-meta. Everything worked so far, but after the backend database grew bigger and bigger, searches with a fixed page size started to give strange results. Tracing the problem led me to the following: If I set a page size of 300 in my ldapsearch (where localhost:3890 is my slapd running slapd-meta): ldapsearch -x -W -D "CN=admin,DC=example,DC=org" -E pr=300 -H "ldap://localhost:3890/" -b "dc=a,dc=example,dc=org" "(objectClass=inetOrgPerson)" uid I get at most 300 results and the paging information is lost on the way. If I set 300 to 1000 I get all of the results, because I have ~500 entries. Doing an ldapsearch to the backand servers: ldapsearch -x -W -D "CN=admin,DC=example,DC=org" -E pr=300 -H "ldap:// dc1.a.example.org/" "dc=a,dc=example,dc=org" "(objectClass=user)" userPrincipalName I get 300 results and a prompt to press enter, after pressing some enters I can get every entries. My backends are Active directories... :( Thanks for your help, Lajos Config: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/ad_attr.schema include /etc/ldap/schema/ad_class.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 8 modulepath /usr/lib/ldap moduleload back_meta moduleload back_ldap moduleload rwm moduleload pcache moduleload back_bdb sizelimit 1000 tool-threads 1 database meta suffix "dc=example,dc=org" norefs yes rebind-as-user yes chase-referrals no uri "ldap://dc1.example.org/dc=example,dc=org" "ldap:// dc2.example.org/" uri "ldap://dc1.a.example.org/dc=a,dc=example,dc=org" "ldap:// dc2.a.example.org/" uri "ldap://dc1.b.example.org/dc=b,dc=example,dc=org" "ldap:// dc2.b.example.org/" overlay rwm rwm-rewriteEngine on rwm-map attribute uid userPrincipalName rwm-map objectclass inetOrgPerson user

4 5

ppolicy pwdcheckmodule...
by JDaniel Jimenez 06 May '09

06 May '09

Hello everyone, I have installed openldap about two months ago, everything went ok and now I need passwords policies. Theese are working as spected but pwdCheckModule. In `man slapo-ppolicy` I have read this is an user-defined module... This is a problem for me... A long time ago I think I was able to do this without too much problems but now by now I must read "C++ Bible" to understand this... Is there any sample, or configurable module for this? Every body do this bi itself? thanks in advance ;) -- JDani

1 0

[Openldap2.4.11-Ubuntu8.10] Configuration Problem: ldap.conf missing, not possible to create slapd.d using slaptest
by Ket Zal Dev 06 May '09

06 May '09

Hi All I'm on Ubuntu 8.10, and using openldap 2.4.11. I successfully installed openldap on my server. I was a little bit surprised because i didn't found slapd.conf on /etc/ldap/ like in older releases, but I found a tuto explaining how to use slapd.d. On this howto, they sepcified it is possible to convert slapd.conf to slapd.d using slaptest. Because I don't have slapd.conf, I cannot convert anything. So, How can I do??? Secondly, on the tutorial, I used slaptest to create a ldif for a schema. I successfully added the ldif schema to openldap using ldapadd, and schema is working. It was mozillaorgperson, and I'm now able to create, read and modify users. My problem is that I need to use a new schema "rfc2703bis.schema" because my openldap server is for egroupware, and there is a problem with PosixGroup...... So I need to add it. This schema should replace nis schema. BUT, I cannot delete NIS schema, because used by open ldap. And cannot add rfc2703bis because I have errors "already exists" <--- it is logical because entries are on NIS which is active on openldap at this time. So I tried a lot of things, like using slaptest to create de ldif, copying it widely to slapd.d and removing by hand the NIS schema.... Not working, the result is that now, the openldap server cannot start.... Is there a clean way to do that??? Is it possible for me to create a slapd.conf, put inside all my configuration, do the slaptest, have a clean slapd.d and run openldap???? in a simple way. What to put inside...??? Thanks a lot for you help Best Regards

1 0

Syncrepl connections failing
by John Kane 05 May '09

05 May '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 3

Re: Berkeley DB V ersion
by Gustavo Mendes de Carvalho 05 May '09

05 May '09

Hi All, I was checking Oracle Berkeley site, and I found many versions available to download. I will compile Berkeley database on my own, and I would like to know which version is most recommended to use with OpenLDAP 2.4.x http://www.oracle.com/technology/software/products/berkeley-db/db/index.html 4.7.25 is the Latest Production Release. -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

1 0

Check for existence of a group
by Alex Chen 05 May '09

05 May '09

I am new to LDAP so please bear with me if my question sounds too basic. I want to make sure if a group already exist in the directory before a member is allowed to be added. I guess the API to use would be ldap_search_s (I want to sue synchronous search). What kind of filter syntax should I use? Alex

3 2

Berkeley DB V ersion
by Gustavo Mendes de Carvalho 05 May '09

05 May '09

Hi All, I was trying to compile openldap 2.4.x and I was surprised because this version _requires_ BDB version 4.4. I am installing it in a Red Hat AS 4 up7 machine and RedHat has only version BDB 4.3 available to download. Is there any doc on OpenLDAP site regarding upgrading BDB, from 4.2.x to 4.4.x ? Is there any problem running openldap 4.4.x using BDB 4.2 ? Tanhks in advance -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

4 4

Attribute for txt records
by Aurélien BARLUET de BEAUCHESNE 05 May '09

05 May '09

Hi List, I sent the same question just after my registration but before my validation, so I'm not sure you received it. I would like to know the name of the attribute for the "txt" record in a DNS zone. I tried txtrecord, txtrecords, txt, but none of these are correct. Can you help me ? Thanks' in advance Regards, --- Aurélien de BEAUCHESNE VOIPLine : 04 27 70 90 07 <http://www.ipline.fr/> IPLine 122 Grande rue St Clair 69300 Caluire Tel : 04 72 27 49 00 Fax : 04 72 27 02 57 Le paysagiste de l'environnement Internet P Afin de contribuer au respect de l'environnement, merci de n'imprimer ce mail que si nécessaire

3 4

Help for special ACL needed
by Florian Götz 04 May '09

04 May '09

A warm "Hello" from germany to the openldap-technical list! I´m rather new to OpenLDAP, using version 2.4.12 on a SLES11 server. I need to write an ACL which allows a user to see his own entry (objectClass build up on inetOrgPerson) and nothing else. I know that this isn´t the intended use of the LDAP system, but our manager wants it that way. I tried it with somekind of that: access to dn.regex="uid=([^,]+),dc=justushere,dc=de$" attrs=entry by dn.regex="uid=$1,ou=Users,dc=justushere,dc=de" write by users none but I just get a message about invalid credentials. Used command was: ldapsearch -xWD uid=user1,ou=users,dc=justushere,dc=de uid=user1 ldapsearch -xWD cn=admin,dc=justushere,dc=de uid=user1 with the rootdn account shows the information, but if the uid of the user1 is used for binding it fails. Has anyone an idea how to realize these restrictions? Additionally not all attributes should get listed to the user, only a few important for him. My idea was to use a ACL like the above to be sure the user only gets access to his object and then add a second ACL below who restricts the access to the important attributes. Best regards Florian Götz

4 6

slapd + gssapi/heimdal: using false realm in principal
by Friedemann Stoyan 30 Apr '09

30 Apr '09

Hello, I struggle with an Debian GNU/Linux (Lenny) and * slapd 2.4.11-1 * heimdal-kdc 1.2.dfsg.1-2.1 * libsasl2-modules-gssapi-heimdal 2.1.22.dfsg1-23 With this configuration: /etc/ldap/slapd.conf: # Kerberos Configuration sasl-host kerberos.lab.swapon.de sasl-realm LAB.SWAPON.DE # Mapping Kerberos Authentication Identities authz-regexp uid=([^,]*),cn=lab.swapon.de,cn=gssapi,cn=auth ldap:///ou=people,dc=lab,dc=swapon,dc=de??one?(&(uid=$1)(objectClass=person)) /etc/ldap/sasl2/slapd.conf: mech_list: GSSAPI log_level: 7 Then I get a kerberos ticket and start ldapsaerch: $ ldapsearch -H ldaps://ldap.lab.swapon.de/ SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) The slapd logfile isn't very helpfull: slapd[11480]: conn=2 fd=14 ACCEPT from IP=[2001:6f8:12ec:11::389:fefe]:60487 (IP=[2001:6f8:12ec:11::389:fefe]:636) slapd[11480]: conn=2 fd=14 TLS established tls_ssf=128 ssf=128 slapd[11480]: conn=2 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" slapd[11480]: conn=2 op=0 SRCH attr=supportedSASLMechanisms slapd[11480]: conn=2 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[11480]: conn=2 op=1 BIND dn="" method=163 slapd[11480]: SASL [conn=2] Failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) slapd[11480]: conn=2 op=1 RESULT tag=97 err=80 text=SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) slapd[11480]: conn=2 fd=14 closed (connection lost) The KDCs logfile is more interesting: Authentication Server Request from slapd (successfull): 14:37:13 AS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB.SWAPON.DE(a)LAB.SWAPON.DE 14:37:13 Client sent patypes: encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp 14:37:13 Looking for PKINIT pa-data -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE 14:37:13 Looking for ENC-TS pa-data -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE 14:37:13 ENC-TS Pre-authentication succeeded -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE using aes256-cts-hmac-sha1-96 14:37:13 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, des3-cbc-md5, arcfour-hmac-md5, des-cbc-md5, des-cbc-md4, des-cbc-crc 14:37:13 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 14:37:13 AS-REQ authtime: 2009-04-27T14:37:13 starttime: unset endtime: 2009-04-28T00:37:13 renew till: unset 14:37:13 sending 670 bytes to IPv6:2001:6f8:12ec:11::88:fefe Ticket Granting Server Request from slapd (fails): 14:37:13 TGS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for digest/LAB(a)LAB.SWAPON.DE [canonicalize] 14:37:13 Searching referral for LAB 14:37:13 Server not found in database: digest/LAB(a)LAB.SWAPON.DE: No such entry in the database 14:37:13 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 TGS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB(a)LAB.SWAPON.DE 14:37:13 Server not found in database: krbtgt/LAB(a)LAB.SWAPON.DE: No such entry in the database 14:37:13 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe It's clear that this TGS-REQ is failing: the realm "LAB" in the principal "krbtgt/LAB(a)LAB.SWAPON.DE" doesn't exist. Correct would be: "krbtgt/LAB.SWAPON.DE(a)LAB.SWAPON.DE". At present I have no clue how to fix this. Good ideas would be appreciated. Regards Friedemann

1 1

RE: CSN Too Old potential Bug
by Victor Andres Sina Sotomayor 30 Apr '09

30 Apr '09

Hi all I was reading this post in openldap-technical forum. I am in the process to install a full authenticate service here using samba and openldap, my pdc and bdc are ldap based servers, and are in different locations, using a router to connect them, then. a full master ldap is needed in these two locations. I have two ldap servers in mirror mode (in a virtual machines, using vmware), these two servers are time synchronized using the same time server. When a update a ldap entry in one server, the data replicate fine, but when I use the other, I have the following error in my logs. Apr 29 11:50:15 srvped2master slapd[7377]: do_syncrep2: cookie=rid=002,sid=002,csn=20090429165015.624045Z#000000#001#000000 Apr 29 11:50:15 srvped2master slapd[7377]: do_syncrep2: rid=002 CSN too old, ignoring 20090429165015.624045Z#000000#001#000000 The time is very difficult to maintain in sync when virtual machines are in use, and Openldap servers are extremely sensitive to time lag. Apparently this is a bug in ldap 2.4.11 and will be fixed in ldap 2.4.16 <http://www.openldap.org/lists/openldap-bugs/200903/msg00202.html> http://www.openldap.org/lists/openldap-bugs/200903/msg00202.html Anyone could solve the problem? Im using debian lenny srvped2master:/etc/ldap# apt-cache policy slapd slapd: Installed: 2.4.11-1 Candidate: 2.4.11-1 Version table: *** 2.4.11-1 0 500 http://ftp.us.debian.org lenny/main Packages 100 /var/lib/dpkg/status This is my slapd.conf ################# serverID 1 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=avhlima,dc=edu,dc=pe" rootdn "cn=admin,dc=avhlima,dc=edu,dc=pe" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 syncrepl rid=001 provider=ldap://192.168.4.8 type=refreshAndPersist retry="60 +" searchbase="dc=avhlima,dc=edu,dc=pe" attrs="*,+" bindmethod=simple binddn="cn=admin,dc=avhlima,dc=edu,dc=pe" credentials=XXXXXXXXXXXX mirrormode on index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub lastmod on checkpoint 512 30 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn="cn=admin,dc=avhlima,dc=edu,dc=pe" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=avhlima,dc=edu,dc=pe" write by * read ########################## The diff between servers are only in: serverID 2 syncrepl rid=002 provider=ldap://192.168.3.8 Thanx 4 your time Victor

3 2

openldap on windows
by singularity suse 29 Apr '09

29 Apr '09

How do I set openldap running on my windows xp machine. I edited the conf fie, but it doesn't work. Thanks

1 0

backing up openldap using slapcat automatically
by hariharan＠thehindu.co.in 29 Apr '09

29 Apr '09

1 0

Ldap error: Logging region out of memory; you may need to increase its size
by vaibhav lokhande 28 Apr '09

28 Apr '09

Hi all , I am new in world of ldap. following is info about my ldap. *openldap-2.4.11-1.3.el5 openldap-servers-2.4.11-1.3.el5 nss_ldap-253-3 compat-openldap-2.4.11_2.3.27-1.3.el5 openldap-clients-2.4.11-1.3.el5 php-ldap-5.1.6-5.el5 openldap-devel-2.4.11-1.3.el5* And m getting error on command slapcat * bdb(o=******_ldap): Logging region out of memory; you may need to increase its size bdb_db_open: database "o=******_ldap": db_open(/var/lib/ldap/id2entry.bdb) failed: Cannot allocate memory (12). backend_startup_one: bi_db_open failed! (12)* *Can any one please guide me to solve this issues. Other things are working fine. But still m getting this error. Regards Vaibhav *

1 0

Adapt memberof overlay for host attribute
by Vince Rafale 28 Apr '09

28 Apr '09

Hi list, I would like to know whether anybody has succeeded in using the memberof overlay for others attributes. I would like a user entry (specifically the host attribute) to be populated when a user is added to a posixGroup. Let's say this posixGroup contains a "hostOfGroup" attribute. Is it feasible? Or do I need to code my own overlay for that purpose? If writing an overlay is not needed, is there an esaier way to do that? Thanks. Regards, Vince

4 5

getting distinguishedName as a distinct attribute in seach result
by Erik De Zeeuw 28 Apr '09

28 Apr '09

Hello, We need to get a line with "distinguishedName: <dn>" in our search results, in order for a specific software to work with our LDAP setup. I tried to play around with rwm-map and rewrite, but could not find a solution to get this working. To be clear, I would like to get this as a search result: dn: uid=myuser,ou=people,dc=my,dc=suffix givenName: My User ... other attributes ... distinguishedName: uid=myuser,ou=people,dc=my,dc=suffix ... other attributes ... I know this might not be standard, and it indeed looks quite stupid as we already get the dn: line, but this seems to be the way it works when using active directory, and software we bought just wait for this to work. Thanks for any constructive answer that will popup :)

2 1

Segfault during Auth Benchmark request
by SAGNIMORTE Thomas (CAMPUS) 28 Apr '09

28 Apr '09

Hi, I am working on building and benchmarking OpenLDAP v2.4.16 for a large entries directory (actual test: 2 000 000 but final objective 10 000 000 users). I use SLAMD to test authentication in order to evaluate what is the maximum number of authentication I can do on my server. So I try to do 5 authentications per 5ms during 5min. My OpenLDAP 2.4.16 is install on the X86 two core 2.8Ghz server with 4Go of memory. I set 3Go in cache of DB_Config and I have look a lot on how configure properly slapd. Is it normal because I have reach system limits or can I change some parameter to optimize slapd performance? Do some people have some figures about slapd performance with large entries directory on standard server? Regards, --- Thomas

3 11

cannot rename back-sql tables
by Matthew Hallsworth 27 Apr '09

27 Apr '09

Hi list, I have searched far and wide for a solution to this but cannot find anywhere where it is possible to configure back-sql as such. I am trying to interface openldap with a MySQL backend using the standard back-sql configuration, with one exception - every 'ldap_*' prefixed table needs to be named 'custom_ldap_*' as we are trying to fit in LDAP support into an existing product which requires the additional tables to make this work to conform with existing schema. What I've found is, I can get the LDAP requests working perfectly via a test database using standard 'ldap_*' notation, but I cannot for the life of me get the system to handle different table names properly. My config file, "/etc/openldap/slapd.conf", on CentOS 5.2 shows the following: <snip> # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. #allow bind_v2 loglevel -1 logfile /var/log/ldap.log # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # sql definitions for mysql access ####################################################################### database sql dbname ldaptest readonly on suffix "dc=rams,dc=com,dc=au" dbuser ldaptest dbpasswd abc123 subtree_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" children_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM custom_ldap_oc_mappings" at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM custom_ldap_attr_mappings WHERE oc_map_id=?" has_ldapinfo_dn_ru no lastmod off ####################################################################### # ldbm and/or bdb database definitions ####################################################################### #database bdb #suffix "dc=my-domain,dc=com" #rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM </snip> Now, when I run "/usr/sbin/slapd -d -5" and attempt to do a general query on the ldap server using "ldapsearch -x -b 'dc=rams,dc=com,dc=au'" I get the following feedback from openldap: <snip> # extended LDIF # # LDAPv3 # base <dc=rams,dc=com,dc=au> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 </snip> And, the debug output displays: <snip> ... ==>backsql_search(): base="dc=rams,dc=com,dc=au", filter="(objectClass=*)", scope=2, deref=0, attrsonly=0, attributes to load: all ==>backsql_get_db_conn() ==>backsql_open_db_conn(3) daemon: epoll: listen=8 active_threads=0 tvp=NULL <==backsql_open_db_conn(3) backsql_open_db_conn(3): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_dn2id("dc=rams,dc=com,dc=au") matched expected backsql_dn2id("dc=rams,dc=com,dc=au"): id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" backsql_dn2id("dc=rams,dc=com,dc=au"): id=1 keyval=1 oc_id=1 dn=dc=rams,dc=com,dc=au >>> dnPrettyNormal: <dc=rams,dc=com,dc=au> <<< dnPrettyNormal: <dc=rams,dc=com,dc=au>, <dc=rams,dc=com,dc=au> <==backsql_dn2id("dc=rams,dc=com,dc=au"): err=0 ==>backsql_id2entry() backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="organizationalUnit" attr="objectClass" keyval=1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM ldap_entry_objclasses,ldap_entries,company WHERE company.id=? AND ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entries.keyval=company.id and ldap_entries.oc_map_id=1' Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entry_objclasses' doesn't exist" <==backsql_id2entry() ==>backsql_oc_get_candidates(): oc="inetOrgPerson" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '2' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" ==>backsql_oc_get_candidates(): oc="organizationalUnit" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '1' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" send_ldap_result: conn=3 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=80 ber_flush: 14 bytes to sd 9 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... conn=3 op=1 SEARCH RESULT tag=101 err=80 nentries=0 text= ... </snip> In summary, I feel that there is some kind of missing configuration variable either in documentation or tutorials online that really doesn't allow you to fully specify alternate table names for the default 4 main tables in the back-sql implementation. If this is due to the backend being experimental then so be it - however I really need some kind of quantified 'yes' or 'no' as to whether what I'm trying to achieve is possible at all. TIA Matthew Hallsworth

1 0

Re: bdb_equality_candidates warning
by Gustavo Mendes de Carvalho 27 Apr '09

27 Apr '09

Hi Quanah, I included this field to be indexed in ldap database, and after ldap restart I can't see this message anymore. Thanks for while. Gustavo 2009/4/27 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Monday, April 27, 2009 3:59 PM -0300 Gustavo Mendes de Carvalho < > gmcarvalho(a)gmail.com> wrote: > > Hi there, >> >> I have an OpenLDAP server version 2.3.39, and recentrly (I mean, since >> last friday) I noticed some delay when athenticating against LDAP base. >> >> I got this messages in ldap.log file >> >> Apr 27 15:46:39 ldap01 slapd[4445]: <= bdb_equality_candidates: >> (uniqueMember) not indexed >> > > Does anybody has some tip about it ? Which entry do I have to index to >> avoid this message ? Is there any way to find out which index is it >> caliming for ? >> > > Seems pretty clear to me. The log clearly states that the attribute > "uniqueMember" is not being indexed. Your index statements in slapd.conf > agree with that. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

3 3

RE:AW: Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 27 Apr '09

27 Apr '09

Actually, I do not have an ACL. Could you provide me further details for what I have to permit with the ACL. The log file of OpenLdapServer, when i execute the command "getent passwd on solaris" is the following: Apr 24 19:37:04 achilles slapd[22086]: conn=19 fd=10 ACCEPT from IP=10.0.0.25:33240 (IP=0.0.0.0:389) Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SRCH base="ou=people,dc=tesyd,dc=teimes,dc=gr" scope=2 deref=3 filter="(objectClass=posixAccount)" Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SRCH attr=cn uid uidnumber gidnumber gecos description homedirectory loginshell Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SEARCH RESULT tag=101 err=32 nentries=0 text= Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=1 UNBIND Apr 24 19:37:04 achilles slapd[22086]: conn=19 fd=10 closed I have not declare the ou=people somewhere and i do not understand the searching on "ou=people,dc=tesyd,dc=teimes,dc=gr". any suggestion would help From: claus.kick(a)siemens.com To: poly_pan78(a)hotmail.com Date: Thu, 23 Apr 2009 16:06:21 +0200 Subject: AW: Problem to Authenticate Users with openLDAP on Solaris 9 Do you have an ACL in place in order to allow binding to read the ldap data? Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von panagiotis polychronopoulos Gesendet: Donnerstag, 23. April 2009 15:04 An: openldap-technical(a)openldap.org Betreff: Problem to Authenticate Users with openLDAP on Solaris 9 hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance Δείξτε το στιλ σας με μια εικόνα στο Messenger. Δείτε τις όλες. Κάντε κλικ εδώ! Δείξτε το στιλ σας με μια εικόνα στο Messenger. Δείτε τις όλες. Κάντε κλικ εδώ! _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 1

bdb_equality_candidates warning
by Gustavo Mendes de Carvalho 27 Apr '09

27 Apr '09

Hi there, I have an OpenLDAP server version 2.3.39, and recentrly (I mean, since last friday) I noticed some delay when athenticating against LDAP base. I got this messages in ldap.log file Apr 27 15:46:39 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:46 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:48 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:54 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:53 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:56 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:58 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed This is my slapd.conf related to indexes ####################################################################### # Indexes ####################################################################### index objectClass eq,pres index uid,memberUid eq,pres,sub I already checked for duplicate entries in ldif file, but I got nothing. Does anybody has some tip about it ? Which entry do I have to index to avoid this message ? Is there any way to find out which index is it caliming for ? Thanks in advance -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

2 1

Re: slapd_db_archive log rotation
by Andrew Hall 27 Apr '09

27 Apr '09

Thanks for the reply Quanah. On 2009/4/25 Quanah Gibson-Mount wrote: > you fail to note what release you are using of OpenLDAP or BDB. There were > known issues with some earlier releases failing to checkpoint correctly. OpenLDAP 2.3.28 I've no idea the version of BDB - how would I find this out ? > You also fail to note your checkpoint parameter in slapd.conf. There doesn't seem to be a checkpoint setting in either slapd.conf or the DB_CONFIG file. Should there be ? > Also, rather than manually deleting logs, you can set BDB up to do it for you. See the > various options that can be set in DB_CONFIG. Yes, this can be specified with DB_LOG_AUTO_REMOVE but I wish to backup the log files before I remove them which is why I wish to do this manually.

2 3

Filter very strange problem for matching values
by Denis BUCHER 26 Apr '09

26 Apr '09

Hello everyone, I have a very strange problem with openldap... * Strange because it used to work and without reason (no update, no change in config) it suddently stopped to work * Strange because I have the correct configuration as far as I know * Strange because when I do tests, the results are illogical ! The problem is simple to explain, a filter doesn't work as expected ! The filter is : (&(objectclass=CourierMailAccount)(mail=%u)(accountStatus=active)) which mean find all object being : * in class CourierMailAccount * email is %u (this is replaced dynamically) * accountStatus is active The first two criteria are working, the problem is with accountStatus (if I remove this criteria it suddently works). PROBLEM : 1. if "accountStatus" is not present in my filter : it works 2. "accountStatus=active" => NO RESULTS ??? 3. "accountStatus=*" => RESULTS I tried in phpldaptadmin web interface, same problem : 1. "accountStatus=active" => NO RESULTS ??? 2. "accountStatus=*" => RESULTS In my schemas the config is : attributetype ( 1.3.6.1.4.1.7914.1.2.1.12 NAME 'accountStatus' DESC 'The status of a user account: active, noaccess, disabled, deleted' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) Is therefore the problem with caseIgnoreIA5Match ? But this seems correct according to many web pages like http://www.zytrax.com/books/ldap/ape/qmail.html And it always worked before... Any help would be greatly appreciated because I don't see where the problem comes from ? (Maybe some index problem ???) Thanks a lot in advance Denis

2 1

slapd_db_archive log rotation
by Andrew Hall 24 Apr '09

24 Apr '09

Hi there. I'm using slapd_db_archive with the -a flag to identify BDB logs which can be safely deleted. I've recently noticed my logs are building up and -a does not produce any output. However the -l flag does successfully list the log files. Therefore any use of the -d flag to remove them does nothing. I'm almost certain these old logs are not being used (there's about 20 going back for several months now) but still slapd_db_archive does not pick up on them. Can anyone advise what may be happening here or how I can debug this further ? Thanks very much.

2 1

openldap as slave server to windows AD
by Aleksander Kamenik 24 Apr '09

24 Apr '09

Hi, This is my first experience with ldap, there are lots of different approaches to configuring openldap and I'm a bit lost. I'm about to setup a windows domain server with AD for some 50 windows pc's. The windows pc's will use the windows server directly and that's settled. However I also have lots of different services running on linux servers which require the same user authentication and could be configured to use ldap based authentication instead of each having their own account database. It's a hassle to maintain accounts for each service separately. Also, if the windows server should be unavailable, I'd still like to be able to login and use the services running on linux servers. So I imagine having openldap act a slave server (like in DNS) the for the windows active directory service's "User" space. Is this possible and which configuration path should I take? The manual mentions proxy configurations as well as something called chaining. Please point me to the correct chapter and any other hints are appreciated. Regards, -- Aleksander Kamenik System Administrator Krediidiinfo AS an Experian Company Phone: +372 665 9649 Email: aleksander(a)krediidiinfo.ee http://www.krediidiinfo.ee/ http://www.experiangroup.com/

2 1

Missing CSN in do_syncrep2 cookie log line
by Sean Burford 24 Apr '09

24 Apr '09

Hi, I'm new to 2.4 (2.4.16) and I don't know if empty CSNs are expected. The provider restarted and the syncrepl consumer kept sync, however part way through the reconnection the consumer got an empty CSN and decided to do an additional reconnect. This may be a side effect of the provider running 2.3.39. The provider has a syncrepl accesslog and an auditlog that both agree with the CSNs below (no changes were skipped by the sync). The accesslog database has syncprov-nopresent and syncprov-reloadhint set to TRUE. The main database has these values set to FALSE (syncprov-reloadhint will be toggled to TRUE shortly on the main database). At 13:20:42 username1 has an attribute removed. The change is replicated at that time. This is the last entry replicated before the provider is shut down: do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xf966560 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0x155621b8 20090424132042Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username1,dc=example,dc=com (0) slap_queue_csn: queing 0xd2f6cf8 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0xec0a758 20090424132042Z#000000#00#000000 At 13:25:18 slapd on the syncrepl provider is shut down and the consumer notices: do_syncrep2: rid=100 (-1) Can't contact LDAP server do_syncrepl: rid=100 rc -1 retrying At 13:26:12 slapd on the replication provider is restarted. The consumer connects 6 seconds later and receives the same attribute delete again (I assume it isn't an entry delete since there are no entry deletes in the hours bracketing this log): do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100* do_syncrep2: cookie=csn=,rid=100* do_syncrepl: rid=100 rc -1 retrying At 13:27:18 slapd on the replication consumer reconnects and receives the same attribute delete again before continuing normal replication a little later when another user is modified: do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 do_syncrep2: cookie=csn=20090424133119Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xc9fdb67 20090424133119Z#000000#00#000000 slap_graduate_commit_csn: removing 0xf610488 20090424133119Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username2,dc=example,dc=com (0) -- Thanks, Sean Burford

2 1

synrepl delete over 90% of ldap entries
by Monika Strack 24 Apr '09

24 Apr '09

Hallo all, in this week, the syncrepl in RefreshOnly mode has delete over 90% of the ldap entries at the consumer. It is the secont time in last month, it make this mistake. The other time it work ok. After I have remove the database and slapd restart, all entries are back. The consumer is my mailserver, so no user can receive mail in the time his entries are removed. I work with debian, at the consumer with lenny and slapd 2.4.11-1 and at the Provider with entch and slapd 2.3.30-5+etch2 . I use gosa 2.5.16 to adminstrate ldap. Here are the log entries of the consumer: Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064823Z#000003#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae7069c0 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72dc78 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete uid=nutzera,ou=people,ou=arbgrp,ou=abt,ou=my,o=domain,c=de (0) : : slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 33fdb48e-c28c-102d-9d8a-c5d1aca5fa09 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=tz,o=fal,c=de Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_add (0) Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064845Z#000000#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae715640 20090421064845Z#000000#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae702e40 20090421064845Z#000000#00#000000 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 8b82805e-0867-102b-8021-e9137c6ded0b Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=mygrp,ou=groups,ou=my,o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_modify (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421065817Z#000003#00#000000,rid=101 Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5d17de-0867-102b-9fad-e9137c6ded0b, dn c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5e5f86-0867-102b-9fb0-e9137c6ded0b, dn o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5ed024-0867-102b-9fb2-e9137c6ded0b, dn ou=my,o=domain,c=de : (90% of ldapr entries) pr 21 08:58:45 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72cf50 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=my,o=domain,c=de (0) : (90% of entries) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete ou=my,o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete c=de (66) Apr 21 08:58:46 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:46 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xb4d03ff0 20090421065817Z#000003#00#000000 I now, that the logs no show errors, but why can the consumer say no entry found and delete. My colleague has delete 3 user, this change was made right and the al the other entriies are delete. How can I prevent this in the future? The configurations: Provider: slapd 2.3.30-5+etch2 Config: .... moduleload back_bdb moduleload syncprov : : # Fuer syncreply index entryCSN,entryUUID eq : overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: slapd 2.4.11-1 (lenny) Config: ..... index entryCSN,entryUUID eq : : syncrepl rid=101 provider=ldaps://ldap.my.local:636 type=refreshOnly searchbase="c=de" retry="60 10 300 3 600 +" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,ou=my,o=domai,c=de" credentials=ReSumpti0n regards Monika -- ________________________________________________________________________________ Monika Strack Institut fuer Nutztiergenetik Friedrich-Loeffler-Institut 31535 Neustadt e-mail: monika.strack(a)fli.bund.de Germany Tel: +49 5034 /871 154 Fax: +49 5034 /871 239 _______________________________________________________________________________

2 1

invalid credential
by owen nirvana 24 Apr '09

24 Apr '09

debian lenny openldap-2.4.11 , "rootpw 123456 " in /etc/ldap/slapd.conf I try to search in Apache Directory Studio, perl , java, but in term , I input "ldapsearch -D "cn=admin.dc=xxx,dc=org" -b "dc=xxx,dc=org" "(objectClass=*)" -W echo: >> Digest/SASL MD5 start invalid credential I am not user md5 password, and it's not right even if I use md5 password. I don't know how to configure slapd.conf to solve the problem gtalk:freeespeech@gmail.com

3 2

how to paginate the dataset from ldap
by owen nirvana 24 Apr '09

24 Apr '09

I'm a newbie, sometime a query might get hundreds of data from the LDAP server, I could not find a way to display these data by paginating, thanks for help gtalk:freeespeech@gmail.com

3 2

ldapadd: Invalid syntax (21)
by François Mehault 24 Apr '09

24 Apr '09

Hi All I am a novice with openldap. I just install on a freeBSD 7.0 with ports. I configure slapd.conf as best as i can. I configure rc.conf, I test my slapd daemon with slapdtest and it's ok. I start slapd with /usr/local/etc/rc.d/slapd start. Well, I create a little .ldif file to test. And I add at my database with : ldapadd -x -D "cn=root,dc=toto,dc=fr" -W -f test.ldif And I have : Enter LDAP Password: adding new entry "dc=toto,dc=fr" ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax The content of my test.ldif : dn: dc=toto,dc=fr objectClass: dcObject objectClass: organizationUnitName ou: test dc: toto My slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #Radius include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema schemascheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel 4 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb #Basic ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=root,dc=toto,dc=fr" write by * none access to * by dn="cn=root,dc=toto,dc=fr" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=toto,dc=fr" rootdn "cn=root,dc=toto,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}ERk1pX08CCoUT2Hixj/kR9Zx8NpJmx+0 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data # Indices to maintain index objectClass eq Why I can't add my ldif ? If someone can help me, thanks If I put organisation instead of organisationalUnit in my ldif, it works ! (and o instead ou of course) Regards François

3 3

Re: Setting up LDAP server
by Santosh Balan 23 Apr '09

23 Apr '09

Hi, My Server is a RHEL 5.0 i386 Architecture and the Clients are RHEL5.0 WS or RHEL4 WS or Thin Client which has minimal installation of Linux. I need information how those schemas will look and what data will it have. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Thu, 23 Apr 2009 11:15:04 +0100 On Thu, Apr 23, 2009 at 02:41:58AM -0500, Santosh Balan wrote: > I am on the look out for free support and advise. I have implemented a > basic LDAP server such that it authenticates for my mail server. However > this time I have been given a project wherein my LDAP works as an > authentication server for user login as well as mails. Also it should > have policies while authentication viz. it should disable USB ports for > the user, it should set a background wallpaper and screensaver which > should start within 20 secs. of the PC's idle time. It should also if > possible mount automatically a partition which will be user dependent > rather that PC dependent. You do not say what operating system you are using. I think you need to start by looking at the mechanisms available on the target OS to implement these policies. This is much more of an OS issue than an LDAP one. For example, with most Linux distros you can use PAM and NSS modules to link authentication and authorisation to LDAP. Solaris has similar mechanisms, and the *BSD systems too (but they are not identical). I suspect that you will do better to ask about this in OS-specific groups or mailing lists. Controlling the wallpaper and screensaver will require configuration of the window system: Gnome, KDE and MSWindows all have ways to do this but they are different. It may be possible to link them to LDAP-hosted policies, but again you need to look at the mechanisms first. You cannot just setup some data in an LDAP server and expect it to magically control user desktops. Once you have identified some control mechanisms you will be able to look at the way they interact with LDAP. This may require new schema, which this group certainly is qualified to discuss. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Syncrepl connections failing
by John Kane 23 Apr '09

23 Apr '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

editing objects with back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

While trying to understand the whole process that makes back-sql work, the following quote was really useful: Pierangelo Masarati wrote on Fri, 4 Jun 2004 16:03:39 +0200 > I'm talking about 2.2.X (2.2.11 at present). > > - slapd uses the structuralObjectClass of the entry to look up the > objectClass mapping according to ldap_oc_mappings; > - it does some sanity checks (I'll discuss these later) > - it checks for the existence of the entry's parent > - it uses the ldap_oc_mappings create_proc to create the objectClass > entry in ldap_entries > - then, for each attribute, the corresponding values are inserted if > possible. I'll discuss later how to decide whether an add should succeed > or not if some (required?) attribute mapping is not available; now I > really have to go :) Q1: Is this process still correct and is there more documentation around this process? Q2: What is the process for editing or remove data? When I add an OU, the ldap_entry_objclasses shows the oc_name of the OU object to be 'top', while the ldap_entries table shows the oc_map_id to be that of organizationalUnit. When I now try to edit the name of this object, I get the following error, which I get as well on trying to edit any other object: Could not rename the entry / Could not perform ldap_modify operation. LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass. Any clue what that could be? Marcel

2 1

Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 23 Apr '09

23 Apr '09

hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 0

Comparable and replaceable fax numbers
by Sean Burford 23 Apr '09

23 Apr '09

Hi, On my servers I've redefined facsimileTelephoneNumber as a telephoneNumber: attributetype ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SUP telephoneNumber ) This requires reimporting the database since the normalisation changes, but it adds comparison rules to fax numbers (allowing comparison and replacement of them): Before: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== Compare Result: Inappropriate matching (18) Additional info: inappropriate matching request UNDEFINED After: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== TRUE Is there any reason to follow the RFC in this case? The RFC itself doesn't make a good argument for or against fax numbers having a separate syntax with no matching rules. -- Thanks, Sean Burford

4 7

entryCSN and back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

Am I correct in my understanding that 'entryCSN' is updated on every change to an object in order for the replication process to work properly? In a back-sql implementation, I do not see this attribute stored in the database but when requesting the internal attributes of objects i do get the 'entryCSN' back. however, the value changes every time I do the request. Can I assume correctly that 'entryCSN' is not being stored and is therefore of no real use when using back-sql and is only being shown to comply with the LDAP standards? Is it possible to store this attribute in the database by defining it and creating the SQL functions to update it? (same question for creatorsName, createTimestamp, modifiersName, modifyTimestamp, etc) -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

1 0

Re: Setting up LDAP server
by Santosh Balan 23 Apr '09

23 Apr '09

Hi Team, I am on the look out for free support and advise. I have implemented a basic LDAP server such that it authenticates for my mail server. However this time I have been given a project wherein my LDAP works as an authentication server for user login as well as mails. Also it should have policies while authentication viz. it should disable USB ports for the user, it should set a background wallpaper and screensaver which should start within 20 secs. of the PC's idle time. It should also if possible mount automatically a partition which will be user dependent rather that PC dependent. I hope your getting the picture for which i require your assistance. This is the first time I am working on such a setup. I would appreciate your valuable help and guidance in resolving and setting up an LDAP server as per requirement. Thanking you in advance for your guidance. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Wed, 22 Apr 2009 11:09:40 +0100 On Wed, Apr 22, 2009 at 03:05:56AM -0500, Santosh Balan wrote: > Can anyone help me on implementing and configuring LDAP server to > authenticate users with system policies and auto mount a user's partition > provided to him. Also, I want it to authenticate qmail users using LDAP. Are you looking for paid support? Several of us on this list are in the business of determining client requirements then designing and building solutions to fit, so I am sure you would get offers if you were to ask for that service. On the other hand, if you want free advice then I think you will have to do more of the basic research yourself so that you can ask more specific questions. There are lots of papers and guides on the web that will help to get you started. Here is a pointer to some of mine: http://www.skills-1st.co.uk/dir/ Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Adding OU with PSQL backend
by Marcel Berteler 23 Apr '09

23 Apr '09

For a project that requires a large user authentication database, we are currently using OpenLDAP with a BDB backend. We have about 150K users in the tree and all works well. Authentication and new user creation is fast and we are happy. But, when we try and get statistical data from the tree, we run into the limitations of LDAP: trying to find all user that have registered last month, using a filter with 2 dates, is just too slow. It takes minutes to come back with a result. To get around this limitation, we want to experiment with a PSQL backend so we can do some comparative testing. (If any of you have a way of allowing us to interrogate our BDB backend with SQL like queries that are relatively fast, than please let me know.) Our test environment: openldap 2.4.16 with Postgres backend I have loaded CORE in slapd.conf as well as our custom schema for our users The only ACL in the conf is ACCESS TO * BY * WRITE Our tree looks like this and I have loaded the data tables and meta-data tables: dc=example,dc=come ou=people,dc=example,dc=com cn=user1,dc=example,dc=com The setup is working about 60%. with openLdapAdmin, I can see the tree and I can add users. What I can not do, is add an OU. It gives me: LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. If I get this on our custom schema, I can explain this by not having the right meta-data and procedures loaded. But as this is part of the CORE schema, am I right in only adding the meta-data for OU in ldap_attr_mappings without add or delete procedures? I have looked at the log files and outputs but I can not figure out what is going wrong and why it is not accepting any new OU Any help is appreciated. -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

7 16

just curious
by Piotr Wadas 22 Apr '09

22 Apr '09

Hello, I've been trying past weeks upgrading my production openldap software. I started from 2.4.11 when it was available, through all available versions, up to 2.4.16. I tried package builds, and my own builds. Each version except 2.4.10 was likely to hang, as it's production, and load is quite high, I haven't too much patience to debug and researching what's actually going on, but I tried disabling syncrepl (no effect), some different settings for bdb backend and slapd thread, concurrency etc ( starting from settings which caused no problems with 2.4.10 ), and finally, got back to 2.4.10 which works fine. Between version change I noticed that 2.4.11+ is build with newer libdb versions (package depends), starting from libdb4.2 (2.4.10), up to libdb4.7 (newer openldap version). I didn't try to build 2.4.15+ with some old (4.2) libdb. Is it some major significant jump between 2.4.10 and all later versions? some general rewrite of some feature ? It's not syncrepl related, as daemon hang no matter whether configured as slave or standalone. The symptoms was, it was (in general) producing BIGGER server load than 2.4.10, and, although daemon process did not segfaults, server stopped responding for requests (?). With higher load I wasn't able to try logging and use of debug symbols. I expected it will work without any slapd.conf, anyway nor leaving it untouched, nor some minor reasonable changes had no effect. So, what's going on? :) Is it possibly related to libdb ? or what? What else could it be ? Except libdb ( 5 different versions available in my system with one default, usually newest ), there was no other software change, just upgrading openldap/libldap. Any clues you may have? I'm sorry I cannot provide more information, anyway config is rather standard and simple, some custom schemas added with indexing, that's all. 2.4.10 has no problems at all, and significantly lower general machine load. ( if 2.4.10 = 100%, 2.4.11+ makes 300-400% ) Actually I'm not expecting some miracle explanation, anyway it's interesting what could it be.. I have about 25 000 entries total in my directory tree, it's used as NSS source, and other information for various applications. regards :) P.

3 4

Porting mozldap to openldap
by Nguyen, Quang 22 Apr '09

22 Apr '09

Hi everybody, I have spend sometime to understand mozldap and openldap. I have searched the archives using these keyword "mozldap to openldap" or just "mozldap" but found nothing. I have to port an application currently using mozldap to openldap. Has anyone done this before, I would like to ask some questions such as: 1. I see that the application called ldapssl_advclientauth_init(), ldapssl_init() if using certificate and call prldap_init() if using simple authentication. The function ldapssl_advclientauth_init() is very big after I traced it down. Is there an equivalent call in openldap? 2. Is there any example posted somewhere that my search on google missed (I could not find any). 3. Is there anything I should be watching for? 4. What is the best approach to do this? I thank you very much for any help, suggestion I can get. Best regards

2 2

Setting up LDAP server
by Santosh Balan 22 Apr '09

22 Apr '09

Hi Friends, Can anyone help me on implementing and configuring LDAP server to authenticate users with system policies and auto mount a user's partition provided to him. Also, I want it to authenticate qmail users using LDAP. Your assistance is highly appreciable. Thanking you in advance. Thanks and Regards Santosh Balan 9819419509 -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

ldap SQL backend and syncrepl
by Frederic Bouy 22 Apr '09

22 Apr '09

Hello, For performance issues (millions or records) I have two ldap servers: - one master with an sql backend (postgres) to allow easy data manipulation - one slave to anwer ldap queries and provide good response time When lauching the slave ("./slapd -f /usr/local/openldap/etc/openldap/slapd-front.conf -h "ldap://localhost:3890" -d 1") I got a first non blocking error I don't really understand: " => bdb_dn2id("dc=lnp") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988)" According to the fact that the following command is successfull: "ldapwhoami -H "ldap://localhost:389" -D "cn=manager,dc=lnp" -w secret" and then the synchronization fails with this error: "read1msg: ld 0x9ca73e8 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_scanf fmt ({a) ber: ber_scanf fmt (o) ber: ber_scanf fmt ({em) ber: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD ldap_msgfree connection_get(11): got connid=0 ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 11 ldap_free_connection: actually freed do_syncrepl: rid=001 quitting" Do you know whether suncrepl is support for ldap with sql backend? Do you know where can I find some documentation on this? Do you have any clue on how I could solve my issues? Thanks in advance. Please find below the .conf of those two ldap servers: # === MASTER ===== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/lnp.schema pidfile /usr/local/openldap/var/slapd-lnp.pid argsfile /usr/local/openldap/var/slapd-lnp.args backend sql ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=lnp" rootdn "cn=Manager,dc=lnp" rootpw secret dbname lnp dbuser lnp dbpasswd lnp strcast_func "text" #subtree_cond "ldap.entries.dn like '%'||?" concat_pattern "?||?" has_ldapinfo_dn_ru no overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 lastmod on # === MASTER ===== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/lnp.schema pidfile /usr/local/openldap/var/run/slapd-front.pid argsfile /usr/local/openldap/var/run/slapd-front.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=lnp" rootdn "cn=Manager,dc=lnp" rootpw secret directory /usr/local/openldap/var/openldap-data # index entryCSN,entryUUID eq index entryUUID eq # filter="(objectClass=*)" syncrepl rid=001 provider=ldap://localhost:389 bindmethod=simple type=refreshAndPersist searchbase="ou=31,dc=lnp" schemachecking=off binddn="cn=manager,dc=lnp" credentials=secret filter="(objectClass=*)" mirrormode on serverID 1

4 7

Re: Directory migration
by Michael Ströder 22 Apr '09

22 Apr '09

Ian wrote: > On Tue, 21 Apr 2009 23:07:11 Michael Ströder wrote: >> Hmm, which password scheme is used? Are the userPassword values prefixed >> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems >> could be incompatible. So this could be another issue. The general >> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 >> (password scheme {SSHA}). > > Well FreeBSD is using MD5 for it's encryption and so is the linux workstation. This does not say much since there are also MD5-based password hashes in Unix crypt. > Is the LDAP server encrypting the hashes as well? No, the clear-text password is hashed depending on the password scheme together with a random salt. > They don't look like the > hashes in master.password What is master.password? > at all, so I guess it is? And that's one reason why > you need to use the PADL scripts when you import /etc/passwd into your LDAP > directory? If you import /etc/shadow or whereever your salted Unix password hashes are stored you would use the platform-specific password scheme {CRYPT}. > The password entry looks like this: > userPassword:: e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0= ^^ The double-colon indicates that the value is base64-encoded in the LDIF representation. $ python -c "print 'e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0='.decode('base64')" {md5}547qEjL5yQnfIp7aDAXd8w== So this is a plain MD5-hashed password. This password scheme is *not* platform-specific. Is this from your original data? Do all entries have password values like this? Check that. If yes, then you should not have a problem to migrate this data. > So I don't know what encoding it's using - is there a setting that controls > this? (nothing in slapd.conf that I can see). There are various relevant settings. But I wonder which component is used for setting the password and which mechanism it uses. You should also consult the fine articles in the FAQ-O-MATIC: http://www.openldap.org/faq/data/cache/419.html Ciao, Michael.

2 1

Re: Directory migration
by Michael Ströder 22 Apr '09

22 Apr '09

Ian wrote: > On Wed, 22 Apr 2009 00:04:47 Andrew Findlay wrote: >> On Tue, Apr 21, 2009 at 03:37:11PM +0200, Michael Ströder wrote: >>> Hmm, which password scheme is used? Are the userPassword values prefixed >>> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems >>> could be incompatible. So this could be another issue. The general >>> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 >>> (password scheme {SSHA}). >> You also need to make sure that the new server was built with support >> for your chosen hash scheme. If using crypt passwords, this means >> adding the --enable-crypt flag to the initial 'configure' command. > > Maybe that's where the problem lies. From what Michael said in his reply, the > passwords are plain MD5 hashes. Perhaps I've build the new one with crypt > support and it's trying to use that instead of straight MD5? The password scheme {MD5} does not need --enable-crypt! >> As Michael says, it would make sense to use 2.4.16 for your >> new installation. > > And I shall, but maybe now it's best to get 2.3.x working first, then go to > the new version. You might have to migrate your database. So there's really no reason to not directly use 2.4.16. Ciao, Michael.

1 0

Re: Directory migration
by Ian Moore 21 Apr '09

21 Apr '09

On Wed, 22 Apr 2009 00:13:51 Michael Ströder wrote: > Ian wrote: > > On Tue, 21 Apr 2009 23:07:11 Michael Ströder wrote: > >> Hmm, which password scheme is used? Are the userPassword values prefixed > >> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems > >> could be incompatible. So this could be another issue. The general > >> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 > >> (password scheme {SSHA}). > > > > Well FreeBSD is using MD5 for it's encryption and so is the linux > > workstation. > > This does not say much since there are also MD5-based password hashes in > Unix crypt. > > > Is the LDAP server encrypting the hashes as well? > > No, the clear-text password is hashed depending on the password scheme > together with a random salt. > > > They don't look like the > > hashes in master.password > > What is master.password? :-) FBSD equivalent of /etc/shadow > > at all, so I guess it is? And that's one reason why > > you need to use the PADL scripts when you import /etc/passwd into your > > LDAP directory? > > If you import /etc/shadow or whereever your salted Unix password hashes > are stored you would use the platform-specific password scheme {CRYPT}. > > > The password entry looks like this: > > userPassword:: e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0= > > ^^ > The double-colon indicates that the value is base64-encoded in the LDIF > representation. > > $ python -c "print > 'e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0='.decode('base64')" > {md5}547qEjL5yQnfIp7aDAXd8w== > > So this is a plain MD5-hashed password. This password scheme is *not* > platform-specific. So I guess that's why it works logging in from a linux workstation, even though the passwords originally were imported from the FBSD master.passwd file and also works with squid running on the FBSD server. > Is this from your original data? Yes, taken from the original server's LDAP database. > Do all entries have password values like this? Check that. Yes, they do! > If yes, then you should not have a problem to migrate this data. Yet sadly I do have a problem :-/ I have used ldapsearch to confirm that the password hashes are the same on the old & new servers when I use ldapsearch or slapcat to view them. Yet I can't login on the new server. And since the hashes are salted, I can't tell if the actual password is really different. > > > So I don't know what encoding it's using - is there a setting that > > controls this? (nothing in slapd.conf that I can see). > > There are various relevant settings. But I wonder which component is > used for setting the password and which mechanism it uses. > > You should also consult the fine articles in the FAQ-O-MATIC: > > http://www.openldap.org/faq/data/cache/419.html I'll give that a read tonight and do some more testing. Cheers, -- Ian gpg key: http://home.swiftdsl.com.au/~imoore/no-spam.asc

1 0

Re: Master server error
by Gavin Henry 21 Apr '09

21 Apr '09

----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > Hi, > > Just wondering why the master server is trying to contact the slave > when > I use any of the smbldap tools? I would get the message below. > > erreur LDAP: Can't contact slave ldap server (IO::Socket::INET: > connect: > timeout) > =>trying to contact the master server > > It would then contact the master server and give me the result. > Instead > of pulling the information faster, it will take a few minutes. It is > > not a big deal, as things are working fine but I just want to know if > > there's a way to get rid of the error. Please advise. > This is actually to do with the smbldap tools, not OpenLDAP. Check the config file for the master/slave settings and the Perl code too. The master isn't trying to contact the slave at ;-) Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 1

Master server error
by Ivan Ordonez 21 Apr '09

21 Apr '09

Hi, Just wondering why the master server is trying to contact the slave when I use any of the smbldap tools? I would get the message below. erreur LDAP: Can't contact slave ldap server (IO::Socket::INET: connect: timeout) =>trying to contact the master server It would then contact the master server and give me the result. Instead of pulling the information faster, it will take a few minutes. It is not a big deal, as things are working fine but I just want to know if there's a way to get rid of the error. Please advise. Thanks, -Ivan

1 0

Directory migration
by Ian Moore 21 Apr '09

21 Apr '09

Hi, I'm trying to migrate my directory from one server to another (I'm building a replacement server and want to test everything before changing over). The old server is FreeBSD 5 with openldap-server-2.3.39 The new one is FreeBSD 7.1 with openldap-server-2.3.43 I thought I would be able to use ldapsearch to dump the contents of the old server to an ldif file and then import it into the new one using ldapadd. That seemed to work, but when I tried to login on a workstation which is configured to use ldap authentication (and works fine when attached to the old server), my login fails. If I change my password to what it's supposed to be and then try to login, it works. So it appears that the passwords for user objects are not being transferred correctly from the old system to the new (all the other information seems correct). I'm using md5 passwords on both systems (the freebsd default) and I've checked that the new server & the workstation are set to use md5. I also tried using slapcat to create the ldif file, but that made no difference. If I look at the encrypted password before and after resetting it, the password hashes are different, even though they are supposedly the same password. I've tried this several times and can't get it to work. Do I need to do something else to transfer passwords correctly from one server to another? -- Ian gpg key: http://home.swiftdsl.com.au/~imoore/no-spam.asc

3 2

Need help on pwdCheckQuality
by Dat Duong 20 Apr '09

20 Apr '09

Hi, I need to enforce the password quality check. I've set all the the requirement on the slapd.conf created default policies profile. Unfortunately, the pwdMinLength and pwdCheckQuality are not working. I also try to compile the cracklib with check_password.c and the Makefile. The instruction was not very clear. Does anyone have a procedure to install the check_password.so module? Please help me with this. See my below setting. I omitted all the other parts from slapd.conf.. slapd.conf file: ..... ..... include /usr/local/etc/openldap/schema/ppolicy.schema ..... overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout ..... # default, policies, arc.nasa.gov dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top objectClass: pwdPolicyChecker pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdExpireWarning: 180 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 24 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxAge: 15768000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 12 pwdMustChange: TRUE pwdSafeModify: FALSE sn: default policy pwdCheckModule: check_password.so pwdCheckQuality: 2 THANKS!!!

1 0

TLS vs. MirrorMode replication
by Maros Timko 19 Apr '09

19 Apr '09

Hi all, we use OpenLDAP 2.4.11 on CentOS 5 for OS user PAM authentication in Xen-based HA cluster of 2 nodes. We are using MirrorMode replication so that databases are synchronised if change occurs on any node and there is no issue if one node goes down - each node maintains its own database. We use non-TLS local LDAP access (127.0.0.1) on Dom0 and TLS from virtual machines to LDAP. As soon as LDAP replication is set up in non-TLS way, everything works fine. But we are trying to set up TLS also for replication to bring more security into the system. However, it seems like there is a principial issue here - one cannot specify client access config for local access and for remote replication at the same time. Or can we? If we define client config to use TLS for the peer, then each local request goes to peer node. If the peer is down, the request will fail and user cannot log in into the OS. It looks like syncrepl requires client configuration to the peer. We tried to use "start_tls" option in syncrepl section but we still fail to connect to peer node. From the replies on the list I assume, TLS options in syncrepl section are just supposed to overwrite default settings, not to specify explicit option for it. Questions: - Is it possible to use local LDAP database locally together with TLS-enabled replication in a cluster? - Is anybody running such or similar setup successfully? - What would you suggest, if it is not possible? Thanks

2 1

Integration
by A Gilmore 18 Apr '09

18 Apr '09

Hello, I have a technical hurdle to overcome and I'm hoping openldap is the answer. I have contacts in a sql db, I'm wanting to make them available in outlook, blackberries, and other clients such as thunderbird. What I'm currently thinking is to setup an openldap server and import the data into that. I'm not expecting much trouble getting the data into LDAP. But how much effort/time is normally involved in the actual implementation of hooking these devices/applications to an openldap directory so non-technical users can use it? If anyone else has done this, how did it go? Has it been 'quirky'? I've read over the FAQ and what google offers, it seems mostly dealing with overcoming specific technical issues, I haven't found much on how well it works overall. Thank you for your time, - Adrien

2 2

Compile module for pwdCheckQuality
by Dat Duong 18 Apr '09

18 Apr '09

Does anyone have good luck on compiling a module like check_password.so for pwdCheckQuality? Also, what are the configuration for check_password.conf ? I'm having a harding time compiling the cracklib using check_password Makefile. Anyone have for the Makefile? What is the -lcrack ? # Comment out this line if you do NOT want to use the cracklib. # You may have to add an -Ldirectory if the libcrak is not in a standard # location # CRACKLIB_LIB=-lcrack

1 0

Context CSN not updated on OpenLDAP 2.3.11
by Adrien Futschik 17 Apr '09

17 Apr '09

Hy everyone ! I am facing a major issued for the second time with OpenLDAP 2.3.11. I am aware it is a pretty old version of OpenLDAP, but, it has been working in production for almost a year now without any problem. Here is the setup : Master -> Slave For some strange reason, the contextCSN stops updating and therefore the Slave is not updated anymore. The strange thing is that the Master continues to successfully update/add data ! We are using a OpenLDAP 2.3.11, Berkeley DB 4.4.16 & OpenSSL 0.9.8a all running on Solaris 10. Restarting the master solved the problem once, but now that it as failed again, I am very woried, because, restarting isn't a solution, considering that the application is in production. Please see in attachement the configuration files for Master & Slave. I have no log on the master, and only "syncrepl logging" on the slave. We consider restarting the master with "enable all logging" to see if wee can grab some informations.... Is this a bug of OpenLDAP, BerkleyDB or something else ? Thanks in advance, Adrien Futschik

4 11

lda_msgfree causing aborting program
by Santosh Kumar 16 Apr '09

16 Apr '09

Hi everyone,Using ldap_msgfree() needs after ldap_result() , as per man page it is to be used, is resulting in abort , but using the same after search result is working fineldap_init(ldap_host, LDAP_PORT))ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version)id = ldap_simple_bind(ld, root_dn, root_pw) //  ldap_perror(ld, "ldap_set_option");  printf("My ID=%d\n",id);result = ldap_result(ld, id, 1, NULL, &msg);    printf("Ldap_Result=%d\n",result);result = ldap_result2error(ld, msg,  1);    printf("Ldap_Result2error=%d\n",result); ldap_msgfree(msg);Output:ldap_bind: Success (0)My ID=1Ldap_Result=97Ldap_Result2error=0ldap_search_async: io.c:190: ber_free_buf: Assertion `((ber)->ber_opts.lbo_valid==0x2)' failed.Is there a way to get around while seeing the fucnction implemeted  ldap_msgfree() is calling ber_free_element() , which checks BerElement is it valid .in the above program it goes to invalid  this causing program to abort , does removing this check causes problem , i'm not aware about the importance of the check. ThanksSantosh Kumar9881481468

1 0

Fax can't have equality index?
by Min 15 Apr '09

15 Apr '09

Hello, I have the fax in my sldap.conf as the following: index facsimileTelephoneNumber eq,pres,sub index telephoneNumber eq,pres,sub But slaptest will report error as: equality index of attribute "facsimileTelephoneNumber" disallowed slaptest: bad configuration file! Any help will be appreciated. Thanks,

2 1

problem with a lot of databases in openldap 2.3
by Patrick Kaufmann 15 Apr '09

15 Apr '09

Patrick Kaufmann schrieb am 06.04.2009 14:13 Hi, We experience some serious problems with our openldap. We got about 50 databases in our openldap. If I now request single databases everything works fine until I request the 30st database. >From there on every database which I haven't already requested will just return an internal error. After some further investigation I finally figured out that the bdb backend somehow has some problems. If I start the sldap with d -1 I get following error: bdb_locker_id: Not enough space(12) We use openLDAP 2.3 together with DBD 4.2.52 Whole error message: daemon: activity on 1 descriptor daemon: activity on: 4052r daemon: read activity on 4052 daemon: select: listen=1912 active_threads=0 tvp=NULL connection_get(4052) connection_get(4052): got connid=0 connection_read(4052): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 35 02 01 6e 63 30 04 05..nc0. ldap_read: want=47, got=47 0000: 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 2e 63 68 .o=test.domain 0010: 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e 01 01 00 ................ 0020: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. ber_get_next: tag 0x30 len 53 contents: ber_dump: buf=086F29D8 ptr=086F29D8 end=086F2A0D len=53 0000: 02 01 6e 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 ..nc0..o=test.ma 0010: 69 6c 34 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 il4.ch.......... 0020: 02 01 1e 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c ........objectcl 0030: 61 73 73 30 00 ass0. ber_get_next ldap_read: want=8 error=Unknown error daemon: activity on 1 descriptor daemon: waked daemon: select: listen=1912 active_threads=0 tvp=NULL do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=086F29D8 ptr=086F29DB end=086F2A0D len=50 0000: 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 c0..o=test.mail4 0010: 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e .ch............. 0020: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0030: 30 00 0. >>> dnPrettyNormal: <o=test.domain> => ldap_bv2dn(o=test.domain,0) <= ldap_bv2dn(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 <<< dnPrettyNormal: <o=test.domain>, <o=test.domain> SRCH "o=test.domain" 0 0 1000 30 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=086F29D8 ptr=086F29FE end=086F2A0D len=15 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=086F29D8 ptr=086F2A0B end=086F2A0D len=2 0000: 00 00 .. attrs: conn=0 op=109 SRCH base="o=test.domain" scope=0 deref=0 filter="(objectClass=*)" ==> limits_get: conn=0 op=109 dn="[anonymous]" => bdb_search bdb_locker_id: err Not enough space(12) send_ldap_result: conn=0 op=109 p=3 send_ldap_result: err=80 matched="" text="internal error" send_ldap_response: msgid=110 tag=101 err=80 ber_flush: 28 bytes to sd 4052 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error ldap_write: want=28, written=28 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error conn=0 op=109 SEARCH RESULT tag=101 err=80 nentries=0 text=internal error Any help is appreciated. Thanks Patrick Patrick Kaufmann Softwareentwicklung Hauptsitz: Hardstrasse 72 CH - 5430 Wettingen Tel. +41 56 437 80 40 Fax + 41 56 437 80 59 pkaufmann(a)zubler.ch<mailto:pkaufmann@zubler.ch> www.zubler.ch<http://www.zubler.ch> [cid:aussenstelle.jpg]

3 10

OpenLDAP and "reverse" wildcards
by Kjell Gustafsson 15 Apr '09

15 Apr '09

Hi I have a somewhat strange question. We are using OpenLDAP (openldap-server-2.4.11-bdb) and Berkley DB (db-4.6.21) in a project. LDAP is used to store subscribernumbers and the address of the ippbx where the subscriber is registered. Typically every subscriber have a separate DN in the LDAP-database. We have a serverfunction that do ldap-searches for subscribernumbers to retrieve the ippbx-address. This part is going to remain working as is. Now we want to be able to have a "wildcard"-entry in LDAP, that points to an address also. This entry shall respond to any ldap-search matching the wildcard. Let me give an example: We have, let's say four ippbx's with prefixes 111, 222, 333 & 444. A subscriber- number consist of the prefix and five more digits. Each subscriber can be registered in any ippbx and still be reachable. The prefix indicates the subscribers "home-location". Now we want to use a gateway to another telephone-system. We don't want to have all of the subscribers from that system registered in LDAP, so we want a "wildcard"-entry saying that if you dial 99912345 LDAP should have an entry 999xxxx pointing to the gateway for the subscribers in the other telephonesystem. The response to the ldap-search should contain the the gateway address to the telephone-system regardless of the number entered. So if I dial 99912345 I should get the same response as if I dial 99967890. The response shall have the same format as in the ippbx-solution. We want the ldap DIT to look the same for the wildcard and the others - the DN shall look the same. We don't want to change the serverfunction we are using today. So - finally my question: Would it be possible to solve this with OpenLDAP and if so - how can it be done? Looking forward to your suggestions! /Kjell

3 5

Re: search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Pierangelo Masarati 14 Apr '09

14 Apr '09

----- "Daniel" <deepee(a)gmx.net> wrote: > Hi slapd-Gurus out there, > > using the search filter "(test=TRUE)" results in: "candidates not > indexed". The cause for the below slapd trace output seems clear to > me: > In fact there is no entry in my bdb backend existing with an attribute > > description "test" present... > > => bdb_filter_candidates > EQUALITY > => bdb_equality_candidates (test) > <= bdb_equality_candidates: (test) not indexed > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=-1 first=1 last=430 > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=25 first=141 last=430 > <= bdb_filter_candidates: id=25 first=141 last=430 > bdb_search_candidates: id=25 first=141 last=430 > => test_filter > EQUALITY > => access_allowed: search access to "dc=foo,dc=bar" "test" requested > <= root access granted > => access_allowed: search access granted by manage(=mwrscxd) > <= test_filter 5 > bdb_search: 141 does not match filter > > > In regard to the above slapd-trace I've the following question: > Could someone please be so kind and tell me whether there exists a > possibility to search (filter) for "dynamic" (calculated) attribute > values, that do not get stored in a backend (in my case bdb)? Idea: An > > overlay should calculate a dynamic attribute's value based on already > > existing attribute values of an entry each time this dynamic attribute > > is searched for using a filter-statement, e.g. > '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. > > First of all I had a quick look into slapo-collect's sources. The > collective attributes seem to be added dynamically to an entry but the > > collected attributes are not "filterable". I think the reason is that > > slapo-collect operates on the response/slapreply and that's to late in > > the overlay's processing queue... > > Then I thought of something similar to the operational attribute > "hasSubordinates" - this attribute's value is filterable and seems (at > > least sounds) to be dynamically evaluated. On the other hand I'm not > sure whether "hasSuborinates" is dynamically calculated each time an > entry get's searched or accessed. Perhabs the value of > "hasSubordinates" > is only be calculated in case the entrys' childrens get modified and > (thus seldomly) updated within the backend, which could be the reason > to > be search- and filterable?! > > Last but not least I tried to implement a small test-overlay using a > custom search-callback that updates the dynamic "test" attribute > within > the bdb-backend: Imagine an (very simple/stupid) overlay that for > example set a custom attribute named "test" to "TRUE" in case an > entry's > attributes "givenName" and "sn" both contain at least one value. ;-) I > > know, that the filter "(&(givenName=*)(sn=*))" would do the trick but > > the example is just a simple scenario for me to step into > overlay-processing details. > > If I use attr_merge() within the search-callback to store the dynamic > > test attribute's value "TRUE" or "FALSE" within the entry the search > succeeds without problems - I mean the filter (test=TRUE) get's > processed ok. > > So my questions still left is: > Do I always have to store/update the dynamic attribute's calculation > result value within each entry (in the backend) or is there another > posibility that allows filtering for the calculated attribute's value, > > while getting rid of the store and update overhead within the > backend? > > Hopefully this is no hen egg problem concerning the internal > processing > order of filters, candidates, entries, etc. Using dynamically computed attrs in a search filter and pretending it to ber indexed is an oxymoron. If you intend to allow it, you need to be prepared to intercepting the search operation and doing the candidate collection yourself. I don't recall any overlay or so that does it and that could be used as an example, simply because it makes little sense. In any case, the problem can be solved, but the solution may not be trivial and require a fair amount of coding. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

2 2

Modifying password by user
by Franck Royer 14 Apr '09

14 Apr '09

Hi, I'm installing openldap on a ubuntu intrepid server (8.10). Everything is ok except when I want that a user is able to modify his own password using phpldapadmin (0x32 LDAP_INSUFFICIENT_ACCESS). So I tried to modify it using ldappasswd : dante@kollok ~ $ ldappasswd SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) or dante@kollok ~ $ ldappasswd -D "uid=dante,ou=people,dc=kollok,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) The posix user dante is the same user than the ldap one (I use pam libs). And I know that my password is right cause I can log in ldapadmin or ssh with it. My slapd.conf : http://pastebin.com/f44dd2b59 My ldap.conf : http://pastebin.com/f3af1bec3 Any idea ? Cheers, Franck Royer

4 4

group of groups
by alois blasbichler 14 Apr '09

14 Apr '09

Hello list Is there a possibility in openldap to make group of groups ? We need this fpr posix- and sambagroups. I dont find any predefined objectclasses or documentation. Somebody can give me a link or other help? Thank you luis

3 3

OpenLDAP groups and Unix users
by Stephen Parry 14 Apr '09

14 Apr '09

Thanks in advance for any answers to this query, and thanks to the geniuses who wrote and maintain OpenLDAP. I have OpenLDAP running on my Ubuntu Intrepid server. I have installed the various PAM and NSS bits and pieces to allow integrated authentication. I can now use users and groups stored in LDAP database to do shell logins, permission files and authenticate Apache secure connections (hooray!). It also is set up so that Unix user accounts and groups still function outside of LDAP as expected. However, there is one quirk to this. I can make LDAP users members of Unix groups and this works fine. I cannot however do the equivalent: make Unix users working members of LDAP groups. I can put them in the groups, but the the system command "id -nG" does not list the LDAP groups and the filesystem fails to pick up the permissions. Is this behaviour by design? Can the relevant modules be configured to allow LDAP groups have Unix users as members?

2 1

Notify mechanism for changes on a specific directory?
by Bahadır Kandemir 13 Apr '09

13 Apr '09

Hello, I'm working on a remote management system that uses LDAP for storing policies. Clients pull policies from server periodically, but we sometimes need to push policies to clients instantly. Polling LDAP every five seconds is not an option, of course. Is there any auto notification mechanism for LDAP that notifies client about changes on a specific directory? I've searched archives but could not find anything. Thanks in advance, Bahadir Kandemir

3 2

search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Daniel 12 Apr '09

12 Apr '09

Hi slapd-Gurus out there, using the search filter "(test=TRUE)" results in: "candidates not indexed". The cause for the below slapd trace output seems clear to me: In fact there is no entry in my bdb backend existing with an attribute description "test" present... => bdb_filter_candidates EQUALITY => bdb_equality_candidates (test) <= bdb_equality_candidates: (test) not indexed <= bdb_filter_candidates: id=-1 first=1 last=430 <= bdb_list_candidates: id=-1 first=1 last=430 <= bdb_filter_candidates: id=-1 first=1 last=430 <= bdb_list_candidates: id=25 first=141 last=430 <= bdb_filter_candidates: id=25 first=141 last=430 bdb_search_candidates: id=25 first=141 last=430 => test_filter EQUALITY => access_allowed: search access to "dc=foo,dc=bar" "test" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 5 bdb_search: 141 does not match filter In regard to the above slapd-trace I've the following question: Could someone please be so kind and tell me whether there exists a possibility to search (filter) for "dynamic" (calculated) attribute values, that do not get stored in a backend (in my case bdb)? Idea: An overlay should calculate a dynamic attribute's value based on already existing attribute values of an entry each time this dynamic attribute is searched for using a filter-statement, e.g. '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. First of all I had a quick look into slapo-collect's sources. The collective attributes seem to be added dynamically to an entry but the collected attributes are not "filterable". I think the reason is that slapo-collect operates on the response/slapreply and that's to late in the overlay's processing queue... Then I thought of something similar to the operational attribute "hasSubordinates" - this attribute's value is filterable and seems (at least sounds) to be dynamically evaluated. On the other hand I'm not sure whether "hasSuborinates" is dynamically calculated each time an entry get's searched or accessed. Perhabs the value of "hasSubordinates" is only be calculated in case the entrys' childrens get modified and (thus seldomly) updated within the backend, which could be the reason to be search- and filterable?! Last but not least I tried to implement a small test-overlay using a custom search-callback that updates the dynamic "test" attribute within the bdb-backend: Imagine an (very simple/stupid) overlay that for example set a custom attribute named "test" to "TRUE" in case an entry's attributes "givenName" and "sn" both contain at least one value. ;-) I know, that the filter "(&(givenName=*)(sn=*))" would do the trick but the example is just a simple scenario for me to step into overlay-processing details. If I use attr_merge() within the search-callback to store the dynamic test attribute's value "TRUE" or "FALSE" within the entry the search succeeds without problems - I mean the filter (test=TRUE) get's processed ok. So my questions still left is: Do I always have to store/update the dynamic attribute's calculation result value within each entry (in the backend) or is there another posibility that allows filtering for the calculated attribute's value, while getting rid of the store and update overhead within the backend? Hopefully this is no hen egg problem concerning the internal processing order of filters, candidates, entries, etc. Many thanks for your advice! Kind regards Daniel

1 0

./scripts/test021-certificate failed
by hariharan＠thehindu.co.in 11 Apr '09

11 Apr '09

2 1

Authentication issue into a ubuntu client: `finger` and `id` commands working but no `su`
by carolina fernandez 10 Apr '09

10 Apr '09

Hello, I'm trying to configure a Ubuntu 8.10 client to authenticate againts a openldap directory. The client configuration (PAM, NSS and /etc/ldap.conf) is here: http://pastebin.com/mc279767 I performed some test getting the following results: `ldapsearch -xLLL`, `id $USER`, `finger $USER` Those three commands work fine. See the ouput here: http://pastebin.com/d43add436 `su $USER` Prompts twice for a password and then fails. See the output with a debug level 1: http://pastebin.com/m390ab435 My main question is: Line 12 from `su $USER` output says: "ldap_connect_to_host: TCP localhost:389" It seems like it were trying to connect to the localhost but I specified "host 192.168.0.10" and "uri ldap://192.168.0.10/" at the /etc/ldap.conf file. Maybe I need to specify a bind domain name but if I'm not wrong the query will be permormed as anonymous and I have the followings credentials at the server /etc/ldap/slapd.conf: access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=carolina,dc=es" write by anonymous auth by self write by * none access to * by dn="cn=admin,dc=carolina,dc=es" write by * read Any idea to solve this? Any one can enlight me? Thank you in advance, Carolina F. Bravo

1 0

pam_ldap: error trying to bind (Server is unwilling to perform)
by Hammad Ahmad Bhatti 10 Apr '09

10 Apr '09

I am trying to ssh my ldap client linux box using ldap user. When I try to login from local root user and su to ldap user then it works and if I try to directly ssh using ldap user then it does not works. Can some one help me out. Hammad Ahmad

2 1

Matthew GARRETT is out of the office.
by Matthew GARRETT 09 Apr '09

09 Apr '09

I will be out of the office starting 08/04/2009 and will not return until 21/04/2009. I will respond to your message when I return. For IT issues please see Drew Harvey Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

1 0

Expiration accounts and indexes ?
by Jordi Espasa Clofent 09 Apr '09

09 Apr '09

Hi folks, Yesterday I see a lot of "Apr 6 16:08:20 xen-ldap01 slapd[1167]: <= bdb_equality_candidates: (objectClass) not indexed" in my OpenLDAP provider server log. After searching in docs (http://www.openldap.org/faq/data/cache/42.html), I applied index objectClass eq instead of previous #index objectClass eq and restart the service. The suprise has been when a few users cannot login in system through LDAP validation this morning. The errors in log (in client logs) was: [...] Apr 9 09:11:13 hc23 sshd[44389]: pam_ldap: error trying to bind as user "uid=ivan,ou=SAT,ou=Tecnic,dc=my_company,dc=com" (Invalid credentials) Apr 9 09:11:13 hc23 sshd[44387]: error: PAM: authentication error for illegal user ivan from XXX.XXX.XXX.XXX [...] The solution has been easy: comment the "index objectClass eq" parameter again in slapd conf file. ¿Why it happens? I wonder it. Maybe some cache-related issue... -- Thanks, Jordi Espasa Clofent

3 2

Ldap authentication
by Hammad Ahmad Bhatti 08 Apr '09

08 Apr '09

Hello, I have configured openldap for SSO. Now I am authenticating all of my linux boxes with this SSO. Now I have requirement that my root user should not authenticate through this SSO. Rest of all users should authenticate through this. Can any one have any suggestion for this. Thannn Koooo Hammad Ahmad

3 3

LDAP for MySQL Cluster
by Howard Chu 07 Apr '09

07 Apr '09

I will be co-presenting a talk at the MySQL Conference on Thursday April 23 in Santa Clara, California on the back-ndb backend in OpenLDAP. Johan Andersson from Sun/MySQL will also be presenting; Symas and MySQL worked together to design the data model for this backend. http://en.oreilly.com/mysql2009/public/schedule/detail/6219 back-ndb is a new OpenLDAP slapd backend that provides direct access to MySQL's NDB Cluster engine. The NDB Cluster design allows concurrent access to relational tables from multiple access methods (including mysqld for traditional SQL access, and slapd for LDAP access) and allows capacity to scale horizontally across multiple data nodes. The OpenLDAP backend uses the native NDBAPI to achieve high speed access without any SQL translation overhead. Multiple slapd servers can operate concurrently on an NDB database, along with other mysqld servers and other agents, allowing performance to be augmented linearly simply by adding more nodes to a cluster. This will be slightly more in-depth than the back-ndb talk I presented at the UKUUG conference in March. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Migrating users, groups and machines from Win NT 4.0 PDC to openldap+samba
by Norberto Bensa 07 Apr '09

07 Apr '09

On Tue, Apr 7, 2009 at 5:51 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, April 07, 2009 11:31 AM -0300 Norberto Bensa > <nbensa(a)gmail.com> wrote: >> This is OT to this list, but "net rpc vampire" will do what you want. >> Consult the samba docs/mailing list. > > I don't see why this is off topic. The -technical list is about > interoperability of OpenLDAP with other applications. Thanks. I thought this list was openldap-only questions. Regards, Norberto

1 0

Migrating users, groups and machines from Win NT 4.0 PDC to openldap+samba
by Nathaniel Simch de Morais 07 Apr '09

07 Apr '09

Hi, does anyone know how can i export users, groups and machines from a WinNT 4.0 PDC and put this informations in my OpenLDAP+SAMBA(PDC)? -- --------------------------------------------------- Nathaniel Simch de Morais skype: nathanielmorais --------------------------------------------------- °v° "Você acha que é livre se o | /(_)\ Software que você usa | ^ ^ nao é?" | --------------------------------------------------- Eu uso BrOffice.org!!! Eu uso Mozilla Firefox!!!

3 2

unable to get openldap to bind to active directory
by Kyle Pike 07 Apr '09

07 Apr '09

[kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1

1 0

back-ndb vs back-sql for exposing one MySQL db?
by Gavin Henry 07 Apr '09

07 Apr '09

Hi All, Here's a quick question, if you need to expose one MySQL db as LDAP for example, using the existing db that has customer records in it and a 3rd party application can look up via LDAP, do you use bog standard back-sql or back-ndb just use one db, as it looks easier to setup? Going by Howards talk at UKUUG 2009: http://www.ukuug.org/events/spring2009/programme/openldap-mysql.shtml -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 1

How to Secure openLdap nss_ldap
by Matthew.GARRETT＠external.total.com 07 Apr '09

07 Apr '09

Folks Note sure if this is the right list ? I have a new OpenLdap (version 2.3) Server that uses Kerberos for Password Authentication, which is going to be a Replacement for NIS (YP) All Normal access works fine and users can login , access automount maps etc However there are 2 types of Ldap binding Simple TLS At the moment any body can run the following ldapsearch -x I would like to try and disable Simple Binding But if I select "disallow bind_anon" in slapd.conf file Things start to break like authentication stops working. /var/log/messages Apr 1 15:42:15 apricot sudo[31515]: pam_ldap: error trying to bind (Inappropriate authentication) Apr 1 15:42:18 apricot sudo[31515]: pam_ldap: error trying to bind (Inappropriate authentication) Apr 1 15:42:25 apricot sudo[31515]: pam_ldap: ldap_result Can't contact LDAP server How do I get a Machine to authenticate to Ldap ? I think the problem lies with nss_ldap ? When I add the following line to /etc/ldap.conf ssl start_tls I start to get the following error's Apr 2 14:09:11 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Apr 2 14:09:15 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Apr 2 14:09:18 bruce nscd: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Apr 2 14:27:06 bruce sshd: pam_ldap: ldap_starttls_s: Operations error Apr 2 14:27:06 bruce sshd(pam_unix)[11233]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=apricot.uk.ad.ep.corp.local user=mgarrett Apr 2 14:27:06 bruce sshd[11233]: pam_krb5[11233]: authentication succeeds for'mgarrett' (mgarrett(a)UK.AD.EP.CORP.LOCAL) /etc/ldap.conf base dc=unix,dc=total bind_timelimit 120 idle_timelimit 3600 ldap_version 3 pam_password md5 scope sub ssl start_tls timelimit 120 tls_cacertdir /etc/openldap/cacerts tls_checkpeer no Can any body point me in the right direction Thanks Matthew Server is RedHat 5.3 Clients are RedHat 4.7 Copy of slapd.conf pwcheck_method: saslauthd mech_list: gssapi sizelimit unlimited include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/krb5-kdc.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapd.pem TLSCertificateKeyFile /etc/openldap/slapd.key ## security - other directives ## prevents anonymous access to ## any connection #disallow bind_anon ## forces a bind operation before DIT access #require bind ## Use of reads on ldaps only port forces use ## of TLS/SSL but not a minimum value ## this directive forces a minimum value #security simple_bind=128 sasl-secprops noanonymous,noplain,noactive # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=unix,dc=total # This should be a ^ plus, not a star, but slapd won't accept it # Default read access for everything else except anonymous users who have no access but does not work. ! access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read #by anonymous none Matthew Garrett Senior IS Technical Analyst Tel: 01224 297889 Fax: 01224 296806 Email: Matthew.Garrett(a)total.com Total E&P UK, Crawpeel Road, Altens Industrial Estate, Aberdeen AB12 3FG Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

2 3

sasl use ip as digest-uri
by Zhen Li 07 Apr '09

07 Apr '09

Hi, I'm trying to do sasl authentication against an active directory server. In the second sasl bind request sent to AD, the ip address of the AD server is used as the digest-uri. e.g. "ldap/192.168.1.1". Isn't it supposed to use domain name like "ldap/svr.example.com"? I used "ldapsearch -Y DIGEST-MD5". And in ldap.conf, "uri" and "host" are given in domain names. Any help will be appreciated. liz _________________________________________________________________ View your Twitter and Flickr updates from one place – Learn more! http://clk.atdmt.com/UKM/go/137984870/direct/01/

1 0

LDAP presentation PDFs are available
by Gavin Henry 07 Apr '09

07 Apr '09

OpenLDAP Replication Strategies - http://www.ukuug.org/events/spring2009/programme/openldap-replication.shtml OpenLDAP and MySQL: Bridging the Data Model Divide - http://www.ukuug.org/events/spring2009/programme/openldap-mysql.shtml Writing Access Control Policies for LDAP - http://www.ukuug.org/events/spring2009/programme/ldap-access-control.shtml -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Question on how to setup OpenLDAP according to RFC2307
by Bryan Boone 06 Apr '09

06 Apr '09

Hi everyone, I am a noobie on LDAP. Here is my problem. I have a tape library that has a web UI that is able to authenticate with and LDAP server. I downloaded and installed OpenLDAP. I have also created some test accounts on the LDAP to make sure it is working properly, and it is. The library documentation says that it is only able to authenticate with LDAP that complys with RFC2307. I read the RFC document and I see that OpenLDAP is already RFC2307 compliant. But I still cannot authenticate the library web UI. So my question is... Is there a structure that the LDAP server should follow in order to comply with RFC2307? For instance, do I need users under certain groups? I used a posixAccount and a posixGroup. Is this correct? Here is my LDIF below. Do I have this setup correct? thanks dn: dc=ibm,dc=com objectClass: dcObject objectClass: organization o: IBM dc: ibm dn: cn=employees,dc=ibm,dc=com objectClass: posixGroup cn: employees gidNumber: 253 dn: cn=bryan,cn=employees,dc=ibm,dc=com cn: bryan uid: bbryan uidNumber: 1 gidNumber: 10 homeDirectory: /home/bryan objectClass: account objectClass: posixAccount userPassword: {crypt}ecVLdK/k7KQMg dn: cn=kenny,cn=employees,dc=ibm,dc=com cn: kenny uid: qkenny uidNumber: 5 gidNumber: 11 homeDirectory: /home/kenny objectClass: account objectClass: posixAccount userPassword: {CRYPT}RuY5yfDjlajGo dn: cn=groups,dc=ibm,dc=com objectClass: posixGroup cn: groups gidNumber: 250 dn: cn=library_a,cn=groups,dc=ibm,dc=com cn: library_a gidNumber: 251 objectClass: posixGroup memberUid: qkenny dn: cn=administrators,cn=groups,dc=ibm,dc=com cn: administrators gidNumber: 252 objectClass: posixGroup memberUid: bbryan _________________________________________________________________ Rediscover Hotmail®: Get quick friend updates right in your inbox. http://windowslive.com/RediscoverHotmail?ocid=TXT_TAGLM_WL_HM_Rediscover_Up…

1 0

Re: openldap-technical Digest, Vol 17, Issue 4
by mario ramirez cervera 06 Apr '09

06 Apr '09

Hello as usuairo admnistador could have a read-only 2009/4/4 <openldap-technical-request(a)openldap.org> > Send openldap-technical mailing list submissions to > openldap-technical(a)openldap.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://www.openldap.org/lists/mm/listinfo/openldap-technical > or, via email, send a message with subject or body 'help' to > openldap-technical-request(a)openldap.org > > You can reach the person managing the list at > openldap-technical-owner(a)openldap.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of openldap-technical digest..." > > > Send openldap-technical mailing list submissions to > openldap-technical(a)openldap.org > When replying, please edit your Subject: header so it is more specific than > "Re: openldap-technical digest..." > > Today's Topics: > > 1. smbk5pwd for openldap 2.3 (Daniel Spannbauer) > 2. Unable to auth on replica (Marcio Merlone) > 3. How to Secure openLdap nss_ldap > (Matthew.GARRETT(a)external.total.com) > 4. TLS/Certificate Problem Openldap (Steffen Knauf) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 02 Apr 2009 12:02:17 +0200 > From: Daniel Spannbauer <ds(a)marco.de> > Subject: smbk5pwd for openldap 2.3 > To: openldap-technical(a)openldap.org > Message-ID: <49D48D29.5010809(a)marco.de> > Content-Type: text/plain; charset=ISO-8859-15; format=flowed > > Hello, > > I'm using the distro opensuse 10.2. > I'm missing the module smbk5pwd. > Can I build this module for openldap 2.3? > > Regards > > Daniel > > -- > Daniel Spannbauer Software Entwicklung > marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 > Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 > http://www.marco.de/ Email ds(a)marco.de > Gesch?ftsf?hrer Martin Reuter HRB 171775 Amtsgericht M?nchen > > > ------------------------------ > > Message: 2 > Date: Thu, 02 Apr 2009 09:10:32 -0300 > From: Marcio Merlone <marcio.merlone(a)a1.ind.br> > Subject: Unable to auth on replica > To: OpenLDAP <openldap-technical(a)openldap.org> > Message-ID: <49D4AB38.7070403(a)a1.ind.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, > > I have set two Ubuntu 8.04 servers running OpenLDAP > 2.4.9-0ubuntu0.8.04.2. I have set replication as per the docs. On the > slave, I start with an empty /var/lib/ldap, and when I start the replica > the dir is populated with the files, I am able to anon search, etc. > Great, except my clients are able to auth on the provider but not on the > replica. > > Both provider and consumer have the same acls, and the diff from one > conf to another is: > > --- slapd.conf 2009-04-02 09:04:42.000000000 -0300 > +++ slapd.conf.replica 2009-04-02 09:05:47.000000000 -0300 > @@ -60,19 +61,13 @@ > # 'database' directive occurs > database hdb > > -overlay syncprov > -syncprov-checkpoint 100 10 > -syncprov-sessionlog 100 > - > -# Let the replica DN have limitless searches > -limits dn.exact="cn=syncrepl,dc=a1,dc=ind" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > - > # The base of your directory in database #1 > suffix "dc=a1,dc=ind" > > # rootdn directive for specifying a superuser on the database. This is > needed > # for syncrepl. > -# rootdn "cn=admin,dc=a1,dc=ind" > +rootdn "cn=admin,dc=a1,dc=ind" > + > > # Where the database file are physically stored for database #1 > directory "/var/lib/ldap" > @@ -112,6 +108,21 @@ > # Where to store the replica logs for database #1 > # replogfile /var/lib/ldap/replog > > +syncrepl rid=3 > + provider=ldap://192.168.0.201:389 > + type=refreshAndPersist > + interval=01:00:00:00 > + searchbase="dc=a1,dc=ind" > + scope=sub > + schemachecking=off > + bindmethod=simple > + binddn="cn=syncrepl,dc=a1,dc=ind" > + credentials=xxxxx > + > + > +# updateref ldap://192.168.0.201:389 > + > + > # The userPassword by default can be changed > # by the entry owning it if they are authenticated. > # Others should not be able to see it, except the > > > Any idea on what could be wrong? Thanks in advance for any hint or help. > > > -- > Marcio Merlone > > > > ------------------------------ > > Message: 3 > Date: Thu, 2 Apr 2009 14:43:12 +0100 > From: Matthew.GARRETT(a)external.total.com > Subject: How to Secure openLdap nss_ldap > To: openldap-technical(a)openldap.org > Message-ID: > < > OF428EEFBC.05C17E8A-ON8025758C.004897FD-8025758C.004B5DD3(a)total.com> > Content-Type: text/plain; charset="utf-8" > > Folks > > Note sure if this is the right list ? > > I have a new OpenLdap (version 2.3) Server that uses Kerberos for Password > Authentication, which is going to be a Replacement for NIS (YP) > All Normal access works fine and users can login , access automount maps > etc > > However there are 2 types of Ldap binding > > Simple > TLS > > At the moment any body can run the following > ldapsearch -x > > I would like to try and disable Simple Binding > But if I select "disallow bind_anon" in slapd.conf file > Things start to break like authentication stops working. > /var/log/messages > > Apr 1 15:42:15 apricot sudo[31515]: pam_ldap: error trying to bind > (Inappropriate authentication) > Apr 1 15:42:18 apricot sudo[31515]: pam_ldap: error trying to bind > (Inappropriate authentication) > Apr 1 15:42:25 apricot sudo[31515]: pam_ldap: ldap_result Can't contact > LDAP server > > How do I get a Machine to authenticate to Ldap ? > > I think the problem lies with nss_ldap ? > When I add the following line to /etc/ldap.conf > > ssl start_tls > > I start to get the following error's > Apr 2 14:09:11 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server > (sleeping 4 seconds)... > Apr 2 14:09:15 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server > (sleeping 8 seconds)... > Apr 2 14:09:18 bruce nscd: nss_ldap: reconnecting to LDAP server > (sleeping 16 seconds)... > Apr 2 14:27:06 bruce sshd: pam_ldap: ldap_starttls_s: Operations error > Apr 2 14:27:06 bruce sshd(pam_unix)[11233]: authentication failure; > logname= uid=0 euid=0 tty=ssh ruser= rhost=apricot.uk.ad.ep.corp.local > user=mgarrett > Apr 2 14:27:06 bruce sshd[11233]: pam_krb5[11233]: authentication > succeeds for'mgarrett' (mgarrett(a)UK.AD.EP.CORP.LOCAL) > > /etc/ldap.conf > > base dc=unix,dc=total > bind_timelimit 120 > idle_timelimit 3600 > ldap_version 3 > pam_password md5 > scope sub > ssl start_tls > timelimit 120 > tls_cacertdir /etc/openldap/cacerts > tls_checkpeer no > > Can any body point me in the right direction > > > Thanks > > Matthew > > Server is RedHat 5.3 > Clients are RedHat 4.7 > > Copy of slapd.conf > pwcheck_method: saslauthd > mech_list: gssapi > sizelimit unlimited > > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/redhat/autofs.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/krb5-kdc.schema > > # Allow LDAPv2 client connections. This is NOT the default. > allow bind_v2 > > > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/slapd.pem > TLSCertificateKeyFile /etc/openldap/slapd.key > > ## security - other directives > ## prevents anonymous access to > ## any connection > #disallow bind_anon > ## forces a bind operation before DIT access > #require bind > ## Use of reads on ldaps only port forces use > ## of TLS/SSL but not a minimum value > ## this directive forces a minimum value > #security simple_bind=128 > > sasl-secprops noanonymous,noplain,noactive > > # Map SASL authentication DNs to LDAP DNs > # This leaves "username/admin" principals untouched > sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth > uid=$1,ou=people,dc=unix,dc=total > # This should be a ^ plus, not a star, but slapd won't accept it > > # Default read access for everything else except anonymous users who have > no access but does not work. ! > access to * > by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write > by * read > > > #by anonymous none > > > > > Matthew Garrett > Senior IS Technical Analyst > Tel: 01224 297889 > Fax: 01224 296806 > Email: Matthew.Garrett(a)total.com > Total E&P UK, Crawpeel Road, Altens Industrial Estate, Aberdeen AB12 3FG > Registered in England and Wales No.811900????????? > Registered Office 33 Cavendish Square, London W1G 0PW > This e-mail and any attachments are intended only for the person or entity > to whom it is addressed and may contain confidential or privileged > information.? If you are not the addressee, any disclosure, reproduction, > copying, distribution, or use of this communication is strictly prohibited. > If you are not the intended recipient or person responsible for delivering > this message to the named addressee, please notify us immediately and > delete > this e-mail. > It is the responsibility of the addressee to scan this email and any > attachments for computer viruses or other defects. The sender does not > accept liability for any loss or damage of any nature, however caused, > which may result directly or indirectly from this email or any file > attached. >

1 0

posixGroup integrated with linux via nss
by Scott Classen 02 Apr '09

02 Apr '09

I have a happily running LDAP installation (2.4.15) running on Fedora 8 with numerous other linux machines using it as a source of authentication and name services. I have a problem with group permissions. Most of my groups have less than 10 members, but I have a few super users that need to belong to many groups (100-200) so that they can help individual users process their data. I can easily add the super users to each group using ldapmodify or GQ, and when I type "groups" or "id" in a terminal window as the super user I see that they belong to all the groups. The problem come when I try to read the contents of a directory that is owned by one of these secondary groups. Maybe its a Fedora/Linux thing, but the super user only has read permissions for the first 16 groups. The super user can not do an "ls -la /home/userwhoisin17thgroup" What is up with that? Also can anyone recommend another way to achieve the one user/many groups scenario using LDAP? Thanks, Scott

3 2

unable to get openldap to bind to AD
by Kyle Pike 02 Apr '09

02 Apr '09

It might be easier to read all of this on here: http://www.linuxquestions.org/questions/linux-server-73/unable-to-get-ldap-… I am able to bind and search AD with ldapsearch, but am unable to get openldap to use it as a backend db. I am able to search for a user in active directory by using the following: ldapsearch -v -H ldap://charizard.company. internal -x -b "dc=company,dc=internal" -D "cn=ldap proxy,cn=Users,dc=company,dc=internal" -w 'passwd' -LLL "(sAMAccountName=testuser)" My slapd.conf looks like: slapd.conf ----------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 1024 database ldap suffix "cn=Users,dc=company,dc=internal" rootdn "cn=ldap proxy" uri "ldap://charizard.company.internal" binddn "cn=ldap proxy,cn=Users,dc=company,dc=internal" bindpw "passwd" rwm-rewriteEngine on rwm-map objectclass account user rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail userPrincipalName rwm-map attribute * lastmod off chase-referrals no access to * by * read ----------------------------- When I try and search on my openldap host, I recive.. [kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1 -------------------------------- In slapd debug log I can see the following... backend_startup_one: starting "cn=Users,dc=corpedia,dc=internal" ldap_back_db_open: URI=ldap://charizard.corpedia.internal slapd starting ldap_pvt_gethostbyname_a: host=heracross.corpedia.local, r=0 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 12 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: version=3 dn="" method=128 send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 9 do_bind: v3 anonymous bind connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal> <<< dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal>, <cn=users,dc=corpedia,dc=internal> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: ==> limits_get: conn=0 op=1 dn="[anonymous]" ldap_create ldap_url_parse_ext(ldap://charizard.corpedia.internal) =>ldap_back_getconn: conn 0x8ad8a88 inserted refcnt=1 binding=1 ldap_search_ext put_filter: "(objectClass=*)" put_filter: simple put_simple_filter: "objectClass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP charizard.corpedia.internal:389 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 10.0.0.6:389 ldap_connect_timeout: fd: 10 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 73 bytes to sd 10 ldap_result ld 0x8ad0860 msgid 1 ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL wait4msg ld 0x8ad0860 msgid 1 (timeout 100000 usec) wait4msg continue ld 0x8ad0860 msgid 1 all 0 ** ld 0x8ad0860 Connections: * host: charizard.corpedia.internal port: 389 (default) refcnt: 2 status: Connected last used: Fri Mar 27 16:23:13 2009 ** ld 0x8ad0860 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x8ad0860 Response Queue: Empty ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL ldap_int_select read1msg: ld 0x8ad0860 msgid 1 all 0 ber_get_next ber_get_next: tag 0x30 len 167 contents: read1msg: ld 0x8ad0860 msgid 1 message type search-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x8ad0860 0 new referrals read1msg: mark request completed, ld 0x8ad0860 msgid 1 request done: ld 0x8ad0860 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=1 ber_flush: 163 bytes to sd 9 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next ber_get_next on fd 9 failed errno=0 (Success) connection_read(9): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=9 for close do_unbind connection_close: deferring conn=0 sd=9 connection_resched: attempting closing conn=0 sd=9 connection_close: conn=0 sd=9 =>ldap_back_conn_destroy: fetching conn 0 connection_get(9): connection not used connection_read(9): no connection! Any help would be much appreciated :-)

2 2

TLS/Certificate Problem Openldap
by Steffen Knauf 02 Apr '09

02 Apr '09

Hello, i try to configure openldap with TLS/SASL. But i only get the same Error ( TLS certificate verification: Error, unable to get local issuer certificate) Perhaps someone have an idea what wrong with the certificate. Version : $OpenLDAP: slapd 2.3.43 OS: SuseLinux Enterprise 10 Ldap Server Output: ----------------------------------------------------------- connection_read(12): checking for input on id=31 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(12): got connid=31 connection_read(12): checking for input on id=31 TLS certificate verification: depth: 0, err: 20, subject: /DC=liga01/ST=Deutschland/L=Munich/O=it/CN=schmidt.muc.liga01, issuer: /DC=liga01/ST=Deutschland/O=it/CN=schmidt.muc.liga01 TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_accept:error in SSLv3 read client certificate B TLS: can't accept. TLS: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned s3_srvr.c:2482 connection_read(12): TLS accept failure error=-1 id=31, closing connection_closing: readying conn=31 sd=12 for close connection_close: conn=31 sd=12 ----------------------------------------------------------- I create the certs like the following tutorial: http://www.openldap.org/faq/index.cgi?_highlightWords=tls&file=185 /etc/openldap/slapd.conf: ----------------------------------------------------------- TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3 TLSCertificateFile /etc/ssl/zertifikate/servercrt.pem TLSCertificateKeyFile /etc/ssl/zertifikate/serverkey.pem TLSCACertificateFile /etc/ssl/zertifikate/demoCA/cacert.pem TLSVerifyClient demand ----------------------------------------------------------- /etc/openldap/ldap.conf: ----------------------------------------------------------- TLS_CACERT /etc/ssl/zertifikate/demoCA/cacert.pem TLS_REQCERT demand ----------------------------------------------------------- /etc/ldap.conf: ----------------------------------------------------------- ssl start_tls ----------------------------------------------------------- greets Steffem

1 0

sasl issue - but I don't want sasl atm
by Da Rock 02 Apr '09

02 Apr '09

I know the security implications of this, but I just want to stage this procedure and take one problem at a time; trouble is the system wants me to bite more than I can chew at a given time! I have setup an ldap server, ldap admin programs can connect to it, but when I run say ldapsearch it says it can't connect with the following error: > SASL/GSSAPI authentication started > ldap_sasl_interactive_bind_s: Local error (-2) Sure, eventually I'd like to secure things more, but I simply need to test things at this point. It also gets in the way of other things which I'm just looking in to right now. I kinda understand the error code, but I'm not entirely sure what the -2 is; I've been working on the premise that it can't connect because the security service isn't setup (sasl or krb principal), so I'm trying to work out how to setup the system to do a simple bind (through ldap.conf? either /etc/ or openldap/) but I can't for the life of me get it to cooperate. Any help? What info is needed here to resolve this? Cheers

4 8

Unable to auth on replica
by Marcio Merlone 02 Apr '09

02 Apr '09

Hello, I have set two Ubuntu 8.04 servers running OpenLDAP 2.4.9-0ubuntu0.8.04.2. I have set replication as per the docs. On the slave, I start with an empty /var/lib/ldap, and when I start the replica the dir is populated with the files, I am able to anon search, etc. Great, except my clients are able to auth on the provider but not on the replica. Both provider and consumer have the same acls, and the diff from one conf to another is: --- slapd.conf 2009-04-02 09:04:42.000000000 -0300 +++ slapd.conf.replica 2009-04-02 09:05:47.000000000 -0300 @@ -60,19 +61,13 @@ # 'database' directive occurs database hdb -overlay syncprov -syncprov-checkpoint 100 10 -syncprov-sessionlog 100 - -# Let the replica DN have limitless searches -limits dn.exact="cn=syncrepl,dc=a1,dc=ind" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited - # The base of your directory in database #1 suffix "dc=a1,dc=ind" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. -# rootdn "cn=admin,dc=a1,dc=ind" +rootdn "cn=admin,dc=a1,dc=ind" + # Where the database file are physically stored for database #1 directory "/var/lib/ldap" @@ -112,6 +108,21 @@ # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog +syncrepl rid=3 + provider=ldap://192.168.0.201:389 + type=refreshAndPersist + interval=01:00:00:00 + searchbase="dc=a1,dc=ind" + scope=sub + schemachecking=off + bindmethod=simple + binddn="cn=syncrepl,dc=a1,dc=ind" + credentials=xxxxx + + +# updateref ldap://192.168.0.201:389 + + # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the Any idea on what could be wrong? Thanks in advance for any hint or help. -- Marcio Merlone

1 0

smbk5pwd for openldap 2.3
by Daniel Spannbauer 02 Apr '09

02 Apr '09

Hello, I'm using the distro opensuse 10.2. I'm missing the module smbk5pwd. Can I build this module for openldap 2.3? Regards Daniel -- Daniel Spannbauer Software Entwicklung marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

1 0

syncrepl issue
by Oliver Henriot 02 Apr '09

02 Apr '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list users, I have a master openldap 2.3 server which is replicated via syncrepl on half a dozen other servers (2.3 too). Due to a legacy application from which I have to import passwords once a day, the master server is stopped, erased and re-built from scratch once every day... I have noticed that all the replicas have recovered only a partial subset of the entries and the strange thing is that all the replicas have the same subset. They are all missing a few hundred entries. When I stop the replicas, erase their data and start them anew, they replicate just fine and are consistent with the master server. I was wondering : could this be due to the fact that the replicas have problems erasing the old entries and replacing them with the new set of entries? Would increasing syncprov-checkpoint <ops> and syncprov-sessionlog <size> values improve the situation? I also recall reading something about a specific configuration directive to improve delete replication but I have a feeling it was 2.4 specific... Thanks, Cheers - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAknQo4MACgkQSWuBJnHIHdKr5gCgl4i6UHIebD5npfmzS+c3bp5O SOcAoLb+T7NtNTg9XIs17MgS7EkENpT9 =YEot -----END PGP SIGNATURE-----

4 10

open-source admin tools
by Raul Libório 31 Mar '09

31 Mar '09

Hello, I wonder which of you are the best open-source tools to maintain a database, which currently are the best if they leave ... I want to integrate environment, leave everything tied in (LDAP proxy, samba, e-mail clients, asterisk, joomla!) I see much talk of phpldapadmin, it is that all who speak it? ------ Raul Libório http://rauhmaru.blogspot.com/ rauhmarutsªhotmailºcom Linux user#4444581 Brazil "The bug is on the table."

5 5

Unable to get openldap to use active directory as ldap backend but am able to search using ldapsearch
by Kyle Pike 30 Mar '09

30 Mar '09

It might be easier to read all of this on here: http://www.linuxquestions.org/questions/linux-server-73/unable-to-get-ldap-… I am able to bind and search AD with ldapsearch, but am unable to get openldap to use it as a backend db. I am able to search for a user in active directory by using the following: ldapsearch -v -H ldap://charizard.company.internal -x -b "dc=company,dc=internal" -D "cn=ldap proxy,cn=Users,dc=company,dc=internal" -w 'passwd' -LLL "(sAMAccountName=testuser)" My slapd.conf looks like: slapd.conf ----------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 1024 database ldap suffix "cn=Users,dc=company,dc=internal" rootdn "cn=ldap proxy" uri "ldap://charizard.company.internal" binddn "cn=ldap proxy,cn=Users,dc=company,dc=internal" bindpw "passwd" rwm-rewriteEngine on rwm-map objectclass account user rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail userPrincipalName rwm-map attribute * lastmod off chase-referrals no access to * by * read ----------------------------- When I try and search on my openldap host, I recive.. [kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1 -------------------------------- In slapd debug log I can see the following... backend_startup_one: starting "cn=Users,dc=corpedia,dc=internal" ldap_back_db_open: URI=ldap://charizard.corpedia.internal slapd starting ldap_pvt_gethostbyname_a: host=heracross.corpedia.local, r=0 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 12 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: version=3 dn="" method=128 send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 9 do_bind: v3 anonymous bind connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal> <<< dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal>, <cn=users,dc=corpedia,dc=internal> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: ==> limits_get: conn=0 op=1 dn="[anonymous]" ldap_create ldap_url_parse_ext(ldap://charizard.corpedia.internal) =>ldap_back_getconn: conn 0x8ad8a88 inserted refcnt=1 binding=1 ldap_search_ext put_filter: "(objectClass=*)" put_filter: simple put_simple_filter: "objectClass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP charizard.corpedia.internal:389 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 10.0.0.6:389 ldap_connect_timeout: fd: 10 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 73 bytes to sd 10 ldap_result ld 0x8ad0860 msgid 1 ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL wait4msg ld 0x8ad0860 msgid 1 (timeout 100000 usec) wait4msg continue ld 0x8ad0860 msgid 1 all 0 ** ld 0x8ad0860 Connections: * host: charizard.corpedia.internal port: 389 (default) refcnt: 2 status: Connected last used: Fri Mar 27 16:23:13 2009 ** ld 0x8ad0860 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x8ad0860 Response Queue: Empty ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL ldap_int_select read1msg: ld 0x8ad0860 msgid 1 all 0 ber_get_next ber_get_next: tag 0x30 len 167 contents: read1msg: ld 0x8ad0860 msgid 1 message type search-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x8ad0860 0 new referrals read1msg: mark request completed, ld 0x8ad0860 msgid 1 request done: ld 0x8ad0860 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=1 ber_flush: 163 bytes to sd 9 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next ber_get_next on fd 9 failed errno=0 (Success) connection_read(9): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=9 for close do_unbind connection_close: deferring conn=0 sd=9 connection_resched: attempting closing conn=0 sd=9 connection_close: conn=0 sd=9 =>ldap_back_conn_destroy: fetching conn 0 connection_get(9): connection not used connection_read(9): no connection! Any help would be much appreciated :-)

1 0

OpenLDAP Load balancing.
by William Jojo 30 Mar '09

30 Mar '09

Under 2.4.x I would like to have 4 replicas of a master or perhaps just use 4 masters in multi-master replication. What is more important is I would like to provide one IP for LDAP queries. I have seen PEN and POUND and other types of TCP "load balancers" for simple TCP and was wondering what the OpenLDAP community recommends for doing such tasks and the implications of TLS/SSL on these tools. I thought about DNS round robin, but that doesn't take into account a missing or non-responsive server, whereas a product like PEN seems to do so. I looked at some older threads regarding this but there don't seem to be any definitive recommendation(s) by the OpenLDAP community whom I feel is the best source for such solutions. :-) Cheers, Bill

1 0

Syncrepl doesn't delete entries?
by Jordi Espasa Clofent 30 Mar '09

30 Mar '09

Hi all, In provider: # provider moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index entryCSN eq index entryUUID eq and ... ldap01:~# ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)' | grep javi # javi, CAT, Tecnic, mydomain.com dn: cn=javi,ou=CAT,ou=Tecnic,dc=mydomain,dc=com cn: javi # javi, CAT, Tecnic, mydomain.com dn: uid=javi,ou=CAT,ou=Tecnic,dc=domain,dc=com uid: javi cn: javi homeDirectory: /usr/local/home/javi but in the consumer: # consumer index objectclass,entryCSN,entryUUID eq syncrepl rid=125 provider=ldap://192.168.10.10:389 type=refreshAndPersist searchbase="dc=mydomain,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=com" credentials=<password> ldap02:/var/lib# ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)' | grep javi # javi, Tecnic, mydomain.com dn: uid=javi,ou=Tecnic,dc=mydomain,dc=com uid: javi cn: javi homeDirectory: /usr/local/home/javi # javi, CAT, Tecnic, mydomain.com dn: cn=javi,ou=CAT,ou=Tecnic,dc=mydomain,dc=com cn: javi # javi, CAT, Tecnic, mydomain.com dn: uid=javi,ou=CAT,ou=Tecnic,dc=mydomain,dc=com uid: javi cn: javi homeDirectory: /usr/local/home/javi It seems that the info in provider and consumer is diferent. If I try, for example, to change the password in provider I see that the value in consumer change automatically. Good. But it seems if I delete some entries in consumer, these changes are not reflected in consumer. ¿Where is the problem? ¿How can I debug t? -- Thanks, Jordi Espasa Clofent

1 0

Require object classes in an OU
by Troy Knabe 29 Mar '09

29 Mar '09

We have a custom schema and we would like to require that all entries in ou=Group have that objectClass in order to be added. Can someone point me in the direction that I should be looking? Thanks -Troy

2 1

mirrormode replication issues
by Jonas Haskins 29 Mar '09

29 Mar '09

Hello friends, I've been trying to setup Mirror Mode replication, using the openldap.org docs and others from googling.. and am having some interesting results. I am new to this so this has been an enlightening experience to say the least, but perhaps if someone on the list might be able to answer a few questions that would be awesome... I have 2 nodes, and want to get mirror mode running for high availibility .. and will add samba to auth ( later ) Basically it seems that mirror mode is sort of working.. i can see the syncRep talking back and forth .. However .. I cannot write to either nodes once replication is running. Below example is me trying to add a user account: error is : ( phpldapadmin reports ) LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. log file reports in detail: Mar 26 13:14:38 ldap01 slapd[1433]: >>> dnPrettyNormal: <cn=joepreston,dc=foobar,dc=com> Mar 26 13:14:38 ldap01 slapd[1433]: <<< dnPrettyNormal: <cn=joepreston,dc=foobar,dc=com>, <cn=joepreston,dc=foobar,dc=com> Mar 26 13:14:38 ldap01 slapd[1433]: do_add: dn (cn=joepreston,dc=foobar,dc=com) Mar 26 13:14:38 ldap01 slapd[1433]: conn=14 op=1 ADD dn="cn=joepreston,dc=foobar,dc=com" Mar 26 13:14:38 ldap01 slapd[1433]: bdb_dn2entry("cn=joepreston,dc=foobar,dc=com") Mar 26 13:14:38 ldap01 slapd[1433]: => bdb_dn2id("cn=joepreston,dc=foobar,dc=com") Mar 26 13:14:38 ldap01 slapd[1433]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Mar 26 13:14:38 ldap01 slapd[1433]: bdb_referrals: op=104 target="cn=joepreston,dc=foobar,dc=com" matched="dc=foobar,dc=com" Mar 26 13:14:38 ldap01 slapd[1433]: send_ldap_result: conn=14 op=1 p=3 Mar 26 13:14:38 ldap01 slapd[1433]: send_ldap_result: err=53 matched="" text="shadow context; no update referral" Mar 26 13:14:38 ldap01 slapd[1433]: send_ldap_response: msgid=2 tag=105 err=53 Mar 26 13:14:38 ldap01 slapd[1433]: conn=14 op=1 RESULT tag=105 err=53 text=shadow context; no update referral Mar 26 13:14:38 ldap01 slapd[1433]: daemon: activity on 1 descriptor Ma so:: text="shadow context; no update referral" using mirrormode, i should be able to write to the db correct? initally, i used ldapadd to add my ldif files on node 1 ( with syncRep commented out ) then useds slapcat/slapadd to populate the db on node 2, then uncommented syncRep on both nodes and restarted both.. ( this was because i was trying to troubleshoot the DB_NOTFOUND error above ... the result was it still errored ) however, it seems the text=shadow context; no update referral may be the real issue. am i missing something in these configs in reguards to mirrormode? logs seem to indicate syncRep is talking, and access is allowed, but no write, and if i ldap add to node 1 ( with Rep commented out ) then uncomment and restart both ( so node 1 has data but node2 does not, i can see syncRep talking, but node2 never picks up the changes ) ok whew, sorry about all of that.. any ideas? using: openldap-2.3.27 CentOS 5.2 2.6.18-92.el5 64 db-4.7.25 smbldap-tools-0.9.5-1 was going to upgrade to the latest, but there are a ton of deps , so i though i'd ask forst.. many many thanks! node1: slapd.conf # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema include /etc/openldap/schema/samba.schema loglevel -1 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap moduleload back_bdb.la moduleload back_ldap.la moduleload back_ldbm.la moduleload back_passwd.la moduleload back_shell.la TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapdcert.pem TLSCertificateKeyFile /etc/openldap/slapdkey.pem access to * by dn.base="cn=Manager,dc=foobar,dc=com" read by * break ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=foobar,dc=com" rootdn "cn=Manager,dc=foobar,dc=com" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXX directory /var/lib/ldap index objectclass,entryCSN,entryUUID eq index cn,sn,uid,displayName pres,sub,eq index uidNumber,gidNumber eq index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index memberUid,mail,givenname eq,subinitial overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Global section serverID 1 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap02.hq.foobar.com bindmethod=simple binddn="cn=Manager,dc=foobar,dc=com" credentials=morefoo searchbase="dc=foobar,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on node2: # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema include /etc/openldap/schema/samba.schema loglevel -1 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap moduleload back_bdb.la moduleload back_ldap.la moduleload back_ldbm.la moduleload back_passwd.la moduleload back_shell.la TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapdcert.pem TLSCertificateKeyFile /etc/openldap/slapdkey.pem access to * by dn.base="cn=Manager,dc=foobar,dc=com" read by * break ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=foobar,dc=com" rootdn "cn=Manager,dc=foobar,dc=com" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXX directory /var/lib/ldap index objectclass,entryCSN,entryUUID eq index cn,sn,uid,displayName pres,sub,eq index uidNumber,gidNumber eq index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index memberUid,mail,givenname eq,subinitial overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Global section serverID 2 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap01.hq.foobar.com bindmethod=simple binddn="cn=Manager,dc=foobar,dc=com" credentials=morefoo searchbase="dc=foobar,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on -- Jonas Haskins Sr Network Administrator jhaskins(a)adready.com (206)792-5184 AdReady INC

4 3

configuring SSL certificate chains for slapd
by Marc Ochs 27 Mar '09

27 Mar '09

Please forgive me if this should be clear, but could someone please point me to info on how to configure a SSL certificate chain for ldaps in slapd? My CA of choice requires a chain cert and I'm having trouble finding this information in the fine documentation. Thanks much, Marc

2 1

Proxy to Active Directory: lost field
by Bogdan B. Rudas 26 Mar '09

26 Mar '09

Hello. I use OpenLDAP as proxy for M$ AD. The problem is: I can set filter only by some fileds like CN or Name. I can't query AD by sAMAccountName via proxy Also I can't see many AD-specific fileds while browsing AD via OpenLDAP proxy. Request to proxy: ldapsearch -M -LLL -H ldap://localhost:389 -x -D "cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" -w password -x -b "dc=domain,dc=company,dc=com" '(sAMAccountName=bogdan.rudas)' sAMAccountName Return nothing. Request directly to AD LDAP: ldapsearch -M -LLL -H ldap://ADserver.domain.company.com:1234 -x -D "cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" -w password -x -b "dc=domain,dc=company,dc=com" '(sAMAccountName=bogdan.rudas)' cn Returns: dn: CN=Bogdan Rudas.......skipped.... cn: Bogdan Rudas Yet another request to proxy: ldapsearch -M -LLL -H ldap://ADserver.domain.company.com:1234 -x -D "cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" -w password -x -b "dc=domain,dc=company,dc=com" '(name=Bogdan Rudas)' cn sAMAccountName dn: cn=Bogdan Rudas.......skip..... cn: Bogdan Rudas SAMACCOUNTNAME: bogdan.rudas Slapd version 2.4.11-1 Running on Debian 5.0 amd64 OpenLDAP config: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap access to dn.base="" by * read access to * by self read by users read by anonymous auth loglevel 256 ###################################################### # database definitions ###################################################### database ldap suffix "dc=intra,dc=nival,dc=com" uri "ldap://ADserver.domain.company.com:1234" acl-bind bindmethod=simple binddn="cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" credentials=password chase-referrals yes

3 5

ldap dir change, ext script?
by Brian Krusic 25 Mar '09

25 Mar '09

Hi all, How would you run an external script automatically after an LDAP change (add/remove a user)? I've checked around and can't seem to find a solution that I can understand. - Brian

3 4

LDAP proxy and referral
by pierre laffont 25 Mar '09

25 Mar '09

Hi, You must already know I'm a French student then i hope you will understand me !! : ) For a project i have to study and make a decision on a new deployment of openldap in the university of Toulouse where i am. for that i read Lot's of sheets on openldap but somethings wrong. To respect of the multitier application we wants to have a frontend proxy and behind this, 3 N-WAY multimaster servers. I have two different database on my replication, the first is the root DIT (dc=iut,dc=fr)and the second database (de=student) must be chain as an OU in the tree of the first database(ou=student,dc=iut,dc=fr). here is my problem, i want an unified presentation of DIT but how can i chain my second database in the first ? with chaining overlay on my 3 servers ? with the meta backend ? with the ldap backend ? and if i use one of the both backend must i add an ldif entry referral for that ? do you have some example ? I'm lost ! Thank you very much for your help ! and sorry for my English : ) Pierre LAFFONT.

1 0

Re: SEGV on AIX (Was: Please test RE24 (3/18/2009 call for testing))
by William Jojo 25 Mar '09

25 Mar '09

Resending since I didn't see it hit the list. Cheers, Bill Using the RE24 from CVS last night Mar 22 20:32 EDT... On AIX 5.3: Running 251 of 500 iterations running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... ldapadd failed for server 1 database (254)! ------------------------------- Error log: LABEL: CORE_DUMP IDENTIFIER: 40E9A4E1 Date/Time: Mon Mar 23 04:15:11 2009 Sequence Number: 377 Machine Id: 000345FAD300 Node Id: dev53 Class: S Type: PERM Resource Name: SYSPROC Description SOFTWARE PROGRAM ABNORMALLY TERMINATED Probable Causes SOFTWARE PROGRAM User Causes USER GENERATED SIGNAL Recommended Actions CORRECT THEN RETRY Failure Causes SOFTWARE PROGRAM Recommended Actions RERUN THE APPLICATION PROGRAM IF PROBLEM PERSISTS THEN DO THE FOLLOWING CONTACT APPROPRIATE SERVICE REPRESENTATIVE Detail Data SIGNAL NUMBER 11 USER'S PROCESS ID: 495704 FILE SYSTEM SERIAL NUMBER 15 INODE NUMBER 905219 PROCESSOR ID 6 CORE FILE NAME /stage/openldap/RE24/ldap/tests/testrun/srv1/core PROGRAM NAME lt-slapd STACK EXECUTION DISABLED 0 COME FROM ADDRESS REGISTER ADDITIONAL INFORMATION strlen 0 _doprnt 2004 Symptom Data REPORTABLE 1 INTERNAL ERROR 0 SYMPTOM CODE PCSS/SPI2 FLDS/lt-slapd SIG/11 FLDS/strlen VALU/0 FLDS/_doprnt ------------------------------ DBX is: Segmentation fault in noname.strlen [/usr/lib/libs.a] at 0xd0335680 ($t14) 0xd0335680 (strlen) 89030000 lbz r8,0x0(r3) (dbx) GCC is: [dev53:/stage/openldap/RE24/ldap/tests] # gcc -v Using built-in specs. Target: powerpc-ibm-aix5.3.0.0 Configured with: ../stage/gcc-4.2.3/configure --disable-shared --enable-threads=posix --prefix=/usr/local --with-long-double-128 --enable-languages=c,c++ Thread model: aix gcc version 4.2.3 BDB 4.6.21.4, OpenSSL 0.9.8.10 (0.9.8j)

3 3

User root from client can be all another users
by Marcelo Gomes 24 Mar '09

24 Mar '09

Hi! In my network, when some client do login as root (local) he can type "su -l" and be all another user from ldap. How can i block this ? thanks Marcelo Gomes

4 3

smbk5pwd - slapd stops responding - please help-me!
by Eduardo Sachs 24 Mar '09

24 Mar '09

Hi People, I use the overlay smbk5pwd for sync password of Samba with the of Heimdal Kerberos. In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2 and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems. But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1, and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems. When I invoke smbpasswd or ldappaswd and trying change the password, slapd stops responding. With kpasswd I do not have problems, change the password of Samba and Kerberos correctly, and userPassword fixed with {K5KEY}, slapd not stops responding (working correctly), but, I need change the password with smbpasswd for Windows clients. Below follows a more detailed debug, has something else that I can show? This is a bug? slapd.conf configuration: moduleload smbk5pwd overlay smbk5pwd smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} - OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key. - I configure OpenLDAP to run with user root and group root, for tests. smb.conf configuration about password: ldap passwd sync = Only unix password sync = no Look this example: 1 - LDAP OK: root# ps aux|grep slapd root 3841 3.0 0.8 21920 4512 ? Ssl 14:47 0:00 /usr/sbin/slapd -h ldap://10.111.222.100:389/ ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f /etc/ldap/slapd.conf root 3844 0.0 0.1 3116 728 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br 2 - Change password witch LDAPPASSWD: root# ldappasswd -x -D "krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" "uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S New password: Re-enter new password: ldap_result: Can't contact LDAP server (-1) root# ps aux|grep slapd root 3832 0.0 0.1 3116 724 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD: conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389) conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=1 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new Debug of Overlay Audit, trying change password with LDAPPASWD: # modify 1236964911 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify replace: userPassword userPassword:: e0s1S0VZfQ== - replace: entryCSN entryCSN: 20090313172151.459306Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313172151Z - # end replace 1236964911 3 - Change Password with SMBPASSWD: LDAP running correctly. root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br # smbpasswd sachs New SMB password: Retype new SMB password: failed to bind to server ldaps://debian.local.int.br/ with dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" Error: Can't contact LDAP server (unknown) Connection to LDAP server failed for the 2 try! Connection to LDAP server failed for the 3 try! Connection to LDAP server failed for the 4 try! Connection to LDAP server failed for the 5 try! Connection to LDAP server failed for the 6 try! Connection to LDAP server failed for the 7 try! Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD: conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636) conn=2 fd=27 TLS established tls_ssf=128 ssf=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=2 op=0 RESULT tag=97 err=0 text= conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))" conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=6 SRCH attr=uid sambaSid conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1 op=9 SRCH attr=supportedExtension conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1 op=10 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new conn=1 op=8 RESULT tag=103 err=0 text= Debug of Overlay Audit, trying change password with SMBPASSWD: # modify 1236968199 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify delete: sambaAcctFlags sambaAcctFlags: [U] - add: sambaAcctFlags sambaAcctFlags: [U ] - replace: entryCSN entryCSN: 20090313181639.613866Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313181639Z - # end replace 1236968199 Thanks!!!

1 0

Re: ssh automatic logins using OpenLDAP
by Norberto Bensa 24 Mar '09

24 Mar '09

On Tue, Mar 24, 2009 at 12:51 PM, Jordi Espasa Clofent <jespasac(a)minibofh.org> wrote: > Another related question żis possible to _NOT_ use LDAP auth in some users? > It means, use LDAP+ssh in general sense, with only a few exeptions which > will stills login in local. Just configure pam/nss to use both sources (files and ldap). Then add users to /etc/passwd and ldap as needed

1 0

ssh automatic logins using OpenLDAP
by Jordi Espasa Clofent 24 Mar '09

24 Mar '09

Hi all, ¿Is possible to configure ssh automatic logins [1] using/through OpenLDAP? ¿How? Currently the ssh+ldap works perfectly in my OpenLDAP config, so a lot of works has been already done. [1] http://linuxproblem.org/art_9.html -- Thanks, Jordi Espasa Clofent

2 1

mirror mode works just one way
by Hegedus Gabor 24 Mar '09

24 Mar '09

Hi, all! I have a problem, I could include the schema to the 2.4 openldap, and I set the mirror mode like the manual said on the first server. I installed the same version openldap to the another server, and set it like the first server. the full database came to the second ldap. If i modify the first database, it push the changes to the second, and I can see the changes on it. BUT when I modify the second database, there is no changes on the first... Why? I can see trafic with tcp dump on first server 389 port,but nothing changes on it. /etc/ldap/* /etc/default/slapd files are the same on both server, and the databases are too. the only differences are the serverID and the provider in the slapd.conf file my mirror mode configuration: serverID 1 moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" mirrormode on I have tried the mirror mode on a basic database and it worked, what is the problem now? please help, it is very important! thank you, best regards, Gabor

3 5

OpenLDAP Syncrepl issue
by Luis Castillo 23 Mar '09

23 Mar '09

Hello, I am having an issue getting the OpenLDAP to replicate using syncrepl. Basically, after configuring the consumer I can start the slapd process but I see no replication happening. Do you have a sample configuration file that can provide more info? Is there anything required on the master? Thanks, Luis

5 8

Re: acls for mirrormode user and its clear text passwords
by Tyler Gates 22 Mar '09

22 Mar '09

I figured this out. The problem was I didn't have the entry 'anonymous auth' in the clause. >I have a multimaster system running behind a back_ldap proxy and all >is? >running fine except for the fact that the mirrormode user specified in >syncrepl section can only specify its password as cleartext or use sasl >authentication. I'm not so worried about the clear text password being >seen because all connections are via tls. But, if anyone binds, >including anonymous users, that password is visible to them which >scares me because the mirrormode user has write access to the entire >tree. My first course of action was to set acls as write to mirrormode >user and none to everyone else but no matter what I do, replication >between the two servers breaks because it seems as soon as an acl is >defined, mirrormode user no longer has permissions. Am I fundamentally >missing something here with the visible clear text password? Or am I >just not doing the acls right? Below is an example of what I surely >thought would work at a (very minimal level). > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by anonymous none > >doesn't work. Even: > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by self write > >gives me no love either. If you need the entire acl I can provide it >but I'm guessing I missing something much more obvious. > >Thanks, > Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 20 Mar '09

20 Mar '09

I have a multimaster system running behind a back_ldap proxy and all is running fine except for the fact that the mirrormode user specified in syncrepl section can only specify its password as cleartext or use sasl authentication. I'm not so worried about the clear text password being seen because all connections are via tls. But, if anyone binds, including anonymous users, that password is visible to them which scares me because the mirrormode user has write access to the entire tree. My first course of action was to set acls as write to mirrormode user and none to everyone else but no matter what I do, replication between the two servers breaks because it seems as soon as an acl is defined, mirrormode user no longer has permissions. Am I fundamentally missing something here with the visible clear text password? Or am I just not doing the acls right? Below is an example of what I surely thought would work at a (very minimal level). access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by anonymous none doesn't work. Even: access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by self write gives me no love either. If you need the entire acl I can provide it but I'm guessing I missing something much more obvious. Thanks, Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 20 Mar '09

20 Mar '09

I have a multimaster system running behind a back_ldap proxy and all is running fine except for the fact that the mirrormode user specified in syncrepl section can only specify its password as cleartext or use sasl authentication. I'm not so worried about the clear text password being seen because all connections are via tls. But, if anyone binds, including anonymous users, that password is visible to them which scares me because the mirrormode user has write access to the entire tree. My first course of action was to set acls as write to mirrormode user and none to everyone else but no matter what I do, replication between the two servers breaks because it seems as soon as an acl is defined, mirrormode user no longer has permissions. Am I fundamentally missing something here with the visible clear text password? Or am I just not doing the acls right? Below is an example of what I surely thought would work at a (very minimal level). access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by anonymous none doesn't work. Even: access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by self write gives me no love either. If you need the entire acl I can provide it but I'm guessing I missing something much more obvious. Thanks, Tyler

1 0

Starting OpenLDAP: slapd - failed
by Eldon Phukuile 20 Mar '09

20 Mar '09

I am following the tutorial at https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html. Everything worked until... Command: sudo /etc/init.d/slapd restart Output: Stopping OpenLDAP: slapd. Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (e.g. /var/log/syslog) or try running the daemon in Debug mode like via "slapd -d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd -h 'ldap://127.0.0.1:389/ ldaps:/// ldapi:///' -g openldap -u openldap -F /etc/ldap/slapd.d/ Command: slapd -d 16383 Output: @(#) $OpenLDAP: slapd 2.4.11 (Nov 8 2008 09:42:18) $ buildd@palmer:/build/buildd/openldap-2.4.11/debian/build/servers/slapd ldap_pvt_gethostbyname_a: host=MORPHEUS.matrix.corp, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: bind(7) failed errno=13 (Permission denied) daemon: bind(7) failed errno=13 (Permission denied) slap_open_listener: failed on ldap:/// slapd stopped. connections_destroy: nothing to destroy.

3 2

trigger a program when ldap db modifies
by Hegedus Gabor 19 Mar '09

19 Mar '09

Hi all! Can you suggest me a program or solution what is do the following: after i modify a record in a db, an external bash script runs off, like a daemon what is check the modifications, and start a script. I hope you are understanding what i want. Gabor

3 2

main: TLS init def ctx failed: -1
by mario ramirez cervera 19 Mar '09

19 Mar '09

main: TLS init def ctx failed: -1 ani ideas? thank

2 1

mirroring problem (unwilling to perform error)
by Hegedus Gabor 18 Mar '09

18 Mar '09

Hi all! I have a serious problem! I try to configure the ldap server mirroring mode, but something problem with this. Fist of all: I tested the mirroring on two openldap 2.4.11-0ubuntu6.1. and it worked fine. I just configured slapd.conf file like this: # Global section serverID 1 (another ldap is 2) moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" retry="60 +" mirrormode on It was okay, when I modified the db1, the db2 modified too. BUT! I try to set up on version 2.3.30, I use the same configuration, the ldap starts good, but when i try to modify the db, the phpldapadmin shows this error: Could not perform ldap_modify operation. LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. What is the problem, what is missconfigured? please help, thank you! br Gabor

2 2

pam_ldap, libnss-ldap and different fields for authentication
by Florian MAURY 18 Mar '09

18 Mar '09

Hi, I'm currently working on an authentication system for my company and facing a problem using pam_ldap, and libnss_ldap. I want to configure pam to authenticate againt a field (let's call it AField) (e.g. a ssh session's authentication) and libnss to provide the content of another field (BField) if I run e.g. ls -l. I mean : # ssh AField-value(a)192.168.1.1 [...] # ls -l /tmp/test -rwx------ 1 BField-value root 1305 2009-03-18 14:11 test #whoami BField-value The goal is to permit login via AField, which will be a quite long name, and BField will ease the reading in my linux-box. Everything is working perfectly fine if I use the same field. (i.e. pam_login_attribute BField and nss_map_attribute uid BField) but if I try to set pam_login_attribute to AField and nss_map_attribute to "uid BField" the authentication process failed in an "Invalid credentials" error. Libnss works correctly since when I list (ls) a file created by an ldap user after logging in via a local user, the resolution works fine. Ls answers me the file is owned by {BField-value} user. Pam_ldap seems to understand it needs to look up to the AField since it bind anonymously, request the rdn of the user having AField equal to the login submitted, but when the binding is done with the rdn of the user, I've got the error. I tcpdump-ed the ldap trafic and discovered pam_ldap is requesting the binding without providing the password. In the packets, where the password (in clear for tests) should be, I can read "INCORRECT". Which is not my password at all =) Then, it's perfectly logical that openldap returns me "Invalid credentials". My question is : what can this INCORRECT mean ? A configuration error ? Is it just possible to do what I want to do ? When my authentication fails, I can rean in openldap log files : slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 When I'm using only the AField (or the BField) for the two options, I don't get this error :o/ I'm using Openldap 2.3.30-5+etch2, libpam-ldap 180-1.7 and libnss-ldap 251-7.5etch1 on Debian. Thank you in advance for your support. Regards, -- Florian MAURY

1 0

dbconfig
by Oliver Henriot 18 Mar '09

18 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list members, I have a bdb database in openldap 2.3.27 on centos 5.2 in which I have defined, in the database section : dbconfig set_cachesize 0 268435456 1 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 I stop my server, clear /var/lib/ldap/*, slapadd my basic ldif entries (replication account, people and groups ou), chown everything to ldap:ldap and start openldap but I still get a warning : bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap - From what I read, I understood that the dbconfig directives created the DB_CONFIG file at startup if it wasn't present in the database directory. This doesn't seem to be working and I can't figure out why. Is there something obvious I'm missing out here? Thanks. - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkm/wc0ACgkQSWuBJnHIHdLvJQCeJKiqBxahNvb65kPI91yTgmVS 1z4An2YprXc5nDcdyw6mm7UWf5yoN7Hp =QFKr -----END PGP SIGNATURE-----

1 1

PROBLEM SSL
by mario ramirez cervera 17 Mar '09

17 Mar '09

Hello again: I copied the certificates in slapd.con: TLSCipherSuite HIGH: MEDIUM: + sslv2: RSA TLSCACertificateFile / etc / ldap / slapd-certs / cacert.pem TLSCertificateFile / etc / ldap / slapd-certs / servercrt.pem TLSCertificateKeyFile / etc / ldap / slapd-certs / serverkey.pem and also writes: SLAPD_SERVICES = "ldap: / / / LDAPS :///" And start giving me the following error: root @ mario-desktop: / etc / gulCA # / etc / init.d / slapd start Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (eg / var / log / syslog) or try running the daemon in Debug mode like via "slapd-d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd-g openldap-u openldap-f / etc / ldap / slapd.conf Deputy my folder Thank you very much it is very important

2 1

Initial setup confusion
by Luke Biddell 17 Mar '09

17 Mar '09

I'm attempting to run openldap on intrepid ibex and am encountering some problems which are most likely down to my understanding. So any newbie help is much appreciated. The first confusion is slapd.conf versus slapd.d. I don't have a slapd.conf file to start with and /etc/ldap/slapd.d is empty. So should I hand-craft a slapd.conf (despite the docs saying this is the old way) and convert it to slapd.d format or do I create an ldif file and put it somewhere (presumably in slapd.d or ldapmodify it)? I've also got a schema I wish to import and currently I'm ldapmodify-ing it in, it's of this form. dn: cn=schema,cn=config changeType: modify add: olcAttributeTypes olcAttributeTypes: ... dn: cn=schema,cn=config changeType: modify add: olcObjectClasses olcObjectClasses: .... ... As you can see I'm adding custom attribute types and object classes into cn=schema,cn=config and this appears to work fine, however they are not persisted across slapd restarts. I presume I need to put them under cn=mycustomconfig,cn=schema,cn=config and then they will persist? I'm sure I'm just missing something fundamental here. More coffee is probably needed. TIA for any help. Luke

2 1

SSL
by mario ramirez cervera 17 Mar '09

17 Mar '09

Firstly thank you very much But my problem was that rpincipal, but to explain it wrong. My problem is the config openldad SSL I followed this manualhttp: / / www.juanramartin.com/?p=60 # comment-49151 but did not work for me to insert the lines in slapd.conf .. Podrian ayudarme Greetings

1 0

Re: Problem ldif encrypt MD5
by mario ramirez cervera 17 Mar '09

17 Mar '09

Firstly thank you very much But my problem was that rpincipal, but to explain it wrong. My problem is the config openldad SSL I followed this manualhttp: / / www.juanramartin.com/?p=60 # comment-49151 but did not work for me to insert the lines in slapd.conf .. Podrian ayudarme Greetings 2009/3/16 Brian Friday <brian.friday(a)gmail.com> > Hello Mario, > > Please check out the documentation on the openldap website which > speaks specifically about passwords: > > http://www.openldap.org/faq/data/cache/419.html > > On Mon, Mar 16, 2009 at 2:08 AM, mario ramirez cervera > <marioramirezph(a)gmail.com> wrote: > > Good morning to everyone: > > > > My problem is I need to configure my openldap not have the passwd in > plain > > text. He then ta rootdn with the passwd MD5. > > How can I spend my ldif passwd current MD5? > > > > Thank you very much and hope your help >

1 0

Openldap cookie synchronization
by Mihai Stanescu 16 Mar '09

16 Mar '09

Hello all I am developing a service to replicate openldap changes to another server. For this i am using cookie based search with a certain polling interval (10 secs) My problem occurs when there are many changes to be synced from openldap while openldap is under modification stress. Sometimes openldap returns all the entries of the openldap database to my cookie search (i am not reseting the cookie). Later on after the processing is finalized even a single modification in openldap triggers a situation in which cookie based search fetches all the entries of the openldap database. I am not altering the cookies between searches. Does anyone have any idea why this could happen? Is it nomal behavior or a known issue? Could it be a configuration problem? Thanks Mihai

1 0

Problem ldif encrypt MD5
by mario ramirez cervera 16 Mar '09

16 Mar '09

Good morning to everyone: My problem is I need to configure my openldap not have the passwd in plain text. He then ta rootdn with the passwd MD5. How can I spend my ldif passwd current MD5? Thank you very much and hope your help

1 0

smbk5pwd - slapd stops responding
by Eduardo Sachs 15 Mar '09

15 Mar '09

Hi People, I use the overlay smbk5pwd for sync password of Samba with the of Heimdal Kerberos. In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2 and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems. But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1, and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems. When I invoke smbpasswd or ldappaswd and trying change the password, slapd stops responding. With kpasswd I do not have problems, change the password of Samba and Kerberos correctly, and userPassword fixed with {K5KEY}, slapd not stops responding (working correctly), but, I need change the password with smbpasswd for Windows clients. Below follows a more detailed debug, has something else that I can show? This is a bug? slapd.conf configuration: moduleload smbk5pwd overlay smbk5pwd smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} - OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key. - I configure OpenLDAP to run with user root and group root, for tests. smb.conf configuration about password: ldap passwd sync = Only unix password sync = no Look this example: 1 - LDAP OK: root# ps aux|grep slapd root 3841 3.0 0.8 21920 4512 ? Ssl 14:47 0:00 /usr/sbin/slapd -h ldap://10.111.222.100:389/ ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f /etc/ldap/slapd.conf root 3844 0.0 0.1 3116 728 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br 2 - Change password witch LDAPPASSWD: root# ldappasswd -x -D "krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" "uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S New password: Re-enter new password: ldap_result: Can't contact LDAP server (-1) root# ps aux|grep slapd root 3832 0.0 0.1 3116 724 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD: conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389) conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=1 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new Debug of Overlay Audit, trying change password with LDAPPASWD: # modify 1236964911 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify replace: userPassword userPassword:: e0s1S0VZfQ== - replace: entryCSN entryCSN: 20090313172151.459306Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313172151Z - # end replace 1236964911 3 - Change Password with SMBPASSWD: LDAP running correctly. root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br # smbpasswd sachs New SMB password: Retype new SMB password: failed to bind to server ldaps://debian.local.int.br/ with dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" Error: Can't contact LDAP server (unknown) Connection to LDAP server failed for the 2 try! Connection to LDAP server failed for the 3 try! Connection to LDAP server failed for the 4 try! Connection to LDAP server failed for the 5 try! Connection to LDAP server failed for the 6 try! Connection to LDAP server failed for the 7 try! Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD: conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636) conn=2 fd=27 TLS established tls_ssf=128 ssf=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=2 op=0 RESULT tag=97 err=0 text= conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))" conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=6 SRCH attr=uid sambaSid conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1 op=9 SRCH attr=supportedExtension conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1 op=10 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new conn=1 op=8 RESULT tag=103 err=0 text= Debug of Overlay Audit, trying change password with SMBPASSWD: # modify 1236968199 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify delete: sambaAcctFlags sambaAcctFlags: [U] - add: sambaAcctFlags sambaAcctFlags: [U ] - replace: entryCSN entryCSN: 20090313181639.613866Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313181639Z - # end replace 1236968199 Thanks!!!

1 0

Hostname does not match common name problem
by Sascha 14 Mar '09

14 Mar '09

Hi there! I have a problem with an LDAP server that I need to connect to. I have the required certificate stored on the client but I am getting the following error message: "TLS: hostname (A.xyz123.com) does not match common name in certificate (*.xyz123.com)" Is there any way to work around this problem? As far as I understand it, RFC4514 section 3.1.3 allows wildcards thus the connection should work, shouldn't it? What is confusing me is that "openssl s_client -connect A.xyz123.com:636 -CAfile /etc/ssl/certs/rootca.cer" results in: Verify return code: 0 (ok) If I am not mistaken, openssl accepts the server based on the certificate but openldap does not. Any help is much appreciated. I am really stuck with this. Thanks. Regards, Sascha -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger01

3 4

CPU IOWAIT
by Sergio Cioban Filho 14 Mar '09

14 Mar '09

Hi all, I have 2 openldap servers running on CentOS 5.2 (openldap-2.4.11 RPM: http://staff.osuosl.org/~jeff/openldap/el5/i386/<http://staff.osuosl.org/%7Ejeff/openldap/el5/i386/>), the single-master replication works fine, but when I have activated mirrormode, any ldap interaction is so slowly and CPU IOWAT is 100% (in ldapsearch or ldapadd...). I have tried the same configuration with openldap-2.4.15 + db-4.7.25, but this problem still occurred. Have any idea about this problem? ** Sorry for my poor english... :) Thanks, Regards, --- Sergio Cioban Filho

2 2

newbie question: No anonymous authentication = problems
by Andreas Brudin 13 Mar '09

13 Mar '09

Hi, I hope I am on the right list for questions like this. I manage a OpenLDAP server installation on Ubuntu 8.10, and when I upgraded from 8.04 the configuration changed quite a bit. I am trying to turn off anonymous access, but I get problems connecting to the ldap database even when not using anonymous bind. I managed to find the configuration options I was looking for (at least i think so) with phpldapadmin. I found an object with dn olcDatabase={1}bdb,cn=config, in which I found an attribute called olcAccess, which I think is what I need to change. From the beginning it said: {0}to attrs=userPassword,shadowLastChange by dn.base="cn=manager,dc=mydomain,dc=com" write by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to * by dn.base="cn=manager,dc=mydomain,dc=com" write by * read (of course with my dc values). I tried to change the last entry to by * none, as I do not right now need my users to be able to read their or other users' values. It worked as expected, from an LDAP point of view, I still could log in anonymously, but I could not browse the database, however, logged in as manager it worked as it should. The problem came in postfix, because I use my LDAP database (among other things) as an alias table. So I configured postfix not to bind anonymously, but to use server_host = localhost server_port = 389 search_base = dc=mydomain, dc=com bind = yes bind_dn = cn=manager, dc=mydomain, dc=com bind_pw = mysecret result_attribute = mail query_filter = (|(uid=%s)(mailAlias=%s)) But I got dict_ldap_lookup: Search error 50: Insufficient access from the mail.log When I changed back, it worked again. I have tried to change various things (such as put in by anonymous auth before by * read, and changing dc.base="..." to dc="..." both in the first and in the last attribute value above, but it does not seem to change. What am I doing wrong? Any help would be much appreciated. Best regards, Andreas

1 0

[Fwd: Re: OpenLDAP event in Paris - programme details]
by Howard Chu 13 Mar '09

13 Mar '09

As already mentioned, I'll be in London later this month to give a talk on OpenLDAP and MySQL at the UKUUG LISA conference. Since I'm going to be in Europe for a few days, the folks at Linagora in France invited me to give a talk in Paris as well. I look forward to meeting up with our friends on the Continent.... 8<------------------------------------------------------------ Community event with Howard Chu, OpenLDAP Chief Architect, in Paris Linagora is proud to welcome Howard Chu, OpenLDAP Chief Architect, for a conference on OpenLDAP version 2.4, Monday 23rd March at 6 PM in Paris. In a relaxed after-work atmosphere, come and learn more about the new features of the open source directory server, and meet other members of the French OpenLDAP community. Sign-up for free by a simple email to <ldap+event2009(a)linagora.com>. Warning : this conference will be given in English. Where : 27 rue de Berri, 75008 Paris - http://www.linagora.com/societe/contacts/nous_contacter/_r45.html Professional needs? Attend a seminary on industrializing OpenLDAP with Symas and Linagora, on Tuesday 24th March morning: http://www.linagora.com/actualites/evenement_exceptionnel_openldap_pour_les… 8<------------------------------------------------------------ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ldap delete and modifying by delete problems
by Catalin 12 Mar '09

12 Mar '09

Hello! I'm trying to write a php script in order to manage my LDAP Directory easier. Everything works fine when I'm adding new entries and when I'm modifying an attribute. When it comes to delete an entry from my directory or to remove an attribute, I get error no. 8 which means "PHP Warning: ldap_delete() [<a href='function.ldap-delete'>function.ldap-delete</a>]: Delete: Strong(er) authentication required in /var/www/html/admin.mydomain.tld/responsabil/sterge.php on line 34, referer: http://admin.mydomain.tld/responsabil/index.php?nav=del [Tue Mar 10 07:15:03 2009] [error] [client 172.17.26.57] PHP Warning: ldap_mod_del() [<a href='function.ldap-mod-del'>function.ldap-mod-del</a>]: Modify: Strong(er) authentication required in /var/www/html/admin. mydomain.tld /responsabil/sterge.php on line 37, referer: http://admin. mydomain.tld /responsabil/index.php?nav=del" Here is how I'm trying to do these: <?php $ldap = ldap_connect("localhost"); ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); $r = @ldap_bind($ldap, "root","password"); $arrayCN=array("cn=",$login,",ou=people,dc=mydomain,dc=tld"); $CN=implode($arrayCN); $arraygroup=array("cn=",$row_verifica[5],",ou=departments,dc=mydomain,dc=tld "); $group=implode($arraygroup); $entry["member"]=$CN; $stergere=ldap_delete($ldap,$CN); $modificare=ldap_mod_del($ldap,$group,$entry); $closing=ldap_close($ldap); ?> I think it has something to do with LDAP settings. I'm using default settings for LDAP , I've only included a supplemental schema to fit it for my needs. I've generated a {SSHA} password for root. If needed, I can send all these files. Can anyone help? Any suggestion would be greatly appreciated. Thanks in advance! Best regards! Catalin

4 3

new ldap installation -LDAP newbie question
by Swenson, Chris 12 Mar '09

12 Mar '09

This is a bit difficult to articulate. Is there a way to move only the passwords from a passwd file into ldap? I have built out an ldap server and a client box and can successful authenticate from one to the other. I am using this to replace an old RHEL that has depended on the passwd file with nearly 10,000 users. To add the users to the new server I have parsed and imported a good deal of the data in the passwd file into on Oracle Db that has all the HR stuff and then scripted an output ldif to add the users into the new ldap server. Good so far, this works. My concern is thus. Ldap is on a new box. There is a lot of junk in the old box I want to leave behind, hence the rewrite via oracle. I want to extract only the passwords from the passwd file and write them to the new ldap server. If I run migrate_passwd.pl and pull the passwords out, they are hashed in some way and I cannot write them to the ldap nor script setting the password from the old one. Even if I run the passwd file through pwunconv they seem to be unusable. I dread the thought of having to communicate with 9000 students and nearly 1000 faculty and staff with new passwords. Regards Chris S.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical