- openldap-technical - openldap.org

getting rid of "request done" messages
by Heiko Petzsch 18 May '09

18 May '09

Hi, I've tried to ask the following question in the openldap-software mailing list: > I have a beginners question: when I log in as root on one of my systems, I > get quite a lot of messages of the form > > request done: ld 0x5654f0 msgid 1 > request done: ld 0x5654f0 msgid 2 > ... > > on the console. I assume that they originate from my openldap installation > - but I don't even understand the mechanism how they are send to me > (openldap was installed by my predecessor). Could someone please tell me > how to get rid of these messages ? The moderator rejected my question, giving as his reason: (I hope he doesn't mind being quoted with this) "Given these messages occurred when you "log in", it is likely that issue relates to LDAP client software you are using to manage system log ins. Your question of "how to get rid of these" is likely lead to off-topic discussion of that LDAP client software. However, your message does at seem to relate to the use of OpenLDAP Software, hence it suggested you submit your submission to the OpenLDAP-technical list." I must admit that I had and have have no certainty at all which software produces these messages - I only searched the internet, and saw the same messages in connection with questions other people asked about openldap. They are, though, not a direct result of me logging in - they arrive continously and even after hours of being logged on. Could anybody tell me where these messages originate from, and how I can disable them ? Any help will be appreciated. Heiko -- Heiko Petzsch GTS Systems and Consulting GmbH D-52134 Herzogenrath

3 3

SDK: ldap_simple_bind gives Protocol error
by Stephen 17 May '09

17 May '09

Hi everyone, I'm trying to work out why some sample code doesn't work against a Centos 5 system (Centos being a RedHat Enterprise clone). Client is Mac OS X 10.5, and server is Centos 5.3, OpenDLAP 2.3.43. The sample code is from http://docs.sun.com/source/816-5616-10/example.htm#13303. (Am not using the Sun SDK, it was just a convenient place to find sample code. If there are OpenLDAP sample code resources, a link is welcome.) In particular the problem occurs at this piece of code: /* Bind anonymously to the LDAP server. */ rc = ldap_simple_bind_s( ld, NULL, NULL ); if ( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_simple_bind_s: %s\n", ldap_err2string(rc)); return( 1 ); } The resultant output is an error, namely; 'ldap_simple_bind_s: Protocol error' In comparison, if I run the same code against a Gentoo Linux system that also has OpenLDAP 2.3.43 the sample code works just fine. If I do an ldapsearch from the Mac OS X client with the query below, it succeeds. ldapsearch -x -h remoteCentosldapsvr -b basedn Can anyone suggest why the Centos 5 system is showing the protocol error? Thanks Regards Stephen

2 2

New DC
by Tech Only 16 May '09

16 May '09

Hello, I am new to LDAP. I have a basic question. How do I delete the default domain which is in the slapd.conf file and create my own? I have suffix "dc=example, dc=com" in slapd.conf file and if i chnge the above line and other lines where dc=example, dc=com to dc=test, dc=com I am not able to connect to it. Pelase let me know how to get rid of default dc and create my own domain. Thanks

2 3

replication between different slapds versions
by jakjr 15 May '09

15 May '09

Hello, Is there any problem to use the syncprov (refreshAndPersist) between a ldap master version 2.3.30 and a consumer version 2.4.16 ? I did some tests and couldn't find any problem. Best regards, João Alfredo

1 0

OpenLDAP 2.1 High Availability
by Kukkala Prasad 15 May '09

15 May '09

Hi All, We are planning to configure High Availability for OpenLDAP 2.1 on Linux CentOS. We are looking at following options and we want to check our understanding about corresponding options and looking for your valuable suggestions. 1. Using Replica Service a. This is not enough because if master machine goes down then LDAP updates will not be possible. 2. Migrating to OpenLDAP2.4 a. Master-Master solution looks promising but in our current project time line it is not possible to migrate. 3. Sharing LDAP file system on NFS a. After going through the thread http://www.openldap.org/lists/openldap-software/200209/msg00256.html it is understood that OpenLDAP does not support GFS or NFS. b. But the thread discussion happened very long back around in 2000 to 2002. ????Is that conclusion applicable to OpenLDAP 2.1???? 4. Hosting LDAP Service on CentOS Cluster Suite a. ????Is it possible to configure "Active-Passive" setup using CentOS Cluster Suite???? 5. H/W based clustering a. We don't know what are the possible solutions in this approach and cost incurred. !!!!Please share your ideas.!!!! 6. NetApp2020 a. We have NetApp 2020 Appliance http://www.b2net.co.uk/netapp/network_appliance_netapp_fas2020.htm with us. ????Does this any way help us???? 7. Other alternatives a. !!!!We need your valuable ideas and suggestions.!!!! Please help me in this regard. Regards, Prasad. ________________________________ The information contained in this communication is confidential, intended solely for the use of the individual or entity to whom it is addressed and may be legally privileged and protected by professional secrecy. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. This email does not constitute any commitment from Cordys Holding BV or any of its subsidiaries except when expressly agreed in a written agreement between the intended recipient and Cordys Holding BV or its subsidiaries. Cordys is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt. Cordys does not guarantee that the integrity of this communication has been maintained nor that the communication is free of viruses, interceptions or interference. If you are not the intended recipient of this communication please return the communication to the sender and delete and destroy all copies.

6 13

database size
by Marcel Berteler 14 May '09

14 May '09

Our current database size is 7GB and we are wondering how big we can grow until we run into LDAP / BDB constrains. Are there others on the list that have extremely large databases? Any pointers to ensure we can grow our DB even further without issues? Marcel

3 2

openldap, proxy, round robin?
by Nathan Lager 14 May '09

14 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am attempting to setup an openldap proxy, which i'd like to connect to a number of openldap directories in a round-robin fashion. There are currently 2 ldap servers, with a round-robin DNS hostname pointing to them. I setup openldap to proxy to this hostname, but it seems that when i actually connect to the proxy, it picks one of the addresses, and holds on to it. If it gets the second server on its first connection, it then continues to use that server. Is there a way to make openldap connect to each server? Whether it uses the round robin hostname or not is irrelevant. Two methods I can think of would be to somehow keep slapd from caching the dns name. Or if I can specify each server separately in the slapd.conf on the proxy. Thanks! - -- - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nathan Lager System Administrator 11 Pardee Hall Lafayette College, Easton, PA 18042 610-330-5907 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkoLLmsACgkQsZqG4IN3sumf4gCeJ3tOzX5Mk8ddbgvkg7TASbUH d9MAn3U+B8uYIj6eQy+yAHitV9Cqij/K =gFcb -----END PGP SIGNATURE-----

2 2

Re: Deleting hundreds of Entry under a OU
by Michael Ströder 11 May '09

11 May '09

Daniel, please keep responses on the list so others can comment and learn as well. Daniel Spannbauer wrote: > > Michael Ströder schrieb: >> Daniel Spannbauer wrote: >>> Hello, >>> >>> I have to deleted abount 500 Entrys under a OU in my LDAP-Tree cause I >>> have to change the objectClass from "account" to "inetorgPerson". >>> Can I do this with ldapdelete? I always used that tool only to delete >>> one entry. >> Yes. But you have to provide a file with a list of the DNs of the >> entries to be deleted. >> >> $ ldapdelete -h >> usage: ldapdelete [options] [dn]... >> dn: list of DNs to delete. If not given, it will be readed from stdin >> or from the file specified with "-f file". >> >> (You could also use some of the GUI LDAP clients for that. E.g. my >> web2ldap supports recursive deletion of all entries below an entry.) > > Thats a posibility. But the ldap-Entries are genarated by a Script. So I > have to delete it also by this script. So a gui is not the solution that > I prefer. In this case I'd prefer to use a full-featured scripting language with a decent LDAP module to do the job. You have more control in the case of an error than with invoking command-line tools from a shell script. Ciao, Michael.

1 0

Deleting hundreds of Entry under a OU
by Daniel Spannbauer 11 May '09

11 May '09

Hello, I have to deleted abount 500 Entrys under a OU in my LDAP-Tree cause I have to change the objectClass from "account" to "inetorgPerson". Can I do this with ldapdelete? I always used that tool only to delete one entry. Regards Daniel -- Daniel Spannbauer Software Entwicklung marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

2 2

OpenLDAP server and OS X clients
by Arne Schmitz 11 May '09

11 May '09

Hi! We are running an OpenLDAP server on Debian Stable. It works very well so far, using more than 20 Linux clients. However, we now also have got a couple of Mac clients that are supposed to use the server. I have set the Mac clients (OS X 10.5.6) to use our LDAP server, using the Directory Utility. That utility is set to use a RFC 2307 server, with our LDAP's IP and the correct base name. After that I can "sudo su" to any LDAP user, also call "id" for any LDAP user, log in via SSH + key to LDAP user, but NOT authenticate via password. I.e. interactive logins or password based SSH logins are NOT possible. It seems the password authentication against LDAP is not working. What I find in /var/log/secure.log is the following: May 6 17:46:38 mymac authorizationhost[70401]: Failed to authenticate user MyLDAPUser (tDirStatus: -14090). Any ideas what might be going wrong here? Where should I look? Cheers, Arne -- Dipl.-Inform. Arne Schmitz Phone +49 (0)241 80-21817 Computer Graphics Group Fax +49 (0)241 80-22899 RWTH Aachen University http://www.rwth-graphics.de Ahornstrasse 55, 52074 Aachen, Germany

2 3

LDIF, userCertificate; and missing "binary" option
by Erwann ABALEA 07 May '09

07 May '09

Hello, Hoping it's the right list to ask for it. I'm facing a "cross-recommendations" problem. Here it is. I'm downloading an LDIF containing some inetOrgPerson and cRLDistributionPoint entries, in order to have a replication site to develop on. Those entries have userCertificate or certificateRevocationList , but not stored with the "binary" option (only the "::" indicating it's Base64-encoded). When trying to import this file with ldapadd on my directory, it failed, telling me that those attributes need to be transfered with the binary option. Right. I'm searching RFCs 2252 and 2256 (and their replacement as well), and find that effectively, those attributes *MUST* be transfered as binary ones. I told the directory maintainer that the LDIF wasn't correct according to these RFCs, and he replied that it was correct regarding RFC2849, which is the only one defining the LDIF format. Finally, that's right. And this RFC doesn't tell anything about certificates or binary option. And I can't find an obvious link between RFC2849 and RFC2252/2256. I know I can just do a 'sed s/userCertificate::/userCertificate;binary::/' of the file, but modifying something defined to be a standard for interchange doesn't seem to be a good solution. Do you have some ideas? Regards. -- Erwann.

2 1

OpenLDAP multi master replication
by Bujji S 07 May '09

07 May '09

Hi, i have openldap(2.4.9) installed in ubuntu 8.04 server. i want to create a multi master set up with two such servers(2 or more than 2) first i tried to follow http://www.openldap.org/doc/admin24/replication.htmlto form n-way master setup. but in starting only i got a problem saying database(dc=mytest,dc=com) is not configured to hold "cn=config" then i tried setting up cn=config using http://www.zytrax.com/books/ldap/ch6/slapd-config.html but that doesn't help me meaning even after configuring that cn=config as he mentioned in the site i got the same error so i removed everything(slapd.d) what i did earlier so now i have slapd.conf in both of my servers finally i found one more link http://itsecureadmin.com/wiki/index.php/OpenLDAP_Multi-Master_Replication that displays sample config file so i followed that you can check the slapd.conf below so now i set up the same configuration in the second server too. after writing these slapd.conf i just restared slapd on both servers. for the first time when i add some data the first server it got replicated on the other server only when restart slapd on second server. that is fine. when i tried to add some other data on second server its not getting replicated on the other server even if i restart slapd. after that wherever i add data not getting replicated adding locally only. what could be the problem. plz check my slapd.conf file and suggetst me how to do multi master replication on ubuntu 8.04 server. so my slapd.conf is below. # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel none # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload ppolicy.la moduleload syncprov.la moduleload back_monitor.la # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> database config rootdn "cn=admin,cn=config" rootpw admin123 database monitor rootdn cn=monitor rootpw admin123 ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=mytest,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=mytest,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" serverid 3 ldap://192.168.7.88:389 serverid 4 ldap://192.168.7.89:389 cachesize 1000 checkpoint 256 5 syncrepl rid=003 provider=ldap://192.168.7.88:389 binddn="cn=admin,dc=mytest,dc=com" bindmethod=simple credentials=admin123 searchbase="dc=mytest,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 syncrepl rid=004 provider=ldap://192.168.7.89:389 binddn="cn=admin,dc=mytest,dc=com" bindmethod=simple credentials=admin123 searchbase="dc=mytest,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode true overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq index cn,mail,surname,givenname eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mytest,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=mytest,dc=com" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=mytest,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be hdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" --------------------------------------------------------------------- so now i set up the same configuration in the second server too. after writing these slapd.conf i just restared slapd on both servers. for the first time when i add some data the first server it got replicated on the other server only when restart slapd on second server. that is fine. when i tried to add some other data on second server its not getting replicated on the other server even if i restart slapd. after that wherever i add data not getting replicated adding locally only. what could be the problem. plz check my slapd.conf file and suggetst me how to do multi master replication on ubuntu 8.04 server. Thanks Visu

2 1

ldap users in local groups
by Justin Lintz 06 May '09

06 May '09

Hi, I'm running into an interesting problem in that when I try to add more than one ldap account to a local group, both users of that group no longer show membership in that group when running "groups" or "id". If I just add one of the users to the group, it works without a problem. I apologize if this is not the correct list of this issue. Does anyone have any ideas on what may be causing this? - Justin Lintz

3 2

Occasional corrupt DN in be_add logs under 2.4.16
by Sean Burford 06 May '09

06 May '09

Hi, As an interim measure while deploying 2.4.16 I am canarying 2.3.43 on a replication provider. As a result the current replication path is: master (2.3.39) -> provider (2.3.43) -> replica (2.4.16) The master will be upgraded in short order once the 2.3.43 canary is successful. I've been seeing occasional corrupt DNs in some be_add log lines on the 2.4.16 replica: May 5 09:35:46 host slapd[31817]: syncrepl_message_to_op: rid=100 be_add <90>Y1 ntry,ou=subtree,dc=example,dc=com (0) I've modified the DN in this log line. The missing text is "cn=l" in this example. The original DN was 65 characters long. I have performed the following search against each host with the following results. It shows that the entry replicated fine but capitalisation of the DN differs (which may be a red herring since I was already aware that DN capitalisation differed across servers): $ ldapsearch -x -b cn=lntry,ou=subtree,dc=example,dc=com -s base dn master: dn is cn=lntry,ou=Subtree,dc=example,dc=com provider: dn is cn=lntry,ou=subtree,dc=example,dc=com replica: dn is cn=lntry,ou=Subtree,dc=example,dc=com slapcat shows no problems with the entry on the 2.4.16 host. Since the database looks fine I wonder if this is just a logging issue. Should this Debug statement in syncrepl.c actually use op->ora_e->e_name.bv_val or some other attribute? rc = op->o_bd->be_add( op, &rs ); Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s be_add %s (%d)\n", si->si_ridtxt, op->o_req_dn.bv_val, rc ); With the exception of si->si_rid becoming si->si_ridtxt (and %d->%s) this Debug statement has not changed since 2.3. -- Thanks, Sean Burford

3 5

slapd-meta and paged results control
by Lajos Boróczki 06 May '09

06 May '09

Hi, I'm trying to set up an openldap proxy server using slapd-meta. Everything worked so far, but after the backend database grew bigger and bigger, searches with a fixed page size started to give strange results. Tracing the problem led me to the following: If I set a page size of 300 in my ldapsearch (where localhost:3890 is my slapd running slapd-meta): ldapsearch -x -W -D "CN=admin,DC=example,DC=org" -E pr=300 -H "ldap://localhost:3890/" -b "dc=a,dc=example,dc=org" "(objectClass=inetOrgPerson)" uid I get at most 300 results and the paging information is lost on the way. If I set 300 to 1000 I get all of the results, because I have ~500 entries. Doing an ldapsearch to the backand servers: ldapsearch -x -W -D "CN=admin,DC=example,DC=org" -E pr=300 -H "ldap:// dc1.a.example.org/" "dc=a,dc=example,dc=org" "(objectClass=user)" userPrincipalName I get 300 results and a prompt to press enter, after pressing some enters I can get every entries. My backends are Active directories... :( Thanks for your help, Lajos Config: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/ad_attr.schema include /etc/ldap/schema/ad_class.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 8 modulepath /usr/lib/ldap moduleload back_meta moduleload back_ldap moduleload rwm moduleload pcache moduleload back_bdb sizelimit 1000 tool-threads 1 database meta suffix "dc=example,dc=org" norefs yes rebind-as-user yes chase-referrals no uri "ldap://dc1.example.org/dc=example,dc=org" "ldap:// dc2.example.org/" uri "ldap://dc1.a.example.org/dc=a,dc=example,dc=org" "ldap:// dc2.a.example.org/" uri "ldap://dc1.b.example.org/dc=b,dc=example,dc=org" "ldap:// dc2.b.example.org/" overlay rwm rwm-rewriteEngine on rwm-map attribute uid userPrincipalName rwm-map objectclass inetOrgPerson user

4 5

ppolicy pwdcheckmodule...
by JDaniel Jimenez 06 May '09

06 May '09

Hello everyone, I have installed openldap about two months ago, everything went ok and now I need passwords policies. Theese are working as spected but pwdCheckModule. In `man slapo-ppolicy` I have read this is an user-defined module... This is a problem for me... A long time ago I think I was able to do this without too much problems but now by now I must read "C++ Bible" to understand this... Is there any sample, or configurable module for this? Every body do this bi itself? thanks in advance ;) -- JDani

1 0

[Openldap2.4.11-Ubuntu8.10] Configuration Problem: ldap.conf missing, not possible to create slapd.d using slaptest
by Ket Zal Dev 06 May '09

06 May '09

Hi All I'm on Ubuntu 8.10, and using openldap 2.4.11. I successfully installed openldap on my server. I was a little bit surprised because i didn't found slapd.conf on /etc/ldap/ like in older releases, but I found a tuto explaining how to use slapd.d. On this howto, they sepcified it is possible to convert slapd.conf to slapd.d using slaptest. Because I don't have slapd.conf, I cannot convert anything. So, How can I do??? Secondly, on the tutorial, I used slaptest to create a ldif for a schema. I successfully added the ldif schema to openldap using ldapadd, and schema is working. It was mozillaorgperson, and I'm now able to create, read and modify users. My problem is that I need to use a new schema "rfc2703bis.schema" because my openldap server is for egroupware, and there is a problem with PosixGroup...... So I need to add it. This schema should replace nis schema. BUT, I cannot delete NIS schema, because used by open ldap. And cannot add rfc2703bis because I have errors "already exists" <--- it is logical because entries are on NIS which is active on openldap at this time. So I tried a lot of things, like using slaptest to create de ldif, copying it widely to slapd.d and removing by hand the NIS schema.... Not working, the result is that now, the openldap server cannot start.... Is there a clean way to do that??? Is it possible for me to create a slapd.conf, put inside all my configuration, do the slaptest, have a clean slapd.d and run openldap???? in a simple way. What to put inside...??? Thanks a lot for you help Best Regards

1 0

Syncrepl connections failing
by John Kane 05 May '09

05 May '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 3

Re: Berkeley DB V ersion
by Gustavo Mendes de Carvalho 05 May '09

05 May '09

Hi All, I was checking Oracle Berkeley site, and I found many versions available to download. I will compile Berkeley database on my own, and I would like to know which version is most recommended to use with OpenLDAP 2.4.x http://www.oracle.com/technology/software/products/berkeley-db/db/index.html 4.7.25 is the Latest Production Release. -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

1 0

Check for existence of a group
by Alex Chen 05 May '09

05 May '09

I am new to LDAP so please bear with me if my question sounds too basic. I want to make sure if a group already exist in the directory before a member is allowed to be added. I guess the API to use would be ldap_search_s (I want to sue synchronous search). What kind of filter syntax should I use? Alex

3 2

Berkeley DB V ersion
by Gustavo Mendes de Carvalho 05 May '09

05 May '09

Hi All, I was trying to compile openldap 2.4.x and I was surprised because this version _requires_ BDB version 4.4. I am installing it in a Red Hat AS 4 up7 machine and RedHat has only version BDB 4.3 available to download. Is there any doc on OpenLDAP site regarding upgrading BDB, from 4.2.x to 4.4.x ? Is there any problem running openldap 4.4.x using BDB 4.2 ? Tanhks in advance -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

4 4

Attribute for txt records
by Aurélien BARLUET de BEAUCHESNE 05 May '09

05 May '09

Hi List, I sent the same question just after my registration but before my validation, so I'm not sure you received it. I would like to know the name of the attribute for the "txt" record in a DNS zone. I tried txtrecord, txtrecords, txt, but none of these are correct. Can you help me ? Thanks' in advance Regards, --- Aurélien de BEAUCHESNE VOIPLine : 04 27 70 90 07 <http://www.ipline.fr/> IPLine 122 Grande rue St Clair 69300 Caluire Tel : 04 72 27 49 00 Fax : 04 72 27 02 57 Le paysagiste de l'environnement Internet P Afin de contribuer au respect de l'environnement, merci de n'imprimer ce mail que si nécessaire

3 4

Help for special ACL needed
by Florian Götz 04 May '09

04 May '09

A warm "Hello" from germany to the openldap-technical list! I´m rather new to OpenLDAP, using version 2.4.12 on a SLES11 server. I need to write an ACL which allows a user to see his own entry (objectClass build up on inetOrgPerson) and nothing else. I know that this isn´t the intended use of the LDAP system, but our manager wants it that way. I tried it with somekind of that: access to dn.regex="uid=([^,]+),dc=justushere,dc=de$" attrs=entry by dn.regex="uid=$1,ou=Users,dc=justushere,dc=de" write by users none but I just get a message about invalid credentials. Used command was: ldapsearch -xWD uid=user1,ou=users,dc=justushere,dc=de uid=user1 ldapsearch -xWD cn=admin,dc=justushere,dc=de uid=user1 with the rootdn account shows the information, but if the uid of the user1 is used for binding it fails. Has anyone an idea how to realize these restrictions? Additionally not all attributes should get listed to the user, only a few important for him. My idea was to use a ACL like the above to be sure the user only gets access to his object and then add a second ACL below who restricts the access to the important attributes. Best regards Florian Götz

4 6

slapd + gssapi/heimdal: using false realm in principal
by Friedemann Stoyan 30 Apr '09

30 Apr '09

Hello, I struggle with an Debian GNU/Linux (Lenny) and * slapd 2.4.11-1 * heimdal-kdc 1.2.dfsg.1-2.1 * libsasl2-modules-gssapi-heimdal 2.1.22.dfsg1-23 With this configuration: /etc/ldap/slapd.conf: # Kerberos Configuration sasl-host kerberos.lab.swapon.de sasl-realm LAB.SWAPON.DE # Mapping Kerberos Authentication Identities authz-regexp uid=([^,]*),cn=lab.swapon.de,cn=gssapi,cn=auth ldap:///ou=people,dc=lab,dc=swapon,dc=de??one?(&(uid=$1)(objectClass=person)) /etc/ldap/sasl2/slapd.conf: mech_list: GSSAPI log_level: 7 Then I get a kerberos ticket and start ldapsaerch: $ ldapsearch -H ldaps://ldap.lab.swapon.de/ SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) The slapd logfile isn't very helpfull: slapd[11480]: conn=2 fd=14 ACCEPT from IP=[2001:6f8:12ec:11::389:fefe]:60487 (IP=[2001:6f8:12ec:11::389:fefe]:636) slapd[11480]: conn=2 fd=14 TLS established tls_ssf=128 ssf=128 slapd[11480]: conn=2 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" slapd[11480]: conn=2 op=0 SRCH attr=supportedSASLMechanisms slapd[11480]: conn=2 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[11480]: conn=2 op=1 BIND dn="" method=163 slapd[11480]: SASL [conn=2] Failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) slapd[11480]: conn=2 op=1 RESULT tag=97 err=80 text=SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) slapd[11480]: conn=2 fd=14 closed (connection lost) The KDCs logfile is more interesting: Authentication Server Request from slapd (successfull): 14:37:13 AS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB.SWAPON.DE(a)LAB.SWAPON.DE 14:37:13 Client sent patypes: encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp 14:37:13 Looking for PKINIT pa-data -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE 14:37:13 Looking for ENC-TS pa-data -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE 14:37:13 ENC-TS Pre-authentication succeeded -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE using aes256-cts-hmac-sha1-96 14:37:13 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, des3-cbc-md5, arcfour-hmac-md5, des-cbc-md5, des-cbc-md4, des-cbc-crc 14:37:13 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 14:37:13 AS-REQ authtime: 2009-04-27T14:37:13 starttime: unset endtime: 2009-04-28T00:37:13 renew till: unset 14:37:13 sending 670 bytes to IPv6:2001:6f8:12ec:11::88:fefe Ticket Granting Server Request from slapd (fails): 14:37:13 TGS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for digest/LAB(a)LAB.SWAPON.DE [canonicalize] 14:37:13 Searching referral for LAB 14:37:13 Server not found in database: digest/LAB(a)LAB.SWAPON.DE: No such entry in the database 14:37:13 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 TGS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB(a)LAB.SWAPON.DE 14:37:13 Server not found in database: krbtgt/LAB(a)LAB.SWAPON.DE: No such entry in the database 14:37:13 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe It's clear that this TGS-REQ is failing: the realm "LAB" in the principal "krbtgt/LAB(a)LAB.SWAPON.DE" doesn't exist. Correct would be: "krbtgt/LAB.SWAPON.DE(a)LAB.SWAPON.DE". At present I have no clue how to fix this. Good ideas would be appreciated. Regards Friedemann

1 1

RE: CSN Too Old potential Bug
by Victor Andres Sina Sotomayor 30 Apr '09

30 Apr '09

Hi all I was reading this post in openldap-technical forum. I am in the process to install a full authenticate service here using samba and openldap, my pdc and bdc are ldap based servers, and are in different locations, using a router to connect them, then. a full master ldap is needed in these two locations. I have two ldap servers in mirror mode (in a virtual machines, using vmware), these two servers are time synchronized using the same time server. When a update a ldap entry in one server, the data replicate fine, but when I use the other, I have the following error in my logs. Apr 29 11:50:15 srvped2master slapd[7377]: do_syncrep2: cookie=rid=002,sid=002,csn=20090429165015.624045Z#000000#001#000000 Apr 29 11:50:15 srvped2master slapd[7377]: do_syncrep2: rid=002 CSN too old, ignoring 20090429165015.624045Z#000000#001#000000 The time is very difficult to maintain in sync when virtual machines are in use, and Openldap servers are extremely sensitive to time lag. Apparently this is a bug in ldap 2.4.11 and will be fixed in ldap 2.4.16 <http://www.openldap.org/lists/openldap-bugs/200903/msg00202.html> http://www.openldap.org/lists/openldap-bugs/200903/msg00202.html Anyone could solve the problem? Im using debian lenny srvped2master:/etc/ldap# apt-cache policy slapd slapd: Installed: 2.4.11-1 Candidate: 2.4.11-1 Version table: *** 2.4.11-1 0 500 http://ftp.us.debian.org lenny/main Packages 100 /var/lib/dpkg/status This is my slapd.conf ################# serverID 1 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=avhlima,dc=edu,dc=pe" rootdn "cn=admin,dc=avhlima,dc=edu,dc=pe" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 syncrepl rid=001 provider=ldap://192.168.4.8 type=refreshAndPersist retry="60 +" searchbase="dc=avhlima,dc=edu,dc=pe" attrs="*,+" bindmethod=simple binddn="cn=admin,dc=avhlima,dc=edu,dc=pe" credentials=XXXXXXXXXXXX mirrormode on index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub lastmod on checkpoint 512 30 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn="cn=admin,dc=avhlima,dc=edu,dc=pe" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=avhlima,dc=edu,dc=pe" write by * read ########################## The diff between servers are only in: serverID 2 syncrepl rid=002 provider=ldap://192.168.3.8 Thanx 4 your time Victor

3 2

openldap on windows
by singularity suse 29 Apr '09

29 Apr '09

How do I set openldap running on my windows xp machine. I edited the conf fie, but it doesn't work. Thanks

1 0

backing up openldap using slapcat automatically
by hariharan＠thehindu.co.in 29 Apr '09

29 Apr '09

1 0

Ldap error: Logging region out of memory; you may need to increase its size
by vaibhav lokhande 29 Apr '09

29 Apr '09

Hi all , I am new in world of ldap. following is info about my ldap. *openldap-2.4.11-1.3.el5 openldap-servers-2.4.11-1.3.el5 nss_ldap-253-3 compat-openldap-2.4.11_2.3.27-1.3.el5 openldap-clients-2.4.11-1.3.el5 php-ldap-5.1.6-5.el5 openldap-devel-2.4.11-1.3.el5* And m getting error on command slapcat * bdb(o=******_ldap): Logging region out of memory; you may need to increase its size bdb_db_open: database "o=******_ldap": db_open(/var/lib/ldap/id2entry.bdb) failed: Cannot allocate memory (12). backend_startup_one: bi_db_open failed! (12)* *Can any one please guide me to solve this issues. Other things are working fine. But still m getting this error. Regards Vaibhav *

1 0

Adapt memberof overlay for host attribute
by Vince Rafale 29 Apr '09

29 Apr '09

Hi list, I would like to know whether anybody has succeeded in using the memberof overlay for others attributes. I would like a user entry (specifically the host attribute) to be populated when a user is added to a posixGroup. Let's say this posixGroup contains a "hostOfGroup" attribute. Is it feasible? Or do I need to code my own overlay for that purpose? If writing an overlay is not needed, is there an esaier way to do that? Thanks. Regards, Vince

4 5

getting distinguishedName as a distinct attribute in seach result
by Erik De Zeeuw 29 Apr '09

29 Apr '09

Hello, We need to get a line with "distinguishedName: <dn>" in our search results, in order for a specific software to work with our LDAP setup. I tried to play around with rwm-map and rewrite, but could not find a solution to get this working. To be clear, I would like to get this as a search result: dn: uid=myuser,ou=people,dc=my,dc=suffix givenName: My User ... other attributes ... distinguishedName: uid=myuser,ou=people,dc=my,dc=suffix ... other attributes ... I know this might not be standard, and it indeed looks quite stupid as we already get the dn: line, but this seems to be the way it works when using active directory, and software we bought just wait for this to work. Thanks for any constructive answer that will popup :)

2 1

Segfault during Auth Benchmark request
by SAGNIMORTE Thomas (CAMPUS) 28 Apr '09

28 Apr '09

Hi, I am working on building and benchmarking OpenLDAP v2.4.16 for a large entries directory (actual test: 2 000 000 but final objective 10 000 000 users). I use SLAMD to test authentication in order to evaluate what is the maximum number of authentication I can do on my server. So I try to do 5 authentications per 5ms during 5min. My OpenLDAP 2.4.16 is install on the X86 two core 2.8Ghz server with 4Go of memory. I set 3Go in cache of DB_Config and I have look a lot on how configure properly slapd. Is it normal because I have reach system limits or can I change some parameter to optimize slapd performance? Do some people have some figures about slapd performance with large entries directory on standard server? Regards, --- Thomas

3 11

cannot rename back-sql tables
by Matthew Hallsworth 28 Apr '09

28 Apr '09

Hi list, I have searched far and wide for a solution to this but cannot find anywhere where it is possible to configure back-sql as such. I am trying to interface openldap with a MySQL backend using the standard back-sql configuration, with one exception - every 'ldap_*' prefixed table needs to be named 'custom_ldap_*' as we are trying to fit in LDAP support into an existing product which requires the additional tables to make this work to conform with existing schema. What I've found is, I can get the LDAP requests working perfectly via a test database using standard 'ldap_*' notation, but I cannot for the life of me get the system to handle different table names properly. My config file, "/etc/openldap/slapd.conf", on CentOS 5.2 shows the following: <snip> # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. #allow bind_v2 loglevel -1 logfile /var/log/ldap.log # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # sql definitions for mysql access ####################################################################### database sql dbname ldaptest readonly on suffix "dc=rams,dc=com,dc=au" dbuser ldaptest dbpasswd abc123 subtree_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" children_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM custom_ldap_oc_mappings" at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM custom_ldap_attr_mappings WHERE oc_map_id=?" has_ldapinfo_dn_ru no lastmod off ####################################################################### # ldbm and/or bdb database definitions ####################################################################### #database bdb #suffix "dc=my-domain,dc=com" #rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM </snip> Now, when I run "/usr/sbin/slapd -d -5" and attempt to do a general query on the ldap server using "ldapsearch -x -b 'dc=rams,dc=com,dc=au'" I get the following feedback from openldap: <snip> # extended LDIF # # LDAPv3 # base <dc=rams,dc=com,dc=au> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 </snip> And, the debug output displays: <snip> ... ==>backsql_search(): base="dc=rams,dc=com,dc=au", filter="(objectClass=*)", scope=2, deref=0, attrsonly=0, attributes to load: all ==>backsql_get_db_conn() ==>backsql_open_db_conn(3) daemon: epoll: listen=8 active_threads=0 tvp=NULL <==backsql_open_db_conn(3) backsql_open_db_conn(3): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_dn2id("dc=rams,dc=com,dc=au") matched expected backsql_dn2id("dc=rams,dc=com,dc=au"): id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" backsql_dn2id("dc=rams,dc=com,dc=au"): id=1 keyval=1 oc_id=1 dn=dc=rams,dc=com,dc=au >>> dnPrettyNormal: <dc=rams,dc=com,dc=au> <<< dnPrettyNormal: <dc=rams,dc=com,dc=au>, <dc=rams,dc=com,dc=au> <==backsql_dn2id("dc=rams,dc=com,dc=au"): err=0 ==>backsql_id2entry() backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="organizationalUnit" attr="objectClass" keyval=1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM ldap_entry_objclasses,ldap_entries,company WHERE company.id=? AND ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entries.keyval=company.id and ldap_entries.oc_map_id=1' Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entry_objclasses' doesn't exist" <==backsql_id2entry() ==>backsql_oc_get_candidates(): oc="inetOrgPerson" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '2' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" ==>backsql_oc_get_candidates(): oc="organizationalUnit" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '1' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" send_ldap_result: conn=3 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=80 ber_flush: 14 bytes to sd 9 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... conn=3 op=1 SEARCH RESULT tag=101 err=80 nentries=0 text= ... </snip> In summary, I feel that there is some kind of missing configuration variable either in documentation or tutorials online that really doesn't allow you to fully specify alternate table names for the default 4 main tables in the back-sql implementation. If this is due to the backend being experimental then so be it - however I really need some kind of quantified 'yes' or 'no' as to whether what I'm trying to achieve is possible at all. TIA Matthew Hallsworth

1 0

Re: bdb_equality_candidates warning
by Gustavo Mendes de Carvalho 28 Apr '09

28 Apr '09

Hi Quanah, I included this field to be indexed in ldap database, and after ldap restart I can't see this message anymore. Thanks for while. Gustavo 2009/4/27 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Monday, April 27, 2009 3:59 PM -0300 Gustavo Mendes de Carvalho < > gmcarvalho(a)gmail.com> wrote: > > Hi there, >> >> I have an OpenLDAP server version 2.3.39, and recentrly (I mean, since >> last friday) I noticed some delay when athenticating against LDAP base. >> >> I got this messages in ldap.log file >> >> Apr 27 15:46:39 ldap01 slapd[4445]: <= bdb_equality_candidates: >> (uniqueMember) not indexed >> > > Does anybody has some tip about it ? Which entry do I have to index to >> avoid this message ? Is there any way to find out which index is it >> caliming for ? >> > > Seems pretty clear to me. The log clearly states that the attribute > "uniqueMember" is not being indexed. Your index statements in slapd.conf > agree with that. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

3 3

RE:AW: Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 27 Apr '09

27 Apr '09

Actually, I do not have an ACL. Could you provide me further details for what I have to permit with the ACL. The log file of OpenLdapServer, when i execute the command "getent passwd on solaris" is the following: Apr 24 19:37:04 achilles slapd[22086]: conn=19 fd=10 ACCEPT from IP=10.0.0.25:33240 (IP=0.0.0.0:389) Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SRCH base="ou=people,dc=tesyd,dc=teimes,dc=gr" scope=2 deref=3 filter="(objectClass=posixAccount)" Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SRCH attr=cn uid uidnumber gidnumber gecos description homedirectory loginshell Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SEARCH RESULT tag=101 err=32 nentries=0 text= Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=1 UNBIND Apr 24 19:37:04 achilles slapd[22086]: conn=19 fd=10 closed I have not declare the ou=people somewhere and i do not understand the searching on "ou=people,dc=tesyd,dc=teimes,dc=gr". any suggestion would help From: claus.kick(a)siemens.com To: poly_pan78(a)hotmail.com Date: Thu, 23 Apr 2009 16:06:21 +0200 Subject: AW: Problem to Authenticate Users with openLDAP on Solaris 9 Do you have an ACL in place in order to allow binding to read the ldap data? Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von panagiotis polychronopoulos Gesendet: Donnerstag, 23. April 2009 15:04 An: openldap-technical(a)openldap.org Betreff: Problem to Authenticate Users with openLDAP on Solaris 9 hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance Δείξτε το στιλ σας με μια εικόνα στο Messenger. Δείτε τις όλες. Κάντε κλικ εδώ! Δείξτε το στιλ σας με μια εικόνα στο Messenger. Δείτε τις όλες. Κάντε κλικ εδώ! _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 1

bdb_equality_candidates warning
by Gustavo Mendes de Carvalho 27 Apr '09

27 Apr '09

Hi there, I have an OpenLDAP server version 2.3.39, and recentrly (I mean, since last friday) I noticed some delay when athenticating against LDAP base. I got this messages in ldap.log file Apr 27 15:46:39 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:46 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:48 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:54 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:53 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:56 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:58 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed This is my slapd.conf related to indexes ####################################################################### # Indexes ####################################################################### index objectClass eq,pres index uid,memberUid eq,pres,sub I already checked for duplicate entries in ldif file, but I got nothing. Does anybody has some tip about it ? Which entry do I have to index to avoid this message ? Is there any way to find out which index is it caliming for ? Thanks in advance -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

2 1

Re: slapd_db_archive log rotation
by Andrew Hall 27 Apr '09

27 Apr '09

Thanks for the reply Quanah. On 2009/4/25 Quanah Gibson-Mount wrote: > you fail to note what release you are using of OpenLDAP or BDB. There were > known issues with some earlier releases failing to checkpoint correctly. OpenLDAP 2.3.28 I've no idea the version of BDB - how would I find this out ? > You also fail to note your checkpoint parameter in slapd.conf. There doesn't seem to be a checkpoint setting in either slapd.conf or the DB_CONFIG file. Should there be ? > Also, rather than manually deleting logs, you can set BDB up to do it for you. See the > various options that can be set in DB_CONFIG. Yes, this can be specified with DB_LOG_AUTO_REMOVE but I wish to backup the log files before I remove them which is why I wish to do this manually.

2 3

Filter very strange problem for matching values
by Denis BUCHER 26 Apr '09

26 Apr '09

Hello everyone, I have a very strange problem with openldap... * Strange because it used to work and without reason (no update, no change in config) it suddently stopped to work * Strange because I have the correct configuration as far as I know * Strange because when I do tests, the results are illogical ! The problem is simple to explain, a filter doesn't work as expected ! The filter is : (&(objectclass=CourierMailAccount)(mail=%u)(accountStatus=active)) which mean find all object being : * in class CourierMailAccount * email is %u (this is replaced dynamically) * accountStatus is active The first two criteria are working, the problem is with accountStatus (if I remove this criteria it suddently works). PROBLEM : 1. if "accountStatus" is not present in my filter : it works 2. "accountStatus=active" => NO RESULTS ??? 3. "accountStatus=*" => RESULTS I tried in phpldaptadmin web interface, same problem : 1. "accountStatus=active" => NO RESULTS ??? 2. "accountStatus=*" => RESULTS In my schemas the config is : attributetype ( 1.3.6.1.4.1.7914.1.2.1.12 NAME 'accountStatus' DESC 'The status of a user account: active, noaccess, disabled, deleted' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) Is therefore the problem with caseIgnoreIA5Match ? But this seems correct according to many web pages like http://www.zytrax.com/books/ldap/ape/qmail.html And it always worked before... Any help would be greatly appreciated because I don't see where the problem comes from ? (Maybe some index problem ???) Thanks a lot in advance Denis

2 1

slapd_db_archive log rotation
by Andrew Hall 25 Apr '09

25 Apr '09

Hi there. I'm using slapd_db_archive with the -a flag to identify BDB logs which can be safely deleted. I've recently noticed my logs are building up and -a does not produce any output. However the -l flag does successfully list the log files. Therefore any use of the -d flag to remove them does nothing. I'm almost certain these old logs are not being used (there's about 20 going back for several months now) but still slapd_db_archive does not pick up on them. Can anyone advise what may be happening here or how I can debug this further ? Thanks very much.

2 1

openldap as slave server to windows AD
by Aleksander Kamenik 24 Apr '09

24 Apr '09

Hi, This is my first experience with ldap, there are lots of different approaches to configuring openldap and I'm a bit lost. I'm about to setup a windows domain server with AD for some 50 windows pc's. The windows pc's will use the windows server directly and that's settled. However I also have lots of different services running on linux servers which require the same user authentication and could be configured to use ldap based authentication instead of each having their own account database. It's a hassle to maintain accounts for each service separately. Also, if the windows server should be unavailable, I'd still like to be able to login and use the services running on linux servers. So I imagine having openldap act a slave server (like in DNS) the for the windows active directory service's "User" space. Is this possible and which configuration path should I take? The manual mentions proxy configurations as well as something called chaining. Please point me to the correct chapter and any other hints are appreciated. Regards, -- Aleksander Kamenik System Administrator Krediidiinfo AS an Experian Company Phone: +372 665 9649 Email: aleksander(a)krediidiinfo.ee http://www.krediidiinfo.ee/ http://www.experiangroup.com/

2 1

Missing CSN in do_syncrep2 cookie log line
by Sean Burford 24 Apr '09

24 Apr '09

Hi, I'm new to 2.4 (2.4.16) and I don't know if empty CSNs are expected. The provider restarted and the syncrepl consumer kept sync, however part way through the reconnection the consumer got an empty CSN and decided to do an additional reconnect. This may be a side effect of the provider running 2.3.39. The provider has a syncrepl accesslog and an auditlog that both agree with the CSNs below (no changes were skipped by the sync). The accesslog database has syncprov-nopresent and syncprov-reloadhint set to TRUE. The main database has these values set to FALSE (syncprov-reloadhint will be toggled to TRUE shortly on the main database). At 13:20:42 username1 has an attribute removed. The change is replicated at that time. This is the last entry replicated before the provider is shut down: do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xf966560 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0x155621b8 20090424132042Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username1,dc=example,dc=com (0) slap_queue_csn: queing 0xd2f6cf8 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0xec0a758 20090424132042Z#000000#00#000000 At 13:25:18 slapd on the syncrepl provider is shut down and the consumer notices: do_syncrep2: rid=100 (-1) Can't contact LDAP server do_syncrepl: rid=100 rc -1 retrying At 13:26:12 slapd on the replication provider is restarted. The consumer connects 6 seconds later and receives the same attribute delete again (I assume it isn't an entry delete since there are no entry deletes in the hours bracketing this log): do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100* do_syncrep2: cookie=csn=,rid=100* do_syncrepl: rid=100 rc -1 retrying At 13:27:18 slapd on the replication consumer reconnects and receives the same attribute delete again before continuing normal replication a little later when another user is modified: do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 do_syncrep2: cookie=csn=20090424133119Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xc9fdb67 20090424133119Z#000000#00#000000 slap_graduate_commit_csn: removing 0xf610488 20090424133119Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username2,dc=example,dc=com (0) -- Thanks, Sean Burford

2 1

synrepl delete over 90% of ldap entries
by Monika Strack 24 Apr '09

24 Apr '09

Hallo all, in this week, the syncrepl in RefreshOnly mode has delete over 90% of the ldap entries at the consumer. It is the secont time in last month, it make this mistake. The other time it work ok. After I have remove the database and slapd restart, all entries are back. The consumer is my mailserver, so no user can receive mail in the time his entries are removed. I work with debian, at the consumer with lenny and slapd 2.4.11-1 and at the Provider with entch and slapd 2.3.30-5+etch2 . I use gosa 2.5.16 to adminstrate ldap. Here are the log entries of the consumer: Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064823Z#000003#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae7069c0 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72dc78 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete uid=nutzera,ou=people,ou=arbgrp,ou=abt,ou=my,o=domain,c=de (0) : : slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 33fdb48e-c28c-102d-9d8a-c5d1aca5fa09 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=tz,o=fal,c=de Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_add (0) Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064845Z#000000#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae715640 20090421064845Z#000000#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae702e40 20090421064845Z#000000#00#000000 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 8b82805e-0867-102b-8021-e9137c6ded0b Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=mygrp,ou=groups,ou=my,o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_modify (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421065817Z#000003#00#000000,rid=101 Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5d17de-0867-102b-9fad-e9137c6ded0b, dn c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5e5f86-0867-102b-9fb0-e9137c6ded0b, dn o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5ed024-0867-102b-9fb2-e9137c6ded0b, dn ou=my,o=domain,c=de : (90% of ldapr entries) pr 21 08:58:45 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72cf50 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=my,o=domain,c=de (0) : (90% of entries) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete ou=my,o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete c=de (66) Apr 21 08:58:46 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:46 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xb4d03ff0 20090421065817Z#000003#00#000000 I now, that the logs no show errors, but why can the consumer say no entry found and delete. My colleague has delete 3 user, this change was made right and the al the other entriies are delete. How can I prevent this in the future? The configurations: Provider: slapd 2.3.30-5+etch2 Config: .... moduleload back_bdb moduleload syncprov : : # Fuer syncreply index entryCSN,entryUUID eq : overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: slapd 2.4.11-1 (lenny) Config: ..... index entryCSN,entryUUID eq : : syncrepl rid=101 provider=ldaps://ldap.my.local:636 type=refreshOnly searchbase="c=de" retry="60 10 300 3 600 +" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,ou=my,o=domai,c=de" credentials=ReSumpti0n regards Monika -- ________________________________________________________________________________ Monika Strack Institut fuer Nutztiergenetik Friedrich-Loeffler-Institut 31535 Neustadt e-mail: monika.strack(a)fli.bund.de Germany Tel: +49 5034 /871 154 Fax: +49 5034 /871 239 _______________________________________________________________________________

2 1

invalid credential
by owen nirvana 24 Apr '09

24 Apr '09

debian lenny openldap-2.4.11 , "rootpw 123456 " in /etc/ldap/slapd.conf I try to search in Apache Directory Studio, perl , java, but in term , I input "ldapsearch -D "cn=admin.dc=xxx,dc=org" -b "dc=xxx,dc=org" "(objectClass=*)" -W echo: >> Digest/SASL MD5 start invalid credential I am not user md5 password, and it's not right even if I use md5 password. I don't know how to configure slapd.conf to solve the problem gtalk:freeespeech@gmail.com

3 2

how to paginate the dataset from ldap
by owen nirvana 24 Apr '09

24 Apr '09

I'm a newbie, sometime a query might get hundreds of data from the LDAP server, I could not find a way to display these data by paginating, thanks for help gtalk:freeespeech@gmail.com

3 2

ldapadd: Invalid syntax (21)
by François Mehault 24 Apr '09

24 Apr '09

Hi All I am a novice with openldap. I just install on a freeBSD 7.0 with ports. I configure slapd.conf as best as i can. I configure rc.conf, I test my slapd daemon with slapdtest and it's ok. I start slapd with /usr/local/etc/rc.d/slapd start. Well, I create a little .ldif file to test. And I add at my database with : ldapadd -x -D "cn=root,dc=toto,dc=fr" -W -f test.ldif And I have : Enter LDAP Password: adding new entry "dc=toto,dc=fr" ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax The content of my test.ldif : dn: dc=toto,dc=fr objectClass: dcObject objectClass: organizationUnitName ou: test dc: toto My slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #Radius include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema schemascheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel 4 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb #Basic ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=root,dc=toto,dc=fr" write by * none access to * by dn="cn=root,dc=toto,dc=fr" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=toto,dc=fr" rootdn "cn=root,dc=toto,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}ERk1pX08CCoUT2Hixj/kR9Zx8NpJmx+0 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data # Indices to maintain index objectClass eq Why I can't add my ldif ? If someone can help me, thanks If I put organisation instead of organisationalUnit in my ldif, it works ! (and o instead ou of course) Regards François

3 3

Re: Setting up LDAP server
by Santosh Balan 24 Apr '09

24 Apr '09

Hi, My Server is a RHEL 5.0 i386 Architecture and the Clients are RHEL5.0 WS or RHEL4 WS or Thin Client which has minimal installation of Linux. I need information how those schemas will look and what data will it have. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Thu, 23 Apr 2009 11:15:04 +0100 On Thu, Apr 23, 2009 at 02:41:58AM -0500, Santosh Balan wrote: > I am on the look out for free support and advise. I have implemented a > basic LDAP server such that it authenticates for my mail server. However > this time I have been given a project wherein my LDAP works as an > authentication server for user login as well as mails. Also it should > have policies while authentication viz. it should disable USB ports for > the user, it should set a background wallpaper and screensaver which > should start within 20 secs. of the PC's idle time. It should also if > possible mount automatically a partition which will be user dependent > rather that PC dependent. You do not say what operating system you are using. I think you need to start by looking at the mechanisms available on the target OS to implement these policies. This is much more of an OS issue than an LDAP one. For example, with most Linux distros you can use PAM and NSS modules to link authentication and authorisation to LDAP. Solaris has similar mechanisms, and the *BSD systems too (but they are not identical). I suspect that you will do better to ask about this in OS-specific groups or mailing lists. Controlling the wallpaper and screensaver will require configuration of the window system: Gnome, KDE and MSWindows all have ways to do this but they are different. It may be possible to link them to LDAP-hosted policies, but again you need to look at the mechanisms first. You cannot just setup some data in an LDAP server and expect it to magically control user desktops. Once you have identified some control mechanisms you will be able to look at the way they interact with LDAP. This may require new schema, which this group certainly is qualified to discuss. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Syncrepl connections failing
by John Kane 24 Apr '09

24 Apr '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

editing objects with back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

While trying to understand the whole process that makes back-sql work, the following quote was really useful: Pierangelo Masarati wrote on Fri, 4 Jun 2004 16:03:39 +0200 > I'm talking about 2.2.X (2.2.11 at present). > > - slapd uses the structuralObjectClass of the entry to look up the > objectClass mapping according to ldap_oc_mappings; > - it does some sanity checks (I'll discuss these later) > - it checks for the existence of the entry's parent > - it uses the ldap_oc_mappings create_proc to create the objectClass > entry in ldap_entries > - then, for each attribute, the corresponding values are inserted if > possible. I'll discuss later how to decide whether an add should succeed > or not if some (required?) attribute mapping is not available; now I > really have to go :) Q1: Is this process still correct and is there more documentation around this process? Q2: What is the process for editing or remove data? When I add an OU, the ldap_entry_objclasses shows the oc_name of the OU object to be 'top', while the ldap_entries table shows the oc_map_id to be that of organizationalUnit. When I now try to edit the name of this object, I get the following error, which I get as well on trying to edit any other object: Could not rename the entry / Could not perform ldap_modify operation. LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass. Any clue what that could be? Marcel

2 1

Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 23 Apr '09

23 Apr '09

hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 0

Comparable and replaceable fax numbers
by Sean Burford 23 Apr '09

23 Apr '09

Hi, On my servers I've redefined facsimileTelephoneNumber as a telephoneNumber: attributetype ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SUP telephoneNumber ) This requires reimporting the database since the normalisation changes, but it adds comparison rules to fax numbers (allowing comparison and replacement of them): Before: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== Compare Result: Inappropriate matching (18) Additional info: inappropriate matching request UNDEFINED After: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== TRUE Is there any reason to follow the RFC in this case? The RFC itself doesn't make a good argument for or against fax numbers having a separate syntax with no matching rules. -- Thanks, Sean Burford

4 7

entryCSN and back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

Am I correct in my understanding that 'entryCSN' is updated on every change to an object in order for the replication process to work properly? In a back-sql implementation, I do not see this attribute stored in the database but when requesting the internal attributes of objects i do get the 'entryCSN' back. however, the value changes every time I do the request. Can I assume correctly that 'entryCSN' is not being stored and is therefore of no real use when using back-sql and is only being shown to comply with the LDAP standards? Is it possible to store this attribute in the database by defining it and creating the SQL functions to update it? (same question for creatorsName, createTimestamp, modifiersName, modifyTimestamp, etc) -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

1 0

Re: Setting up LDAP server
by Santosh Balan 23 Apr '09

23 Apr '09

Hi Team, I am on the look out for free support and advise. I have implemented a basic LDAP server such that it authenticates for my mail server. However this time I have been given a project wherein my LDAP works as an authentication server for user login as well as mails. Also it should have policies while authentication viz. it should disable USB ports for the user, it should set a background wallpaper and screensaver which should start within 20 secs. of the PC's idle time. It should also if possible mount automatically a partition which will be user dependent rather that PC dependent. I hope your getting the picture for which i require your assistance. This is the first time I am working on such a setup. I would appreciate your valuable help and guidance in resolving and setting up an LDAP server as per requirement. Thanking you in advance for your guidance. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Wed, 22 Apr 2009 11:09:40 +0100 On Wed, Apr 22, 2009 at 03:05:56AM -0500, Santosh Balan wrote: > Can anyone help me on implementing and configuring LDAP server to > authenticate users with system policies and auto mount a user's partition > provided to him. Also, I want it to authenticate qmail users using LDAP. Are you looking for paid support? Several of us on this list are in the business of determining client requirements then designing and building solutions to fit, so I am sure you would get offers if you were to ask for that service. On the other hand, if you want free advice then I think you will have to do more of the basic research yourself so that you can ask more specific questions. There are lots of papers and guides on the web that will help to get you started. Here is a pointer to some of mine: http://www.skills-1st.co.uk/dir/ Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Adding OU with PSQL backend
by Marcel Berteler 23 Apr '09

23 Apr '09

For a project that requires a large user authentication database, we are currently using OpenLDAP with a BDB backend. We have about 150K users in the tree and all works well. Authentication and new user creation is fast and we are happy. But, when we try and get statistical data from the tree, we run into the limitations of LDAP: trying to find all user that have registered last month, using a filter with 2 dates, is just too slow. It takes minutes to come back with a result. To get around this limitation, we want to experiment with a PSQL backend so we can do some comparative testing. (If any of you have a way of allowing us to interrogate our BDB backend with SQL like queries that are relatively fast, than please let me know.) Our test environment: openldap 2.4.16 with Postgres backend I have loaded CORE in slapd.conf as well as our custom schema for our users The only ACL in the conf is ACCESS TO * BY * WRITE Our tree looks like this and I have loaded the data tables and meta-data tables: dc=example,dc=come ou=people,dc=example,dc=com cn=user1,dc=example,dc=com The setup is working about 60%. with openLdapAdmin, I can see the tree and I can add users. What I can not do, is add an OU. It gives me: LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. If I get this on our custom schema, I can explain this by not having the right meta-data and procedures loaded. But as this is part of the CORE schema, am I right in only adding the meta-data for OU in ldap_attr_mappings without add or delete procedures? I have looked at the log files and outputs but I can not figure out what is going wrong and why it is not accepting any new OU Any help is appreciated. -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

7 16

just curious
by Piotr Wadas 22 Apr '09

22 Apr '09

Hello, I've been trying past weeks upgrading my production openldap software. I started from 2.4.11 when it was available, through all available versions, up to 2.4.16. I tried package builds, and my own builds. Each version except 2.4.10 was likely to hang, as it's production, and load is quite high, I haven't too much patience to debug and researching what's actually going on, but I tried disabling syncrepl (no effect), some different settings for bdb backend and slapd thread, concurrency etc ( starting from settings which caused no problems with 2.4.10 ), and finally, got back to 2.4.10 which works fine. Between version change I noticed that 2.4.11+ is build with newer libdb versions (package depends), starting from libdb4.2 (2.4.10), up to libdb4.7 (newer openldap version). I didn't try to build 2.4.15+ with some old (4.2) libdb. Is it some major significant jump between 2.4.10 and all later versions? some general rewrite of some feature ? It's not syncrepl related, as daemon hang no matter whether configured as slave or standalone. The symptoms was, it was (in general) producing BIGGER server load than 2.4.10, and, although daemon process did not segfaults, server stopped responding for requests (?). With higher load I wasn't able to try logging and use of debug symbols. I expected it will work without any slapd.conf, anyway nor leaving it untouched, nor some minor reasonable changes had no effect. So, what's going on? :) Is it possibly related to libdb ? or what? What else could it be ? Except libdb ( 5 different versions available in my system with one default, usually newest ), there was no other software change, just upgrading openldap/libldap. Any clues you may have? I'm sorry I cannot provide more information, anyway config is rather standard and simple, some custom schemas added with indexing, that's all. 2.4.10 has no problems at all, and significantly lower general machine load. ( if 2.4.10 = 100%, 2.4.11+ makes 300-400% ) Actually I'm not expecting some miracle explanation, anyway it's interesting what could it be.. I have about 25 000 entries total in my directory tree, it's used as NSS source, and other information for various applications. regards :) P.

3 4

Porting mozldap to openldap
by Nguyen, Quang 22 Apr '09

22 Apr '09

Hi everybody, I have spend sometime to understand mozldap and openldap. I have searched the archives using these keyword "mozldap to openldap" or just "mozldap" but found nothing. I have to port an application currently using mozldap to openldap. Has anyone done this before, I would like to ask some questions such as: 1. I see that the application called ldapssl_advclientauth_init(), ldapssl_init() if using certificate and call prldap_init() if using simple authentication. The function ldapssl_advclientauth_init() is very big after I traced it down. Is there an equivalent call in openldap? 2. Is there any example posted somewhere that my search on google missed (I could not find any). 3. Is there anything I should be watching for? 4. What is the best approach to do this? I thank you very much for any help, suggestion I can get. Best regards

2 2

Setting up LDAP server
by Santosh Balan 22 Apr '09

22 Apr '09

Hi Friends, Can anyone help me on implementing and configuring LDAP server to authenticate users with system policies and auto mount a user's partition provided to him. Also, I want it to authenticate qmail users using LDAP. Your assistance is highly appreciable. Thanking you in advance. Thanks and Regards Santosh Balan 9819419509 -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

ldap SQL backend and syncrepl
by Frederic Bouy 22 Apr '09

22 Apr '09

Hello, For performance issues (millions or records) I have two ldap servers: - one master with an sql backend (postgres) to allow easy data manipulation - one slave to anwer ldap queries and provide good response time When lauching the slave ("./slapd -f /usr/local/openldap/etc/openldap/slapd-front.conf -h "ldap://localhost:3890" -d 1") I got a first non blocking error I don't really understand: " => bdb_dn2id("dc=lnp") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988)" According to the fact that the following command is successfull: "ldapwhoami -H "ldap://localhost:389" -D "cn=manager,dc=lnp" -w secret" and then the synchronization fails with this error: "read1msg: ld 0x9ca73e8 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_scanf fmt ({a) ber: ber_scanf fmt (o) ber: ber_scanf fmt ({em) ber: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD ldap_msgfree connection_get(11): got connid=0 ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 11 ldap_free_connection: actually freed do_syncrepl: rid=001 quitting" Do you know whether suncrepl is support for ldap with sql backend? Do you know where can I find some documentation on this? Do you have any clue on how I could solve my issues? Thanks in advance. Please find below the .conf of those two ldap servers: # === MASTER ===== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/lnp.schema pidfile /usr/local/openldap/var/slapd-lnp.pid argsfile /usr/local/openldap/var/slapd-lnp.args backend sql ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=lnp" rootdn "cn=Manager,dc=lnp" rootpw secret dbname lnp dbuser lnp dbpasswd lnp strcast_func "text" #subtree_cond "ldap.entries.dn like '%'||?" concat_pattern "?||?" has_ldapinfo_dn_ru no overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 lastmod on # === MASTER ===== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/lnp.schema pidfile /usr/local/openldap/var/run/slapd-front.pid argsfile /usr/local/openldap/var/run/slapd-front.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=lnp" rootdn "cn=Manager,dc=lnp" rootpw secret directory /usr/local/openldap/var/openldap-data # index entryCSN,entryUUID eq index entryUUID eq # filter="(objectClass=*)" syncrepl rid=001 provider=ldap://localhost:389 bindmethod=simple type=refreshAndPersist searchbase="ou=31,dc=lnp" schemachecking=off binddn="cn=manager,dc=lnp" credentials=secret filter="(objectClass=*)" mirrormode on serverID 1

4 7

Re: Directory migration
by Michael Ströder 22 Apr '09

22 Apr '09

Ian wrote: > On Tue, 21 Apr 2009 23:07:11 Michael Ströder wrote: >> Hmm, which password scheme is used? Are the userPassword values prefixed >> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems >> could be incompatible. So this could be another issue. The general >> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 >> (password scheme {SSHA}). > > Well FreeBSD is using MD5 for it's encryption and so is the linux workstation. This does not say much since there are also MD5-based password hashes in Unix crypt. > Is the LDAP server encrypting the hashes as well? No, the clear-text password is hashed depending on the password scheme together with a random salt. > They don't look like the > hashes in master.password What is master.password? > at all, so I guess it is? And that's one reason why > you need to use the PADL scripts when you import /etc/passwd into your LDAP > directory? If you import /etc/shadow or whereever your salted Unix password hashes are stored you would use the platform-specific password scheme {CRYPT}. > The password entry looks like this: > userPassword:: e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0= ^^ The double-colon indicates that the value is base64-encoded in the LDIF representation. $ python -c "print 'e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0='.decode('base64')" {md5}547qEjL5yQnfIp7aDAXd8w== So this is a plain MD5-hashed password. This password scheme is *not* platform-specific. Is this from your original data? Do all entries have password values like this? Check that. If yes, then you should not have a problem to migrate this data. > So I don't know what encoding it's using - is there a setting that controls > this? (nothing in slapd.conf that I can see). There are various relevant settings. But I wonder which component is used for setting the password and which mechanism it uses. You should also consult the fine articles in the FAQ-O-MATIC: http://www.openldap.org/faq/data/cache/419.html Ciao, Michael.

2 1

Re: Directory migration
by Michael Ströder 22 Apr '09

22 Apr '09

Ian wrote: > On Wed, 22 Apr 2009 00:04:47 Andrew Findlay wrote: >> On Tue, Apr 21, 2009 at 03:37:11PM +0200, Michael Ströder wrote: >>> Hmm, which password scheme is used? Are the userPassword values prefixed >>> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems >>> could be incompatible. So this could be another issue. The general >>> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 >>> (password scheme {SSHA}). >> You also need to make sure that the new server was built with support >> for your chosen hash scheme. If using crypt passwords, this means >> adding the --enable-crypt flag to the initial 'configure' command. > > Maybe that's where the problem lies. From what Michael said in his reply, the > passwords are plain MD5 hashes. Perhaps I've build the new one with crypt > support and it's trying to use that instead of straight MD5? The password scheme {MD5} does not need --enable-crypt! >> As Michael says, it would make sense to use 2.4.16 for your >> new installation. > > And I shall, but maybe now it's best to get 2.3.x working first, then go to > the new version. You might have to migrate your database. So there's really no reason to not directly use 2.4.16. Ciao, Michael.

1 0

Re: Directory migration
by Ian Moore 22 Apr '09

22 Apr '09

On Wed, 22 Apr 2009 00:13:51 Michael Ströder wrote: > Ian wrote: > > On Tue, 21 Apr 2009 23:07:11 Michael Ströder wrote: > >> Hmm, which password scheme is used? Are the userPassword values prefixed > >> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems > >> could be incompatible. So this could be another issue. The general > >> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 > >> (password scheme {SSHA}). > > > > Well FreeBSD is using MD5 for it's encryption and so is the linux > > workstation. > > This does not say much since there are also MD5-based password hashes in > Unix crypt. > > > Is the LDAP server encrypting the hashes as well? > > No, the clear-text password is hashed depending on the password scheme > together with a random salt. > > > They don't look like the > > hashes in master.password > > What is master.password? :-) FBSD equivalent of /etc/shadow > > at all, so I guess it is? And that's one reason why > > you need to use the PADL scripts when you import /etc/passwd into your > > LDAP directory? > > If you import /etc/shadow or whereever your salted Unix password hashes > are stored you would use the platform-specific password scheme {CRYPT}. > > > The password entry looks like this: > > userPassword:: e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0= > > ^^ > The double-colon indicates that the value is base64-encoded in the LDIF > representation. > > $ python -c "print > 'e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0='.decode('base64')" > {md5}547qEjL5yQnfIp7aDAXd8w== > > So this is a plain MD5-hashed password. This password scheme is *not* > platform-specific. So I guess that's why it works logging in from a linux workstation, even though the passwords originally were imported from the FBSD master.passwd file and also works with squid running on the FBSD server. > Is this from your original data? Yes, taken from the original server's LDAP database. > Do all entries have password values like this? Check that. Yes, they do! > If yes, then you should not have a problem to migrate this data. Yet sadly I do have a problem :-/ I have used ldapsearch to confirm that the password hashes are the same on the old & new servers when I use ldapsearch or slapcat to view them. Yet I can't login on the new server. And since the hashes are salted, I can't tell if the actual password is really different. > > > So I don't know what encoding it's using - is there a setting that > > controls this? (nothing in slapd.conf that I can see). > > There are various relevant settings. But I wonder which component is > used for setting the password and which mechanism it uses. > > You should also consult the fine articles in the FAQ-O-MATIC: > > http://www.openldap.org/faq/data/cache/419.html I'll give that a read tonight and do some more testing. Cheers, -- Ian gpg key: http://home.swiftdsl.com.au/~imoore/no-spam.asc

1 0

Re: Master server error
by Gavin Henry 21 Apr '09

21 Apr '09

----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > Hi, > > Just wondering why the master server is trying to contact the slave > when > I use any of the smbldap tools? I would get the message below. > > erreur LDAP: Can't contact slave ldap server (IO::Socket::INET: > connect: > timeout) > =>trying to contact the master server > > It would then contact the master server and give me the result. > Instead > of pulling the information faster, it will take a few minutes. It is > > not a big deal, as things are working fine but I just want to know if > > there's a way to get rid of the error. Please advise. > This is actually to do with the smbldap tools, not OpenLDAP. Check the config file for the master/slave settings and the Perl code too. The master isn't trying to contact the slave at ;-) Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 1

Master server error
by Ivan Ordonez 21 Apr '09

21 Apr '09

Hi, Just wondering why the master server is trying to contact the slave when I use any of the smbldap tools? I would get the message below. erreur LDAP: Can't contact slave ldap server (IO::Socket::INET: connect: timeout) =>trying to contact the master server It would then contact the master server and give me the result. Instead of pulling the information faster, it will take a few minutes. It is not a big deal, as things are working fine but I just want to know if there's a way to get rid of the error. Please advise. Thanks, -Ivan

1 0

Directory migration
by Ian Moore 21 Apr '09

21 Apr '09

Hi, I'm trying to migrate my directory from one server to another (I'm building a replacement server and want to test everything before changing over). The old server is FreeBSD 5 with openldap-server-2.3.39 The new one is FreeBSD 7.1 with openldap-server-2.3.43 I thought I would be able to use ldapsearch to dump the contents of the old server to an ldif file and then import it into the new one using ldapadd. That seemed to work, but when I tried to login on a workstation which is configured to use ldap authentication (and works fine when attached to the old server), my login fails. If I change my password to what it's supposed to be and then try to login, it works. So it appears that the passwords for user objects are not being transferred correctly from the old system to the new (all the other information seems correct). I'm using md5 passwords on both systems (the freebsd default) and I've checked that the new server & the workstation are set to use md5. I also tried using slapcat to create the ldif file, but that made no difference. If I look at the encrypted password before and after resetting it, the password hashes are different, even though they are supposedly the same password. I've tried this several times and can't get it to work. Do I need to do something else to transfer passwords correctly from one server to another? -- Ian gpg key: http://home.swiftdsl.com.au/~imoore/no-spam.asc

3 2

Need help on pwdCheckQuality
by Dat Duong 20 Apr '09

20 Apr '09

Hi, I need to enforce the password quality check. I've set all the the requirement on the slapd.conf created default policies profile. Unfortunately, the pwdMinLength and pwdCheckQuality are not working. I also try to compile the cracklib with check_password.c and the Makefile. The instruction was not very clear. Does anyone have a procedure to install the check_password.so module? Please help me with this. See my below setting. I omitted all the other parts from slapd.conf.. slapd.conf file: ..... ..... include /usr/local/etc/openldap/schema/ppolicy.schema ..... overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout ..... # default, policies, arc.nasa.gov dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top objectClass: pwdPolicyChecker pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdExpireWarning: 180 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 24 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxAge: 15768000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 12 pwdMustChange: TRUE pwdSafeModify: FALSE sn: default policy pwdCheckModule: check_password.so pwdCheckQuality: 2 THANKS!!!

1 0

TLS vs. MirrorMode replication
by Maros Timko 20 Apr '09

20 Apr '09

Hi all, we use OpenLDAP 2.4.11 on CentOS 5 for OS user PAM authentication in Xen-based HA cluster of 2 nodes. We are using MirrorMode replication so that databases are synchronised if change occurs on any node and there is no issue if one node goes down - each node maintains its own database. We use non-TLS local LDAP access (127.0.0.1) on Dom0 and TLS from virtual machines to LDAP. As soon as LDAP replication is set up in non-TLS way, everything works fine. But we are trying to set up TLS also for replication to bring more security into the system. However, it seems like there is a principial issue here - one cannot specify client access config for local access and for remote replication at the same time. Or can we? If we define client config to use TLS for the peer, then each local request goes to peer node. If the peer is down, the request will fail and user cannot log in into the OS. It looks like syncrepl requires client configuration to the peer. We tried to use "start_tls" option in syncrepl section but we still fail to connect to peer node. From the replies on the list I assume, TLS options in syncrepl section are just supposed to overwrite default settings, not to specify explicit option for it. Questions: - Is it possible to use local LDAP database locally together with TLS-enabled replication in a cluster? - Is anybody running such or similar setup successfully? - What would you suggest, if it is not possible? Thanks

2 1

Integration
by A Gilmore 19 Apr '09

19 Apr '09

Hello, I have a technical hurdle to overcome and I'm hoping openldap is the answer. I have contacts in a sql db, I'm wanting to make them available in outlook, blackberries, and other clients such as thunderbird. What I'm currently thinking is to setup an openldap server and import the data into that. I'm not expecting much trouble getting the data into LDAP. But how much effort/time is normally involved in the actual implementation of hooking these devices/applications to an openldap directory so non-technical users can use it? If anyone else has done this, how did it go? Has it been 'quirky'? I've read over the FAQ and what google offers, it seems mostly dealing with overcoming specific technical issues, I haven't found much on how well it works overall. Thank you for your time, - Adrien

2 2

Compile module for pwdCheckQuality
by Dat Duong 19 Apr '09

19 Apr '09

Does anyone have good luck on compiling a module like check_password.so for pwdCheckQuality? Also, what are the configuration for check_password.conf ? I'm having a harding time compiling the cracklib using check_password Makefile. Anyone have for the Makefile? What is the -lcrack ? # Comment out this line if you do NOT want to use the cracklib. # You may have to add an -Ldirectory if the libcrak is not in a standard # location # CRACKLIB_LIB=-lcrack

1 0

Context CSN not updated on OpenLDAP 2.3.11
by Adrien Futschik 17 Apr '09

17 Apr '09

Hy everyone ! I am facing a major issued for the second time with OpenLDAP 2.3.11. I am aware it is a pretty old version of OpenLDAP, but, it has been working in production for almost a year now without any problem. Here is the setup : Master -> Slave For some strange reason, the contextCSN stops updating and therefore the Slave is not updated anymore. The strange thing is that the Master continues to successfully update/add data ! We are using a OpenLDAP 2.3.11, Berkeley DB 4.4.16 & OpenSSL 0.9.8a all running on Solaris 10. Restarting the master solved the problem once, but now that it as failed again, I am very woried, because, restarting isn't a solution, considering that the application is in production. Please see in attachement the configuration files for Master & Slave. I have no log on the master, and only "syncrepl logging" on the slave. We consider restarting the master with "enable all logging" to see if wee can grab some informations.... Is this a bug of OpenLDAP, BerkleyDB or something else ? Thanks in advance, Adrien Futschik

4 11

lda_msgfree causing aborting program
by Santosh Kumar 16 Apr '09

16 Apr '09

Hi everyone,Using ldap_msgfree() needs after ldap_result() , as per man page it is to be used, is resulting in abort , but using the same after search result is working fineldap_init(ldap_host, LDAP_PORT))ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version)id = ldap_simple_bind(ld, root_dn, root_pw) //  ldap_perror(ld, "ldap_set_option");  printf("My ID=%d\n",id);result = ldap_result(ld, id, 1, NULL, &msg);    printf("Ldap_Result=%d\n",result);result = ldap_result2error(ld, msg,  1);    printf("Ldap_Result2error=%d\n",result); ldap_msgfree(msg);Output:ldap_bind: Success (0)My ID=1Ldap_Result=97Ldap_Result2error=0ldap_search_async: io.c:190: ber_free_buf: Assertion `((ber)->ber_opts.lbo_valid==0x2)' failed.Is there a way to get around while seeing the fucnction implemeted  ldap_msgfree() is calling ber_free_element() , which checks BerElement is it valid .in the above program it goes to invalid  this causing program to abort , does removing this check causes problem , i'm not aware about the importance of the check. ThanksSantosh Kumar9881481468

1 0

Fax can't have equality index?
by Min 16 Apr '09

16 Apr '09

Hello, I have the fax in my sldap.conf as the following: index facsimileTelephoneNumber eq,pres,sub index telephoneNumber eq,pres,sub But slaptest will report error as: equality index of attribute "facsimileTelephoneNumber" disallowed slaptest: bad configuration file! Any help will be appreciated. Thanks,

2 1

problem with a lot of databases in openldap 2.3
by Patrick Kaufmann 15 Apr '09

15 Apr '09

Patrick Kaufmann schrieb am 06.04.2009 14:13 Hi, We experience some serious problems with our openldap. We got about 50 databases in our openldap. If I now request single databases everything works fine until I request the 30st database. >From there on every database which I haven't already requested will just return an internal error. After some further investigation I finally figured out that the bdb backend somehow has some problems. If I start the sldap with d -1 I get following error: bdb_locker_id: Not enough space(12) We use openLDAP 2.3 together with DBD 4.2.52 Whole error message: daemon: activity on 1 descriptor daemon: activity on: 4052r daemon: read activity on 4052 daemon: select: listen=1912 active_threads=0 tvp=NULL connection_get(4052) connection_get(4052): got connid=0 connection_read(4052): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 35 02 01 6e 63 30 04 05..nc0. ldap_read: want=47, got=47 0000: 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 2e 63 68 .o=test.domain 0010: 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e 01 01 00 ................ 0020: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. ber_get_next: tag 0x30 len 53 contents: ber_dump: buf=086F29D8 ptr=086F29D8 end=086F2A0D len=53 0000: 02 01 6e 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 ..nc0..o=test.ma 0010: 69 6c 34 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 il4.ch.......... 0020: 02 01 1e 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c ........objectcl 0030: 61 73 73 30 00 ass0. ber_get_next ldap_read: want=8 error=Unknown error daemon: activity on 1 descriptor daemon: waked daemon: select: listen=1912 active_threads=0 tvp=NULL do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=086F29D8 ptr=086F29DB end=086F2A0D len=50 0000: 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 c0..o=test.mail4 0010: 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e .ch............. 0020: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0030: 30 00 0. >>> dnPrettyNormal: <o=test.domain> => ldap_bv2dn(o=test.domain,0) <= ldap_bv2dn(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 <<< dnPrettyNormal: <o=test.domain>, <o=test.domain> SRCH "o=test.domain" 0 0 1000 30 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=086F29D8 ptr=086F29FE end=086F2A0D len=15 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=086F29D8 ptr=086F2A0B end=086F2A0D len=2 0000: 00 00 .. attrs: conn=0 op=109 SRCH base="o=test.domain" scope=0 deref=0 filter="(objectClass=*)" ==> limits_get: conn=0 op=109 dn="[anonymous]" => bdb_search bdb_locker_id: err Not enough space(12) send_ldap_result: conn=0 op=109 p=3 send_ldap_result: err=80 matched="" text="internal error" send_ldap_response: msgid=110 tag=101 err=80 ber_flush: 28 bytes to sd 4052 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error ldap_write: want=28, written=28 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error conn=0 op=109 SEARCH RESULT tag=101 err=80 nentries=0 text=internal error Any help is appreciated. Thanks Patrick Patrick Kaufmann Softwareentwicklung Hauptsitz: Hardstrasse 72 CH - 5430 Wettingen Tel. +41 56 437 80 40 Fax + 41 56 437 80 59 pkaufmann(a)zubler.ch<mailto:pkaufmann@zubler.ch> www.zubler.ch<http://www.zubler.ch> [cid:aussenstelle.jpg]

3 10

OpenLDAP and "reverse" wildcards
by Kjell Gustafsson 15 Apr '09

15 Apr '09

Hi I have a somewhat strange question. We are using OpenLDAP (openldap-server-2.4.11-bdb) and Berkley DB (db-4.6.21) in a project. LDAP is used to store subscribernumbers and the address of the ippbx where the subscriber is registered. Typically every subscriber have a separate DN in the LDAP-database. We have a serverfunction that do ldap-searches for subscribernumbers to retrieve the ippbx-address. This part is going to remain working as is. Now we want to be able to have a "wildcard"-entry in LDAP, that points to an address also. This entry shall respond to any ldap-search matching the wildcard. Let me give an example: We have, let's say four ippbx's with prefixes 111, 222, 333 & 444. A subscriber- number consist of the prefix and five more digits. Each subscriber can be registered in any ippbx and still be reachable. The prefix indicates the subscribers "home-location". Now we want to use a gateway to another telephone-system. We don't want to have all of the subscribers from that system registered in LDAP, so we want a "wildcard"-entry saying that if you dial 99912345 LDAP should have an entry 999xxxx pointing to the gateway for the subscribers in the other telephonesystem. The response to the ldap-search should contain the the gateway address to the telephone-system regardless of the number entered. So if I dial 99912345 I should get the same response as if I dial 99967890. The response shall have the same format as in the ippbx-solution. We want the ldap DIT to look the same for the wildcard and the others - the DN shall look the same. We don't want to change the serverfunction we are using today. So - finally my question: Would it be possible to solve this with OpenLDAP and if so - how can it be done? Looking forward to your suggestions! /Kjell

3 5

Re: search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Pierangelo Masarati 14 Apr '09

14 Apr '09

----- "Daniel" <deepee(a)gmx.net> wrote: > Hi slapd-Gurus out there, > > using the search filter "(test=TRUE)" results in: "candidates not > indexed". The cause for the below slapd trace output seems clear to > me: > In fact there is no entry in my bdb backend existing with an attribute > > description "test" present... > > => bdb_filter_candidates > EQUALITY > => bdb_equality_candidates (test) > <= bdb_equality_candidates: (test) not indexed > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=-1 first=1 last=430 > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=25 first=141 last=430 > <= bdb_filter_candidates: id=25 first=141 last=430 > bdb_search_candidates: id=25 first=141 last=430 > => test_filter > EQUALITY > => access_allowed: search access to "dc=foo,dc=bar" "test" requested > <= root access granted > => access_allowed: search access granted by manage(=mwrscxd) > <= test_filter 5 > bdb_search: 141 does not match filter > > > In regard to the above slapd-trace I've the following question: > Could someone please be so kind and tell me whether there exists a > possibility to search (filter) for "dynamic" (calculated) attribute > values, that do not get stored in a backend (in my case bdb)? Idea: An > > overlay should calculate a dynamic attribute's value based on already > > existing attribute values of an entry each time this dynamic attribute > > is searched for using a filter-statement, e.g. > '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. > > First of all I had a quick look into slapo-collect's sources. The > collective attributes seem to be added dynamically to an entry but the > > collected attributes are not "filterable". I think the reason is that > > slapo-collect operates on the response/slapreply and that's to late in > > the overlay's processing queue... > > Then I thought of something similar to the operational attribute > "hasSubordinates" - this attribute's value is filterable and seems (at > > least sounds) to be dynamically evaluated. On the other hand I'm not > sure whether "hasSuborinates" is dynamically calculated each time an > entry get's searched or accessed. Perhabs the value of > "hasSubordinates" > is only be calculated in case the entrys' childrens get modified and > (thus seldomly) updated within the backend, which could be the reason > to > be search- and filterable?! > > Last but not least I tried to implement a small test-overlay using a > custom search-callback that updates the dynamic "test" attribute > within > the bdb-backend: Imagine an (very simple/stupid) overlay that for > example set a custom attribute named "test" to "TRUE" in case an > entry's > attributes "givenName" and "sn" both contain at least one value. ;-) I > > know, that the filter "(&(givenName=*)(sn=*))" would do the trick but > > the example is just a simple scenario for me to step into > overlay-processing details. > > If I use attr_merge() within the search-callback to store the dynamic > > test attribute's value "TRUE" or "FALSE" within the entry the search > succeeds without problems - I mean the filter (test=TRUE) get's > processed ok. > > So my questions still left is: > Do I always have to store/update the dynamic attribute's calculation > result value within each entry (in the backend) or is there another > posibility that allows filtering for the calculated attribute's value, > > while getting rid of the store and update overhead within the > backend? > > Hopefully this is no hen egg problem concerning the internal > processing > order of filters, candidates, entries, etc. Using dynamically computed attrs in a search filter and pretending it to ber indexed is an oxymoron. If you intend to allow it, you need to be prepared to intercepting the search operation and doing the candidate collection yourself. I don't recall any overlay or so that does it and that could be used as an example, simply because it makes little sense. In any case, the problem can be solved, but the solution may not be trivial and require a fair amount of coding. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

2 2

Modifying password by user
by Franck Royer 14 Apr '09

14 Apr '09

Hi, I'm installing openldap on a ubuntu intrepid server (8.10). Everything is ok except when I want that a user is able to modify his own password using phpldapadmin (0x32 LDAP_INSUFFICIENT_ACCESS). So I tried to modify it using ldappasswd : dante@kollok ~ $ ldappasswd SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) or dante@kollok ~ $ ldappasswd -D "uid=dante,ou=people,dc=kollok,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) The posix user dante is the same user than the ldap one (I use pam libs). And I know that my password is right cause I can log in ldapadmin or ssh with it. My slapd.conf : http://pastebin.com/f44dd2b59 My ldap.conf : http://pastebin.com/f3af1bec3 Any idea ? Cheers, Franck Royer

4 4

group of groups
by alois blasbichler 14 Apr '09

14 Apr '09

Hello list Is there a possibility in openldap to make group of groups ? We need this fpr posix- and sambagroups. I dont find any predefined objectclasses or documentation. Somebody can give me a link or other help? Thank you luis

3 3

OpenLDAP groups and Unix users
by Stephen Parry 14 Apr '09

14 Apr '09

Thanks in advance for any answers to this query, and thanks to the geniuses who wrote and maintain OpenLDAP. I have OpenLDAP running on my Ubuntu Intrepid server. I have installed the various PAM and NSS bits and pieces to allow integrated authentication. I can now use users and groups stored in LDAP database to do shell logins, permission files and authenticate Apache secure connections (hooray!). It also is set up so that Unix user accounts and groups still function outside of LDAP as expected. However, there is one quirk to this. I can make LDAP users members of Unix groups and this works fine. I cannot however do the equivalent: make Unix users working members of LDAP groups. I can put them in the groups, but the the system command "id -nG" does not list the LDAP groups and the filesystem fails to pick up the permissions. Is this behaviour by design? Can the relevant modules be configured to allow LDAP groups have Unix users as members?

2 1

Notify mechanism for changes on a specific directory?
by Bahadır Kandemir 13 Apr '09

13 Apr '09

Hello, I'm working on a remote management system that uses LDAP for storing policies. Clients pull policies from server periodically, but we sometimes need to push policies to clients instantly. Polling LDAP every five seconds is not an option, of course. Is there any auto notification mechanism for LDAP that notifies client about changes on a specific directory? I've searched archives but could not find anything. Thanks in advance, Bahadir Kandemir

3 2

search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Daniel 13 Apr '09

13 Apr '09

Hi slapd-Gurus out there, using the search filter "(test=TRUE)" results in: "candidates not indexed". The cause for the below slapd trace output seems clear to me: In fact there is no entry in my bdb backend existing with an attribute description "test" present... => bdb_filter_candidates EQUALITY => bdb_equality_candidates (test) <= bdb_equality_candidates: (test) not indexed <= bdb_filter_candidates: id=-1 first=1 last=430 <= bdb_list_candidates: id=-1 first=1 last=430 <= bdb_filter_candidates: id=-1 first=1 last=430 <= bdb_list_candidates: id=25 first=141 last=430 <= bdb_filter_candidates: id=25 first=141 last=430 bdb_search_candidates: id=25 first=141 last=430 => test_filter EQUALITY => access_allowed: search access to "dc=foo,dc=bar" "test" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 5 bdb_search: 141 does not match filter In regard to the above slapd-trace I've the following question: Could someone please be so kind and tell me whether there exists a possibility to search (filter) for "dynamic" (calculated) attribute values, that do not get stored in a backend (in my case bdb)? Idea: An overlay should calculate a dynamic attribute's value based on already existing attribute values of an entry each time this dynamic attribute is searched for using a filter-statement, e.g. '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. First of all I had a quick look into slapo-collect's sources. The collective attributes seem to be added dynamically to an entry but the collected attributes are not "filterable". I think the reason is that slapo-collect operates on the response/slapreply and that's to late in the overlay's processing queue... Then I thought of something similar to the operational attribute "hasSubordinates" - this attribute's value is filterable and seems (at least sounds) to be dynamically evaluated. On the other hand I'm not sure whether "hasSuborinates" is dynamically calculated each time an entry get's searched or accessed. Perhabs the value of "hasSubordinates" is only be calculated in case the entrys' childrens get modified and (thus seldomly) updated within the backend, which could be the reason to be search- and filterable?! Last but not least I tried to implement a small test-overlay using a custom search-callback that updates the dynamic "test" attribute within the bdb-backend: Imagine an (very simple/stupid) overlay that for example set a custom attribute named "test" to "TRUE" in case an entry's attributes "givenName" and "sn" both contain at least one value. ;-) I know, that the filter "(&(givenName=*)(sn=*))" would do the trick but the example is just a simple scenario for me to step into overlay-processing details. If I use attr_merge() within the search-callback to store the dynamic test attribute's value "TRUE" or "FALSE" within the entry the search succeeds without problems - I mean the filter (test=TRUE) get's processed ok. So my questions still left is: Do I always have to store/update the dynamic attribute's calculation result value within each entry (in the backend) or is there another posibility that allows filtering for the calculated attribute's value, while getting rid of the store and update overhead within the backend? Hopefully this is no hen egg problem concerning the internal processing order of filters, candidates, entries, etc. Many thanks for your advice! Kind regards Daniel

1 0

./scripts/test021-certificate failed
by hariharan＠thehindu.co.in 11 Apr '09

11 Apr '09

2 1

Authentication issue into a ubuntu client: `finger` and `id` commands working but no `su`
by carolina fernandez 10 Apr '09

10 Apr '09

Hello, I'm trying to configure a Ubuntu 8.10 client to authenticate againts a openldap directory. The client configuration (PAM, NSS and /etc/ldap.conf) is here: http://pastebin.com/mc279767 I performed some test getting the following results: `ldapsearch -xLLL`, `id $USER`, `finger $USER` Those three commands work fine. See the ouput here: http://pastebin.com/d43add436 `su $USER` Prompts twice for a password and then fails. See the output with a debug level 1: http://pastebin.com/m390ab435 My main question is: Line 12 from `su $USER` output says: "ldap_connect_to_host: TCP localhost:389" It seems like it were trying to connect to the localhost but I specified "host 192.168.0.10" and "uri ldap://192.168.0.10/" at the /etc/ldap.conf file. Maybe I need to specify a bind domain name but if I'm not wrong the query will be permormed as anonymous and I have the followings credentials at the server /etc/ldap/slapd.conf: access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=carolina,dc=es" write by anonymous auth by self write by * none access to * by dn="cn=admin,dc=carolina,dc=es" write by * read Any idea to solve this? Any one can enlight me? Thank you in advance, Carolina F. Bravo

1 0

pam_ldap: error trying to bind (Server is unwilling to perform)
by Hammad Ahmad Bhatti 10 Apr '09

10 Apr '09

I am trying to ssh my ldap client linux box using ldap user. When I try to login from local root user and su to ldap user then it works and if I try to directly ssh using ldap user then it does not works. Can some one help me out. Hammad Ahmad

2 1

Matthew GARRETT is out of the office.
by Matthew GARRETT 09 Apr '09

09 Apr '09

I will be out of the office starting 08/04/2009 and will not return until 21/04/2009. I will respond to your message when I return. For IT issues please see Drew Harvey Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

1 0

Expiration accounts and indexes ?
by Jordi Espasa Clofent 09 Apr '09

09 Apr '09

Hi folks, Yesterday I see a lot of "Apr 6 16:08:20 xen-ldap01 slapd[1167]: <= bdb_equality_candidates: (objectClass) not indexed" in my OpenLDAP provider server log. After searching in docs (http://www.openldap.org/faq/data/cache/42.html), I applied index objectClass eq instead of previous #index objectClass eq and restart the service. The suprise has been when a few users cannot login in system through LDAP validation this morning. The errors in log (in client logs) was: [...] Apr 9 09:11:13 hc23 sshd[44389]: pam_ldap: error trying to bind as user "uid=ivan,ou=SAT,ou=Tecnic,dc=my_company,dc=com" (Invalid credentials) Apr 9 09:11:13 hc23 sshd[44387]: error: PAM: authentication error for illegal user ivan from XXX.XXX.XXX.XXX [...] The solution has been easy: comment the "index objectClass eq" parameter again in slapd conf file. ¿Why it happens? I wonder it. Maybe some cache-related issue... -- Thanks, Jordi Espasa Clofent

3 2

Ldap authentication
by Hammad Ahmad Bhatti 08 Apr '09

08 Apr '09

Hello, I have configured openldap for SSO. Now I am authenticating all of my linux boxes with this SSO. Now I have requirement that my root user should not authenticate through this SSO. Rest of all users should authenticate through this. Can any one have any suggestion for this. Thannn Koooo Hammad Ahmad

3 3

LDAP for MySQL Cluster
by Howard Chu 08 Apr '09

08 Apr '09

I will be co-presenting a talk at the MySQL Conference on Thursday April 23 in Santa Clara, California on the back-ndb backend in OpenLDAP. Johan Andersson from Sun/MySQL will also be presenting; Symas and MySQL worked together to design the data model for this backend. http://en.oreilly.com/mysql2009/public/schedule/detail/6219 back-ndb is a new OpenLDAP slapd backend that provides direct access to MySQL's NDB Cluster engine. The NDB Cluster design allows concurrent access to relational tables from multiple access methods (including mysqld for traditional SQL access, and slapd for LDAP access) and allows capacity to scale horizontally across multiple data nodes. The OpenLDAP backend uses the native NDBAPI to achieve high speed access without any SQL translation overhead. Multiple slapd servers can operate concurrently on an NDB database, along with other mysqld servers and other agents, allowing performance to be augmented linearly simply by adding more nodes to a cluster. This will be slightly more in-depth than the back-ndb talk I presented at the UKUUG conference in March. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Migrating users, groups and machines from Win NT 4.0 PDC to openldap+samba
by Norberto Bensa 07 Apr '09

07 Apr '09

On Tue, Apr 7, 2009 at 5:51 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, April 07, 2009 11:31 AM -0300 Norberto Bensa > <nbensa(a)gmail.com> wrote: >> This is OT to this list, but "net rpc vampire" will do what you want. >> Consult the samba docs/mailing list. > > I don't see why this is off topic. The -technical list is about > interoperability of OpenLDAP with other applications. Thanks. I thought this list was openldap-only questions. Regards, Norberto

1 0

Migrating users, groups and machines from Win NT 4.0 PDC to openldap+samba
by Nathaniel Simch de Morais 07 Apr '09

07 Apr '09

Hi, does anyone know how can i export users, groups and machines from a WinNT 4.0 PDC and put this informations in my OpenLDAP+SAMBA(PDC)? -- --------------------------------------------------- Nathaniel Simch de Morais skype: nathanielmorais --------------------------------------------------- °v° "Você acha que é livre se o | /(_)\ Software que você usa | ^ ^ nao é?" | --------------------------------------------------- Eu uso BrOffice.org!!! Eu uso Mozilla Firefox!!!

3 2

unable to get openldap to bind to active directory
by Kyle Pike 07 Apr '09

07 Apr '09

[kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1

1 0

back-ndb vs back-sql for exposing one MySQL db?
by Gavin Henry 07 Apr '09

07 Apr '09

Hi All, Here's a quick question, if you need to expose one MySQL db as LDAP for example, using the existing db that has customer records in it and a 3rd party application can look up via LDAP, do you use bog standard back-sql or back-ndb just use one db, as it looks easier to setup? Going by Howards talk at UKUUG 2009: http://www.ukuug.org/events/spring2009/programme/openldap-mysql.shtml -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 1

How to Secure openLdap nss_ldap
by Matthew.GARRETT＠external.total.com 07 Apr '09

07 Apr '09

Folks Note sure if this is the right list ? I have a new OpenLdap (version 2.3) Server that uses Kerberos for Password Authentication, which is going to be a Replacement for NIS (YP) All Normal access works fine and users can login , access automount maps etc However there are 2 types of Ldap binding Simple TLS At the moment any body can run the following ldapsearch -x I would like to try and disable Simple Binding But if I select "disallow bind_anon" in slapd.conf file Things start to break like authentication stops working. /var/log/messages Apr 1 15:42:15 apricot sudo[31515]: pam_ldap: error trying to bind (Inappropriate authentication) Apr 1 15:42:18 apricot sudo[31515]: pam_ldap: error trying to bind (Inappropriate authentication) Apr 1 15:42:25 apricot sudo[31515]: pam_ldap: ldap_result Can't contact LDAP server How do I get a Machine to authenticate to Ldap ? I think the problem lies with nss_ldap ? When I add the following line to /etc/ldap.conf ssl start_tls I start to get the following error's Apr 2 14:09:11 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Apr 2 14:09:15 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Apr 2 14:09:18 bruce nscd: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Apr 2 14:27:06 bruce sshd: pam_ldap: ldap_starttls_s: Operations error Apr 2 14:27:06 bruce sshd(pam_unix)[11233]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=apricot.uk.ad.ep.corp.local user=mgarrett Apr 2 14:27:06 bruce sshd[11233]: pam_krb5[11233]: authentication succeeds for'mgarrett' (mgarrett(a)UK.AD.EP.CORP.LOCAL) /etc/ldap.conf base dc=unix,dc=total bind_timelimit 120 idle_timelimit 3600 ldap_version 3 pam_password md5 scope sub ssl start_tls timelimit 120 tls_cacertdir /etc/openldap/cacerts tls_checkpeer no Can any body point me in the right direction Thanks Matthew Server is RedHat 5.3 Clients are RedHat 4.7 Copy of slapd.conf pwcheck_method: saslauthd mech_list: gssapi sizelimit unlimited include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/krb5-kdc.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapd.pem TLSCertificateKeyFile /etc/openldap/slapd.key ## security - other directives ## prevents anonymous access to ## any connection #disallow bind_anon ## forces a bind operation before DIT access #require bind ## Use of reads on ldaps only port forces use ## of TLS/SSL but not a minimum value ## this directive forces a minimum value #security simple_bind=128 sasl-secprops noanonymous,noplain,noactive # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=unix,dc=total # This should be a ^ plus, not a star, but slapd won't accept it # Default read access for everything else except anonymous users who have no access but does not work. ! access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read #by anonymous none Matthew Garrett Senior IS Technical Analyst Tel: 01224 297889 Fax: 01224 296806 Email: Matthew.Garrett(a)total.com Total E&P UK, Crawpeel Road, Altens Industrial Estate, Aberdeen AB12 3FG Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

2 3

sasl use ip as digest-uri
by Zhen Li 07 Apr '09

07 Apr '09

Hi, I'm trying to do sasl authentication against an active directory server. In the second sasl bind request sent to AD, the ip address of the AD server is used as the digest-uri. e.g. "ldap/192.168.1.1". Isn't it supposed to use domain name like "ldap/svr.example.com"? I used "ldapsearch -Y DIGEST-MD5". And in ldap.conf, "uri" and "host" are given in domain names. Any help will be appreciated. liz _________________________________________________________________ View your Twitter and Flickr updates from one place – Learn more! http://clk.atdmt.com/UKM/go/137984870/direct/01/

1 0

LDAP presentation PDFs are available
by Gavin Henry 07 Apr '09

07 Apr '09

OpenLDAP Replication Strategies - http://www.ukuug.org/events/spring2009/programme/openldap-replication.shtml OpenLDAP and MySQL: Bridging the Data Model Divide - http://www.ukuug.org/events/spring2009/programme/openldap-mysql.shtml Writing Access Control Policies for LDAP - http://www.ukuug.org/events/spring2009/programme/ldap-access-control.shtml -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Question on how to setup OpenLDAP according to RFC2307
by Bryan Boone 06 Apr '09

06 Apr '09

Hi everyone, I am a noobie on LDAP. Here is my problem. I have a tape library that has a web UI that is able to authenticate with and LDAP server. I downloaded and installed OpenLDAP. I have also created some test accounts on the LDAP to make sure it is working properly, and it is. The library documentation says that it is only able to authenticate with LDAP that complys with RFC2307. I read the RFC document and I see that OpenLDAP is already RFC2307 compliant. But I still cannot authenticate the library web UI. So my question is... Is there a structure that the LDAP server should follow in order to comply with RFC2307? For instance, do I need users under certain groups? I used a posixAccount and a posixGroup. Is this correct? Here is my LDIF below. Do I have this setup correct? thanks dn: dc=ibm,dc=com objectClass: dcObject objectClass: organization o: IBM dc: ibm dn: cn=employees,dc=ibm,dc=com objectClass: posixGroup cn: employees gidNumber: 253 dn: cn=bryan,cn=employees,dc=ibm,dc=com cn: bryan uid: bbryan uidNumber: 1 gidNumber: 10 homeDirectory: /home/bryan objectClass: account objectClass: posixAccount userPassword: {crypt}ecVLdK/k7KQMg dn: cn=kenny,cn=employees,dc=ibm,dc=com cn: kenny uid: qkenny uidNumber: 5 gidNumber: 11 homeDirectory: /home/kenny objectClass: account objectClass: posixAccount userPassword: {CRYPT}RuY5yfDjlajGo dn: cn=groups,dc=ibm,dc=com objectClass: posixGroup cn: groups gidNumber: 250 dn: cn=library_a,cn=groups,dc=ibm,dc=com cn: library_a gidNumber: 251 objectClass: posixGroup memberUid: qkenny dn: cn=administrators,cn=groups,dc=ibm,dc=com cn: administrators gidNumber: 252 objectClass: posixGroup memberUid: bbryan _________________________________________________________________ Rediscover Hotmail®: Get quick friend updates right in your inbox. http://windowslive.com/RediscoverHotmail?ocid=TXT_TAGLM_WL_HM_Rediscover_Up…

1 0

Re: openldap-technical Digest, Vol 17, Issue 4
by mario ramirez cervera 06 Apr '09

06 Apr '09

Hello as usuairo admnistador could have a read-only 2009/4/4 <openldap-technical-request(a)openldap.org> > Send openldap-technical mailing list submissions to > openldap-technical(a)openldap.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://www.openldap.org/lists/mm/listinfo/openldap-technical > or, via email, send a message with subject or body 'help' to > openldap-technical-request(a)openldap.org > > You can reach the person managing the list at > openldap-technical-owner(a)openldap.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of openldap-technical digest..." > > > Send openldap-technical mailing list submissions to > openldap-technical(a)openldap.org > When replying, please edit your Subject: header so it is more specific than > "Re: openldap-technical digest..." > > Today's Topics: > > 1. smbk5pwd for openldap 2.3 (Daniel Spannbauer) > 2. Unable to auth on replica (Marcio Merlone) > 3. How to Secure openLdap nss_ldap > (Matthew.GARRETT(a)external.total.com) > 4. TLS/Certificate Problem Openldap (Steffen Knauf) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 02 Apr 2009 12:02:17 +0200 > From: Daniel Spannbauer <ds(a)marco.de> > Subject: smbk5pwd for openldap 2.3 > To: openldap-technical(a)openldap.org > Message-ID: <49D48D29.5010809(a)marco.de> > Content-Type: text/plain; charset=ISO-8859-15; format=flowed > > Hello, > > I'm using the distro opensuse 10.2. > I'm missing the module smbk5pwd. > Can I build this module for openldap 2.3? > > Regards > > Daniel > > -- > Daniel Spannbauer Software Entwicklung > marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 > Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 > http://www.marco.de/ Email ds(a)marco.de > Gesch?ftsf?hrer Martin Reuter HRB 171775 Amtsgericht M?nchen > > > ------------------------------ > > Message: 2 > Date: Thu, 02 Apr 2009 09:10:32 -0300 > From: Marcio Merlone <marcio.merlone(a)a1.ind.br> > Subject: Unable to auth on replica > To: OpenLDAP <openldap-technical(a)openldap.org> > Message-ID: <49D4AB38.7070403(a)a1.ind.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, > > I have set two Ubuntu 8.04 servers running OpenLDAP > 2.4.9-0ubuntu0.8.04.2. I have set replication as per the docs. On the > slave, I start with an empty /var/lib/ldap, and when I start the replica > the dir is populated with the files, I am able to anon search, etc. > Great, except my clients are able to auth on the provider but not on the > replica. > > Both provider and consumer have the same acls, and the diff from one > conf to another is: > > --- slapd.conf 2009-04-02 09:04:42.000000000 -0300 > +++ slapd.conf.replica 2009-04-02 09:05:47.000000000 -0300 > @@ -60,19 +61,13 @@ > # 'database' directive occurs > database hdb > > -overlay syncprov > -syncprov-checkpoint 100 10 > -syncprov-sessionlog 100 > - > -# Let the replica DN have limitless searches > -limits dn.exact="cn=syncrepl,dc=a1,dc=ind" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > - > # The base of your directory in database #1 > suffix "dc=a1,dc=ind" > > # rootdn directive for specifying a superuser on the database. This is > needed > # for syncrepl. > -# rootdn "cn=admin,dc=a1,dc=ind" > +rootdn "cn=admin,dc=a1,dc=ind" > + > > # Where the database file are physically stored for database #1 > directory "/var/lib/ldap" > @@ -112,6 +108,21 @@ > # Where to store the replica logs for database #1 > # replogfile /var/lib/ldap/replog > > +syncrepl rid=3 > + provider=ldap://192.168.0.201:389 > + type=refreshAndPersist > + interval=01:00:00:00 > + searchbase="dc=a1,dc=ind" > + scope=sub > + schemachecking=off > + bindmethod=simple > + binddn="cn=syncrepl,dc=a1,dc=ind" > + credentials=xxxxx > + > + > +# updateref ldap://192.168.0.201:389 > + > + > # The userPassword by default can be changed > # by the entry owning it if they are authenticated. > # Others should not be able to see it, except the > > > Any idea on what could be wrong? Thanks in advance for any hint or help. > > > -- > Marcio Merlone > > > > ------------------------------ > > Message: 3 > Date: Thu, 2 Apr 2009 14:43:12 +0100 > From: Matthew.GARRETT(a)external.total.com > Subject: How to Secure openLdap nss_ldap > To: openldap-technical(a)openldap.org > Message-ID: > < > OF428EEFBC.05C17E8A-ON8025758C.004897FD-8025758C.004B5DD3(a)total.com> > Content-Type: text/plain; charset="utf-8" > > Folks > > Note sure if this is the right list ? > > I have a new OpenLdap (version 2.3) Server that uses Kerberos for Password > Authentication, which is going to be a Replacement for NIS (YP) > All Normal access works fine and users can login , access automount maps > etc > > However there are 2 types of Ldap binding > > Simple > TLS > > At the moment any body can run the following > ldapsearch -x > > I would like to try and disable Simple Binding > But if I select "disallow bind_anon" in slapd.conf file > Things start to break like authentication stops working. > /var/log/messages > > Apr 1 15:42:15 apricot sudo[31515]: pam_ldap: error trying to bind > (Inappropriate authentication) > Apr 1 15:42:18 apricot sudo[31515]: pam_ldap: error trying to bind > (Inappropriate authentication) > Apr 1 15:42:25 apricot sudo[31515]: pam_ldap: ldap_result Can't contact > LDAP server > > How do I get a Machine to authenticate to Ldap ? > > I think the problem lies with nss_ldap ? > When I add the following line to /etc/ldap.conf > > ssl start_tls > > I start to get the following error's > Apr 2 14:09:11 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server > (sleeping 4 seconds)... > Apr 2 14:09:15 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server > (sleeping 8 seconds)... > Apr 2 14:09:18 bruce nscd: nss_ldap: reconnecting to LDAP server > (sleeping 16 seconds)... > Apr 2 14:27:06 bruce sshd: pam_ldap: ldap_starttls_s: Operations error > Apr 2 14:27:06 bruce sshd(pam_unix)[11233]: authentication failure; > logname= uid=0 euid=0 tty=ssh ruser= rhost=apricot.uk.ad.ep.corp.local > user=mgarrett > Apr 2 14:27:06 bruce sshd[11233]: pam_krb5[11233]: authentication > succeeds for'mgarrett' (mgarrett(a)UK.AD.EP.CORP.LOCAL) > > /etc/ldap.conf > > base dc=unix,dc=total > bind_timelimit 120 > idle_timelimit 3600 > ldap_version 3 > pam_password md5 > scope sub > ssl start_tls > timelimit 120 > tls_cacertdir /etc/openldap/cacerts > tls_checkpeer no > > Can any body point me in the right direction > > > Thanks > > Matthew > > Server is RedHat 5.3 > Clients are RedHat 4.7 > > Copy of slapd.conf > pwcheck_method: saslauthd > mech_list: gssapi > sizelimit unlimited > > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/redhat/autofs.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/krb5-kdc.schema > > # Allow LDAPv2 client connections. This is NOT the default. > allow bind_v2 > > > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/slapd.pem > TLSCertificateKeyFile /etc/openldap/slapd.key > > ## security - other directives > ## prevents anonymous access to > ## any connection > #disallow bind_anon > ## forces a bind operation before DIT access > #require bind > ## Use of reads on ldaps only port forces use > ## of TLS/SSL but not a minimum value > ## this directive forces a minimum value > #security simple_bind=128 > > sasl-secprops noanonymous,noplain,noactive > > # Map SASL authentication DNs to LDAP DNs > # This leaves "username/admin" principals untouched > sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth > uid=$1,ou=people,dc=unix,dc=total > # This should be a ^ plus, not a star, but slapd won't accept it > > # Default read access for everything else except anonymous users who have > no access but does not work. ! > access to * > by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write > by * read > > > #by anonymous none > > > > > Matthew Garrett > Senior IS Technical Analyst > Tel: 01224 297889 > Fax: 01224 296806 > Email: Matthew.Garrett(a)total.com > Total E&P UK, Crawpeel Road, Altens Industrial Estate, Aberdeen AB12 3FG > Registered in England and Wales No.811900????????? > Registered Office 33 Cavendish Square, London W1G 0PW > This e-mail and any attachments are intended only for the person or entity > to whom it is addressed and may contain confidential or privileged > information.? If you are not the addressee, any disclosure, reproduction, > copying, distribution, or use of this communication is strictly prohibited. > If you are not the intended recipient or person responsible for delivering > this message to the named addressee, please notify us immediately and > delete > this e-mail. > It is the responsibility of the addressee to scan this email and any > attachments for computer viruses or other defects. The sender does not > accept liability for any loss or damage of any nature, however caused, > which may result directly or indirectly from this email or any file > attached. >

1 0

posixGroup integrated with linux via nss
by Scott Classen 03 Apr '09

03 Apr '09

I have a happily running LDAP installation (2.4.15) running on Fedora 8 with numerous other linux machines using it as a source of authentication and name services. I have a problem with group permissions. Most of my groups have less than 10 members, but I have a few super users that need to belong to many groups (100-200) so that they can help individual users process their data. I can easily add the super users to each group using ldapmodify or GQ, and when I type "groups" or "id" in a terminal window as the super user I see that they belong to all the groups. The problem come when I try to read the contents of a directory that is owned by one of these secondary groups. Maybe its a Fedora/Linux thing, but the super user only has read permissions for the first 16 groups. The super user can not do an "ls -la /home/userwhoisin17thgroup" What is up with that? Also can anyone recommend another way to achieve the one user/many groups scenario using LDAP? Thanks, Scott

3 2

unable to get openldap to bind to AD
by Kyle Pike 02 Apr '09

02 Apr '09

It might be easier to read all of this on here: http://www.linuxquestions.org/questions/linux-server-73/unable-to-get-ldap-… I am able to bind and search AD with ldapsearch, but am unable to get openldap to use it as a backend db. I am able to search for a user in active directory by using the following: ldapsearch -v -H ldap://charizard.company. internal -x -b "dc=company,dc=internal" -D "cn=ldap proxy,cn=Users,dc=company,dc=internal" -w 'passwd' -LLL "(sAMAccountName=testuser)" My slapd.conf looks like: slapd.conf ----------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 1024 database ldap suffix "cn=Users,dc=company,dc=internal" rootdn "cn=ldap proxy" uri "ldap://charizard.company.internal" binddn "cn=ldap proxy,cn=Users,dc=company,dc=internal" bindpw "passwd" rwm-rewriteEngine on rwm-map objectclass account user rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail userPrincipalName rwm-map attribute * lastmod off chase-referrals no access to * by * read ----------------------------- When I try and search on my openldap host, I recive.. [kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1 -------------------------------- In slapd debug log I can see the following... backend_startup_one: starting "cn=Users,dc=corpedia,dc=internal" ldap_back_db_open: URI=ldap://charizard.corpedia.internal slapd starting ldap_pvt_gethostbyname_a: host=heracross.corpedia.local, r=0 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 12 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: version=3 dn="" method=128 send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 9 do_bind: v3 anonymous bind connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal> <<< dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal>, <cn=users,dc=corpedia,dc=internal> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: ==> limits_get: conn=0 op=1 dn="[anonymous]" ldap_create ldap_url_parse_ext(ldap://charizard.corpedia.internal) =>ldap_back_getconn: conn 0x8ad8a88 inserted refcnt=1 binding=1 ldap_search_ext put_filter: "(objectClass=*)" put_filter: simple put_simple_filter: "objectClass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP charizard.corpedia.internal:389 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 10.0.0.6:389 ldap_connect_timeout: fd: 10 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 73 bytes to sd 10 ldap_result ld 0x8ad0860 msgid 1 ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL wait4msg ld 0x8ad0860 msgid 1 (timeout 100000 usec) wait4msg continue ld 0x8ad0860 msgid 1 all 0 ** ld 0x8ad0860 Connections: * host: charizard.corpedia.internal port: 389 (default) refcnt: 2 status: Connected last used: Fri Mar 27 16:23:13 2009 ** ld 0x8ad0860 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x8ad0860 Response Queue: Empty ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL ldap_int_select read1msg: ld 0x8ad0860 msgid 1 all 0 ber_get_next ber_get_next: tag 0x30 len 167 contents: read1msg: ld 0x8ad0860 msgid 1 message type search-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x8ad0860 0 new referrals read1msg: mark request completed, ld 0x8ad0860 msgid 1 request done: ld 0x8ad0860 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=1 ber_flush: 163 bytes to sd 9 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next ber_get_next on fd 9 failed errno=0 (Success) connection_read(9): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=9 for close do_unbind connection_close: deferring conn=0 sd=9 connection_resched: attempting closing conn=0 sd=9 connection_close: conn=0 sd=9 =>ldap_back_conn_destroy: fetching conn 0 connection_get(9): connection not used connection_read(9): no connection! Any help would be much appreciated :-)

2 2

TLS/Certificate Problem Openldap
by Steffen Knauf 02 Apr '09

02 Apr '09

Hello, i try to configure openldap with TLS/SASL. But i only get the same Error ( TLS certificate verification: Error, unable to get local issuer certificate) Perhaps someone have an idea what wrong with the certificate. Version : $OpenLDAP: slapd 2.3.43 OS: SuseLinux Enterprise 10 Ldap Server Output: ----------------------------------------------------------- connection_read(12): checking for input on id=31 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(12): got connid=31 connection_read(12): checking for input on id=31 TLS certificate verification: depth: 0, err: 20, subject: /DC=liga01/ST=Deutschland/L=Munich/O=it/CN=schmidt.muc.liga01, issuer: /DC=liga01/ST=Deutschland/O=it/CN=schmidt.muc.liga01 TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_accept:error in SSLv3 read client certificate B TLS: can't accept. TLS: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned s3_srvr.c:2482 connection_read(12): TLS accept failure error=-1 id=31, closing connection_closing: readying conn=31 sd=12 for close connection_close: conn=31 sd=12 ----------------------------------------------------------- I create the certs like the following tutorial: http://www.openldap.org/faq/index.cgi?_highlightWords=tls&file=185 /etc/openldap/slapd.conf: ----------------------------------------------------------- TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3 TLSCertificateFile /etc/ssl/zertifikate/servercrt.pem TLSCertificateKeyFile /etc/ssl/zertifikate/serverkey.pem TLSCACertificateFile /etc/ssl/zertifikate/demoCA/cacert.pem TLSVerifyClient demand ----------------------------------------------------------- /etc/openldap/ldap.conf: ----------------------------------------------------------- TLS_CACERT /etc/ssl/zertifikate/demoCA/cacert.pem TLS_REQCERT demand ----------------------------------------------------------- /etc/ldap.conf: ----------------------------------------------------------- ssl start_tls ----------------------------------------------------------- greets Steffem

1 0

sasl issue - but I don't want sasl atm
by Da Rock 02 Apr '09

02 Apr '09

I know the security implications of this, but I just want to stage this procedure and take one problem at a time; trouble is the system wants me to bite more than I can chew at a given time! I have setup an ldap server, ldap admin programs can connect to it, but when I run say ldapsearch it says it can't connect with the following error: > SASL/GSSAPI authentication started > ldap_sasl_interactive_bind_s: Local error (-2) Sure, eventually I'd like to secure things more, but I simply need to test things at this point. It also gets in the way of other things which I'm just looking in to right now. I kinda understand the error code, but I'm not entirely sure what the -2 is; I've been working on the premise that it can't connect because the security service isn't setup (sasl or krb principal), so I'm trying to work out how to setup the system to do a simple bind (through ldap.conf? either /etc/ or openldap/) but I can't for the life of me get it to cooperate. Any help? What info is needed here to resolve this? Cheers

4 8

Unable to auth on replica
by Marcio Merlone 02 Apr '09

02 Apr '09

Hello, I have set two Ubuntu 8.04 servers running OpenLDAP 2.4.9-0ubuntu0.8.04.2. I have set replication as per the docs. On the slave, I start with an empty /var/lib/ldap, and when I start the replica the dir is populated with the files, I am able to anon search, etc. Great, except my clients are able to auth on the provider but not on the replica. Both provider and consumer have the same acls, and the diff from one conf to another is: --- slapd.conf 2009-04-02 09:04:42.000000000 -0300 +++ slapd.conf.replica 2009-04-02 09:05:47.000000000 -0300 @@ -60,19 +61,13 @@ # 'database' directive occurs database hdb -overlay syncprov -syncprov-checkpoint 100 10 -syncprov-sessionlog 100 - -# Let the replica DN have limitless searches -limits dn.exact="cn=syncrepl,dc=a1,dc=ind" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited - # The base of your directory in database #1 suffix "dc=a1,dc=ind" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. -# rootdn "cn=admin,dc=a1,dc=ind" +rootdn "cn=admin,dc=a1,dc=ind" + # Where the database file are physically stored for database #1 directory "/var/lib/ldap" @@ -112,6 +108,21 @@ # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog +syncrepl rid=3 + provider=ldap://192.168.0.201:389 + type=refreshAndPersist + interval=01:00:00:00 + searchbase="dc=a1,dc=ind" + scope=sub + schemachecking=off + bindmethod=simple + binddn="cn=syncrepl,dc=a1,dc=ind" + credentials=xxxxx + + +# updateref ldap://192.168.0.201:389 + + # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the Any idea on what could be wrong? Thanks in advance for any hint or help. -- Marcio Merlone

1 0

smbk5pwd for openldap 2.3
by Daniel Spannbauer 02 Apr '09

02 Apr '09

Hello, I'm using the distro opensuse 10.2. I'm missing the module smbk5pwd. Can I build this module for openldap 2.3? Regards Daniel -- Daniel Spannbauer Software Entwicklung marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

1 0

syncrepl issue
by Oliver Henriot 02 Apr '09

02 Apr '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list users, I have a master openldap 2.3 server which is replicated via syncrepl on half a dozen other servers (2.3 too). Due to a legacy application from which I have to import passwords once a day, the master server is stopped, erased and re-built from scratch once every day... I have noticed that all the replicas have recovered only a partial subset of the entries and the strange thing is that all the replicas have the same subset. They are all missing a few hundred entries. When I stop the replicas, erase their data and start them anew, they replicate just fine and are consistent with the master server. I was wondering : could this be due to the fact that the replicas have problems erasing the old entries and replacing them with the new set of entries? Would increasing syncprov-checkpoint <ops> and syncprov-sessionlog <size> values improve the situation? I also recall reading something about a specific configuration directive to improve delete replication but I have a feeling it was 2.4 specific... Thanks, Cheers - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAknQo4MACgkQSWuBJnHIHdKr5gCgl4i6UHIebD5npfmzS+c3bp5O SOcAoLb+T7NtNTg9XIs17MgS7EkENpT9 =YEot -----END PGP SIGNATURE-----

4 10

open-source admin tools
by Raul Libório 31 Mar '09

31 Mar '09

Hello, I wonder which of you are the best open-source tools to maintain a database, which currently are the best if they leave ... I want to integrate environment, leave everything tied in (LDAP proxy, samba, e-mail clients, asterisk, joomla!) I see much talk of phpldapadmin, it is that all who speak it? ------ Raul Libório http://rauhmaru.blogspot.com/ rauhmarutsªhotmailºcom Linux user#4444581 Brazil "The bug is on the table."

5 5

Unable to get openldap to use active directory as ldap backend but am able to search using ldapsearch
by Kyle Pike 30 Mar '09

30 Mar '09

It might be easier to read all of this on here: http://www.linuxquestions.org/questions/linux-server-73/unable-to-get-ldap-… I am able to bind and search AD with ldapsearch, but am unable to get openldap to use it as a backend db. I am able to search for a user in active directory by using the following: ldapsearch -v -H ldap://charizard.company.internal -x -b "dc=company,dc=internal" -D "cn=ldap proxy,cn=Users,dc=company,dc=internal" -w 'passwd' -LLL "(sAMAccountName=testuser)" My slapd.conf looks like: slapd.conf ----------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 1024 database ldap suffix "cn=Users,dc=company,dc=internal" rootdn "cn=ldap proxy" uri "ldap://charizard.company.internal" binddn "cn=ldap proxy,cn=Users,dc=company,dc=internal" bindpw "passwd" rwm-rewriteEngine on rwm-map objectclass account user rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail userPrincipalName rwm-map attribute * lastmod off chase-referrals no access to * by * read ----------------------------- When I try and search on my openldap host, I recive.. [kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1 -------------------------------- In slapd debug log I can see the following... backend_startup_one: starting "cn=Users,dc=corpedia,dc=internal" ldap_back_db_open: URI=ldap://charizard.corpedia.internal slapd starting ldap_pvt_gethostbyname_a: host=heracross.corpedia.local, r=0 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 12 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: version=3 dn="" method=128 send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 9 do_bind: v3 anonymous bind connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next ber_get_next on fd 9 failed errno=11 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal> <<< dnPrettyNormal: <cn=Users,dc=corpedia,dc=internal>, <cn=users,dc=corpedia,dc=internal> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: ==> limits_get: conn=0 op=1 dn="[anonymous]" ldap_create ldap_url_parse_ext(ldap://charizard.corpedia.internal) =>ldap_back_getconn: conn 0x8ad8a88 inserted refcnt=1 binding=1 ldap_search_ext put_filter: "(objectClass=*)" put_filter: simple put_simple_filter: "objectClass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP charizard.corpedia.internal:389 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 10.0.0.6:389 ldap_connect_timeout: fd: 10 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 73 bytes to sd 10 ldap_result ld 0x8ad0860 msgid 1 ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL wait4msg ld 0x8ad0860 msgid 1 (timeout 100000 usec) wait4msg continue ld 0x8ad0860 msgid 1 all 0 ** ld 0x8ad0860 Connections: * host: charizard.corpedia.internal port: 389 (default) refcnt: 2 status: Connected last used: Fri Mar 27 16:23:13 2009 ** ld 0x8ad0860 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x8ad0860 Response Queue: Empty ldap_chkResponseList ld 0x8ad0860 msgid 1 all 0 ldap_chkResponseList returns ld 0x8ad0860 NULL ldap_int_select read1msg: ld 0x8ad0860 msgid 1 all 0 ber_get_next ber_get_next: tag 0x30 len 167 contents: read1msg: ld 0x8ad0860 msgid 1 message type search-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x8ad0860 0 new referrals read1msg: mark request completed, ld 0x8ad0860 msgid 1 request done: ld 0x8ad0860 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=1 ber_flush: 163 bytes to sd 9 connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next ber_get_next on fd 9 failed errno=0 (Success) connection_read(9): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=9 for close do_unbind connection_close: deferring conn=0 sd=9 connection_resched: attempting closing conn=0 sd=9 connection_close: conn=0 sd=9 =>ldap_back_conn_destroy: fetching conn 0 connection_get(9): connection not used connection_read(9): no connection! Any help would be much appreciated :-)

1 0

OpenLDAP Load balancing.
by William Jojo 30 Mar '09

30 Mar '09

Under 2.4.x I would like to have 4 replicas of a master or perhaps just use 4 masters in multi-master replication. What is more important is I would like to provide one IP for LDAP queries. I have seen PEN and POUND and other types of TCP "load balancers" for simple TCP and was wondering what the OpenLDAP community recommends for doing such tasks and the implications of TLS/SSL on these tools. I thought about DNS round robin, but that doesn't take into account a missing or non-responsive server, whereas a product like PEN seems to do so. I looked at some older threads regarding this but there don't seem to be any definitive recommendation(s) by the OpenLDAP community whom I feel is the best source for such solutions. :-) Cheers, Bill

1 0

Syncrepl doesn't delete entries?
by Jordi Espasa Clofent 30 Mar '09

30 Mar '09

Hi all, In provider: # provider moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index entryCSN eq index entryUUID eq and ... ldap01:~# ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)' | grep javi # javi, CAT, Tecnic, mydomain.com dn: cn=javi,ou=CAT,ou=Tecnic,dc=mydomain,dc=com cn: javi # javi, CAT, Tecnic, mydomain.com dn: uid=javi,ou=CAT,ou=Tecnic,dc=domain,dc=com uid: javi cn: javi homeDirectory: /usr/local/home/javi but in the consumer: # consumer index objectclass,entryCSN,entryUUID eq syncrepl rid=125 provider=ldap://192.168.10.10:389 type=refreshAndPersist searchbase="dc=mydomain,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=com" credentials=<password> ldap02:/var/lib# ldapsearch -x -b 'dc=mydomain,dc=com' '(objectclass=*)' | grep javi # javi, Tecnic, mydomain.com dn: uid=javi,ou=Tecnic,dc=mydomain,dc=com uid: javi cn: javi homeDirectory: /usr/local/home/javi # javi, CAT, Tecnic, mydomain.com dn: cn=javi,ou=CAT,ou=Tecnic,dc=mydomain,dc=com cn: javi # javi, CAT, Tecnic, mydomain.com dn: uid=javi,ou=CAT,ou=Tecnic,dc=mydomain,dc=com uid: javi cn: javi homeDirectory: /usr/local/home/javi It seems that the info in provider and consumer is diferent. If I try, for example, to change the password in provider I see that the value in consumer change automatically. Good. But it seems if I delete some entries in consumer, these changes are not reflected in consumer. ¿Where is the problem? ¿How can I debug t? -- Thanks, Jordi Espasa Clofent

1 0

Require object classes in an OU
by Troy Knabe 29 Mar '09

29 Mar '09

We have a custom schema and we would like to require that all entries in ou=Group have that objectClass in order to be added. Can someone point me in the direction that I should be looking? Thanks -Troy

2 1

mirrormode replication issues
by Jonas Haskins 29 Mar '09

29 Mar '09

Hello friends, I've been trying to setup Mirror Mode replication, using the openldap.org docs and others from googling.. and am having some interesting results. I am new to this so this has been an enlightening experience to say the least, but perhaps if someone on the list might be able to answer a few questions that would be awesome... I have 2 nodes, and want to get mirror mode running for high availibility .. and will add samba to auth ( later ) Basically it seems that mirror mode is sort of working.. i can see the syncRep talking back and forth .. However .. I cannot write to either nodes once replication is running. Below example is me trying to add a user account: error is : ( phpldapadmin reports ) LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. log file reports in detail: Mar 26 13:14:38 ldap01 slapd[1433]: >>> dnPrettyNormal: <cn=joepreston,dc=foobar,dc=com> Mar 26 13:14:38 ldap01 slapd[1433]: <<< dnPrettyNormal: <cn=joepreston,dc=foobar,dc=com>, <cn=joepreston,dc=foobar,dc=com> Mar 26 13:14:38 ldap01 slapd[1433]: do_add: dn (cn=joepreston,dc=foobar,dc=com) Mar 26 13:14:38 ldap01 slapd[1433]: conn=14 op=1 ADD dn="cn=joepreston,dc=foobar,dc=com" Mar 26 13:14:38 ldap01 slapd[1433]: bdb_dn2entry("cn=joepreston,dc=foobar,dc=com") Mar 26 13:14:38 ldap01 slapd[1433]: => bdb_dn2id("cn=joepreston,dc=foobar,dc=com") Mar 26 13:14:38 ldap01 slapd[1433]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Mar 26 13:14:38 ldap01 slapd[1433]: bdb_referrals: op=104 target="cn=joepreston,dc=foobar,dc=com" matched="dc=foobar,dc=com" Mar 26 13:14:38 ldap01 slapd[1433]: send_ldap_result: conn=14 op=1 p=3 Mar 26 13:14:38 ldap01 slapd[1433]: send_ldap_result: err=53 matched="" text="shadow context; no update referral" Mar 26 13:14:38 ldap01 slapd[1433]: send_ldap_response: msgid=2 tag=105 err=53 Mar 26 13:14:38 ldap01 slapd[1433]: conn=14 op=1 RESULT tag=105 err=53 text=shadow context; no update referral Mar 26 13:14:38 ldap01 slapd[1433]: daemon: activity on 1 descriptor Ma so:: text="shadow context; no update referral" using mirrormode, i should be able to write to the db correct? initally, i used ldapadd to add my ldif files on node 1 ( with syncRep commented out ) then useds slapcat/slapadd to populate the db on node 2, then uncommented syncRep on both nodes and restarted both.. ( this was because i was trying to troubleshoot the DB_NOTFOUND error above ... the result was it still errored ) however, it seems the text=shadow context; no update referral may be the real issue. am i missing something in these configs in reguards to mirrormode? logs seem to indicate syncRep is talking, and access is allowed, but no write, and if i ldap add to node 1 ( with Rep commented out ) then uncomment and restart both ( so node 1 has data but node2 does not, i can see syncRep talking, but node2 never picks up the changes ) ok whew, sorry about all of that.. any ideas? using: openldap-2.3.27 CentOS 5.2 2.6.18-92.el5 64 db-4.7.25 smbldap-tools-0.9.5-1 was going to upgrade to the latest, but there are a ton of deps , so i though i'd ask forst.. many many thanks! node1: slapd.conf # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema include /etc/openldap/schema/samba.schema loglevel -1 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap moduleload back_bdb.la moduleload back_ldap.la moduleload back_ldbm.la moduleload back_passwd.la moduleload back_shell.la TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapdcert.pem TLSCertificateKeyFile /etc/openldap/slapdkey.pem access to * by dn.base="cn=Manager,dc=foobar,dc=com" read by * break ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=foobar,dc=com" rootdn "cn=Manager,dc=foobar,dc=com" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXX directory /var/lib/ldap index objectclass,entryCSN,entryUUID eq index cn,sn,uid,displayName pres,sub,eq index uidNumber,gidNumber eq index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index memberUid,mail,givenname eq,subinitial overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Global section serverID 1 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap02.hq.foobar.com bindmethod=simple binddn="cn=Manager,dc=foobar,dc=com" credentials=morefoo searchbase="dc=foobar,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on node2: # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema include /etc/openldap/schema/samba.schema loglevel -1 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap moduleload back_bdb.la moduleload back_ldap.la moduleload back_ldbm.la moduleload back_passwd.la moduleload back_shell.la TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapdcert.pem TLSCertificateKeyFile /etc/openldap/slapdkey.pem access to * by dn.base="cn=Manager,dc=foobar,dc=com" read by * break ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=foobar,dc=com" rootdn "cn=Manager,dc=foobar,dc=com" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXX directory /var/lib/ldap index objectclass,entryCSN,entryUUID eq index cn,sn,uid,displayName pres,sub,eq index uidNumber,gidNumber eq index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index memberUid,mail,givenname eq,subinitial overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Global section serverID 2 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap01.hq.foobar.com bindmethod=simple binddn="cn=Manager,dc=foobar,dc=com" credentials=morefoo searchbase="dc=foobar,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on -- Jonas Haskins Sr Network Administrator jhaskins(a)adready.com (206)792-5184 AdReady INC

4 3

configuring SSL certificate chains for slapd
by Marc Ochs 28 Mar '09

28 Mar '09

Please forgive me if this should be clear, but could someone please point me to info on how to configure a SSL certificate chain for ldaps in slapd? My CA of choice requires a chain cert and I'm having trouble finding this information in the fine documentation. Thanks much, Marc

2 1

Proxy to Active Directory: lost field
by Bogdan B. Rudas 26 Mar '09

26 Mar '09

Hello. I use OpenLDAP as proxy for M$ AD. The problem is: I can set filter only by some fileds like CN or Name. I can't query AD by sAMAccountName via proxy Also I can't see many AD-specific fileds while browsing AD via OpenLDAP proxy. Request to proxy: ldapsearch -M -LLL -H ldap://localhost:389 -x -D "cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" -w password -x -b "dc=domain,dc=company,dc=com" '(sAMAccountName=bogdan.rudas)' sAMAccountName Return nothing. Request directly to AD LDAP: ldapsearch -M -LLL -H ldap://ADserver.domain.company.com:1234 -x -D "cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" -w password -x -b "dc=domain,dc=company,dc=com" '(sAMAccountName=bogdan.rudas)' cn Returns: dn: CN=Bogdan Rudas.......skipped.... cn: Bogdan Rudas Yet another request to proxy: ldapsearch -M -LLL -H ldap://ADserver.domain.company.com:1234 -x -D "cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" -w password -x -b "dc=domain,dc=company,dc=com" '(name=Bogdan Rudas)' cn sAMAccountName dn: cn=Bogdan Rudas.......skip..... cn: Bogdan Rudas SAMACCOUNTNAME: bogdan.rudas Slapd version 2.4.11-1 Running on Debian 5.0 amd64 OpenLDAP config: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap access to dn.base="" by * read access to * by self read by users read by anonymous auth loglevel 256 ###################################################### # database definitions ###################################################### database ldap suffix "dc=intra,dc=nival,dc=com" uri "ldap://ADserver.domain.company.com:1234" acl-bind bindmethod=simple binddn="cn=aduser,ou=allusers,ou=itdep,dc=domain,dc=company,dc=com" credentials=password chase-referrals yes

3 5

ldap dir change, ext script?
by Brian Krusic 25 Mar '09

25 Mar '09

Hi all, How would you run an external script automatically after an LDAP change (add/remove a user)? I've checked around and can't seem to find a solution that I can understand. - Brian

3 4

LDAP proxy and referral
by pierre laffont 25 Mar '09

25 Mar '09

Hi, You must already know I'm a French student then i hope you will understand me !! : ) For a project i have to study and make a decision on a new deployment of openldap in the university of Toulouse where i am. for that i read Lot's of sheets on openldap but somethings wrong. To respect of the multitier application we wants to have a frontend proxy and behind this, 3 N-WAY multimaster servers. I have two different database on my replication, the first is the root DIT (dc=iut,dc=fr)and the second database (de=student) must be chain as an OU in the tree of the first database(ou=student,dc=iut,dc=fr). here is my problem, i want an unified presentation of DIT but how can i chain my second database in the first ? with chaining overlay on my 3 servers ? with the meta backend ? with the ldap backend ? and if i use one of the both backend must i add an ldif entry referral for that ? do you have some example ? I'm lost ! Thank you very much for your help ! and sorry for my English : ) Pierre LAFFONT.

1 0

Re: SEGV on AIX (Was: Please test RE24 (3/18/2009 call for testing))
by William Jojo 25 Mar '09

25 Mar '09

Resending since I didn't see it hit the list. Cheers, Bill Using the RE24 from CVS last night Mar 22 20:32 EDT... On AIX 5.3: Running 251 of 500 iterations running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... ldapadd failed for server 1 database (254)! ------------------------------- Error log: LABEL: CORE_DUMP IDENTIFIER: 40E9A4E1 Date/Time: Mon Mar 23 04:15:11 2009 Sequence Number: 377 Machine Id: 000345FAD300 Node Id: dev53 Class: S Type: PERM Resource Name: SYSPROC Description SOFTWARE PROGRAM ABNORMALLY TERMINATED Probable Causes SOFTWARE PROGRAM User Causes USER GENERATED SIGNAL Recommended Actions CORRECT THEN RETRY Failure Causes SOFTWARE PROGRAM Recommended Actions RERUN THE APPLICATION PROGRAM IF PROBLEM PERSISTS THEN DO THE FOLLOWING CONTACT APPROPRIATE SERVICE REPRESENTATIVE Detail Data SIGNAL NUMBER 11 USER'S PROCESS ID: 495704 FILE SYSTEM SERIAL NUMBER 15 INODE NUMBER 905219 PROCESSOR ID 6 CORE FILE NAME /stage/openldap/RE24/ldap/tests/testrun/srv1/core PROGRAM NAME lt-slapd STACK EXECUTION DISABLED 0 COME FROM ADDRESS REGISTER ADDITIONAL INFORMATION strlen 0 _doprnt 2004 Symptom Data REPORTABLE 1 INTERNAL ERROR 0 SYMPTOM CODE PCSS/SPI2 FLDS/lt-slapd SIG/11 FLDS/strlen VALU/0 FLDS/_doprnt ------------------------------ DBX is: Segmentation fault in noname.strlen [/usr/lib/libs.a] at 0xd0335680 ($t14) 0xd0335680 (strlen) 89030000 lbz r8,0x0(r3) (dbx) GCC is: [dev53:/stage/openldap/RE24/ldap/tests] # gcc -v Using built-in specs. Target: powerpc-ibm-aix5.3.0.0 Configured with: ../stage/gcc-4.2.3/configure --disable-shared --enable-threads=posix --prefix=/usr/local --with-long-double-128 --enable-languages=c,c++ Thread model: aix gcc version 4.2.3 BDB 4.6.21.4, OpenSSL 0.9.8.10 (0.9.8j)

3 3

User root from client can be all another users
by Marcelo Gomes 24 Mar '09

24 Mar '09

Hi! In my network, when some client do login as root (local) he can type "su -l" and be all another user from ldap. How can i block this ? thanks Marcelo Gomes

4 3

smbk5pwd - slapd stops responding - please help-me!
by Eduardo Sachs 24 Mar '09

24 Mar '09

Hi People, I use the overlay smbk5pwd for sync password of Samba with the of Heimdal Kerberos. In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2 and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems. But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1, and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems. When I invoke smbpasswd or ldappaswd and trying change the password, slapd stops responding. With kpasswd I do not have problems, change the password of Samba and Kerberos correctly, and userPassword fixed with {K5KEY}, slapd not stops responding (working correctly), but, I need change the password with smbpasswd for Windows clients. Below follows a more detailed debug, has something else that I can show? This is a bug? slapd.conf configuration: moduleload smbk5pwd overlay smbk5pwd smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} - OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key. - I configure OpenLDAP to run with user root and group root, for tests. smb.conf configuration about password: ldap passwd sync = Only unix password sync = no Look this example: 1 - LDAP OK: root# ps aux|grep slapd root 3841 3.0 0.8 21920 4512 ? Ssl 14:47 0:00 /usr/sbin/slapd -h ldap://10.111.222.100:389/ ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f /etc/ldap/slapd.conf root 3844 0.0 0.1 3116 728 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br 2 - Change password witch LDAPPASSWD: root# ldappasswd -x -D "krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" "uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S New password: Re-enter new password: ldap_result: Can't contact LDAP server (-1) root# ps aux|grep slapd root 3832 0.0 0.1 3116 724 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD: conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389) conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=1 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new Debug of Overlay Audit, trying change password with LDAPPASWD: # modify 1236964911 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify replace: userPassword userPassword:: e0s1S0VZfQ== - replace: entryCSN entryCSN: 20090313172151.459306Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313172151Z - # end replace 1236964911 3 - Change Password with SMBPASSWD: LDAP running correctly. root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br # smbpasswd sachs New SMB password: Retype new SMB password: failed to bind to server ldaps://debian.local.int.br/ with dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" Error: Can't contact LDAP server (unknown) Connection to LDAP server failed for the 2 try! Connection to LDAP server failed for the 3 try! Connection to LDAP server failed for the 4 try! Connection to LDAP server failed for the 5 try! Connection to LDAP server failed for the 6 try! Connection to LDAP server failed for the 7 try! Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD: conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636) conn=2 fd=27 TLS established tls_ssf=128 ssf=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=2 op=0 RESULT tag=97 err=0 text= conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))" conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=6 SRCH attr=uid sambaSid conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1 op=9 SRCH attr=supportedExtension conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1 op=10 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new conn=1 op=8 RESULT tag=103 err=0 text= Debug of Overlay Audit, trying change password with SMBPASSWD: # modify 1236968199 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify delete: sambaAcctFlags sambaAcctFlags: [U] - add: sambaAcctFlags sambaAcctFlags: [U ] - replace: entryCSN entryCSN: 20090313181639.613866Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313181639Z - # end replace 1236968199 Thanks!!!

1 0

Re: ssh automatic logins using OpenLDAP
by Norberto Bensa 24 Mar '09

24 Mar '09

On Tue, Mar 24, 2009 at 12:51 PM, Jordi Espasa Clofent <jespasac(a)minibofh.org> wrote: > Another related question żis possible to _NOT_ use LDAP auth in some users? > It means, use LDAP+ssh in general sense, with only a few exeptions which > will stills login in local. Just configure pam/nss to use both sources (files and ldap). Then add users to /etc/passwd and ldap as needed

1 0

ssh automatic logins using OpenLDAP
by Jordi Espasa Clofent 24 Mar '09

24 Mar '09

Hi all, ¿Is possible to configure ssh automatic logins [1] using/through OpenLDAP? ¿How? Currently the ssh+ldap works perfectly in my OpenLDAP config, so a lot of works has been already done. [1] http://linuxproblem.org/art_9.html -- Thanks, Jordi Espasa Clofent

2 1

mirror mode works just one way
by Hegedus Gabor 24 Mar '09

24 Mar '09

Hi, all! I have a problem, I could include the schema to the 2.4 openldap, and I set the mirror mode like the manual said on the first server. I installed the same version openldap to the another server, and set it like the first server. the full database came to the second ldap. If i modify the first database, it push the changes to the second, and I can see the changes on it. BUT when I modify the second database, there is no changes on the first... Why? I can see trafic with tcp dump on first server 389 port,but nothing changes on it. /etc/ldap/* /etc/default/slapd files are the same on both server, and the databases are too. the only differences are the serverID and the provider in the slapd.conf file my mirror mode configuration: serverID 1 moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" mirrormode on I have tried the mirror mode on a basic database and it worked, what is the problem now? please help, it is very important! thank you, best regards, Gabor

3 5

OpenLDAP Syncrepl issue
by Luis Castillo 23 Mar '09

23 Mar '09

Hello, I am having an issue getting the OpenLDAP to replicate using syncrepl. Basically, after configuring the consumer I can start the slapd process but I see no replication happening. Do you have a sample configuration file that can provide more info? Is there anything required on the master? Thanks, Luis

5 8

Re: acls for mirrormode user and its clear text passwords
by Tyler Gates 22 Mar '09

22 Mar '09

I figured this out. The problem was I didn't have the entry 'anonymous auth' in the clause. >I have a multimaster system running behind a back_ldap proxy and all >is? >running fine except for the fact that the mirrormode user specified in >syncrepl section can only specify its password as cleartext or use sasl >authentication. I'm not so worried about the clear text password being >seen because all connections are via tls. But, if anyone binds, >including anonymous users, that password is visible to them which >scares me because the mirrormode user has write access to the entire >tree. My first course of action was to set acls as write to mirrormode >user and none to everyone else but no matter what I do, replication >between the two servers breaks because it seems as soon as an acl is >defined, mirrormode user no longer has permissions. Am I fundamentally >missing something here with the visible clear text password? Or am I >just not doing the acls right? Below is an example of what I surely >thought would work at a (very minimal level). > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by anonymous none > >doesn't work. Even: > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by self write > >gives me no love either. If you need the entire acl I can provide it >but I'm guessing I missing something much more obvious. > >Thanks, > Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 21 Mar '09

21 Mar '09

I have a multimaster system running behind a back_ldap proxy and all is running fine except for the fact that the mirrormode user specified in syncrepl section can only specify its password as cleartext or use sasl authentication. I'm not so worried about the clear text password being seen because all connections are via tls. But, if anyone binds, including anonymous users, that password is visible to them which scares me because the mirrormode user has write access to the entire tree. My first course of action was to set acls as write to mirrormode user and none to everyone else but no matter what I do, replication between the two servers breaks because it seems as soon as an acl is defined, mirrormode user no longer has permissions. Am I fundamentally missing something here with the visible clear text password? Or am I just not doing the acls right? Below is an example of what I surely thought would work at a (very minimal level). access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by anonymous none doesn't work. Even: access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by self write gives me no love either. If you need the entire acl I can provide it but I'm guessing I missing something much more obvious. Thanks, Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 21 Mar '09

21 Mar '09

I have a multimaster system running behind a back_ldap proxy and all is running fine except for the fact that the mirrormode user specified in syncrepl section can only specify its password as cleartext or use sasl authentication. I'm not so worried about the clear text password being seen because all connections are via tls. But, if anyone binds, including anonymous users, that password is visible to them which scares me because the mirrormode user has write access to the entire tree. My first course of action was to set acls as write to mirrormode user and none to everyone else but no matter what I do, replication between the two servers breaks because it seems as soon as an acl is defined, mirrormode user no longer has permissions. Am I fundamentally missing something here with the visible clear text password? Or am I just not doing the acls right? Below is an example of what I surely thought would work at a (very minimal level). access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by anonymous none doesn't work. Even: access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by self write gives me no love either. If you need the entire acl I can provide it but I'm guessing I missing something much more obvious. Thanks, Tyler

1 0

Starting OpenLDAP: slapd - failed
by Eldon Phukuile 21 Mar '09

21 Mar '09

I am following the tutorial at https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html. Everything worked until... Command: sudo /etc/init.d/slapd restart Output: Stopping OpenLDAP: slapd. Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (e.g. /var/log/syslog) or try running the daemon in Debug mode like via "slapd -d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd -h 'ldap://127.0.0.1:389/ ldaps:/// ldapi:///' -g openldap -u openldap -F /etc/ldap/slapd.d/ Command: slapd -d 16383 Output: @(#) $OpenLDAP: slapd 2.4.11 (Nov 8 2008 09:42:18) $ buildd@palmer:/build/buildd/openldap-2.4.11/debian/build/servers/slapd ldap_pvt_gethostbyname_a: host=MORPHEUS.matrix.corp, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: bind(7) failed errno=13 (Permission denied) daemon: bind(7) failed errno=13 (Permission denied) slap_open_listener: failed on ldap:/// slapd stopped. connections_destroy: nothing to destroy.

3 2

trigger a program when ldap db modifies
by Hegedus Gabor 19 Mar '09

19 Mar '09

Hi all! Can you suggest me a program or solution what is do the following: after i modify a record in a db, an external bash script runs off, like a daemon what is check the modifications, and start a script. I hope you are understanding what i want. Gabor

3 2

main: TLS init def ctx failed: -1
by mario ramirez cervera 19 Mar '09

19 Mar '09

main: TLS init def ctx failed: -1 ani ideas? thank

2 1

mirroring problem (unwilling to perform error)
by Hegedus Gabor 19 Mar '09

19 Mar '09

Hi all! I have a serious problem! I try to configure the ldap server mirroring mode, but something problem with this. Fist of all: I tested the mirroring on two openldap 2.4.11-0ubuntu6.1. and it worked fine. I just configured slapd.conf file like this: # Global section serverID 1 (another ldap is 2) moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" retry="60 +" mirrormode on It was okay, when I modified the db1, the db2 modified too. BUT! I try to set up on version 2.3.30, I use the same configuration, the ldap starts good, but when i try to modify the db, the phpldapadmin shows this error: Could not perform ldap_modify operation. LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. What is the problem, what is missconfigured? please help, thank you! br Gabor

2 2

pam_ldap, libnss-ldap and different fields for authentication
by Florian MAURY 18 Mar '09

18 Mar '09

Hi, I'm currently working on an authentication system for my company and facing a problem using pam_ldap, and libnss_ldap. I want to configure pam to authenticate againt a field (let's call it AField) (e.g. a ssh session's authentication) and libnss to provide the content of another field (BField) if I run e.g. ls -l. I mean : # ssh AField-value(a)192.168.1.1 [...] # ls -l /tmp/test -rwx------ 1 BField-value root 1305 2009-03-18 14:11 test #whoami BField-value The goal is to permit login via AField, which will be a quite long name, and BField will ease the reading in my linux-box. Everything is working perfectly fine if I use the same field. (i.e. pam_login_attribute BField and nss_map_attribute uid BField) but if I try to set pam_login_attribute to AField and nss_map_attribute to "uid BField" the authentication process failed in an "Invalid credentials" error. Libnss works correctly since when I list (ls) a file created by an ldap user after logging in via a local user, the resolution works fine. Ls answers me the file is owned by {BField-value} user. Pam_ldap seems to understand it needs to look up to the AField since it bind anonymously, request the rdn of the user having AField equal to the login submitted, but when the binding is done with the rdn of the user, I've got the error. I tcpdump-ed the ldap trafic and discovered pam_ldap is requesting the binding without providing the password. In the packets, where the password (in clear for tests) should be, I can read "INCORRECT". Which is not my password at all =) Then, it's perfectly logical that openldap returns me "Invalid credentials". My question is : what can this INCORRECT mean ? A configuration error ? Is it just possible to do what I want to do ? When my authentication fails, I can rean in openldap log files : slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 When I'm using only the AField (or the BField) for the two options, I don't get this error :o/ I'm using Openldap 2.3.30-5+etch2, libpam-ldap 180-1.7 and libnss-ldap 251-7.5etch1 on Debian. Thank you in advance for your support. Regards, -- Florian MAURY

1 0

dbconfig
by Oliver Henriot 18 Mar '09

18 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list members, I have a bdb database in openldap 2.3.27 on centos 5.2 in which I have defined, in the database section : dbconfig set_cachesize 0 268435456 1 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 I stop my server, clear /var/lib/ldap/*, slapadd my basic ldif entries (replication account, people and groups ou), chown everything to ldap:ldap and start openldap but I still get a warning : bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap - From what I read, I understood that the dbconfig directives created the DB_CONFIG file at startup if it wasn't present in the database directory. This doesn't seem to be working and I can't figure out why. Is there something obvious I'm missing out here? Thanks. - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkm/wc0ACgkQSWuBJnHIHdLvJQCeJKiqBxahNvb65kPI91yTgmVS 1z4An2YprXc5nDcdyw6mm7UWf5yoN7Hp =QFKr -----END PGP SIGNATURE-----

1 1

PROBLEM SSL
by mario ramirez cervera 17 Mar '09

17 Mar '09

Hello again: I copied the certificates in slapd.con: TLSCipherSuite HIGH: MEDIUM: + sslv2: RSA TLSCACertificateFile / etc / ldap / slapd-certs / cacert.pem TLSCertificateFile / etc / ldap / slapd-certs / servercrt.pem TLSCertificateKeyFile / etc / ldap / slapd-certs / serverkey.pem and also writes: SLAPD_SERVICES = "ldap: / / / LDAPS :///" And start giving me the following error: root @ mario-desktop: / etc / gulCA # / etc / init.d / slapd start Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (eg / var / log / syslog) or try running the daemon in Debug mode like via "slapd-d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd-g openldap-u openldap-f / etc / ldap / slapd.conf Deputy my folder Thank you very much it is very important

2 1

Initial setup confusion
by Luke Biddell 17 Mar '09

17 Mar '09

I'm attempting to run openldap on intrepid ibex and am encountering some problems which are most likely down to my understanding. So any newbie help is much appreciated. The first confusion is slapd.conf versus slapd.d. I don't have a slapd.conf file to start with and /etc/ldap/slapd.d is empty. So should I hand-craft a slapd.conf (despite the docs saying this is the old way) and convert it to slapd.d format or do I create an ldif file and put it somewhere (presumably in slapd.d or ldapmodify it)? I've also got a schema I wish to import and currently I'm ldapmodify-ing it in, it's of this form. dn: cn=schema,cn=config changeType: modify add: olcAttributeTypes olcAttributeTypes: ... dn: cn=schema,cn=config changeType: modify add: olcObjectClasses olcObjectClasses: .... ... As you can see I'm adding custom attribute types and object classes into cn=schema,cn=config and this appears to work fine, however they are not persisted across slapd restarts. I presume I need to put them under cn=mycustomconfig,cn=schema,cn=config and then they will persist? I'm sure I'm just missing something fundamental here. More coffee is probably needed. TIA for any help. Luke

2 1

SSL
by mario ramirez cervera 17 Mar '09

17 Mar '09

Firstly thank you very much But my problem was that rpincipal, but to explain it wrong. My problem is the config openldad SSL I followed this manualhttp: / / www.juanramartin.com/?p=60 # comment-49151 but did not work for me to insert the lines in slapd.conf .. Podrian ayudarme Greetings

1 0

Re: Problem ldif encrypt MD5
by mario ramirez cervera 17 Mar '09

17 Mar '09

Firstly thank you very much But my problem was that rpincipal, but to explain it wrong. My problem is the config openldad SSL I followed this manualhttp: / / www.juanramartin.com/?p=60 # comment-49151 but did not work for me to insert the lines in slapd.conf .. Podrian ayudarme Greetings 2009/3/16 Brian Friday <brian.friday(a)gmail.com> > Hello Mario, > > Please check out the documentation on the openldap website which > speaks specifically about passwords: > > http://www.openldap.org/faq/data/cache/419.html > > On Mon, Mar 16, 2009 at 2:08 AM, mario ramirez cervera > <marioramirezph(a)gmail.com> wrote: > > Good morning to everyone: > > > > My problem is I need to configure my openldap not have the passwd in > plain > > text. He then ta rootdn with the passwd MD5. > > How can I spend my ldif passwd current MD5? > > > > Thank you very much and hope your help >

1 0

Openldap cookie synchronization
by Mihai Stanescu 16 Mar '09

16 Mar '09

Hello all I am developing a service to replicate openldap changes to another server. For this i am using cookie based search with a certain polling interval (10 secs) My problem occurs when there are many changes to be synced from openldap while openldap is under modification stress. Sometimes openldap returns all the entries of the openldap database to my cookie search (i am not reseting the cookie). Later on after the processing is finalized even a single modification in openldap triggers a situation in which cookie based search fetches all the entries of the openldap database. I am not altering the cookies between searches. Does anyone have any idea why this could happen? Is it nomal behavior or a known issue? Could it be a configuration problem? Thanks Mihai

1 0

Problem ldif encrypt MD5
by mario ramirez cervera 16 Mar '09

16 Mar '09

Good morning to everyone: My problem is I need to configure my openldap not have the passwd in plain text. He then ta rootdn with the passwd MD5. How can I spend my ldif passwd current MD5? Thank you very much and hope your help

1 0

smbk5pwd - slapd stops responding
by Eduardo Sachs 15 Mar '09

15 Mar '09

Hi People, I use the overlay smbk5pwd for sync password of Samba with the of Heimdal Kerberos. In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2 and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems. But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1, and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems. When I invoke smbpasswd or ldappaswd and trying change the password, slapd stops responding. With kpasswd I do not have problems, change the password of Samba and Kerberos correctly, and userPassword fixed with {K5KEY}, slapd not stops responding (working correctly), but, I need change the password with smbpasswd for Windows clients. Below follows a more detailed debug, has something else that I can show? This is a bug? slapd.conf configuration: moduleload smbk5pwd overlay smbk5pwd smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} - OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key. - I configure OpenLDAP to run with user root and group root, for tests. smb.conf configuration about password: ldap passwd sync = Only unix password sync = no Look this example: 1 - LDAP OK: root# ps aux|grep slapd root 3841 3.0 0.8 21920 4512 ? Ssl 14:47 0:00 /usr/sbin/slapd -h ldap://10.111.222.100:389/ ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f /etc/ldap/slapd.conf root 3844 0.0 0.1 3116 728 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br 2 - Change password witch LDAPPASSWD: root# ldappasswd -x -D "krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" "uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S New password: Re-enter new password: ldap_result: Can't contact LDAP server (-1) root# ps aux|grep slapd root 3832 0.0 0.1 3116 724 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD: conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389) conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=1 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new Debug of Overlay Audit, trying change password with LDAPPASWD: # modify 1236964911 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify replace: userPassword userPassword:: e0s1S0VZfQ== - replace: entryCSN entryCSN: 20090313172151.459306Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313172151Z - # end replace 1236964911 3 - Change Password with SMBPASSWD: LDAP running correctly. root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br # smbpasswd sachs New SMB password: Retype new SMB password: failed to bind to server ldaps://debian.local.int.br/ with dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" Error: Can't contact LDAP server (unknown) Connection to LDAP server failed for the 2 try! Connection to LDAP server failed for the 3 try! Connection to LDAP server failed for the 4 try! Connection to LDAP server failed for the 5 try! Connection to LDAP server failed for the 6 try! Connection to LDAP server failed for the 7 try! Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD: conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636) conn=2 fd=27 TLS established tls_ssf=128 ssf=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=2 op=0 RESULT tag=97 err=0 text= conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))" conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=6 SRCH attr=uid sambaSid conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1 op=9 SRCH attr=supportedExtension conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1 op=10 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new conn=1 op=8 RESULT tag=103 err=0 text= Debug of Overlay Audit, trying change password with SMBPASSWD: # modify 1236968199 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify delete: sambaAcctFlags sambaAcctFlags: [U] - add: sambaAcctFlags sambaAcctFlags: [U ] - replace: entryCSN entryCSN: 20090313181639.613866Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313181639Z - # end replace 1236968199 Thanks!!!

1 0

Hostname does not match common name problem
by Sascha 14 Mar '09

14 Mar '09

Hi there! I have a problem with an LDAP server that I need to connect to. I have the required certificate stored on the client but I am getting the following error message: "TLS: hostname (A.xyz123.com) does not match common name in certificate (*.xyz123.com)" Is there any way to work around this problem? As far as I understand it, RFC4514 section 3.1.3 allows wildcards thus the connection should work, shouldn't it? What is confusing me is that "openssl s_client -connect A.xyz123.com:636 -CAfile /etc/ssl/certs/rootca.cer" results in: Verify return code: 0 (ok) If I am not mistaken, openssl accepts the server based on the certificate but openldap does not. Any help is much appreciated. I am really stuck with this. Thanks. Regards, Sascha -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger01

3 4

CPU IOWAIT
by Sergio Cioban Filho 14 Mar '09

14 Mar '09

Hi all, I have 2 openldap servers running on CentOS 5.2 (openldap-2.4.11 RPM: http://staff.osuosl.org/~jeff/openldap/el5/i386/<http://staff.osuosl.org/%7Ejeff/openldap/el5/i386/>), the single-master replication works fine, but when I have activated mirrormode, any ldap interaction is so slowly and CPU IOWAT is 100% (in ldapsearch or ldapadd...). I have tried the same configuration with openldap-2.4.15 + db-4.7.25, but this problem still occurred. Have any idea about this problem? ** Sorry for my poor english... :) Thanks, Regards, --- Sergio Cioban Filho

2 2

newbie question: No anonymous authentication = problems
by Andreas Brudin 13 Mar '09

13 Mar '09

Hi, I hope I am on the right list for questions like this. I manage a OpenLDAP server installation on Ubuntu 8.10, and when I upgraded from 8.04 the configuration changed quite a bit. I am trying to turn off anonymous access, but I get problems connecting to the ldap database even when not using anonymous bind. I managed to find the configuration options I was looking for (at least i think so) with phpldapadmin. I found an object with dn olcDatabase={1}bdb,cn=config, in which I found an attribute called olcAccess, which I think is what I need to change. From the beginning it said: {0}to attrs=userPassword,shadowLastChange by dn.base="cn=manager,dc=mydomain,dc=com" write by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to * by dn.base="cn=manager,dc=mydomain,dc=com" write by * read (of course with my dc values). I tried to change the last entry to by * none, as I do not right now need my users to be able to read their or other users' values. It worked as expected, from an LDAP point of view, I still could log in anonymously, but I could not browse the database, however, logged in as manager it worked as it should. The problem came in postfix, because I use my LDAP database (among other things) as an alias table. So I configured postfix not to bind anonymously, but to use server_host = localhost server_port = 389 search_base = dc=mydomain, dc=com bind = yes bind_dn = cn=manager, dc=mydomain, dc=com bind_pw = mysecret result_attribute = mail query_filter = (|(uid=%s)(mailAlias=%s)) But I got dict_ldap_lookup: Search error 50: Insufficient access from the mail.log When I changed back, it worked again. I have tried to change various things (such as put in by anonymous auth before by * read, and changing dc.base="..." to dc="..." both in the first and in the last attribute value above, but it does not seem to change. What am I doing wrong? Any help would be much appreciated. Best regards, Andreas

1 0

[Fwd: Re: OpenLDAP event in Paris - programme details]
by Howard Chu 13 Mar '09

13 Mar '09

As already mentioned, I'll be in London later this month to give a talk on OpenLDAP and MySQL at the UKUUG LISA conference. Since I'm going to be in Europe for a few days, the folks at Linagora in France invited me to give a talk in Paris as well. I look forward to meeting up with our friends on the Continent.... 8<------------------------------------------------------------ Community event with Howard Chu, OpenLDAP Chief Architect, in Paris Linagora is proud to welcome Howard Chu, OpenLDAP Chief Architect, for a conference on OpenLDAP version 2.4, Monday 23rd March at 6 PM in Paris. In a relaxed after-work atmosphere, come and learn more about the new features of the open source directory server, and meet other members of the French OpenLDAP community. Sign-up for free by a simple email to <ldap+event2009(a)linagora.com>. Warning : this conference will be given in English. Where : 27 rue de Berri, 75008 Paris - http://www.linagora.com/societe/contacts/nous_contacter/_r45.html Professional needs? Attend a seminary on industrializing OpenLDAP with Symas and Linagora, on Tuesday 24th March morning: http://www.linagora.com/actualites/evenement_exceptionnel_openldap_pour_les… 8<------------------------------------------------------------ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ldap delete and modifying by delete problems
by Catalin 12 Mar '09

12 Mar '09

Hello! I'm trying to write a php script in order to manage my LDAP Directory easier. Everything works fine when I'm adding new entries and when I'm modifying an attribute. When it comes to delete an entry from my directory or to remove an attribute, I get error no. 8 which means "PHP Warning: ldap_delete() [<a href='function.ldap-delete'>function.ldap-delete</a>]: Delete: Strong(er) authentication required in /var/www/html/admin.mydomain.tld/responsabil/sterge.php on line 34, referer: http://admin.mydomain.tld/responsabil/index.php?nav=del [Tue Mar 10 07:15:03 2009] [error] [client 172.17.26.57] PHP Warning: ldap_mod_del() [<a href='function.ldap-mod-del'>function.ldap-mod-del</a>]: Modify: Strong(er) authentication required in /var/www/html/admin. mydomain.tld /responsabil/sterge.php on line 37, referer: http://admin. mydomain.tld /responsabil/index.php?nav=del" Here is how I'm trying to do these: <?php $ldap = ldap_connect("localhost"); ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); $r = @ldap_bind($ldap, "root","password"); $arrayCN=array("cn=",$login,",ou=people,dc=mydomain,dc=tld"); $CN=implode($arrayCN); $arraygroup=array("cn=",$row_verifica[5],",ou=departments,dc=mydomain,dc=tld "); $group=implode($arraygroup); $entry["member"]=$CN; $stergere=ldap_delete($ldap,$CN); $modificare=ldap_mod_del($ldap,$group,$entry); $closing=ldap_close($ldap); ?> I think it has something to do with LDAP settings. I'm using default settings for LDAP , I've only included a supplemental schema to fit it for my needs. I've generated a {SSHA} password for root. If needed, I can send all these files. Can anyone help? Any suggestion would be greatly appreciated. Thanks in advance! Best regards! Catalin

4 3

new ldap installation -LDAP newbie question
by Swenson, Chris 12 Mar '09

12 Mar '09

This is a bit difficult to articulate. Is there a way to move only the passwords from a passwd file into ldap? I have built out an ldap server and a client box and can successful authenticate from one to the other. I am using this to replace an old RHEL that has depended on the passwd file with nearly 10,000 users. To add the users to the new server I have parsed and imported a good deal of the data in the passwd file into on Oracle Db that has all the HR stuff and then scripted an output ldif to add the users into the new ldap server. Good so far, this works. My concern is thus. Ldap is on a new box. There is a lot of junk in the old box I want to leave behind, hence the rewrite via oracle. I want to extract only the passwords from the passwd file and write them to the new ldap server. If I run migrate_passwd.pl and pull the passwords out, they are hashed in some way and I cannot write them to the ldap nor script setting the password from the old one. Even if I run the passwd file through pwunconv they seem to be unusable. I dread the thought of having to communicate with 9000 students and nearly 1000 faculty and staff with new passwords. Regards Chris S.

2 1

API to read config file before ldap_search.
by Santosh Kumar 12 Mar '09

12 Mar '09

Dear friends,looking to where we could specify config file path to be read by  ldapsearch.c  to /openldap/ldap.conf  will be trying to pass the query to ldapclient and obtain the result. should we write program starting from ldap_open , ldap_init, ldap_bind , ldap_search  or its suffice only by modifying ldapsearch.c.RegardsSantosh

2 1

what ldap configuration paramentrs for ldapclient
by Santosh Kumar 12 Mar '09

12 Mar '09

Hi,  bharath , thanks for the link,command  working fine ,ldapsearch -v -x -W -h 10.10.20.50 -D cn=testuser1,ou=testusers,dc=kpairtest,dc=local -b ou=testusers,dc=kpairtest,dc=localwhat is binddn  , rootbinddn , basepart that needs to be specified in ldap.conf for openldap client,can we  have either in /etc/ldap.conf or  /etc/openldap/ldap.conf  ?and does ldapsearch()  automatically looks for configuration in /etc/ldap.confThanksSantosh Kumar Sr Software Engineer On Tue, 10 Mar 2009 05:21:58 -0400 "Kantrapati, Bharath" wrote Hi santosh,   Your mail is not clear , what is it you are exactly looking for??   But as the error says the objects you are trying to query would require you to bind to the active directory with a set of credentials.   Regards Bharath   From: openldap-technical-bounces+bharath.kantrapati=gs.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+bharath.kantrapati=gs.com@OpenLDAP.org] On Behalf Of Santosh Kumar Sent: Tuesday, March 10, 2009 11:39 AM To: openldap-technical(a)openldap.org Subject: ldap-client connection to AD - LdapErr: DSID-0C090627,   Trying to query Active Directory  via command line for searching all Please let me know what this error refers to ./ldapsearch  -h 10.10.10.50 -b "ou=users,DC=SFBAY,DC=tech,DC=com"  -s sub "objectclass=*" # extended LDIF # # LDAPv3 # base with scope subtree # filter: objectclass=* # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope  ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1  i'm  looking to extract -b option and -D from AD Please if anyone is aware let me know. Thanks Santosh  

1 0

Developing client in c
by Michael Luich 11 Mar '09

11 Mar '09

Hello Everyone, I'm trying to develop my application in c. And since I've never done LDAP before I thought i'd do a test program to work out the how's of retrieving from an ldap directory. in this case I'm pulling a X509 certificate from the verisign directory. I successfully run the search and can retrieve the data, but the certificate;binary is incomplete. I've tried a number of different things but cannot seem to get the whole certificate. Below is the hard coded test program, and any help would be greatly appreciated! -- Michael Luich Stone's Rose mluich(a)stonesrose.com #include <stdio.h> #include "ldap.h" /* Specify the search criteria here. */ #define HOSTNAME "directory.verisign.com" #define PORTNUMBER 389 #define BASEDN "" #define SCOPE LDAP_SCOPE_SUBTREE #define FILTER "(mail=mluich(a)stonesrose.com)" char *encode_64 (char *message); int main (int argc, char **argv) { LDAP *ld; LDAPMessage *result, *e; char *dn, *cert; char **vals; int rc; LDAPMessage *res; char *a; int version, i; BerElement *ber; // /* Print out an informational message. */ // // printf ("Connecting to host %s at port %d...\n\n", HOSTNAME, PORTNUMBER); /* STEP 1: Get a handle to an LDAP connection and set any session preferences. */ if ((ld = ldap_init (HOSTNAME, PORTNUMBER)) == NULL) { perror ("ldap_init"); return (1); } /* Use the LDAP_OPT_PROTOCOL_VERSION session preference to specify that the client is an LDAPv3 client. */ version = LDAP_VERSION3; ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version); /* STEP 2: Bind to the server. In this example, the client binds anonymously to the server (no DN or credentials are specified). */ rc = ldap_simple_bind_s (ld, NULL, NULL); if (rc != LDAP_SUCCESS) { fprintf (stderr, "ldap_simple_bind_s: %s\n", ldap_err2string (rc)); return (1); } /* STEP 3: Perform the LDAP operations. In this example, a simple search operation is performed. The client iterates through each of the entries returned and prints out the DN of each entry. */ rc = ldap_search_ext_s (ld, BASEDN, SCOPE, FILTER, NULL, 0, NULL, NULL, NULL, 0, &result); if (rc != LDAP_SUCCESS) { fprintf (stderr, "ldap_search_ext_s: %s\n", ldap_err2string (rc)); return (1); } if ((vals = ldap_get_values_len (ld, result, "usercertificate;binary")) != NULL) { for (i = 0; vals[i] != NULL; i++) { printf ("%d - %s: %s\n", i, a, vals[i]); // if (!strcmp (a, "usercertificate;binary")) // { printf ("%s: %s\nlength: %d\n\n", a, vals[i], sizeof (vals[i])); encode_64 (vals[i]); // } } } else { fprintf (stderr, "ldap_get_values_len: %s\n", ldap_err2string (rc)); } ldap_value_free (vals); ldap_msgfree (result); /* STEP 4: Disconnect from the server. */ ldap_unbind (ld); return (0); } char * encode_64 (char *message) { #include <openssl/bio.h> #include <openssl/evp.h> BIO *bio, *b64; //char message[] = "Hello World \n"; b64 = BIO_new (BIO_f_base64 ()); bio = BIO_new_fp (stdout, BIO_NOCLOSE); bio = BIO_push (b64, bio); BIO_write (bio, message, strlen (message)); BIO_flush (bio); BIO_free_all (bio); }

2 1

Nway multimaster sync having weird functionality
by Mathew Rowley 11 Mar '09

11 Mar '09

I am experiencing some really strange behavior with nway multimaster. Does anyone know why this would be happening? I have 2 boxes set up to sync, called rsa01, rsa02 If I create ou=groups,dc=comcast,dc=com¹ on rsa02, it will create it on rsa01 If I create cn=test,ou=groups,dc=comcast,dc=com¹ on rsa02 it will NOT create on rsa01 If I delete ou=groups,dc=comcast,dc=com¹ on rsa02, it will delete on rsa01 If I create anything on rsa01, it will NOT create on rsa02 I have the sync set up for searchBase¹ set to dc=comcast,dc=com. Here is the olcSyncrepl configuration (for both boxes): dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcbdbConfig olcDatabase: {1}bdb olcSuffix: dc=comcast,dc=com olcDbDirectory: /usr/var/openldap-data/ olcRootDN: cn=Manager,dc=comcast,dc=com olcRootPW: {SSHA}kJTEcfOmPf7fKv71AtxDjlUZNPqN9pIT olcLimits: dn.exact="cn=Manager,dc=comcast,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=004 provider=ldap://10.252.152.76 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="test" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://10.252.152.77 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="test" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov -- MAT

2 4

ldap-client connection to AD - LdapErr: DSID-0C090627,
by Santosh Kumar 11 Mar '09

11 Mar '09

Trying to query Active Directory  via command line for searching all Please let me know what this error refers to./ldapsearch  -h 10.10.10.50 -b "ou=users,DC=SFBAY,DC=tech,DC=com"  -s sub "objectclass=*"# extended LDIF## LDAPv3# base <ou=users,DC=SFBAY,DC=keypairtech,DC=com> with scope subtree# filter: objectclass=*# requesting: ALL## search resultsearch: 2result: 1 Operations errortext: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece# numResponses: 1 i'm  looking to extract -b option and -D from AD Please if anyone is aware let me know.ThanksSantosh

5 8

Mirrormode problem
by Sergio Cioban Filho 10 Mar '09

10 Mar '09

Hi all, I have configured two openldap servers with mirrormode, but no have sync at servers... Any idea about the problem? My configuration files: Server1: serverID 1 syncrepl rid=001 provider=ldap://192.168.170.36:389/ bindmethod=simple binddn="cn=user,dc=teste,dc=com,dc=br" credentials="xxxxx" searchbase="dc=teste,dc=com,dc=br" schemachecking=on type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode on mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Server2: serverID 2 syncrepl rid=001 provider=ldap://192.168.170.25:389/ bindmethod=simple binddn="cn=user,dc=teste,dc=com,dc=br" credentials="xxxxx" searchbase="dc=teste,dc=com,dc=br" schemachecking=on type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode on mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ** Sorry for my poor english. Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------ Vendo GOL G3 PLUS 1.0 8V 4P 2002 - Branco - COMPLETÍSSIMO - Só R$ 18.500,00 http://cioban.googlepages.com/vendogolg38v

1 0

automatic versioning of objects?
by Karsten Kankowski 09 Mar '09

09 Mar '09

Hello dear wise guys :-) Is there any nice feature at Oo-LDAP implemented to get the information if an object is changed; something like a internal version number...??? We would like to use LDAP for storing complex configuration data which can have dependencies. For that a version number for all objects is necessary. Unfortunately these changes must be done also in a safe way which means that a version change must be done in a “atomic operation”. A internal incrementing by the LDAP server seemed to me a quite more simple solution than to try this to handle via the ( say here ~ 6000 concurrent ) clients. By the way: Do anyone implement something like a LDAP server based sequence number which can be queried??? Thanks a lot for your hints... and best regards Karsten (Sorry for the bad English ;-() The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other then the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

Issues when changing LDAP password
by Gustavo Mendes de Carvalho 09 Mar '09

09 Mar '09

Hi there, I'm running an LDAP server version 2.3.39 and I'm using ppolicy to force users in some specific things, but I'm having some issue when I try to change my user's password with passwd command. Here's the output screen [user1@cliserv ~]$ ssh ldapclisrv user1@ldapclisrv's password: Your LDAP password will expire in 10 days. Last login: Wed Mar 4 17:42:18 2009 from cliserv [user1@ldapclisrv ~]$ [user1@ldapclisrv ~]$ [user1@ldapclisrv ~]$ passwd Changing password for user user1. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Can't contact LDAP server Must supply old password to be changed as well as new one passwd: Permission denied [user1@ldapclisrv ~]$ As you can see, I can login using LDAP ID, and I can change user1 password if I use ldappasswd, entering all ldap information, but I would like to make it simpler. Does anybody has any idea ? -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

2 1

Multi-master or MirrorMode
by Sergio Cioban Filho 09 Mar '09

09 Mar '09

Hello all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------

1 0

Multi-master or MirrorMode
by Sergio Cioban Filho 07 Mar '09

07 Mar '09

Hi all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------

1 0

TLSVerifyClient => no login possible
by Sebastian Reinhardt 06 Mar '09

06 Mar '09

Hello, I have configured an openSUSE 11.0 (x86_64) with openldap- server. Also the TLS is activated. All clients are set to "TLS_REQCERT demand" and is working. Then I created client certificates by using the servers Yast2 CA- management. I copied teh client certificates and also the servers "cacert" into the "/etc/openldap/" directory on client computer. With "TLSVerifyClient allow" clients can login, but if I activate the "TLSVerifyClient demand" option in servers slapd.conf no user can perform an login and it causes errors in /var/log/messages: ----------------/var/log/messages---------------- Feb 22 18:50:01 lmvserver slapd[7093]: slap_listener_activate(8): Feb 22 18:50:01 lmvserver slapd[7093]: >>> slap_listener(ldap://) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=107 Feb 22 18:50:01 lmvserver slapd[7093]: conn=107 op=0 do_extended Feb 22 18:50:01 lmvserver slapd[7093]: do_extended: oid=1.3.6.1.4.1.1466.20037 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_extended: err=0 oid= len=0 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_response: msgid=1 tag=120 err=0 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): TLS accept failure error=-1 id=107, closing Feb 22 18:50:01 lmvserver slapd[7093]: connection_closing: readying conn=107 sd=14 for close Feb 22 18:50:01 lmvserver slapd[7093]: connection_close: conn=107 sd=14 Feb 22 18:50:01 lmvserver slapd[7093]: slap_listener_activate(8): Feb 22 18:50:01 lmvserver slapd[7093]: >>> slap_listener(ldap://) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=108 Feb 22 18:50:01 lmvserver slapd[7093]: conn=108 op=0 do_extended Feb 22 18:50:01 lmvserver slapd[7093]: do_extended: oid=1.3.6.1.4.1.1466.20037 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_extended: err=0 oid= len=0 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_response: msgid=1 tag=120 err=0 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): TLS accept failure error=-1 id=108, closing Feb 22 18:50:01 lmvserver slapd[7093]: connection_closing: readying conn=108 sd=14 for close Feb 22 18:50:01 lmvserver slapd[7093]: connection_close: conn=108 sd=14 Feb 22 18:50:01 lmvserver slapd[7093]: slap_listener_activate(8): Feb 22 18:50:01 lmvserver slapd[7093]: >>> slap_listener(ldap://) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=109 Feb 22 18:50:01 lmvserver slapd[7093]: conn=109 op=0 do_extended Feb 22 18:50:01 lmvserver slapd[7093]: do_extended: oid=1.3.6.1.4.1.1466.20037 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_extended: err=0 oid= len=0 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_response: msgid=1 tag=120 err=0 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): TLS accept failure error=-1 id=109, closing Feb 22 18:50:01 lmvserver slapd[7093]: connection_closing: readying conn=109 sd=14 for close Feb 22 18:50:01 lmvserver slapd[7093]: connection_close: conn=109 sd=14 ----------------/var/log/messages---------------- slapd.conf: ---------------/etc/openldap/slapd.conf-------- # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/dnszone.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/samba3.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema # Define global ACLs to disable default read access. pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Directives needed to implement policy: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read ####################################################################### # BDB database definitions ####################################################################### loglevel 5 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem TLSVerifyClient demand database bdb suffix "dc=lmv,dc=lmv" rootdn "cn=ldaproot,dc=lmv,dc=lmv" rootpw "???????" directory /mnt/lvm/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres database monitor ---------------/etc/openldap/slapd.conf-------- ldap.conf (client): --------------/etc/openldap/slapd.conf--------- # # LDAP Defaults # #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/openldap/cacert.pem TLS_CERT /etc/openldap/clientcert_205.pem TLS_KEY /etc/openldap/clientkey_205.pem TLS_REQCERT demand host 192.168.0.201 base dc=lmv,dc=lmv --------------/etc/openldap/slapd.conf--------- What is wrong? The clients certificate "common name" is set to the clients hostname. Is this ok? -- Mit freundlichen Grüßen Sebastian Reinhardt

3 17

openldap client configuration to connect to AD
by Santosh Kumar 06 Mar '09

06 Mar '09

Hi  Trying to configure ldap client connection for AD,  in the ldap.conf , what configuration needs to be carried, like is it required for PAM & NSS configuration .tried to test in ldap command as initial test, but getting the below error, ./ldapsearch -x -W -h 10.10.10.10 -b "CN=testuser,OU=Users,OU=KeyPairIN,OU=KeyPair,DC=keypair,DC=internal" -S subEnter LDAP Password:  ***   ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)Please do know what needs to be included ThanksSantosh Sr Software developer

3 5

Negation regex
by Miguel Jinez 06 Mar '09

06 Mar '09

Hi guys I need your help, anyone knows which is the negation regex? I need to perform an ACL Thanks Mike

1 0

Syncrepl cn=config from another context ...
by Mads Freek Petersen 06 Mar '09

06 Mar '09

Is it possible to have a server with multiple cn=config templates (for other servers) in a non cn=config context and then "translate" them into cn=config on the consumer side using a bootstrap config and olcsyncrepl? Regards Mads Freek ------------------------------------------------------ Mads Freek Petersen Special Consultant IT-Campus Roskilde University Building 42-1, P.O. Box 260, DK-4000 Roskilde, Denmark Phone: +45 4674 3882 Fax: +45 4674 3072 E-mail: freek(a)ruc.dk

2 2

Nway multimaster sync cn=config doesn¹t make cn=config look the same...
by Mathew Rowley 06 Mar '09

06 Mar '09

I have spent the past couple of days setting up nway multimaster in my lab. I was thinking it was not working because the first step (in the admin guide) was syncing up the cn=config. When doing that, I would look at both servers to see if the cn=config was the same they were, and are not. First box has (under cn=config): Cn=schema OlcDatabase={-1}front OlcDatabase{0}config OlcDatabase={1}bdb OlcDatabase={2}bdb Second box has (under cn=config): Cn=schema OlcDatabase={-1}front OlcDatabase{0}config OlcDatabase={1}bdb My question is: is this normal, or did I do something wrong? The sync on my dc=comcast,dc=com is working fine. Here are the steps I went through to get this working. Set up slapd.conf sure to include the directory config¹ in order to have a rootd for cn=config On both servers remove old directory/config ( rm -rf /usr/var/openldap-data/* /usr/etc/openldap/slapd.d/* ) On both servers run slapd with f and F options to sync to new config mode ( /usr/sbin/slapd -h ldap://10.252.152.76 -u ldap -F /usr/etc/openldap/slapd.d/ -f /usr/etc/openldap/slapd.conf -d 1 ) On both servers run slapd with F option - made sure that it was run with ldap://<ip> (/usr/sbin/slapd -h ldap://10.252.152.76 -u ldap -F /usr/etc/openldap/slapd.d/) On both servers run ldapmodify to add initial syncrepl, and sync the two cn=config directories: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://10.252.152.76 olcServerID: 2 ldap://10.252.152.77 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://10.252.152.76 binddn="cn=root,cn=config" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://10.252.152.77 binddn="cn=root,cn=config" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE On first server run ldapadd to sync the dc=comcast,dc=com directory: dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcbdbConfig olcDatabase: {1}bdb olcSuffix: dc=comcast,dc=com olcDbDirectory: /usr/var/openldap-data/ olcRootDN: cn=Manager,dc=comcast,dc=com olcRootPW: {SSHA}kJTEcfOmPf7fKv71AtxDjlUZNPqN9pIT olcLimits: dn.exact="cn=Manager,dc=comcast,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=004 provider=ldap://10.252.152.76 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://10.252.152.77 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Now, at this point is where I look at the cn=config to see if they were the same... -- MAT DESK: 720.267.7767

2 1

Multi-master vs. MirrorMode
by Sergio Cioban Filho 05 Mar '09

05 Mar '09

Hi all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------ Vendo GOL G3 PLUS 1.0 8V 4P 2002 - Branco - COMPLETÍSSIMO - Só R$ 18.500,00 http://cioban.googlepages.com/vendogolg38v

1 0

Openldap, kerberos backend, and SASL
by Da Rock 05 Mar '09

05 Mar '09

Sorry to barge in straight away with a question like this, but my time is running out and I have not been able to get a straight answer out of google. I'm going through the hypotheticals for using ldap as the backend for kerberos, and I've hit a chicken and egg problem with SASL- can someone untangle my mind? IF kerberos is using ldap as a backend store for keys, users, etc, and one can set the rootdn and leave the rootpw for later entry in the database itself, and the password can use SASL auth- what happens if you use kerberos as the auth mechanism? According to the book, slapd needs to set up the access to the key from startup, and kerberos in this scenario will need ldap up to provide the key. Is ldap up enough that kerberos can provide this? Or does ldap retry or something so that this problem is overcome? Thoughts? Cheers

4 15

syntax error in my ldif file
by Ken Perl 05 Mar '09

05 Mar '09

I got the error like below and can not fix it, could anyone help me? ldap_add: Invalid syntax (21) additional info: ObjectClass: value #0 invalid per syntax $cat lv1.ldif dn: mail=lv1(a)colinux.my, dc=colinux, dc=my ObjectClass: CourierMailAccount cn: ldap_vitural1 mail: lv1(a)colinux.my mail: lv1 userPassword: {MD5}$1$RnorJ$uVjJOT1I//zCCoFAYvP8t0 homeDirectory: lv1 uidNumber: 1000 gidNumber: 100 -- perl -e 'print unpack(u,"62V5N\"FME;G\!E<FQ`9VUA:6PN8V]M\"\@`` ")'

2 2

2.3 -> 2.4 upgrading advice
by Rex Roof 04 Mar '09

04 Mar '09

I'm currently running a fairly simple LDAP environment of two OpenLDAP 2.3 servers with a Master & Slave relationship using syncrepl. These servers are currently being used for authentication and for sendmail routing. I'm hoping to upgrade these two OpenLDAP 2.4 and create some sort of multi-master environment so that I can accept writes when one or more of the servers is down. I'd also like to add 2 more servers to the pool. I have two questions: 1) does anyone have any advice for things to watch out for when updating from 2.3 to 2.4? 2) what should I use for replication? Can I use some combination of MirrorMode and Multi-Master replication? This statement worries me: "Breaks the data consistency guarantees of the directory model" what does it mean? I found that here: http://www.openldap.org/doc/admin24/replication.html is that only a concern when the servers get out of sync as far as time goes? Any advice would be appreciated.

1 0

Security issues when authenticating from multiple sites
by Einar S. Ids� 04 Mar '09

04 Mar '09

Hello, We have a number of different community sites that will use a single central OpenLDAP-server for authentication. We want each site to provide its users with a logon-box for that site, just as any forum or portal you can find out there. Each site has its own admins with full access to everything related to their specific site. This makes it possible for them to edit their own logon mechanism to capture passwords for users that log on to their site. Thus an admin on one site can capture the password of an admin on another site, which is an obvious security issue. We can of course redirect logons to a common secure webpage, or monitor files in the respective sites' webroot to detect modifications to logon procedures, but we'd really prefer a cleaner solution if at all possible. Do any mechanisms exist to avoid this problem? Cheers, Einar S. Idsø Norsk eSport DA

2 1

can't change password with ldappaswd on Solaris 10 SPARC
by Marius Paulauskas 04 Mar '09

04 Mar '09

Hello, Is anyone successfully running openldap 2.4.15 on Solaris 10 SPARC? I cannot make it change passwords using ldappasswd if hash is set to smd5, ssha or crypt. Using latest Sun Studio 12. Same problem reveals if compiling with gcc 3.4.3 or 3.4.6. Somebody suggested it is due to flawed old gcc compiler version. I installed Sun Studio 12 but problem just wouldn't go away. Compiles without any problem both 32 or 64 bit memory models. I just can't believe that Sun Studio is flawed too. I must be missing some kind of setting or option or flag but seem to run out of ideas. any input greatly appreciated. /Marius

1 0

Can not modify cn=conf - openldap 2.4.15
by Mathew Rowley 04 Mar '09

04 Mar '09

I am trying to configure an n-way multi master following the tutorial in the admin guide (18.3.3 in http://www.openldap.org/doc/admin24/replication.html). When trying to add/modify anything in the cn=config, I get the following error: atlantis:~/comcast/authentication/ldif $ ldapadd -v -x -W -h 10.252.152.78 -D 'cn=Manager,dc=comcast,dc=com' ldap_initialize( ldap://10.252.152.78 ) Enter LDAP Password: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 add objectClass: olcGlobal add cn: config add olcServerID: 1 adding new entry "cn=config" modify complete ldap_add: Insufficient access (50) After looking through the test050 script, I see that this is done using the slapd Ta instead of a slapadd. I tried doing this, and get this error: [root@kdc01 scripts]# slapd -Ta bdb_db_open: warning - no DB_CONFIG file found in directory /usr/var/openldap-data: (2). Expect poor performance for suffix "dc=comcast,dc=com". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" I am using 2.4.15 built from source, with the only config option of changing the prefix directory. Any ideas on whats going on? Thanks. -- MAT

2 9

slapadd thank you!
by William Jojo 03 Mar '09

03 Mar '09

Thanks to all for the meter recently added to slapadd! Yeah, I know it's a small detail, but it really is the little things that matter sometimes. :-) Cheers, Bill

2 1

error in modifying subordinate entries
by Rakesh Yadav 03 Mar '09

03 Mar '09

Hi, I want to establish communication between two ldap servers at different machines. For this i have used "ref attribute of ldap" by using this attribute, i am able to retrieve entries of second ldap server. Means i can read or search entries of second server from first ldap server. But the problem comes when i want to modify any attribute of an entry of second server from the first server. Definitely i am having some access permissions related error. Here i am attaching slapd.conf files of both ldap servers. *First Server* *slapd.conf:* # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample access control policy: # Root DSE: allow anyone to write it # Subschema (sub)entry DSE: allow anyone to write it #Other DSEs: allow update_anon # Allow * write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: access to * by * write ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" rootpw secret index objectClass eq *access to * by * write* -------------------------------------------------------------------------------------------------------------------------------- *Second server's slapd.conf:* # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" rootpw secret directory /usr/local/var/gfsMetaData index objectClass eq *access to * by * write* ----------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------- *FIRST LADP SERVER DN*: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in where *test_ref* is having *ref* attribute dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject fn: test_ref ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in *NOW SECOND LDAP SERVER is having DN*: dn: fn=test1,fn=test_ref,dc=cdac,dc=in Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry. I have used ldap command line tool "*ldapdelete*" and executed this tool on *first LDAP machine*. Then the result of command is: **[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" \"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap:// 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in *And slapd debug statements:* do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Manager,dc=cdac,dc=in> <<< dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>, <cn=manager,dc=cdac,dc=in> do_bind: version=3 dn="cn=Manager,dc=cdac,dc=in" method=128 do_bind: v3 bind: "cn=Manager,dc=cdac,dc=in" to "cn=Manager,dc=cdac,dc=in" send_ldap_result: conn=2 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next do_delete ber_scanf fmt (m) ber: >>> dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> <<< dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>, <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> bdb_dn2entry("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") => bdb_dn2id("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_referrals: op=74 target="fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" matched="fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" ldap_url_parse_ext(ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in) send_ldap_result: conn=2 op=1 p=3 send_ldap_response: msgid=2 tag=107 err=10 ber_flush: 160 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next do_unbind connection_closing: readying conn=2 sd=11 for close connection_resched: attempting closing conn=2 sd=11 connection_close: conn=2 sd=11 * ----------------------------------------------------------------------------------------------------------------------------------------- * Please do me a favour suggest any solution as soon as possible through which i can update slave ldap server entries from master ldap server. -- Rakesh Yadav Pune.

2 4

limits in openldap 2.3
by Oliver Henriot 03 Mar '09

03 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list members, Is there a mechanism to control acces limits in openldap 2.3 similar to what can be achieved with the openldap 2.4 limits directive (http://www.openldap.org/doc/admin24/limits.html)? Appart from sizelimit and timelimit, which are not dn specific and therefore do not allow the same fine tuning as the limits directive, I haven't found anything. Maybe I missed it? Thanks, - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmr+a4ACgkQSWuBJnHIHdJYLQCgr2G31lT6KUAF8VsJDj56Jqdy OMQAnRZzU69ff3o94cGfJSgV0PlpGW0F =TEBl -----END PGP SIGNATURE-----

3 4

OpenLDAP 2.4.15 : CSN too old when using 4-way multimaster
by Adrien Futschik 03 Mar '09

03 Mar '09

Hello everyone, I have been testing n-way multimaster replication with OpenLDAP for a while now (from 2.4.11, to 2.4.15) and just when I though that everything was working perfectly, I dicided to test N-way multimaster not only with 2 masters on different servers, but with 4 ! 2 OpenLDAP instances per server. I have been configuring syncprov and syncrepl accordingly : olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 I am starting with all instances synced and I am trying to add entries en all four instances (in //). If I do so, I have a few entries that are not replicated on the others. I am getting this kind of messages : do_syncrep2: cookie=rid=011,sid=002,csn=20090227130003.849482Z#000000#004#000000 do_syncrep2: rid=011 CSN too old, ignoring 20090227130003.849482Z#000000#004#000000 do_syncrep2: cookie=rid=013,sid=002,csn=20090227130003.849482Z#000000#004#000000 do_syncrep2: rid=013 CSN too old, ignoring 20090227130003.849482Z#000000#004#000000 do_syncrep2: cookie=rid=014,sid=002,csn=20090227130003.946474Z#000000#004#000000 Did someone face the same issue ? Here is my configuration : (I am using refreshAndPersist mode for both cn=config and olcDatabase={1}bdb) M1 on IP1 / PORT1 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal creatorsName: cn=config olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryUUID: ef89c876-adb3-4dc7-aa7d-024bbc359c98 createTimestamp: 20090227085748Z entryCSN: 20090227085749.920499Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20090227085749Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z M2 on IP2 / PORT2 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: 8da75037-65e6-4375-8c21-7e5c0194a60b creatorsName: cn=config createTimestamp: 20090227085723Z olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryCSN: 20090227085725.003182Z#000000#002#000000 modifiersName: cn=config modifyTimestamp: 20090227085725Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z M3 on IP1 / PORT3 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: cf068647-318f-4848-9c72-9c7745a8a4b3 creatorsName: cn=config createTimestamp: 20090227085742Z olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryCSN: 20090227085743.825685Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20090227085743Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z M4 on IP2 / PORT4 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: ef89c876-adb3-4dc7-aa7d-024bbc359c98 creatorsName: cn=config createTimestamp: 20090227085748Z olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryCSN: 20090227085749.920499Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20090227085749Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z I also have to say that if I stop M3 & M4 and try to add entries to M1 & M2, I don't get the "CSN too old" messages and all entries a replicated correctly !!! Is this because Multimaster is limited to 2-3 instances ? The reason why I am trying to build a 4-way master architecture is because I would like to be able to stop one server and perform a slapcat, even if one "physical" server is down... Thanks very much for your consideration & time.. Adrien Futschik

5 8

Is there disadvantage using a single dc?
by AlexanDER Franca 02 Mar '09

02 Mar '09

Hi everyone. Is there any disadvantage using a single dc? I mean, I work at a small company and I'm setting up a small ldap repository, for me is enough to use just a "dc=my_company". But slapd says something about less performance. I think this warning is just about large repositories using just a single dc, what seems to be a bad setup, but I'm not sure. []'s Alexander

3 2

ldappasswd returns "Additional info: password hash failed" in Solaris 10 SPARC
by Marius P. 01 Mar '09

01 Mar '09

Hello, I am trying to change a password for ldap entry using ldappasswd -vx -D "cn=root,dc=test,dc=com" -w foobarr "uid=mariusp,ou=people,dc=test,dc=com" and reply I get is: Result: Other (e.g., implementation specific) error (80) Additional info: password hash failed I am running openldap on Solaris 10 latest on SPARC. It is in testing meaning there is nothing special about its configuration all defaults. Database has two entries just to play with. I haven't bothered to compile it myself so just downloaded openldap 2.4.11 from sunfreeware.com with required prerequisits such as Berkeley DB, SASL, openssl etc. Everything works fine except this weird problem which looks like a bug. Password checking (binding) works fine if I manually change userPassword: attribute no matter what algorithm prefix I use be it SSHA, crypt or MD5. That tells me that it can succesfully check and run those algorithms however something breaks when it tries to change the password like it couldn't hash that supplied password. Wondering if anyone exprienced similar problem and have any comments or findings. Regards, /M.

4 4

BDB Inconsistencies when configuring on RH4 vs RH5
by Mathew Rowley 27 Feb '09

27 Feb '09

When installing 2.4.11 on my RH4 box, it configures fine with db4-4.2.52 installed (with bdb support) ... Making servers/slapd/backends.c Add config ... Add ldif ... Add monitor ... Add bdb ... Add hdb ... Add relay ... Making servers/slapd/overlays/statover.c Add seqmod ... Add syncprov ... Please run "make depend" to build dependencies [root@rsa01 openldap-2.4.11]# rpm -qa | grep db4 db4-4.2.52-7.1 db4-devel-4.2.52-7.1 [root@rsa01 openldap-2.4.11]# cat /etc/redhat-release Red Hat Enterprise Linux ES release 4 (Nahant Update 5) [root@rsa01 openldap-2.4.11]# But when trying to configure on a RH5 system, I get the BDB incompatible error: ... checking for Berkeley DB link (-ldb-4.3)... yes checking for Berkeley DB version match... yes checking for Berkeley DB thread support... yes checking Berkeley DB version for BDB/HDB backends... no configure: error: BDB/HDB: BerkeleyDB version incompatible [root@kdc01 openldap-2.4.11]# rpm -qa | grep db4 db4-utils-4.3.29-9.fc6 db4-devel-4.3.29-9.fc6 db4-4.3.29-9.fc6 [root@kdc01 openldap-2.4.11]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.2 (Tikanga) [root@kdc01 openldap-2.4.11]# Is this an error in the configure script? Kind of confused. Thanks for any help. -- MAT

2 2

Running both ldap and ldaps simultaneously
by Bryan Payne 25 Feb '09

25 Feb '09

I'm trying to run both ldap:// and ldaps:// at the same time. Reason being, I can't get phpldapadmin to use ldaps. If I execute the command: /usr/local/openldap/libexec/slapd -u ldap -h ldap:/// ldaps:///, it just listens on 389. If I run, /usr/local/openldap/libexec/slapd -u ldap -h ldaps:/// ldap:///, it just listens on 636. How can I get it to listen on both ports?

4 4

Re: contextCSN
by Guillaume Arteta 25 Feb '09

25 Feb '09

Hello, Sorry for my English google:) I'm put into production 2 openldap masters, and I asked the same question João Alfredo. * So, if the resultt of this search is the same on all master's this mean that all servers are consistents, right ?* Ok, the ldapsearch (ldapsearch-x-h Master1 ... and ldapsearch-x-h master2 ...) displays the same values of contextCSN for server ID, but what it proves that they are synchronized? The question is, why master node, the ldapsearch ContextCSN displays of 2 servers (001 & 002) Can be put in place a monitoring system to test the replication by performing 2 ldapsearchs, if even then synchronized values. Merci ------ Arteta.

3 14

ldapmodify command line tool results in 'deferring operation: too many executing'
by Sean Burford 24 Feb '09

24 Feb '09

Hi, During a recent ldapmodify of 1000 records, I got some "deferring operation: too many executing" messages from OpenLDAP slapd 2.3.39. I am surprised by this, since I thought that since ldapmodify waited for the result of each operation nothing would be queued. Could this be caused by there being too many operations in progress across the entire server? This was the ldapmodify command line: ldapmodify -v -H "ldaps://master.example.com" -x -W -D "uid=person,ou=people,dc=example,dc=com" -c -f file.ldif The ldif only contained OpenLDAPaci attribute deletes that fit this template: dn: cn=host1000.example.com,ou=servers,dc=example,dc=com changetype: modify delete: OpenLDAPaci The ldapmodify output looked normal: delete OpenLDAPaci: modifying entry "cn=host1000.example.com,ou=servers,dc=example,dc=com" modify complete delete OpenLDAPaci: modifying entry "cn=host1001.example.com,ou=servers,dc=example,dc=com" modify complete But the logs show the 'deferring operation: too many executing': Feb 24 08:27:54 server slapd[9433]: conn=19226 op=640 MOD dn="cn= host1000.example.com,ou=servers,dc=example,dc=com" Feb 24 08:27:54 server slapd[9433]: conn=19226 op=640 MOD attr=OpenLDAPaci Feb 24 08:27:54 server slapd[9433]: conn=19226 op=640 RESULT tag=103 err=0 text= Feb 24 08:27:54 server slapd[9433]: connection_input: conn=19226 deferring operation: too many executing Feb 24 08:27:54 server slapd[9433]: conn=19226 op=641 MOD dn="cn= host1001.example.com,ou=servers,dc=example,dc=com" Feb 24 08:27:54 server slapd[9433]: conn=19226 op=641 MOD attr=OpenLDAPaci Feb 24 08:27:54 server slapd[9433]: conn=19226 op=641 RESULT tag=103 err=0 text= -- Thanks, Sean Burford

1 0

How to integrated OpenLDAP proxy to web application
by Duong Pham Tung 23 Feb '09

23 Feb '09

Hi all, I have already installed an OpenLDAP server as a LDAP proxy server. The data source backend of this server is a set of AD servers and other LDAP servers. I also have enabled SASL and Pass-through Authentication feature on this OpenLDAP server. Everything is running properly. Now, I want to deploy an Web Application which will use this OpenLDAP as a backend data source. I have deployed Pass-through authentication via SASL server, but as I understand, I must store information about user on my OpenLDAP server (such as username) and the userPassword field is set to {SASL}user@realm. But this LDAP proxy hasn’t any information about user on itself. So, which solutions can I use to solve user authentication problem without storing any user information on the LDAP Proxy. Thanks and Best regards Dương Phạm Tùng

1 0

Re: Password protection of TLS key
by ghenry＠OpenLDAP.org 20 Feb '09

20 Feb '09

> No really good ideas come to mind. I have a patch for libldap to > explicitly > set a callback to supply the key password, it won't make it into > 2.4.13 but > probably will be in 2.4.14. I will probably add two options to slapd, Hi, Did this make it into 2.4.14? I've checked the CHANGES and can't see anything mentioned re libldap? Thanks. > analogous to the back-bdb options to set the DB encryption key. (One > option to > set the key directly as an argument of the config option, one option > to read > the key from an arbitrary file.) Obviously for automated startup the > plaintext > of the key must be accessible to the slapd somewhere, and that means > it is > also accessible to potential intruders. This is just a fact of life. > You can > make key retrieval more tedious by hiding it behind other layers of > encryption, but ultimately the keys to each of those layers must also > be > accessible, otherwise slapd itself cannot use them. > > There are "clever" schemes to hide startup keys, but they tend to make > > restarts difficult. E.g., store keys on a mountpoint that you remount > some > other filesystem onto after the boot sequence has completed and all > dependent > daemons have started. Keep a file handle open on the new filesystem, > to > prevent it from being dismounted without rebooting the system. It'll > fool a > lot of intruders, but you won't be able to restart individual daemons > without > rebooting the machine. > > > Akke Bengtsson > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

4 3

olcSyncprovConfig not converted for cn=config
by Oliver Liebel 20 Feb '09

20 Feb '09

using openldap 2.4.14 (compiled from openldap.org source-package) i have noticed the following, reproducable behaviour when converting a slapd.conf to slapd.d: olcSyncprovConfig is generated during conversion for the hdb-context, but not for cn=config, although "overlay syncprov" is set for database config tested the conversion several times with slaptest and slapd, with the following simple example-slapd.conf. the result seems always to be the same. --- include /usr/local/etc/openldap/schema/core.schema access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by * read ##################################### database config rootdn cn=config rootpw {SSHA}4PvZLcpQ7s1CyQG+yworyl5DcrFTn78q overlay syncprov ##################################### database hdb suffix "dc=local,dc=site" checkpoint 1024 5 cachesize 10000 rootdn "cn=ldapadmin,dc=local,dc=site" rootpw {SSHA}4PvZLcpQ7s1CyQG+yworyl5DcrFTn78q directory /var/lib/ldap index objectClass eq index entryUUID,entryCSN eq overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 --- any ideas? thanks and greetings, oliver

2 2

Syncrepl master/master on RedHat4 Update 5 - wheres library?
by Mathew Rowley 19 Feb '09

19 Feb '09

I am trying to test the master/master replication architecture. When following the documentation from: http://www.openldap.org/doc/admin24/replication.html it shows: olcModulePath: /usr/local/libexec/openldap olcModuleLoad: syncprov.la When looking on my system, that file, nor the directory exists. I then looked into the slapd.conf file to see where the other libraries were: # modulepath /usr/sbin/openldap # moduleload back_bdb.la Again that directory, nor the module exist. I then thought there may be some option in the source that needs to be enabled to build the syncprov library, but I found nothing. I do see that there is a patch for syncrepl-uuid¹ which would make me think that the package is being built with syncrepl capability. How do I move forward? Do I need that library loaded? I did find this: https://bugzilla.redhat.com/show_bug.cgi?id=466937 which states: syncprov is compiled statically into slapd daemon to keep backward compatibility, I forgot to remove it from the config file. Does that mean the library is loaded by default, and doesn¹t explicitly need to be set to load? Thanks for any help. -- MAT

2 1

N-way multimaster replication with 2 masters
by Adrien Futschik 19 Feb '09

19 Feb '09

Hy again ! Still testing n-way multimaster replication with 2 masters. I encountered a situation where my two masters where out of sync. Here is the deal : I have M1(serverID=1) & M2(serverID=2) synced and I am performing adds/modify to both M1 & M2. 1) I stop M2 and make a backup of it with slapcat. 2) I then restart M2. 3) I continue to make updates on M1 & M2. 4) I then stop (kill -INT PID) M2 5) I continue to make updates on M1 6) I then delete all *.bdb etc.. files from M2 7) I use the LDIF backup(see 1)) to restore M2 and then restart it. 8) restart M2 9) all entries modified/added during phase 5) are successfuly replicated to M2, but all entries modified/added on M2 dunring phase 3) are not replicated on M2. This is because those entries have an entryCSN menchening that theses entries where last modified/created on M2 (ex: entryCSN: 20090219091852.789559Z#000000#002#000000) So M1 doesn't send them back to M2 even though they aren't present on M2. The trick I used to force M1 to send these entries to M2 is to change the serverID of M2. In fact, it is like setting up a whole new master. So I changed cn=config olcServerID from M1 before restarting M2 (before 8)) and I modify /appli/projects/m2/openldap_2.4.14/conf/slapd.d/cn=config.ldif also This is the only way I found to make sure that M1 & M2 are really the same again. Any other suggestions ? I didn't found anything in the documentation about that, maybe I missed-it. Adrien

1 0

N-way multimaster error code 53 - shadow context
by Adrien Futschik 19 Feb '09

19 Feb '09

Hy ! it's me again :) I am still testing n-way multi master replication with OpenLDAP 2.4.14. I don't know why I could modify my olcSyncrepl attribute from my data bdb. I am binding with cn=config, and I can modify the olcSyncrepl attribute from olcDatabase={0}config, but not from olcDatabase={1}bdb ! I am getting this error : 08:57:25: Failed to update entry olcDatabase={1}bdb, cn=config Reason: [LDAP: error code 53 - shadow context; no update referral] This appends on both masters. Is this supposed to be like that ? I have configured cn=config to replicate, this should work right ? Adrien

2 3

Usermod problems with ldap
by okossuth＠antel.com.uy 19 Feb '09

19 Feb '09

hi I'm having a problem dealing with usermod and groups stored on my openldap 2.3 server. when I try to change the supplementary group of a user I do: vmlx-jboss-desa:/home # usermod -D 'cn=admin,dc=vmlx-ldapauth-test,dc=in.iantel.com.uy' -G mysql okossuth Enter LDAP Password: LDAP information update failed: Object class violation usermod: User not added to LDAP group `mysql'. vmlx-jboss-desa:/home # I looked into the log of my ldap server and I saw this error: Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify: cn=mysql,ou=Grupos,ou=Teleinformatica,dc=vmlx-ldapauth-test,dc=in.iantel.com.uy Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: add member Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: replace entryCSN Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: replace modifiersName Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: replace modifyTimestamp Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: Entry (cn=mysql,ou=Grupos,ou=Teleinformatica,dc=vmlx-ldapauth-test,dc=in.iantel.com.uy), attribute 'member' not allowed Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: entry failed schema check: attribute 'member' not allowed Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: send_ldap_result: err=65 matched="" text="attribute 'member' not allowed" Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: connection_get(40) Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: connection_get(35) The groups that I have created on the ldap server don't have the member attribute, only the memberUid... Any ideas on how to solve this problem with usermod??? thanks. Saludos, Oskar Kossuth Administrador UNIX ANTEL Telecomunicaciones El presente correo y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo anexando este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender immediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that is not the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy.

2 12

DO script IF ldap-useraccount GETS LOCKED ...
by Axel Werner 19 Feb '09

19 Feb '09

Hi Gurus out there! Is there a Way to have OpenLDAP start a script that kicks in whenever a LDAP User-Object got locked down ?? (through manual lock OR more important, through a intruder detection / x failed logon attempts ) My Problem is that whenever a LDAP Account got locked because of exceeding max. failed logon attempts the corresponding SAMBA Account (same LDAP Object) is still "unlocked". So when however the user cannot log back in to LDAP, he is still able to log in on Windows-workstation (samba) and reset his password. But reseting his SAMBA Password through Windows PC does also reset his LDAP Password through Password-Syncronisation. That means that his Locked LDAP Account is again "unlocked" because Samba's LDAP-Admin reseted the Password of my locked LDAP User. So i want to make sure that if he fucks up his LDAP account , his SAMBA account will also be disabled. Some Hook for a custom script would be fine. But is there something like that ? Any other Ideas how to manage that ? greetings Axel

1 0

Re: N-way replication "dn_callback : entries have identical CSN"
by Jonathan Clarke 19 Feb '09

19 Feb '09

Le Mer 18 février 2009 09:24, Adrien Futschik a écrit : > I then switched to OpenLDAP 2.4.14 and did not have the problem anymore > (same > configuration). I guess this was a bug form 2.4.11. > > Still, I had a few of theses messages in the log : > conn=9 op=1 => bdb_dn2id_add > dn="cn=M2client2(a)laposte.net,ou=clients,o=edf,c=fr" ID=0xb: put failed: > DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock -30995 > > but I also got a few of theses : > dn_callback : entries have identical CSN > cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr > 20090217155418.854085Z#000000#002#000000 > syncrepl_entry: rid=004 be_search (0) > syncrepl_entry: rid=004 cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr > syncrepl_entry: rid=004 entry unchanged, ignored > (cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr) > do_syncrep2: cookie=rid=004,sid=002 > syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) > > Can anyone explain to me why ? is this normal ? > The dn_callback message comes from the master log-file where > "cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr" was inserted. I don't know about the DB_LOCK_DEADLOCK message, but "entries have identical CSN" means that your syncrepl consumer received an entry that is identical to one already present in your DB. This may happen when resynching a database, or it could be that your multi-master setup is causing each server to feed updates back to itself. Make sure the URLs in your syncrepl declarations match the listener URLs to slapd (-h option). Jonathan

2 3

Re: N-way multi-master replication
by Gavin Henry 19 Feb '09

19 Feb '09

----- "Adrien Futschik" <adrien.futschik(a)atosorigin.com> wrote: > I am testing Multi-master replication with two masters. > > If I stop one of them and don't restart it before the end of retry > interval, > the replication process doesn't work anymore. (looks like it is > stopped). > > exemple : > - M1 & M2 are synchronised. > - stop M2 > - add entries to M1 > - wait for retry to fail (retry="5 5 300 5") > - restart M2 > - previously added entries to M1 are replicated to M2 > - modifying M2 (attributes) are not replicated to M1 > > It look like M1 -> M2 : OK and M2 -> M1 : broken > > Is there a way to restart replication after configured retry are over > ? The > solution I found was to restart M1. After that everything seems to > work fine. > > I could set up retry so that the number of retry is very hight, but I > was > wondering if there was a way to restart synchronisation online. "If an error occurs during replication, the consumer will attempt to reconnect according to the retry parameter which is a list of the <retry interval> and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer retry every 60 seconds for the first 10 times and then retry every 300 seconds for the next 3 times before stop retrying. The '+' in <# of retries> means indefinite number of retries until success. If no retry was specified, by default syncrepl retries every hour forever." Why not just change it to retry="60 +" ? -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 6

LDAP + PAM + NSS with groups local and in LDAP
by John Kane 18 Feb '09

18 Feb '09

I am using LDAP + PAM + NSS on Linux, and am trying to use groups defined locally as well as in LDAP. These groups are for (critical) apps that run on the Linux systems. I want to define the group locally as to not have issues when and if LDAP is unavailable. But to manage group members, I want to define the same groups (and gids) in LDAP. The problem is that the group members cannot 'newgrp' to groups in which they are members (LDAP defined) if the groups exists locally. It appears that when the group is defined locally, the server does not check LDAP for group members. In the following example, user 'tester' is a member of groups 'postgres' and 'testgrp' (defined in LDAP), and the group 'testgrp' is also defined locally: [tester]$ groups postgres testgrp [tester]$ grep testgrp /etc/group [tester]$ getent group testgrp testgrp:x:110:tester [tester]$ grep postgres /etc/group postgres:x:110: [tester]$ grep postgres /etc/gshadow postgres:!:: [tester]$ getent group postgres postgres:x:101: As you can see, 'getent group' shows 'tester' is NOT a member of postgres, although 'groups' shows he is. My /etc/nsswitch.conf has: passwd: files ldap shadow: files ldap group: files ldap PAM /etc/pam.d/system-auth has: # testing for groups local and in ldap - 022809 auth required /lib/security/$ISA/pam_group.so debug use_first_pass # auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok nodelay auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so And, in LDAP: [tester]$ ldapsearch -x -b 'ou=groups,o=partner_x,dc=example,dc=net' 'cn=postgres' # extended LDIF # # LDAPv3 # base <ou=groups,o=partner_x,dc= example,dc=net> with scope subtree # filter: cn=postgres # requesting: ALL # # postgres, groups, partner_x, example.net dn: cn=postgres,ou=groups,o=partner_x,dc=example,dc=net objectClass: top objectClass: posixGroup cn:: cG9zdGdyZXMg gidNumber: 110 memberUid: tester description: Postgres DB Group Thanks in advance for any help. John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

password encryption question
by Mike Simonton 18 Feb '09

18 Feb '09

Hello, I want to change the default 'secret' password in the slapd.conf file to something that's encrypted in some way to hide the clear text password for the Manager account. What's the best and easiest way to go about doing this? Is slappasswd the way to not only do this but change passwords for any users in the database, or is ldappasswd the way to go? One other question - does anyone have an example slapd.conf file that uses the /etc/passwd and /etc/shadow files to manage the passwords for openldap, particularly for the Manager account? Thank you for your help! Mike

2 1

N-way multi-master replication
by Adrien Futschik 18 Feb '09

18 Feb '09

I am testing Multi-master replication with two masters. If I stop one of them and don't restart it before the end of retry interval, the replication process doesn't work anymore. (looks like it is stopped). exemple : - M1 & M2 are synchronised. - stop M2 - add entries to M1 - wait for retry to fail (retry="5 5 300 5") - restart M2 - previously added entries to M1 are replicated to M2 - modifying M2 (attributes) are not replicated to M1 It look like M1 -> M2 : OK and M2 -> M1 : broken Is there a way to restart replication after configured retry are over ? The solution I found was to restart M1. After that everything seems to work fine. I could set up retry so that the number of retry is very hight, but I was wondering if there was a way to restart synchronisation online. Thanks in advance, Adrien

1 0

Cache/Proxy/Replicating a distant, slow LDAP server
by Morten Mikkelsen 18 Feb '09

18 Feb '09

Hi. I work at a rather large company that has a rather slow LDAP server that impacts the performance on a wiki-server, I am using. I am playing with the idea of setting up a cache or replication of the company LDAP server locally to reduce time spent performing ldap lookups, but as I am quite new to the world of LDAP and openldap, I have a hard time getting the set-up right. I would like to set up a server that does not impose any requirements on the existing (slow) server at all. I only need a read-only server - updates are made on the slow 'master' - and only a few percent of the records are interesting to our wiki. Having looked at caching and proxying, I ended up at setting my mind on replication. As the master is out-of-bounds except for ldap queries (no slurping-logs), the syncrepl-option seems to be the way to go. I just can't get my head around the configuration. The master LDAP has the following structure (as I see it) o=company.com -> ou=commondirectory -> c=xx Under commondirectory, all countries (such as 'dk', 'us' and a whole bunch of others) are represented with the employees residing in them listed below. o=company.com -> ou=companygroups -> ou=groupmembers contain groups that are used for controlling access to the wiki pages. So what I need to have on my replicated server is: The groups and people in the countries 'us' and 'dk'. To start off easy, I try to replicate the c=dk at first - I've tried adding the following to /etc/ldap/slapd.conf syncrepl rid=111 provider=ldap://ldap.company.com:389 type=refreshOnly interval=00:12:00:00 searchbase="c=dk,ou=commondirectory,o=company.com" scope=one updatedn="c=dk,ou=commondirectory,o=company.com" which make the server start without errormessages, but when I query with ldapsearch -x -h 127.0.0.1 -b "c=dk,ou=commondirectory,o=company.com" '(objectClass=*)' I get no result: "result: 32 No such object" What am I doing wrong? -- /Morten

3 3

N-way replication "dn_callback : entries have identical CSN"
by Adrien Futschik 18 Feb '09

18 Feb '09

Hy ! I am still working on n-way multi master replication. I am using refreshAndPersist mode with to masters. My first test was to inject in parallel 2 x 500 entries to the first master and also 2 x 500 entries to the second master. The goal is to see how the replication behaves when massive adds are performed to both masters. When I used OpenLDAP 2.4.11, I suffered lost. The 1000 entries where successfully added on each master, but a few entries where lost in the replication process. I didn't found any "errors" in the log, even with debug on. The only suspect messages I had, where like this : => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) => bdb_dn2id_add 0x543: parent (ou=clients,o=edf,c=fr) insert failed: -30995 I then switched to OpenLDAP 2.4.14 and did not have the problem anymore (same configuration). I guess this was a bug form 2.4.11. Still, I had a few of theses messages in the log : conn=9 op=1 => bdb_dn2id_add dn="cn=M2client2(a)laposte.net,ou=clients,o=edf,c=fr" ID=0xb: put failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock -30995 but I also got a few of theses : dn_callback : entries have identical CSN cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr 20090217155418.854085Z#000000#002#000000 syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr syncrepl_entry: rid=004 entry unchanged, ignored (cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr) do_syncrep2: cookie=rid=004,sid=002 syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Can anyone explain to me why ? is this normal ? The dn_callback message comes from the master log-file where "cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr" was inserted. Thanks in advance, Adrien Futschik

1 0

slapd connection_read: no connection; tcp time_wait state
by James Bagley 18 Feb '09

18 Feb '09

Hi! This is an interesting one... I have an OpenLDAP 2.4.12 server as a consumer in a two node cluster. It's sole function is to answer queries for our mail hub for recipient validation. We see about 50-300 queries / second and occasional spikes. Unfortunately, our mail hub appliances (vendor name left out to protect the guilty) are somewhat inefficient in ldap connection handling and are opening a new TCP connection for every single ldap query. It does this even when there are multiple recipients in one smtp session (boggles the mind!). A percentage of these connections don't get closed properly and I get the following error in the syslog: slapd[23108]: connection_read(18): no connection! The reason is that the connections are in a time_wait state because they were not closed properly. They go away in 60 seconds, but with the load this server gets we continuously have several hundred tcp connections in a time_wait state and a system log full of the above errors. I'm attaching two packet captures: time_wait.cap - filtered a single complete tcp session that ended with the port in a time_wait condition. no_time_wait.cap - control capture for reference. This session closed properly. I can't claim to have the greatest understanding of 3-way / 4-way tcp open / close handshakes. But, one thing that I did notice that seems to be consistent among the sessions that end in time_wait is that the fin-ack is initiated by the server. Possibly i'm reading it wrong, but doesn't the client normally initiate the close? and the server does a passive close? So, in theory the server should never have to wait for the client. Could someone more knowledgeable than me tell me why the server might initiate the active close? thanks, -james

1 0

LDAP Group
by Paul bob 16 Feb '09

16 Feb '09

I have created group called readonly1 in ldap server and added ldap user "jimmy" member of that group. When I try to access he is not getting ldap group access. Whereas I created local group readonly1 and added jimmy" into that group it works fine. dn: cn=readonly1,ou=Group,dc=ndmacb,dc=local objectClass: posixGroup objectClass: top cn: readonly1 gidNumber: 550 memberUid: jimmy Am I missing any config in ldap side? Thanks for your help! - PB

1 0

Howto monitor n-way replication ?
by a.schild＠aarboard.ch 16 Feb '09

16 Feb '09

Hello, during the last years we used a open ldap setup with snycrepl for 3 servers. We monitored them with nagios (http://www.nagiosexchange.org/cgi-bin/page.cgi?g=Detailed%2F2477.html;d=1) with success. Now we changed our setup to a n-way master setup and also wish to monitor replication via nagios. Monitoring the contextcsn value seems to not be usefull in a n-way setup. Any ideas/hints how we can monitor the n-way replication ? Thanks André

1 0

connection.c segfault with new sasl mechanism
by Francesco Grossi ITQL 16 Feb '09

16 Feb '09

Dear team We hope you can help us in discovering where or how we are wrong. We are providing a new sasl mechanism for third party strong authentication and we are in the final delivery step. We are current with openldap 2.3.38. We used strong authentication server to carry out the authorization part of the mech and our backside (sasl client) is Openldap 2.3.38. On the client side we have pam-ldap+ssh. sasl libs are cyrus 2.1.22 os is linux red-hat cent-os 4.7 final During our functional and stress tests everything works fine but once in a while when openldap crashes and this happens only, but not always, under a certain condition: Before explaining such a condition we would like to establish the meaning of some terms: 1) straight authentication session: a simple (not interactive) authentication, being either successfull or not (right or wrong passcode) 2) interactive authentication session: a complex (interactive) authentication with iterated tcp/ip requests such as next-token or new-pin Crash scenario: one ore more straight authentication scripts are running in parallel, emulating parallel ssh authentication sessions with either right or wrong passcode; one interactive authentication session: in the error-originating session the whole user back-and-forth got his way to the authentication server, that is to say next-token or new-pin procedure comes to a complete end: user gives its next token or new pin (twice) and the strong authentication is fully accomplished and reported by the authentication manager. What is wrong is that (by average 2 attempts out of 3) make openldap crash. Sasl speaking our server-step mechanism closes fine and we expect its dispose step to be called by openldap (by the sasl_server_end) That is not going to happen being Openldap crashed meanwhile. Again this happens only but not always when the stress scripts are running. Does it smell of thread concurrency and safety? Our different use cases tests run almost always successfully when done individually or in parallel but manually (real people operating). Conversely when stress test are going on the problem arise very often but not always. We had the Opeldap crash both on linux and solaris installations though on linux the crash happens some steps earlier than with solaris. On linux we have had the opportunity to rebuild openldap with some debug instruction inside. what came out is connection.c crashing at: op->o_tmpfree( op->orb_edn.bv_val, op->o_tmpmemctx ); in both successful and error cases either the values passed and the function address look alike. op->orb_edn.bv_val shows the distinguished name of the user just logged in (op->orb_edn.bv_len is correctly set with its length). Based on the function name we guess ldap is about to free the DN allocated storage. On Solaris9 we had the segfault symptom but we have some more line on the log, one of which shows a almost empty DN (!!!) made just of uid="" GDB has the following from the linux core dump: gdb -c core.5785 GNU gdb Red Hat Linux (6.3.0.0-1.159.el4rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu". Core was generated by `/usr/sbin/slapd -h ldap:///'. Program terminated with signal 11, Segmentation fault. #0 0x00268934 in ?? () THE FOLLOWING CODE IS AN EXCERPT OF THE FINAL SERVER_MECH_STEP FUNCTION OF THE MECHANISM WHICH RUN BEHIND THE SASL_SERVER_STEP ONLY WHEN CRASH HAPPENS: static int mymech_server_mech_step(void *conn_context __attribute__((unused)), sasl_server_params_t *params, const char *clientin, unsigned clientinlen, const char **serverout, unsigned *serveroutlen, sasl_out_params_t *oparams) { server_context_t *text = (server_context_t *) conn_context; *serverout = NULL; *serveroutlen = 0; oparams->doneflag = 1; oparams->mech_ssf = 0; oparams->maxoutbuf = 0; oparams->encode_context = NULL; oparams->encode = NULL; oparams->decode_context = NULL; oparams->decode = NULL; oparams->param_version = 0; oparams->authid = text->authid; return SASL_OK; } SLAPD.LOG OF THE CRASH CASE (WITH OUR ADDED SYSLOGS): Feb 4 12:09:15 yavcentos slapd: SASL [conn=48] Debug MMYMECH====================== SERVER mymech_server_mech_step END == Feb 4 12:09:15 yavcentos mymech: sasl.c label slap_sasl_authorize Feb 4 12:09:15 yavcentos slapd: SASL proxy authorize [conn=48]: authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:09:15 yavcentos slapd: conn=48 op=4 BIND authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:09:15 yavcentos slapd: SASL Authorize [conn=48]: proxy authorization allowed authzDN="" Feb 4 12:09:15 yavcentos mymech: sasl.c label1 Feb 4 12:09:15 yavcentos mymech: result.c label2 Feb 4 12:09:15 yavcentos slapd: send_ldap_sasl: err=0 len=-1 Feb 4 12:09:15 yavcentos mymech: result.c label6a Feb 4 12:09:15 yavcentos mymech: result.c label61 Feb 4 12:09:15 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:09:15 yavcentos mymech: result.c label61b Feb 4 12:09:15 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x8926cb0 rs=0x17551a0 Feb 4 12:09:15 yavcentos mymech: connection.c label1 Feb 4 12:09:15 yavcentos mymech: connection.c label1a Feb 4 12:09:15 yavcentos mymech: connection.c label11a Feb 4 12:09:15 yavcentos mymech: connection.c label111a Feb 4 12:09:15 yavcentos mymech: connection.c label12a Feb 4 12:09:15 yavcentos mymech: connection.c label12a op->o_tmpfree=0x809c3e8 op->orb_edn.bv_val=uid=alfredo@yavcentos,ou= people,dc=my-domain,dc=com op->orb_edn.bv_len=51 op->o_tmpmemctx=0x8926c10 (slab malloc context) END SLAPD.LOG OF A SUCCESSFUL LOGIN CASE (WITH OUR ADDED SYSLOGS): Feb 4 12:13:13 yavcentos mymech: sasl.c label slap_sasl_authorize Feb 4 12:13:13 yavcentos slapd: SASL proxy authorize [conn=3]: authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:13:14 yavcentos slapd: conn=3 op=4 BIND authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:13:14 yavcentos slapd: SASL Authorize [conn=3]: proxy authorization allowed authzDN="" Feb 4 12:13:14 yavcentos mymech: sasl.c label1 Feb 4 12:13:14 yavcentos mymech: result.c label2 Feb 4 12:13:14 yavcentos slapd: send_ldap_sasl: err=0 len=-1 Feb 4 12:13:14 yavcentos mymech: result.c label6a Feb 4 12:13:14 yavcentos mymech: result.c label61 Feb 4 12:13:14 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:13:14 yavcentos mymech: result.c label61b Feb 4 12:13:14 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x86667b8 rs=0x51271a0 Feb 4 12:13:14 yavcentos mymech: connection.c label1 Feb 4 12:13:14 yavcentos mymech: connection.c label1a Feb 4 12:13:14 yavcentos mymech: connection.c label11a Feb 4 12:13:14 yavcentos mymech: connection.c label111a Feb 4 12:13:14 yavcentos mymech: connection.c label12a Feb 4 12:13:14 yavcentos mymech: connection.c label12a op->o_tmpfree=0x809c3e8 op->orb_edn.bv_val=uid=alfredo@yavcentos,ou= people,dc=my-domain,dc=com op->orb_edn.bv_len=51 op->o_tmpmemctx=0x86660c0 (slab malloc context) Feb 4 12:13:14 yavcentos mymech: connection.c label13a Feb 4 12:13:14 yavcentos mymech: connection.c label14a Feb 4 12:13:14 yavcentos mymech: connection.c label15a Feb 4 12:13:14 yavcentos mymech: connection.c label151a Feb 4 12:13:14 yavcentos mymech: connection.c label151b Feb 4 12:13:14 yavcentos mymech: connection.c label2 Feb 4 12:13:14 yavcentos slapd: conn=3 op=4 BIND dn="uid=alfredo@yavcentos,ou=people,dc=my-domain,dc=com" mech=MYMECH sasl_ ssf=0 ssf=0 Feb 4 12:13:14 yavcentos slapd: do_bind: SASL/MYMECH bind: dn="uid=alfredo@yavcentos,ou=people,dc=my-domain,dc=com" sasl_ss f=0 Feb 4 12:13:14 yavcentos mymech: connection.c label3 Feb 4 12:13:14 yavcentos mymech: result.c label61c Feb 4 12:13:14 yavcentos mymech: result.c label61d Feb 4 12:13:14 yavcentos mymech: result.c label61d2 Feb 4 12:13:14 yavcentos mymech: result.c label61e Feb 4 12:13:14 yavcentos slapd: send_ldap_response: msgid=5 tag=97 err=0 Feb 4 12:13:14 yavcentos mymech: result.c label1 Feb 4 12:13:14 yavcentos mymech: result.c label11 Feb 4 12:13:14 yavcentos mymech: result.c label12 Feb 4 12:13:14 yavcentos mymech: result.c label13 Feb 4 12:13:14 yavcentos mymech: result.c label14 Feb 4 12:13:14 yavcentos mymech: result.c label14e Feb 4 12:13:14 yavcentos mymech: result.c label14f Feb 4 12:13:14 yavcentos mymech: result.c label14g Feb 4 12:13:14 yavcentos mymech: result.c label14h Feb 4 12:13:14 yavcentos mymech: result.c label15 Feb 4 12:13:14 yavcentos mymech: result.c label16 Feb 4 12:13:14 yavcentos mymech: result.c label18 Feb 4 12:13:14 yavcentos mymech: result.c label19 Feb 4 12:13:14 yavcentos mymech: result.c label20 Feb 4 12:13:14 yavcentos mymech: result.c label21 Feb 4 12:13:14 yavcentos mymech: result.c label6b e qui2 Feb 4 12:13:14 yavcentos mymech: daemon: activity on 1 descriptor Feb 4 12:13:15 yavcentos slapd: daemon: activity on: Feb 4 12:13:15 yavcentos slapd: 13r Feb 4 12:13:15 yavcentos slapd: Feb 4 12:13:15 yavcentos slapd: daemon: read active on 13 Feb 4 12:13:15 yavcentos slapd: connection_get(13) Feb 4 12:13:15 yavcentos slapd: connection_get(13): got connid=3 Feb 4 12:13:15 yavcentos slapd: connection_read(13): checking for input on id=3 Feb 4 12:13:15 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:15 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 4 12:13:15 yavcentos slapd: conn=3 op=4 RESULT tag=97 err=0 text= Feb 4 12:13:15 yavcentos mymech: sasl.c label4 Feb 4 12:13:15 yavcentos slapd: <== slap_sasl_bind: rc=0 Feb 4 12:13:15 yavcentos mymech: bind.c do_bind label1 Feb 4 12:13:15 yavcentos slapd: do_bind Feb 4 12:13:15 yavcentos slapd: conn=3 op=5 BIND anonymous mech=implicit ssf=0 Feb 4 12:13:15 yavcentos slapd: >>> dnPrettyNormal: <> Feb 4 12:13:15 yavcentos slapd: <<< dnPrettyNormal: <>, <> Feb 4 12:13:15 yavcentos slapd: do_bind: version=3 dn="" method=128 Feb 4 12:13:15 yavcentos slapd: conn=3 op=5 BIND dn="" method=128 Feb 4 12:13:15 yavcentos mymech: sasl.c label slap_sasl_reset Feb 4 12:13:15 yavcentos slapd: send_ldap_result: conn=3 op=5 p=3 Feb 4 12:13:15 yavcentos slapd: send_ldap_result: err=0 matched="" text="" Feb 4 12:13:15 yavcentos mymech: result.c label22a Feb 4 12:13:15 yavcentos mymech: result.c label61 Feb 4 12:13:15 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:13:15 yavcentos mymech: result.c label61b Feb 4 12:13:15 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x8668158 rs=0x2afc1a0 Feb 4 12:13:15 yavcentos mymech: connection.c label1 Feb 4 12:13:15 yavcentos mymech: connection.c label3 Feb 4 12:13:15 yavcentos mymech: result.c label61c Feb 4 12:13:15 yavcentos mymech: result.c label61d Feb 4 12:13:15 yavcentos mymech: result.c label61d2 Feb 4 12:13:15 yavcentos mymech: result.c label61e Feb 4 12:13:15 yavcentos slapd: send_ldap_response: msgid=6 tag=97 err=0 Feb 4 12:13:15 yavcentos mymech: result.c label1 Feb 4 12:13:15 yavcentos mymech: result.c label11 Feb 4 12:13:15 yavcentos mymech: result.c label12 Feb 4 12:13:15 yavcentos mymech: result.c label13 Feb 4 12:13:15 yavcentos mymech: result.c label14 Feb 4 12:13:15 yavcentos mymech: result.c label14e Feb 4 12:13:15 yavcentos mymech: result.c label14f Feb 4 12:13:15 yavcentos mymech: result.c label14g Feb 4 12:13:15 yavcentos mymech: result.c label14h Feb 4 12:13:15 yavcentos mymech: result.c label15 Feb 4 12:13:15 yavcentos mymech: result.c label16 Feb 4 12:13:15 yavcentos mymech: result.c label18 Feb 4 12:13:15 yavcentos mymech: result.c label19 Feb 4 12:13:16 yavcentos mymech: result.c label20 Feb 4 12:13:16 yavcentos mymech: result.c label21 Feb 4 12:13:16 yavcentos mymech: result.c label22b Feb 4 12:13:16 yavcentos mymech: result.c label5 e qui1 Feb 4 12:13:16 yavcentos slapd: conn=3 op=5 RESULT tag=97 err=0 text= Feb 4 12:13:16 yavcentos slapd: do_bind: v3 anonymous bind Feb 4 12:13:15 yavcentos mymech: daemon: activity on 1 descriptor Feb 4 12:13:16 yavcentos slapd: daemon: activity on: Feb 4 12:13:16 yavcentos slapd: 13r Feb 4 12:13:16 yavcentos slapd: Feb 4 12:13:16 yavcentos slapd: daemon: read active on 13 Feb 4 12:13:16 yavcentos slapd: connection_get(13) Feb 4 12:13:16 yavcentos slapd: connection_get(13): got connid=3 Feb 4 12:13:16 yavcentos slapd: connection_read(13): checking for input on id=3 Feb 4 12:13:16 yavcentos slapd: ber_get_next on fd 13 failed errno=0 (Success) Feb 4 12:13:16 yavcentos slapd: connection_read(13): input error=-2 id=3, closing. Feb 4 12:13:16 yavcentos slapd: connection_closing: readying conn=3 sd=13 for close Feb 4 12:13:16 yavcentos slapd: connection_close: conn=3 sd=-1 Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_close Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:16 yavcentos slapd: SASL [conn=-1] Debug: MMYMECHSERVER mymech_server_mech_dispose Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:16 yavcentos slapd: SASL [conn=-1] Error: MMYMECHSERVER mymech_server_mech_dispose: start - receives *conn_co ntext=0x8666a10 *utils=0x8666188 Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:17 yavcentos slapd: SASL [conn=-1] Error: MMYMECHSERVER mymech_server_mech_dispose Feb 4 12:13:17 yavcentos slapd: daemon: removing 13 Feb 4 12:13:17 yavcentos slapd: conn=3 fd=13 closed (connection lost) Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: activity on 1 descriptor Feb 4 12:13:17 yavcentos slapd: daemon: activity on: Feb 4 12:13:17 yavcentos slapd: Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL END Compile and link options of mymech: gcc -I ..... -v -Wall -W -O2 -MT mymech.lo -MD -MP -MF .deps/mymech.Tpo -c mymech.c -fPIC -DPIC -o mymech.lo gcc -shared mymech.lo mymech _init.lo plugin_common.lo -lpthread -lcrypt -lresolv -lc -Wl,-soname -Wl,lib mymech.so.2 -o .libs/lib mymech.so.2.0.22 Would you have a clue or a though for us about some further check to do over either our code or compile options, (maybe particularly on the thread-safe topic)? Would you suggest some thread safe programming strategy? Many many thanks Francesco Grossi

2 6

Question about subtree renaming
by Philipp Foeckeler 14 Feb '09

14 Feb '09

Hi, Could someone explain me please the prerequisites for subtree renames/moves support by slapd (LDAP ModifyDN for non-leaf objects)? Currently i use slapd 2.2.6-37.19 with bdb backend without. What backend do i need to support subtree renames/moves? What slapd versions could support it? Do i need any special config for this? I understand that Overlay salpo-refint would be a good idea, any other overlays i should use then? Thank you, Philipp

2 1

OpenLDAP coredumps on startup (Solaris 10)
by Daniel Hoffend 14 Feb '09

14 Feb '09

Hello I'm setting up an openldap directory server (2.4.13) including a 2nd one for as backup/failover partner. After i compiled everything, installing, configuring everything (database, sync, schema, etc) and imported the basic LDAP Layout (ou=Users,ou=Groups, etc), I wanted to use this directory as Userdirectory for Userauthentication on ldap. I was switching user/group lookups using the 'ldapclient' command and modified to /etc/nsswitch.conf to refer for "files ldap" for passwd and group. Everything seems to work. 'genent passwd' and 'getent group' is listing my ldap user and groups. But when i try to restart the slapd server it crashes sometimes with a coredump. ---------------------------------------------------------------------- # /usr/local/libexec/slapd -d 65535 -u openldap -g openldap @(#) $OpenLDAP: slapd 2.4.13 (Jan 30 2009 12:02:48) $ root@ldapserver:/usr/local/src/openldap-2.4.13/servers/slapd ldap_pvt_gethostbyname_a: host=ldapserver, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened ldap_create Bus Error (core dumped) ---------------------------------------------------------------------- Not everytime, sometimes several times in a row, sometimes after a 2nd start. I've no clue what it could be. In the ldap logfile, i found the 2 following lines ---------------------------------------------------------------------- an 30 16:26:56 ldapserver slapd[9494]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported Jan 30 16:26:56 ldapserver slapd[9494]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported ---------------------------------------------------------------------- I started to run the slapd server using "truss" to see when the server starts to coredump. ---------------------------------------------------------------------- # truss /usr/local/libexec/slapd -d 65535 -u openldap -g openldap [...] open("/etc/nsswitch.conf", O_RDONLY|O_LARGEFILE) = 9 fcntl(9, F_DUPFD, 0x00000100) Err#22 EINVAL read(9, " #\n # C o p y r i g h".., 1024) = 1024 read(9, " g u r e i t o u t ".., 1024) = 245 read(9, 0xFF092400, 1024) = 0 close(9) = 0 fstat(3, 0xFFBFCAE8) = 0 time() = 1233329411 getpid() = 9512 [9511] putmsg(3, 0xFFBFC1A0, 0xFFBFC194, 0) = 0 open("/var/run/syslog_door", O_RDONLY) = 9 door_info(9, 0xFFBFC0D8) = 0 getpid() = 9512 [9511] door_call(9, 0xFFBFC0C0) = 0 close(9) = 0 fstat(3, 0xFFBFCB88) = 0 time() = 1233329411 getpid() = 9512 [9511] putmsg(3, 0xFFBFC240, 0xFFBFC234, 0) = 0 open("/var/run/syslog_door", O_RDONLY) = 9 door_info(9, 0xFFBFC178) = 0 getpid() = 9512 [9511] door_call(9, 0xFFBFC160) = 0 close(9) = 0 Incurred fault #5, FLTACCESS %pc = 0x0008E1FC siginfo: SIGBUS BUS_ADRALN addr=0x00000191 Received signal #10, SIGBUS [default] siginfo: SIGBUS BUS_ADRALN addr=0x00000191 ---------------------------------------------------------------------- It looks like after reading nsswitch.conf, the server starts to crash. I changed the following lines in the nsswitch.conf and the server starts fine without any further problems. (even 20x in a row) ---------------------------------------------------------------------- Before: group files ldap After: group files ---------------------------------------------------------------------- Another thing is: If the server could startup without problems, it never crashed again. It's only sometimes during the initial startup. I would be happy if anyone could help me or point me what i could adjust. If needed i could provide more information. -- Best regards Daniel Hoffend

6 10

run time link options
by Brett ＠Google 14 Feb '09

14 Feb '09

Is there any likelyhood of -R${PREFIX}/lib making it into the default build options to help mitigate system library mismatches ? Likewise a -with-bdb-home=/my/berkeley/home, which results in a -L/my/berkeley/home/lib and/or -R/my/berkeley/home/lib option being added to the LDFLAGS variable (-L in the case of a static build, -L and -R in the case of a dynamic build) and -I/my/berkeley/home/include being added to CPPFLAGS ? I guess -R may not be available on every platform, buy maybe the presence of -R is detectable ?

1 0

upgrading an openldap v1 ldbm database to a v2 bdb database?
by Kevin Martin 13 Feb '09

13 Feb '09

So I've got an openldap v1 database with .oc.conf and .at.conf files describing the database that get included in the slapd.conf and I need to be able to migrate to a v2 database (bdb or ldbm, I don't care which). I find no mention of how to migrate the .oc and/or .at file entries to a usable .schema/(s) file(s) and I apparently can't ldapsearch and dump the schema from the old database (using ldapsearch -b cn=schema -L “(objectclass=*)” )...it doesn't find a cn=schema. I can copy the ldbm format ldap database lock, stock, and barrel from the old machine to a new machine but ldap2 won't allow me to include the .at.conf and .oc.conf files that describe the database. I've also dumped the old database entries into a .ldif file at this point but have nowhere to import it to. All constructive thoughts appreciated. Kevin

3 2

Can OpenLDAP get password from AD
by Duong Pham Tung 13 Feb '09

13 Feb '09

Hi, I am building a solution for web-based application authentication using OpenLDAP as a backend data source. But, in my case, OpenLDAP acts as a proxy and all user information are stored on AD servers. I can get some field from AD to OpenLDAP, but it is not enough for my apps to authentication user because OpenLDAP can’t get password field from ADs. So, can OpenLDAP have other solutions to solve my problem? Thanks and Best regards, Phạm Tùng Dương

5 5

kerberosSecurityObject object Class
by Chavez, James R. 12 Feb '09

12 Feb '09

Hello List, I am inquiring about the kerberosSecurityObject object class and the krbName Attribute type. How can these be utilized in the LDAP environment? I do have an associated kerberos realm that I would not mind using for authentication. Can these help me to leverage this? Any pointers to documentation is appreciated as are any explanations. I have extended the OPenLDAP schema to include the kerberos schema in a test environment but am unsure how to leverage it. Thanks James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

1 0

Multiple Databases not replicating.
by Tom Cooper 12 Feb '09

12 Feb '09

Hi all, I am running openldap-2.4.12 in a mirror configuration with each master also having a slave updated with syncrepl. Each master contains multiple databases but replication between the masters happens only for the first database. I have checked my configuration and there is nothing obvious. An extract of my slapd.conf follows: # Free Radius OpenLDAP Server database bdb suffix "dc=radius,dc=xxxxxxx,dc=co,dc=za" rootdn "cn=Manager,dc=radius,dc=xxxxxxxx,dc=co,dc=za" directory /var/lib/ldapradius rootpw XXXXXXXXX access to * by * read overlay syncprov syncprov-checkpoint 5 1 syncrepl rid=001 provider=ldap://dev-ldap-master-03.xxxxxxxx.co.za bindmethod=simple binddn="cn=Manager,dc=radius,dc=xxxxxxxxx,dc=co,dc=za" credentials=XXXXXXXXXX searchbase="dc=radius,dc=xxxxxxxxx,dc=co,dc=za" schemachecking=off type=refreshAndPersist interval=00:00:05:00 retry="60 +" mirrormode true # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq ################################################################### # Portal OpenLDAP Server database bdb suffix "dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" rootdn "cn=Manager,dc=portal,dc=xxxxxxxxxxx,dc=co,dc=za" directory /var/lib/ldapPortal rootpw XXXXXXXXXXXXXXXX access to * by * read overlay syncprov syncprov-checkpoint 5 1 syncrepl rid=002 provider=ldap://dev-ldap-master-03.xxxxxxxxxxx.co.za bindmethod=simple binddn="cn=Manager,dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" credentials=XXXXXXXXXXX searchbase="dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" schemachecking=off type=refreshAndPersist interval=00:00:05:00 retry="60 +" mirrormode true # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index fnbConnectProfileId eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq Thanks, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

1 0

LDAP at the UKUUG Spring 2009 Conference
by Andrew Findlay 11 Feb '09

11 Feb '09

The UKUUG Spring 2009 Conference (24-26 March 2009 in London) has a strong LDAP flavour. OpenLDAP and other LDAP technologies are covered by several papers: * OpenLDAP Replication Strategies Gavin Henry (Suretec Systems & OpenLDAP project) * OpenLDAP and MySQL: Bridging the Data Model Divide Howard Chu (Symas Corp. & OpenLDAP project) * Writing Access Control Policies for LDAP Andrew Findlay (Skills 1st) * Securing Access to UNIX, Linux and Mac with Active Directory Barry Scott (Centrify) There is also a Kerberos tutorial and several papers on systems monitoring. The programme is here: http://www.ukuug.org/events/spring2009/programme/ Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Openldap RWM/AD Bind
by Chris Natter 11 Feb '09

11 Feb '09

Hi, I'm hoping someone can help me out on this. At the moment I have this setup: database ldap suffix "ou=foo.com,o=mail" uri "ldap://4.4.4.4:389/" rootdn "cn=Overlord,dc=foo,dc=com" idassert-bind bindmethod=simple binddn="cn=BAR LDAP Proxy Account,cn=Users,dc=bar,dc=local" credentials="w00tz0r" mode=none flags=override,prescriptive rebind-as-user yes overlay rwm rwm-suffixmassage "dc=bar,dc=local" rwm-map attribute proxyAddresses * rwm-map attribute sAMAccountName * rwm-map attribute cn * rwm-map attribute givenName * rwm-map attribute mail * rwm-map attribute sn * rwm-map attribute * 4.4.4.4 is an Active Directory server. This seems to work fine for simple searches and the like again ou=foo.com,o=mail, however I need to setup an application against it. The way the application works for authentication is it uses an openldap service account, finds the user's email address in the directory via proxy, then tries to rebind as that user to the directory via proxy. I'm imagining this setup doesn't work because of the service account handling the bind for the actual directory search transparently, you can't just bind as a user through it. (specifically, I get inappropriateAuthentication/error code 48) Is there a way to implement what I need? Thanks for any help in advance. -Chris

1 0

ssh certificate ldap
by Peter Gordon 11 Feb '09

11 Feb '09

Hi. I have the following setup: pam.d/ssh #%PAM0.0 auth required /lib/security/pam_nologin.so auth sufficient /lib/security/pam_ldap.so auth required /lib/security/pam_unix_auth.so try_first_pass account [success=ok perm_denied=die default=ignore] /lib/security/pam_ldap.so account required /lib/security/pam_unix_acct.so password sufficient /lib/security/pam_ldap.so session required /lib/security/pam_unix_session.so User logins are filtered by the line pam_filter in /etc/ldap.conf. All the conf files are soft links to this file. The configuration works for a user without a certificate. Which is to say, users belonging to the correct group as defined in the filter can login, others cannot. If the user has an ssh certificate pair, and the public key appears on the target, and there is no password needed, the pam_filter is not used. Is there any way to ensure that even users with certificates have to pass the pam_filter? Thanks, Peter

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical