- openldap-technical - openldap.org

API to read config file before ldap_search.
by Santosh Kumar 12 Mar '09

12 Mar '09

Dear friends,looking to where we could specify config file path to be read by  ldapsearch.c  to /openldap/ldap.conf  will be trying to pass the query to ldapclient and obtain the result. should we write program starting from ldap_open , ldap_init, ldap_bind , ldap_search  or its suffice only by modifying ldapsearch.c.RegardsSantosh

2 1

what ldap configuration paramentrs for ldapclient
by Santosh Kumar 12 Mar '09

12 Mar '09

Hi,  bharath , thanks for the link,command  working fine ,ldapsearch -v -x -W -h 10.10.20.50 -D cn=testuser1,ou=testusers,dc=kpairtest,dc=local -b ou=testusers,dc=kpairtest,dc=localwhat is binddn  , rootbinddn , basepart that needs to be specified in ldap.conf for openldap client,can we  have either in /etc/ldap.conf or  /etc/openldap/ldap.conf  ?and does ldapsearch()  automatically looks for configuration in /etc/ldap.confThanksSantosh Kumar Sr Software Engineer On Tue, 10 Mar 2009 05:21:58 -0400 "Kantrapati, Bharath" wrote Hi santosh,   Your mail is not clear , what is it you are exactly looking for??   But as the error says the objects you are trying to query would require you to bind to the active directory with a set of credentials.   Regards Bharath   From: openldap-technical-bounces+bharath.kantrapati=gs.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+bharath.kantrapati=gs.com@OpenLDAP.org] On Behalf Of Santosh Kumar Sent: Tuesday, March 10, 2009 11:39 AM To: openldap-technical(a)openldap.org Subject: ldap-client connection to AD - LdapErr: DSID-0C090627,   Trying to query Active Directory  via command line for searching all Please let me know what this error refers to ./ldapsearch  -h 10.10.10.50 -b "ou=users,DC=SFBAY,DC=tech,DC=com"  -s sub "objectclass=*" # extended LDIF # # LDAPv3 # base with scope subtree # filter: objectclass=* # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope  ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1  i'm  looking to extract -b option and -D from AD Please if anyone is aware let me know. Thanks Santosh  

1 0

Developing client in c
by Michael Luich 11 Mar '09

11 Mar '09

Hello Everyone, I'm trying to develop my application in c. And since I've never done LDAP before I thought i'd do a test program to work out the how's of retrieving from an ldap directory. in this case I'm pulling a X509 certificate from the verisign directory. I successfully run the search and can retrieve the data, but the certificate;binary is incomplete. I've tried a number of different things but cannot seem to get the whole certificate. Below is the hard coded test program, and any help would be greatly appreciated! -- Michael Luich Stone's Rose mluich(a)stonesrose.com #include <stdio.h> #include "ldap.h" /* Specify the search criteria here. */ #define HOSTNAME "directory.verisign.com" #define PORTNUMBER 389 #define BASEDN "" #define SCOPE LDAP_SCOPE_SUBTREE #define FILTER "(mail=mluich(a)stonesrose.com)" char *encode_64 (char *message); int main (int argc, char **argv) { LDAP *ld; LDAPMessage *result, *e; char *dn, *cert; char **vals; int rc; LDAPMessage *res; char *a; int version, i; BerElement *ber; // /* Print out an informational message. */ // // printf ("Connecting to host %s at port %d...\n\n", HOSTNAME, PORTNUMBER); /* STEP 1: Get a handle to an LDAP connection and set any session preferences. */ if ((ld = ldap_init (HOSTNAME, PORTNUMBER)) == NULL) { perror ("ldap_init"); return (1); } /* Use the LDAP_OPT_PROTOCOL_VERSION session preference to specify that the client is an LDAPv3 client. */ version = LDAP_VERSION3; ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version); /* STEP 2: Bind to the server. In this example, the client binds anonymously to the server (no DN or credentials are specified). */ rc = ldap_simple_bind_s (ld, NULL, NULL); if (rc != LDAP_SUCCESS) { fprintf (stderr, "ldap_simple_bind_s: %s\n", ldap_err2string (rc)); return (1); } /* STEP 3: Perform the LDAP operations. In this example, a simple search operation is performed. The client iterates through each of the entries returned and prints out the DN of each entry. */ rc = ldap_search_ext_s (ld, BASEDN, SCOPE, FILTER, NULL, 0, NULL, NULL, NULL, 0, &result); if (rc != LDAP_SUCCESS) { fprintf (stderr, "ldap_search_ext_s: %s\n", ldap_err2string (rc)); return (1); } if ((vals = ldap_get_values_len (ld, result, "usercertificate;binary")) != NULL) { for (i = 0; vals[i] != NULL; i++) { printf ("%d - %s: %s\n", i, a, vals[i]); // if (!strcmp (a, "usercertificate;binary")) // { printf ("%s: %s\nlength: %d\n\n", a, vals[i], sizeof (vals[i])); encode_64 (vals[i]); // } } } else { fprintf (stderr, "ldap_get_values_len: %s\n", ldap_err2string (rc)); } ldap_value_free (vals); ldap_msgfree (result); /* STEP 4: Disconnect from the server. */ ldap_unbind (ld); return (0); } char * encode_64 (char *message) { #include <openssl/bio.h> #include <openssl/evp.h> BIO *bio, *b64; //char message[] = "Hello World \n"; b64 = BIO_new (BIO_f_base64 ()); bio = BIO_new_fp (stdout, BIO_NOCLOSE); bio = BIO_push (b64, bio); BIO_write (bio, message, strlen (message)); BIO_flush (bio); BIO_free_all (bio); }

2 1

Nway multimaster sync having weird functionality
by Mathew Rowley 11 Mar '09

11 Mar '09

I am experiencing some really strange behavior with nway multimaster. Does anyone know why this would be happening? I have 2 boxes set up to sync, called rsa01, rsa02 If I create ou=groups,dc=comcast,dc=com¹ on rsa02, it will create it on rsa01 If I create cn=test,ou=groups,dc=comcast,dc=com¹ on rsa02 it will NOT create on rsa01 If I delete ou=groups,dc=comcast,dc=com¹ on rsa02, it will delete on rsa01 If I create anything on rsa01, it will NOT create on rsa02 I have the sync set up for searchBase¹ set to dc=comcast,dc=com. Here is the olcSyncrepl configuration (for both boxes): dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcbdbConfig olcDatabase: {1}bdb olcSuffix: dc=comcast,dc=com olcDbDirectory: /usr/var/openldap-data/ olcRootDN: cn=Manager,dc=comcast,dc=com olcRootPW: {SSHA}kJTEcfOmPf7fKv71AtxDjlUZNPqN9pIT olcLimits: dn.exact="cn=Manager,dc=comcast,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=004 provider=ldap://10.252.152.76 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="test" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://10.252.152.77 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="test" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov -- MAT

2 4

ldap-client connection to AD - LdapErr: DSID-0C090627,
by Santosh Kumar 10 Mar '09

10 Mar '09

Trying to query Active Directory  via command line for searching all Please let me know what this error refers to./ldapsearch  -h 10.10.10.50 -b "ou=users,DC=SFBAY,DC=tech,DC=com"  -s sub "objectclass=*"# extended LDIF## LDAPv3# base <ou=users,DC=SFBAY,DC=keypairtech,DC=com> with scope subtree# filter: objectclass=*# requesting: ALL## search resultsearch: 2result: 1 Operations errortext: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece# numResponses: 1 i'm  looking to extract -b option and -D from AD Please if anyone is aware let me know.ThanksSantosh

5 8

Mirrormode problem
by Sergio Cioban Filho 10 Mar '09

10 Mar '09

Hi all, I have configured two openldap servers with mirrormode, but no have sync at servers... Any idea about the problem? My configuration files: Server1: serverID 1 syncrepl rid=001 provider=ldap://192.168.170.36:389/ bindmethod=simple binddn="cn=user,dc=teste,dc=com,dc=br" credentials="xxxxx" searchbase="dc=teste,dc=com,dc=br" schemachecking=on type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode on mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Server2: serverID 2 syncrepl rid=001 provider=ldap://192.168.170.25:389/ bindmethod=simple binddn="cn=user,dc=teste,dc=com,dc=br" credentials="xxxxx" searchbase="dc=teste,dc=com,dc=br" schemachecking=on type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode on mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ** Sorry for my poor english. Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------ Vendo GOL G3 PLUS 1.0 8V 4P 2002 - Branco - COMPLETÍSSIMO - Só R$ 18.500,00 http://cioban.googlepages.com/vendogolg38v

1 0

automatic versioning of objects?
by Karsten Kankowski 09 Mar '09

09 Mar '09

Hello dear wise guys :-) Is there any nice feature at Oo-LDAP implemented to get the information if an object is changed; something like a internal version number...??? We would like to use LDAP for storing complex configuration data which can have dependencies. For that a version number for all objects is necessary. Unfortunately these changes must be done also in a safe way which means that a version change must be done in a “atomic operation”. A internal incrementing by the LDAP server seemed to me a quite more simple solution than to try this to handle via the ( say here ~ 6000 concurrent ) clients. By the way: Do anyone implement something like a LDAP server based sequence number which can be queried??? Thanks a lot for your hints... and best regards Karsten (Sorry for the bad English ;-() The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other then the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

Issues when changing LDAP password
by Gustavo Mendes de Carvalho 09 Mar '09

09 Mar '09

Hi there, I'm running an LDAP server version 2.3.39 and I'm using ppolicy to force users in some specific things, but I'm having some issue when I try to change my user's password with passwd command. Here's the output screen [user1@cliserv ~]$ ssh ldapclisrv user1@ldapclisrv's password: Your LDAP password will expire in 10 days. Last login: Wed Mar 4 17:42:18 2009 from cliserv [user1@ldapclisrv ~]$ [user1@ldapclisrv ~]$ [user1@ldapclisrv ~]$ passwd Changing password for user user1. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Can't contact LDAP server Must supply old password to be changed as well as new one passwd: Permission denied [user1@ldapclisrv ~]$ As you can see, I can login using LDAP ID, and I can change user1 password if I use ldappasswd, entering all ldap information, but I would like to make it simpler. Does anybody has any idea ? -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

2 1

Multi-master or MirrorMode
by Sergio Cioban Filho 09 Mar '09

09 Mar '09

Hello all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------

1 0

Multi-master or MirrorMode
by Sergio Cioban Filho 07 Mar '09

07 Mar '09

Hi all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------

1 0

TLSVerifyClient => no login possible
by Sebastian Reinhardt 06 Mar '09

06 Mar '09

Hello, I have configured an openSUSE 11.0 (x86_64) with openldap- server. Also the TLS is activated. All clients are set to "TLS_REQCERT demand" and is working. Then I created client certificates by using the servers Yast2 CA- management. I copied teh client certificates and also the servers "cacert" into the "/etc/openldap/" directory on client computer. With "TLSVerifyClient allow" clients can login, but if I activate the "TLSVerifyClient demand" option in servers slapd.conf no user can perform an login and it causes errors in /var/log/messages: ----------------/var/log/messages---------------- Feb 22 18:50:01 lmvserver slapd[7093]: slap_listener_activate(8): Feb 22 18:50:01 lmvserver slapd[7093]: >>> slap_listener(ldap://) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=107 Feb 22 18:50:01 lmvserver slapd[7093]: conn=107 op=0 do_extended Feb 22 18:50:01 lmvserver slapd[7093]: do_extended: oid=1.3.6.1.4.1.1466.20037 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_extended: err=0 oid= len=0 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_response: msgid=1 tag=120 err=0 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=107 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): TLS accept failure error=-1 id=107, closing Feb 22 18:50:01 lmvserver slapd[7093]: connection_closing: readying conn=107 sd=14 for close Feb 22 18:50:01 lmvserver slapd[7093]: connection_close: conn=107 sd=14 Feb 22 18:50:01 lmvserver slapd[7093]: slap_listener_activate(8): Feb 22 18:50:01 lmvserver slapd[7093]: >>> slap_listener(ldap://) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=108 Feb 22 18:50:01 lmvserver slapd[7093]: conn=108 op=0 do_extended Feb 22 18:50:01 lmvserver slapd[7093]: do_extended: oid=1.3.6.1.4.1.1466.20037 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_extended: err=0 oid= len=0 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_response: msgid=1 tag=120 err=0 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=108 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): TLS accept failure error=-1 id=108, closing Feb 22 18:50:01 lmvserver slapd[7093]: connection_closing: readying conn=108 sd=14 for close Feb 22 18:50:01 lmvserver slapd[7093]: connection_close: conn=108 sd=14 Feb 22 18:50:01 lmvserver slapd[7093]: slap_listener_activate(8): Feb 22 18:50:01 lmvserver slapd[7093]: >>> slap_listener(ldap://) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=109 Feb 22 18:50:01 lmvserver slapd[7093]: conn=109 op=0 do_extended Feb 22 18:50:01 lmvserver slapd[7093]: do_extended: oid=1.3.6.1.4.1.1466.20037 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_extended: err=0 oid= len=0 Feb 22 18:50:01 lmvserver slapd[7093]: send_ldap_response: msgid=1 tag=120 err=0 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14) Feb 22 18:50:01 lmvserver slapd[7093]: connection_get(14): got connid=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): checking for input on id=109 Feb 22 18:50:01 lmvserver slapd[7093]: connection_read(14): TLS accept failure error=-1 id=109, closing Feb 22 18:50:01 lmvserver slapd[7093]: connection_closing: readying conn=109 sd=14 for close Feb 22 18:50:01 lmvserver slapd[7093]: connection_close: conn=109 sd=14 ----------------/var/log/messages---------------- slapd.conf: ---------------/etc/openldap/slapd.conf-------- # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/dnszone.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/samba3.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema # Define global ACLs to disable default read access. pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Directives needed to implement policy: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read ####################################################################### # BDB database definitions ####################################################################### loglevel 5 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem TLSVerifyClient demand database bdb suffix "dc=lmv,dc=lmv" rootdn "cn=ldaproot,dc=lmv,dc=lmv" rootpw "???????" directory /mnt/lvm/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres database monitor ---------------/etc/openldap/slapd.conf-------- ldap.conf (client): --------------/etc/openldap/slapd.conf--------- # # LDAP Defaults # #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/openldap/cacert.pem TLS_CERT /etc/openldap/clientcert_205.pem TLS_KEY /etc/openldap/clientkey_205.pem TLS_REQCERT demand host 192.168.0.201 base dc=lmv,dc=lmv --------------/etc/openldap/slapd.conf--------- What is wrong? The clients certificate "common name" is set to the clients hostname. Is this ok? -- Mit freundlichen Grüßen Sebastian Reinhardt

3 17

openldap client configuration to connect to AD
by Santosh Kumar 06 Mar '09

06 Mar '09

Hi  Trying to configure ldap client connection for AD,  in the ldap.conf , what configuration needs to be carried, like is it required for PAM & NSS configuration .tried to test in ldap command as initial test, but getting the below error, ./ldapsearch -x -W -h 10.10.10.10 -b "CN=testuser,OU=Users,OU=KeyPairIN,OU=KeyPair,DC=keypair,DC=internal" -S subEnter LDAP Password:  ***   ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)Please do know what needs to be included ThanksSantosh Sr Software developer

3 5

Negation regex
by Miguel Jinez 06 Mar '09

06 Mar '09

Hi guys I need your help, anyone knows which is the negation regex? I need to perform an ACL Thanks Mike

1 0

Syncrepl cn=config from another context ...
by Mads Freek Petersen 05 Mar '09

05 Mar '09

Is it possible to have a server with multiple cn=config templates (for other servers) in a non cn=config context and then "translate" them into cn=config on the consumer side using a bootstrap config and olcsyncrepl? Regards Mads Freek ------------------------------------------------------ Mads Freek Petersen Special Consultant IT-Campus Roskilde University Building 42-1, P.O. Box 260, DK-4000 Roskilde, Denmark Phone: +45 4674 3882 Fax: +45 4674 3072 E-mail: freek(a)ruc.dk

2 2

Nway multimaster sync cn=config doesn¹t make cn=config look the same...
by Mathew Rowley 05 Mar '09

05 Mar '09

I have spent the past couple of days setting up nway multimaster in my lab. I was thinking it was not working because the first step (in the admin guide) was syncing up the cn=config. When doing that, I would look at both servers to see if the cn=config was the same they were, and are not. First box has (under cn=config): Cn=schema OlcDatabase={-1}front OlcDatabase{0}config OlcDatabase={1}bdb OlcDatabase={2}bdb Second box has (under cn=config): Cn=schema OlcDatabase={-1}front OlcDatabase{0}config OlcDatabase={1}bdb My question is: is this normal, or did I do something wrong? The sync on my dc=comcast,dc=com is working fine. Here are the steps I went through to get this working. Set up slapd.conf sure to include the directory config¹ in order to have a rootd for cn=config On both servers remove old directory/config ( rm -rf /usr/var/openldap-data/* /usr/etc/openldap/slapd.d/* ) On both servers run slapd with f and F options to sync to new config mode ( /usr/sbin/slapd -h ldap://10.252.152.76 -u ldap -F /usr/etc/openldap/slapd.d/ -f /usr/etc/openldap/slapd.conf -d 1 ) On both servers run slapd with F option - made sure that it was run with ldap://<ip> (/usr/sbin/slapd -h ldap://10.252.152.76 -u ldap -F /usr/etc/openldap/slapd.d/) On both servers run ldapmodify to add initial syncrepl, and sync the two cn=config directories: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://10.252.152.76 olcServerID: 2 ldap://10.252.152.77 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://10.252.152.76 binddn="cn=root,cn=config" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://10.252.152.77 binddn="cn=root,cn=config" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE On first server run ldapadd to sync the dc=comcast,dc=com directory: dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcbdbConfig olcDatabase: {1}bdb olcSuffix: dc=comcast,dc=com olcDbDirectory: /usr/var/openldap-data/ olcRootDN: cn=Manager,dc=comcast,dc=com olcRootPW: {SSHA}kJTEcfOmPf7fKv71AtxDjlUZNPqN9pIT olcLimits: dn.exact="cn=Manager,dc=comcast,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=004 provider=ldap://10.252.152.76 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://10.252.152.77 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Now, at this point is where I look at the cn=config to see if they were the same... -- MAT DESK: 720.267.7767

2 1

Multi-master vs. MirrorMode
by Sergio Cioban Filho 05 Mar '09

05 Mar '09

Hi all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------ Vendo GOL G3 PLUS 1.0 8V 4P 2002 - Branco - COMPLETÍSSIMO - Só R$ 18.500,00 http://cioban.googlepages.com/vendogolg38v

1 0

Openldap, kerberos backend, and SASL
by Da Rock 05 Mar '09

05 Mar '09

Sorry to barge in straight away with a question like this, but my time is running out and I have not been able to get a straight answer out of google. I'm going through the hypotheticals for using ldap as the backend for kerberos, and I've hit a chicken and egg problem with SASL- can someone untangle my mind? IF kerberos is using ldap as a backend store for keys, users, etc, and one can set the rootdn and leave the rootpw for later entry in the database itself, and the password can use SASL auth- what happens if you use kerberos as the auth mechanism? According to the book, slapd needs to set up the access to the key from startup, and kerberos in this scenario will need ldap up to provide the key. Is ldap up enough that kerberos can provide this? Or does ldap retry or something so that this problem is overcome? Thoughts? Cheers

4 15

syntax error in my ldif file
by Ken Perl 05 Mar '09

05 Mar '09

I got the error like below and can not fix it, could anyone help me? ldap_add: Invalid syntax (21) additional info: ObjectClass: value #0 invalid per syntax $cat lv1.ldif dn: mail=lv1(a)colinux.my, dc=colinux, dc=my ObjectClass: CourierMailAccount cn: ldap_vitural1 mail: lv1(a)colinux.my mail: lv1 userPassword: {MD5}$1$RnorJ$uVjJOT1I//zCCoFAYvP8t0 homeDirectory: lv1 uidNumber: 1000 gidNumber: 100 -- perl -e 'print unpack(u,"62V5N\"FME;G\!E<FQ`9VUA:6PN8V]M\"\@`` ")'

2 2

2.3 -> 2.4 upgrading advice
by Rex Roof 04 Mar '09

04 Mar '09

I'm currently running a fairly simple LDAP environment of two OpenLDAP 2.3 servers with a Master & Slave relationship using syncrepl. These servers are currently being used for authentication and for sendmail routing. I'm hoping to upgrade these two OpenLDAP 2.4 and create some sort of multi-master environment so that I can accept writes when one or more of the servers is down. I'd also like to add 2 more servers to the pool. I have two questions: 1) does anyone have any advice for things to watch out for when updating from 2.3 to 2.4? 2) what should I use for replication? Can I use some combination of MirrorMode and Multi-Master replication? This statement worries me: "Breaks the data consistency guarantees of the directory model" what does it mean? I found that here: http://www.openldap.org/doc/admin24/replication.html is that only a concern when the servers get out of sync as far as time goes? Any advice would be appreciated.

1 0

Security issues when authenticating from multiple sites
by Einar S. Ids� 04 Mar '09

04 Mar '09

Hello, We have a number of different community sites that will use a single central OpenLDAP-server for authentication. We want each site to provide its users with a logon-box for that site, just as any forum or portal you can find out there. Each site has its own admins with full access to everything related to their specific site. This makes it possible for them to edit their own logon mechanism to capture passwords for users that log on to their site. Thus an admin on one site can capture the password of an admin on another site, which is an obvious security issue. We can of course redirect logons to a common secure webpage, or monitor files in the respective sites' webroot to detect modifications to logon procedures, but we'd really prefer a cleaner solution if at all possible. Do any mechanisms exist to avoid this problem? Cheers, Einar S. Idsø Norsk eSport DA

2 1

can't change password with ldappaswd on Solaris 10 SPARC
by Marius Paulauskas 03 Mar '09

03 Mar '09

Hello, Is anyone successfully running openldap 2.4.15 on Solaris 10 SPARC? I cannot make it change passwords using ldappasswd if hash is set to smd5, ssha or crypt. Using latest Sun Studio 12. Same problem reveals if compiling with gcc 3.4.3 or 3.4.6. Somebody suggested it is due to flawed old gcc compiler version. I installed Sun Studio 12 but problem just wouldn't go away. Compiles without any problem both 32 or 64 bit memory models. I just can't believe that Sun Studio is flawed too. I must be missing some kind of setting or option or flag but seem to run out of ideas. any input greatly appreciated. /Marius

1 0

Can not modify cn=conf - openldap 2.4.15
by Mathew Rowley 03 Mar '09

03 Mar '09

I am trying to configure an n-way multi master following the tutorial in the admin guide (18.3.3 in http://www.openldap.org/doc/admin24/replication.html). When trying to add/modify anything in the cn=config, I get the following error: atlantis:~/comcast/authentication/ldif $ ldapadd -v -x -W -h 10.252.152.78 -D 'cn=Manager,dc=comcast,dc=com' ldap_initialize( ldap://10.252.152.78 ) Enter LDAP Password: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 add objectClass: olcGlobal add cn: config add olcServerID: 1 adding new entry "cn=config" modify complete ldap_add: Insufficient access (50) After looking through the test050 script, I see that this is done using the slapd Ta instead of a slapadd. I tried doing this, and get this error: [root@kdc01 scripts]# slapd -Ta bdb_db_open: warning - no DB_CONFIG file found in directory /usr/var/openldap-data: (2). Expect poor performance for suffix "dc=comcast,dc=com". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" I am using 2.4.15 built from source, with the only config option of changing the prefix directory. Any ideas on whats going on? Thanks. -- MAT

2 9

slapadd thank you!
by William Jojo 03 Mar '09

03 Mar '09

Thanks to all for the meter recently added to slapadd! Yeah, I know it's a small detail, but it really is the little things that matter sometimes. :-) Cheers, Bill

2 1

error in modifying subordinate entries
by Rakesh Yadav 03 Mar '09

03 Mar '09

Hi, I want to establish communication between two ldap servers at different machines. For this i have used "ref attribute of ldap" by using this attribute, i am able to retrieve entries of second ldap server. Means i can read or search entries of second server from first ldap server. But the problem comes when i want to modify any attribute of an entry of second server from the first server. Definitely i am having some access permissions related error. Here i am attaching slapd.conf files of both ldap servers. *First Server* *slapd.conf:* # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample access control policy: # Root DSE: allow anyone to write it # Subschema (sub)entry DSE: allow anyone to write it #Other DSEs: allow update_anon # Allow * write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: access to * by * write ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" rootpw secret index objectClass eq *access to * by * write* -------------------------------------------------------------------------------------------------------------------------------- *Second server's slapd.conf:* # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" rootpw secret directory /usr/local/var/gfsMetaData index objectClass eq *access to * by * write* ----------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------- *FIRST LADP SERVER DN*: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in where *test_ref* is having *ref* attribute dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject fn: test_ref ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in *NOW SECOND LDAP SERVER is having DN*: dn: fn=test1,fn=test_ref,dc=cdac,dc=in Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry. I have used ldap command line tool "*ldapdelete*" and executed this tool on *first LDAP machine*. Then the result of command is: **[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" \"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap:// 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in *And slapd debug statements:* do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Manager,dc=cdac,dc=in> <<< dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>, <cn=manager,dc=cdac,dc=in> do_bind: version=3 dn="cn=Manager,dc=cdac,dc=in" method=128 do_bind: v3 bind: "cn=Manager,dc=cdac,dc=in" to "cn=Manager,dc=cdac,dc=in" send_ldap_result: conn=2 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next do_delete ber_scanf fmt (m) ber: >>> dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> <<< dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>, <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> bdb_dn2entry("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") => bdb_dn2id("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_referrals: op=74 target="fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" matched="fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" ldap_url_parse_ext(ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in) send_ldap_result: conn=2 op=1 p=3 send_ldap_response: msgid=2 tag=107 err=10 ber_flush: 160 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next do_unbind connection_closing: readying conn=2 sd=11 for close connection_resched: attempting closing conn=2 sd=11 connection_close: conn=2 sd=11 * ----------------------------------------------------------------------------------------------------------------------------------------- * Please do me a favour suggest any solution as soon as possible through which i can update slave ldap server entries from master ldap server. -- Rakesh Yadav Pune.

2 4

limits in openldap 2.3
by Oliver Henriot 03 Mar '09

03 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list members, Is there a mechanism to control acces limits in openldap 2.3 similar to what can be achieved with the openldap 2.4 limits directive (http://www.openldap.org/doc/admin24/limits.html)? Appart from sizelimit and timelimit, which are not dn specific and therefore do not allow the same fine tuning as the limits directive, I haven't found anything. Maybe I missed it? Thanks, - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmr+a4ACgkQSWuBJnHIHdJYLQCgr2G31lT6KUAF8VsJDj56Jqdy OMQAnRZzU69ff3o94cGfJSgV0PlpGW0F =TEBl -----END PGP SIGNATURE-----

3 4

OpenLDAP 2.4.15 : CSN too old when using 4-way multimaster
by Adrien Futschik 02 Mar '09

02 Mar '09

Hello everyone, I have been testing n-way multimaster replication with OpenLDAP for a while now (from 2.4.11, to 2.4.15) and just when I though that everything was working perfectly, I dicided to test N-way multimaster not only with 2 masters on different servers, but with 4 ! 2 OpenLDAP instances per server. I have been configuring syncprov and syncrepl accordingly : olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 I am starting with all instances synced and I am trying to add entries en all four instances (in //). If I do so, I have a few entries that are not replicated on the others. I am getting this kind of messages : do_syncrep2: cookie=rid=011,sid=002,csn=20090227130003.849482Z#000000#004#000000 do_syncrep2: rid=011 CSN too old, ignoring 20090227130003.849482Z#000000#004#000000 do_syncrep2: cookie=rid=013,sid=002,csn=20090227130003.849482Z#000000#004#000000 do_syncrep2: rid=013 CSN too old, ignoring 20090227130003.849482Z#000000#004#000000 do_syncrep2: cookie=rid=014,sid=002,csn=20090227130003.946474Z#000000#004#000000 Did someone face the same issue ? Here is my configuration : (I am using refreshAndPersist mode for both cn=config and olcDatabase={1}bdb) M1 on IP1 / PORT1 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal creatorsName: cn=config olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryUUID: ef89c876-adb3-4dc7-aa7d-024bbc359c98 createTimestamp: 20090227085748Z entryCSN: 20090227085749.920499Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20090227085749Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z M2 on IP2 / PORT2 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: 8da75037-65e6-4375-8c21-7e5c0194a60b creatorsName: cn=config createTimestamp: 20090227085723Z olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryCSN: 20090227085725.003182Z#000000#002#000000 modifiersName: cn=config modifyTimestamp: 20090227085725Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z M3 on IP1 / PORT3 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: cf068647-318f-4848-9c72-9c7745a8a4b3 creatorsName: cn=config createTimestamp: 20090227085742Z olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryCSN: 20090227085743.825685Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20090227085743Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z M4 on IP2 / PORT4 : dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobal entryUUID: ef89c876-adb3-4dc7-aa7d-024bbc359c98 creatorsName: cn=config createTimestamp: 20090227085748Z olcServerID: 1 ldap://163.106.38.90:9011/ olcServerID: 2 ldap://163.106.38.92:9012/ olcServerID: 3 ldap://163.106.38.90:9013/ olcServerID: 4 ldap://163.106.38.92:9014/ entryCSN: 20090227085749.920499Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20090227085749Z contextCSN: 20090227085752.833630Z#000000#001#000000 dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: ./openldap-data olcSuffix: c=fr olcRootDN: cn=admin,c=fr olcRootPW:: e1NTSEF9WVZNSHJtYTRvUGd4KzFoak9kYWhBcm5NVHJxU1Zmdno= olcSizeLimit: 100 olcSyncrepl: {0}rid=011 provider=ldap://163.106.38.90:9011/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {1}rid=012 provider=ldap://163.106.38.92:9012/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {2}rid=013 provider=ldap://163.106.38.90:9013/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcSyncrepl: {3}rid=014 provider=ldap://163.106.38.92:9014/ binddn="cn=admin,c =fr" bindmethod=simple credentials=secret searchbase="c=fr" type=refreshAndPe rsist retry="5 5 300 12 3600 +" timeout=3 olcTimeLimit: 600 olcMirrorMode: TRUE olcDbCacheSize: 2000 olcDbCheckpoint: 2000 10 olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,entryCSN,entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 00c01e5d-69ee-4baa-8e5a-4ef609dfd958 creatorsName: cn=config createTimestamp: 20090227085752Z entryCSN: 20090227085752.729899Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090227085752Z I also have to say that if I stop M3 & M4 and try to add entries to M1 & M2, I don't get the "CSN too old" messages and all entries a replicated correctly !!! Is this because Multimaster is limited to 2-3 instances ? The reason why I am trying to build a 4-way master architecture is because I would like to be able to stop one server and perform a slapcat, even if one "physical" server is down... Thanks very much for your consideration & time.. Adrien Futschik

5 8

Is there disadvantage using a single dc?
by AlexanDER Franca 02 Mar '09

02 Mar '09

Hi everyone. Is there any disadvantage using a single dc? I mean, I work at a small company and I'm setting up a small ldap repository, for me is enough to use just a "dc=my_company". But slapd says something about less performance. I think this warning is just about large repositories using just a single dc, what seems to be a bad setup, but I'm not sure. []'s Alexander

3 2

ldappasswd returns "Additional info: password hash failed" in Solaris 10 SPARC
by Marius P. 01 Mar '09

01 Mar '09

Hello, I am trying to change a password for ldap entry using ldappasswd -vx -D "cn=root,dc=test,dc=com" -w foobarr "uid=mariusp,ou=people,dc=test,dc=com" and reply I get is: Result: Other (e.g., implementation specific) error (80) Additional info: password hash failed I am running openldap on Solaris 10 latest on SPARC. It is in testing meaning there is nothing special about its configuration all defaults. Database has two entries just to play with. I haven't bothered to compile it myself so just downloaded openldap 2.4.11 from sunfreeware.com with required prerequisits such as Berkeley DB, SASL, openssl etc. Everything works fine except this weird problem which looks like a bug. Password checking (binding) works fine if I manually change userPassword: attribute no matter what algorithm prefix I use be it SSHA, crypt or MD5. That tells me that it can succesfully check and run those algorithms however something breaks when it tries to change the password like it couldn't hash that supplied password. Wondering if anyone exprienced similar problem and have any comments or findings. Regards, /M.

4 4

BDB Inconsistencies when configuring on RH4 vs RH5
by Mathew Rowley 27 Feb '09

27 Feb '09

When installing 2.4.11 on my RH4 box, it configures fine with db4-4.2.52 installed (with bdb support) ... Making servers/slapd/backends.c Add config ... Add ldif ... Add monitor ... Add bdb ... Add hdb ... Add relay ... Making servers/slapd/overlays/statover.c Add seqmod ... Add syncprov ... Please run "make depend" to build dependencies [root@rsa01 openldap-2.4.11]# rpm -qa | grep db4 db4-4.2.52-7.1 db4-devel-4.2.52-7.1 [root@rsa01 openldap-2.4.11]# cat /etc/redhat-release Red Hat Enterprise Linux ES release 4 (Nahant Update 5) [root@rsa01 openldap-2.4.11]# But when trying to configure on a RH5 system, I get the BDB incompatible error: ... checking for Berkeley DB link (-ldb-4.3)... yes checking for Berkeley DB version match... yes checking for Berkeley DB thread support... yes checking Berkeley DB version for BDB/HDB backends... no configure: error: BDB/HDB: BerkeleyDB version incompatible [root@kdc01 openldap-2.4.11]# rpm -qa | grep db4 db4-utils-4.3.29-9.fc6 db4-devel-4.3.29-9.fc6 db4-4.3.29-9.fc6 [root@kdc01 openldap-2.4.11]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.2 (Tikanga) [root@kdc01 openldap-2.4.11]# Is this an error in the configure script? Kind of confused. Thanks for any help. -- MAT

2 2

Running both ldap and ldaps simultaneously
by Bryan Payne 25 Feb '09

25 Feb '09

I'm trying to run both ldap:// and ldaps:// at the same time. Reason being, I can't get phpldapadmin to use ldaps. If I execute the command: /usr/local/openldap/libexec/slapd -u ldap -h ldap:/// ldaps:///, it just listens on 389. If I run, /usr/local/openldap/libexec/slapd -u ldap -h ldaps:/// ldap:///, it just listens on 636. How can I get it to listen on both ports?

4 4

Re: contextCSN
by Guillaume Arteta 25 Feb '09

25 Feb '09

Hello, Sorry for my English google:) I'm put into production 2 openldap masters, and I asked the same question João Alfredo. * So, if the resultt of this search is the same on all master's this mean that all servers are consistents, right ?* Ok, the ldapsearch (ldapsearch-x-h Master1 ... and ldapsearch-x-h master2 ...) displays the same values of contextCSN for server ID, but what it proves that they are synchronized? The question is, why master node, the ldapsearch ContextCSN displays of 2 servers (001 & 002) Can be put in place a monitoring system to test the replication by performing 2 ldapsearchs, if even then synchronized values. Merci ------ Arteta.

3 14

ldapmodify command line tool results in 'deferring operation: too many executing'
by Sean Burford 24 Feb '09

24 Feb '09

Hi, During a recent ldapmodify of 1000 records, I got some "deferring operation: too many executing" messages from OpenLDAP slapd 2.3.39. I am surprised by this, since I thought that since ldapmodify waited for the result of each operation nothing would be queued. Could this be caused by there being too many operations in progress across the entire server? This was the ldapmodify command line: ldapmodify -v -H "ldaps://master.example.com" -x -W -D "uid=person,ou=people,dc=example,dc=com" -c -f file.ldif The ldif only contained OpenLDAPaci attribute deletes that fit this template: dn: cn=host1000.example.com,ou=servers,dc=example,dc=com changetype: modify delete: OpenLDAPaci The ldapmodify output looked normal: delete OpenLDAPaci: modifying entry "cn=host1000.example.com,ou=servers,dc=example,dc=com" modify complete delete OpenLDAPaci: modifying entry "cn=host1001.example.com,ou=servers,dc=example,dc=com" modify complete But the logs show the 'deferring operation: too many executing': Feb 24 08:27:54 server slapd[9433]: conn=19226 op=640 MOD dn="cn= host1000.example.com,ou=servers,dc=example,dc=com" Feb 24 08:27:54 server slapd[9433]: conn=19226 op=640 MOD attr=OpenLDAPaci Feb 24 08:27:54 server slapd[9433]: conn=19226 op=640 RESULT tag=103 err=0 text= Feb 24 08:27:54 server slapd[9433]: connection_input: conn=19226 deferring operation: too many executing Feb 24 08:27:54 server slapd[9433]: conn=19226 op=641 MOD dn="cn= host1001.example.com,ou=servers,dc=example,dc=com" Feb 24 08:27:54 server slapd[9433]: conn=19226 op=641 MOD attr=OpenLDAPaci Feb 24 08:27:54 server slapd[9433]: conn=19226 op=641 RESULT tag=103 err=0 text= -- Thanks, Sean Burford

1 0

How to integrated OpenLDAP proxy to web application
by Duong Pham Tung 23 Feb '09

23 Feb '09

Hi all, I have already installed an OpenLDAP server as a LDAP proxy server. The data source backend of this server is a set of AD servers and other LDAP servers. I also have enabled SASL and Pass-through Authentication feature on this OpenLDAP server. Everything is running properly. Now, I want to deploy an Web Application which will use this OpenLDAP as a backend data source. I have deployed Pass-through authentication via SASL server, but as I understand, I must store information about user on my OpenLDAP server (such as username) and the userPassword field is set to {SASL}user@realm. But this LDAP proxy hasn’t any information about user on itself. So, which solutions can I use to solve user authentication problem without storing any user information on the LDAP Proxy. Thanks and Best regards Dương Phạm Tùng

1 0

Re: Password protection of TLS key
by ghenry＠OpenLDAP.org 20 Feb '09

20 Feb '09

> No really good ideas come to mind. I have a patch for libldap to > explicitly > set a callback to supply the key password, it won't make it into > 2.4.13 but > probably will be in 2.4.14. I will probably add two options to slapd, Hi, Did this make it into 2.4.14? I've checked the CHANGES and can't see anything mentioned re libldap? Thanks. > analogous to the back-bdb options to set the DB encryption key. (One > option to > set the key directly as an argument of the config option, one option > to read > the key from an arbitrary file.) Obviously for automated startup the > plaintext > of the key must be accessible to the slapd somewhere, and that means > it is > also accessible to potential intruders. This is just a fact of life. > You can > make key retrieval more tedious by hiding it behind other layers of > encryption, but ultimately the keys to each of those layers must also > be > accessible, otherwise slapd itself cannot use them. > > There are "clever" schemes to hide startup keys, but they tend to make > > restarts difficult. E.g., store keys on a mountpoint that you remount > some > other filesystem onto after the boot sequence has completed and all > dependent > daemons have started. Keep a file handle open on the new filesystem, > to > prevent it from being dismounted without rebooting the system. It'll > fool a > lot of intruders, but you won't be able to restart individual daemons > without > rebooting the machine. > > > Akke Bengtsson > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

4 3

olcSyncprovConfig not converted for cn=config
by Oliver Liebel 20 Feb '09

20 Feb '09

using openldap 2.4.14 (compiled from openldap.org source-package) i have noticed the following, reproducable behaviour when converting a slapd.conf to slapd.d: olcSyncprovConfig is generated during conversion for the hdb-context, but not for cn=config, although "overlay syncprov" is set for database config tested the conversion several times with slaptest and slapd, with the following simple example-slapd.conf. the result seems always to be the same. --- include /usr/local/etc/openldap/schema/core.schema access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by * read ##################################### database config rootdn cn=config rootpw {SSHA}4PvZLcpQ7s1CyQG+yworyl5DcrFTn78q overlay syncprov ##################################### database hdb suffix "dc=local,dc=site" checkpoint 1024 5 cachesize 10000 rootdn "cn=ldapadmin,dc=local,dc=site" rootpw {SSHA}4PvZLcpQ7s1CyQG+yworyl5DcrFTn78q directory /var/lib/ldap index objectClass eq index entryUUID,entryCSN eq overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 --- any ideas? thanks and greetings, oliver

2 2

Syncrepl master/master on RedHat4 Update 5 - wheres library?
by Mathew Rowley 19 Feb '09

19 Feb '09

I am trying to test the master/master replication architecture. When following the documentation from: http://www.openldap.org/doc/admin24/replication.html it shows: olcModulePath: /usr/local/libexec/openldap olcModuleLoad: syncprov.la When looking on my system, that file, nor the directory exists. I then looked into the slapd.conf file to see where the other libraries were: # modulepath /usr/sbin/openldap # moduleload back_bdb.la Again that directory, nor the module exist. I then thought there may be some option in the source that needs to be enabled to build the syncprov library, but I found nothing. I do see that there is a patch for syncrepl-uuid¹ which would make me think that the package is being built with syncrepl capability. How do I move forward? Do I need that library loaded? I did find this: https://bugzilla.redhat.com/show_bug.cgi?id=466937 which states: syncprov is compiled statically into slapd daemon to keep backward compatibility, I forgot to remove it from the config file. Does that mean the library is loaded by default, and doesn¹t explicitly need to be set to load? Thanks for any help. -- MAT

2 1

N-way multimaster replication with 2 masters
by Adrien Futschik 19 Feb '09

19 Feb '09

Hy again ! Still testing n-way multimaster replication with 2 masters. I encountered a situation where my two masters where out of sync. Here is the deal : I have M1(serverID=1) & M2(serverID=2) synced and I am performing adds/modify to both M1 & M2. 1) I stop M2 and make a backup of it with slapcat. 2) I then restart M2. 3) I continue to make updates on M1 & M2. 4) I then stop (kill -INT PID) M2 5) I continue to make updates on M1 6) I then delete all *.bdb etc.. files from M2 7) I use the LDIF backup(see 1)) to restore M2 and then restart it. 8) restart M2 9) all entries modified/added during phase 5) are successfuly replicated to M2, but all entries modified/added on M2 dunring phase 3) are not replicated on M2. This is because those entries have an entryCSN menchening that theses entries where last modified/created on M2 (ex: entryCSN: 20090219091852.789559Z#000000#002#000000) So M1 doesn't send them back to M2 even though they aren't present on M2. The trick I used to force M1 to send these entries to M2 is to change the serverID of M2. In fact, it is like setting up a whole new master. So I changed cn=config olcServerID from M1 before restarting M2 (before 8)) and I modify /appli/projects/m2/openldap_2.4.14/conf/slapd.d/cn=config.ldif also This is the only way I found to make sure that M1 & M2 are really the same again. Any other suggestions ? I didn't found anything in the documentation about that, maybe I missed-it. Adrien

1 0

N-way multimaster error code 53 - shadow context
by Adrien Futschik 19 Feb '09

19 Feb '09

Hy ! it's me again :) I am still testing n-way multi master replication with OpenLDAP 2.4.14. I don't know why I could modify my olcSyncrepl attribute from my data bdb. I am binding with cn=config, and I can modify the olcSyncrepl attribute from olcDatabase={0}config, but not from olcDatabase={1}bdb ! I am getting this error : 08:57:25: Failed to update entry olcDatabase={1}bdb, cn=config Reason: [LDAP: error code 53 - shadow context; no update referral] This appends on both masters. Is this supposed to be like that ? I have configured cn=config to replicate, this should work right ? Adrien

2 3

Usermod problems with ldap
by okossuth＠antel.com.uy 19 Feb '09

19 Feb '09

hi I'm having a problem dealing with usermod and groups stored on my openldap 2.3 server. when I try to change the supplementary group of a user I do: vmlx-jboss-desa:/home # usermod -D 'cn=admin,dc=vmlx-ldapauth-test,dc=in.iantel.com.uy' -G mysql okossuth Enter LDAP Password: LDAP information update failed: Object class violation usermod: User not added to LDAP group `mysql'. vmlx-jboss-desa:/home # I looked into the log of my ldap server and I saw this error: Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify: cn=mysql,ou=Grupos,ou=Teleinformatica,dc=vmlx-ldapauth-test,dc=in.iantel.com.uy Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: add member Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: replace entryCSN Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: replace modifiersName Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: bdb_modify_internal: replace modifyTimestamp Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: Entry (cn=mysql,ou=Grupos,ou=Teleinformatica,dc=vmlx-ldapauth-test,dc=in.iantel.com.uy), attribute 'member' not allowed Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: entry failed schema check: attribute 'member' not allowed Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: send_ldap_result: err=65 matched="" text="attribute 'member' not allowed" Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: connection_get(40) Feb 17 17:17:07 vmlx-ldapauth-test slapd[2800]: connection_get(35) The groups that I have created on the ldap server don't have the member attribute, only the memberUid... Any ideas on how to solve this problem with usermod??? thanks. Saludos, Oskar Kossuth Administrador UNIX ANTEL Telecomunicaciones El presente correo y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo anexando este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender immediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that is not the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy.

2 12

DO script IF ldap-useraccount GETS LOCKED ...
by Axel Werner 19 Feb '09

19 Feb '09

Hi Gurus out there! Is there a Way to have OpenLDAP start a script that kicks in whenever a LDAP User-Object got locked down ?? (through manual lock OR more important, through a intruder detection / x failed logon attempts ) My Problem is that whenever a LDAP Account got locked because of exceeding max. failed logon attempts the corresponding SAMBA Account (same LDAP Object) is still "unlocked". So when however the user cannot log back in to LDAP, he is still able to log in on Windows-workstation (samba) and reset his password. But reseting his SAMBA Password through Windows PC does also reset his LDAP Password through Password-Syncronisation. That means that his Locked LDAP Account is again "unlocked" because Samba's LDAP-Admin reseted the Password of my locked LDAP User. So i want to make sure that if he fucks up his LDAP account , his SAMBA account will also be disabled. Some Hook for a custom script would be fine. But is there something like that ? Any other Ideas how to manage that ? greetings Axel

1 0

Re: N-way replication "dn_callback : entries have identical CSN"
by Jonathan Clarke 18 Feb '09

18 Feb '09

Le Mer 18 février 2009 09:24, Adrien Futschik a écrit : > I then switched to OpenLDAP 2.4.14 and did not have the problem anymore > (same > configuration). I guess this was a bug form 2.4.11. > > Still, I had a few of theses messages in the log : > conn=9 op=1 => bdb_dn2id_add > dn="cn=M2client2(a)laposte.net,ou=clients,o=edf,c=fr" ID=0xb: put failed: > DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock -30995 > > but I also got a few of theses : > dn_callback : entries have identical CSN > cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr > 20090217155418.854085Z#000000#002#000000 > syncrepl_entry: rid=004 be_search (0) > syncrepl_entry: rid=004 cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr > syncrepl_entry: rid=004 entry unchanged, ignored > (cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr) > do_syncrep2: cookie=rid=004,sid=002 > syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) > > Can anyone explain to me why ? is this normal ? > The dn_callback message comes from the master log-file where > "cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr" was inserted. I don't know about the DB_LOCK_DEADLOCK message, but "entries have identical CSN" means that your syncrepl consumer received an entry that is identical to one already present in your DB. This may happen when resynching a database, or it could be that your multi-master setup is causing each server to feed updates back to itself. Make sure the URLs in your syncrepl declarations match the listener URLs to slapd (-h option). Jonathan

2 3

Re: N-way multi-master replication
by Gavin Henry 18 Feb '09

18 Feb '09

----- "Adrien Futschik" <adrien.futschik(a)atosorigin.com> wrote: > I am testing Multi-master replication with two masters. > > If I stop one of them and don't restart it before the end of retry > interval, > the replication process doesn't work anymore. (looks like it is > stopped). > > exemple : > - M1 & M2 are synchronised. > - stop M2 > - add entries to M1 > - wait for retry to fail (retry="5 5 300 5") > - restart M2 > - previously added entries to M1 are replicated to M2 > - modifying M2 (attributes) are not replicated to M1 > > It look like M1 -> M2 : OK and M2 -> M1 : broken > > Is there a way to restart replication after configured retry are over > ? The > solution I found was to restart M1. After that everything seems to > work fine. > > I could set up retry so that the number of retry is very hight, but I > was > wondering if there was a way to restart synchronisation online. "If an error occurs during replication, the consumer will attempt to reconnect according to the retry parameter which is a list of the <retry interval> and <# of retries> pairs. For example, retry="60 10 300 3" lets the consumer retry every 60 seconds for the first 10 times and then retry every 300 seconds for the next 3 times before stop retrying. The '+' in <# of retries> means indefinite number of retries until success. If no retry was specified, by default syncrepl retries every hour forever." Why not just change it to retry="60 +" ? -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 6

LDAP + PAM + NSS with groups local and in LDAP
by John Kane 18 Feb '09

18 Feb '09

I am using LDAP + PAM + NSS on Linux, and am trying to use groups defined locally as well as in LDAP. These groups are for (critical) apps that run on the Linux systems. I want to define the group locally as to not have issues when and if LDAP is unavailable. But to manage group members, I want to define the same groups (and gids) in LDAP. The problem is that the group members cannot 'newgrp' to groups in which they are members (LDAP defined) if the groups exists locally. It appears that when the group is defined locally, the server does not check LDAP for group members. In the following example, user 'tester' is a member of groups 'postgres' and 'testgrp' (defined in LDAP), and the group 'testgrp' is also defined locally: [tester]$ groups postgres testgrp [tester]$ grep testgrp /etc/group [tester]$ getent group testgrp testgrp:x:110:tester [tester]$ grep postgres /etc/group postgres:x:110: [tester]$ grep postgres /etc/gshadow postgres:!:: [tester]$ getent group postgres postgres:x:101: As you can see, 'getent group' shows 'tester' is NOT a member of postgres, although 'groups' shows he is. My /etc/nsswitch.conf has: passwd: files ldap shadow: files ldap group: files ldap PAM /etc/pam.d/system-auth has: # testing for groups local and in ldap - 022809 auth required /lib/security/$ISA/pam_group.so debug use_first_pass # auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok nodelay auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so And, in LDAP: [tester]$ ldapsearch -x -b 'ou=groups,o=partner_x,dc=example,dc=net' 'cn=postgres' # extended LDIF # # LDAPv3 # base <ou=groups,o=partner_x,dc= example,dc=net> with scope subtree # filter: cn=postgres # requesting: ALL # # postgres, groups, partner_x, example.net dn: cn=postgres,ou=groups,o=partner_x,dc=example,dc=net objectClass: top objectClass: posixGroup cn:: cG9zdGdyZXMg gidNumber: 110 memberUid: tester description: Postgres DB Group Thanks in advance for any help. John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

password encryption question
by Mike Simonton 18 Feb '09

18 Feb '09

Hello, I want to change the default 'secret' password in the slapd.conf file to something that's encrypted in some way to hide the clear text password for the Manager account. What's the best and easiest way to go about doing this? Is slappasswd the way to not only do this but change passwords for any users in the database, or is ldappasswd the way to go? One other question - does anyone have an example slapd.conf file that uses the /etc/passwd and /etc/shadow files to manage the passwords for openldap, particularly for the Manager account? Thank you for your help! Mike

2 1

N-way multi-master replication
by Adrien Futschik 18 Feb '09

18 Feb '09

I am testing Multi-master replication with two masters. If I stop one of them and don't restart it before the end of retry interval, the replication process doesn't work anymore. (looks like it is stopped). exemple : - M1 & M2 are synchronised. - stop M2 - add entries to M1 - wait for retry to fail (retry="5 5 300 5") - restart M2 - previously added entries to M1 are replicated to M2 - modifying M2 (attributes) are not replicated to M1 It look like M1 -> M2 : OK and M2 -> M1 : broken Is there a way to restart replication after configured retry are over ? The solution I found was to restart M1. After that everything seems to work fine. I could set up retry so that the number of retry is very hight, but I was wondering if there was a way to restart synchronisation online. Thanks in advance, Adrien

1 0

Cache/Proxy/Replicating a distant, slow LDAP server
by Morten Mikkelsen 18 Feb '09

18 Feb '09

Hi. I work at a rather large company that has a rather slow LDAP server that impacts the performance on a wiki-server, I am using. I am playing with the idea of setting up a cache or replication of the company LDAP server locally to reduce time spent performing ldap lookups, but as I am quite new to the world of LDAP and openldap, I have a hard time getting the set-up right. I would like to set up a server that does not impose any requirements on the existing (slow) server at all. I only need a read-only server - updates are made on the slow 'master' - and only a few percent of the records are interesting to our wiki. Having looked at caching and proxying, I ended up at setting my mind on replication. As the master is out-of-bounds except for ldap queries (no slurping-logs), the syncrepl-option seems to be the way to go. I just can't get my head around the configuration. The master LDAP has the following structure (as I see it) o=company.com -> ou=commondirectory -> c=xx Under commondirectory, all countries (such as 'dk', 'us' and a whole bunch of others) are represented with the employees residing in them listed below. o=company.com -> ou=companygroups -> ou=groupmembers contain groups that are used for controlling access to the wiki pages. So what I need to have on my replicated server is: The groups and people in the countries 'us' and 'dk'. To start off easy, I try to replicate the c=dk at first - I've tried adding the following to /etc/ldap/slapd.conf syncrepl rid=111 provider=ldap://ldap.company.com:389 type=refreshOnly interval=00:12:00:00 searchbase="c=dk,ou=commondirectory,o=company.com" scope=one updatedn="c=dk,ou=commondirectory,o=company.com" which make the server start without errormessages, but when I query with ldapsearch -x -h 127.0.0.1 -b "c=dk,ou=commondirectory,o=company.com" '(objectClass=*)' I get no result: "result: 32 No such object" What am I doing wrong? -- /Morten

3 3

N-way replication "dn_callback : entries have identical CSN"
by Adrien Futschik 18 Feb '09

18 Feb '09

Hy ! I am still working on n-way multi master replication. I am using refreshAndPersist mode with to masters. My first test was to inject in parallel 2 x 500 entries to the first master and also 2 x 500 entries to the second master. The goal is to see how the replication behaves when massive adds are performed to both masters. When I used OpenLDAP 2.4.11, I suffered lost. The 1000 entries where successfully added on each master, but a few entries where lost in the replication process. I didn't found any "errors" in the log, even with debug on. The only suspect messages I had, where like this : => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) => bdb_dn2id_add 0x543: parent (ou=clients,o=edf,c=fr) insert failed: -30995 I then switched to OpenLDAP 2.4.14 and did not have the problem anymore (same configuration). I guess this was a bug form 2.4.11. Still, I had a few of theses messages in the log : conn=9 op=1 => bdb_dn2id_add dn="cn=M2client2(a)laposte.net,ou=clients,o=edf,c=fr" ID=0xb: put failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock -30995 but I also got a few of theses : dn_callback : entries have identical CSN cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr 20090217155418.854085Z#000000#002#000000 syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr syncrepl_entry: rid=004 entry unchanged, ignored (cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr) do_syncrep2: cookie=rid=004,sid=002 syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Can anyone explain to me why ? is this normal ? The dn_callback message comes from the master log-file where "cn=M2client20(a)laposte.net,ou=clients,o=edf,c=fr" was inserted. Thanks in advance, Adrien Futschik

1 0

slapd connection_read: no connection; tcp time_wait state
by James Bagley 17 Feb '09

17 Feb '09

Hi! This is an interesting one... I have an OpenLDAP 2.4.12 server as a consumer in a two node cluster. It's sole function is to answer queries for our mail hub for recipient validation. We see about 50-300 queries / second and occasional spikes. Unfortunately, our mail hub appliances (vendor name left out to protect the guilty) are somewhat inefficient in ldap connection handling and are opening a new TCP connection for every single ldap query. It does this even when there are multiple recipients in one smtp session (boggles the mind!). A percentage of these connections don't get closed properly and I get the following error in the syslog: slapd[23108]: connection_read(18): no connection! The reason is that the connections are in a time_wait state because they were not closed properly. They go away in 60 seconds, but with the load this server gets we continuously have several hundred tcp connections in a time_wait state and a system log full of the above errors. I'm attaching two packet captures: time_wait.cap - filtered a single complete tcp session that ended with the port in a time_wait condition. no_time_wait.cap - control capture for reference. This session closed properly. I can't claim to have the greatest understanding of 3-way / 4-way tcp open / close handshakes. But, one thing that I did notice that seems to be consistent among the sessions that end in time_wait is that the fin-ack is initiated by the server. Possibly i'm reading it wrong, but doesn't the client normally initiate the close? and the server does a passive close? So, in theory the server should never have to wait for the client. Could someone more knowledgeable than me tell me why the server might initiate the active close? thanks, -james

1 0

LDAP Group
by Paul bob 16 Feb '09

16 Feb '09

I have created group called readonly1 in ldap server and added ldap user "jimmy" member of that group. When I try to access he is not getting ldap group access. Whereas I created local group readonly1 and added jimmy" into that group it works fine. dn: cn=readonly1,ou=Group,dc=ndmacb,dc=local objectClass: posixGroup objectClass: top cn: readonly1 gidNumber: 550 memberUid: jimmy Am I missing any config in ldap side? Thanks for your help! - PB

1 0

Howto monitor n-way replication ?
by a.schild＠aarboard.ch 16 Feb '09

16 Feb '09

Hello, during the last years we used a open ldap setup with snycrepl for 3 servers. We monitored them with nagios (http://www.nagiosexchange.org/cgi-bin/page.cgi?g=Detailed%2F2477.html;d=1) with success. Now we changed our setup to a n-way master setup and also wish to monitor replication via nagios. Monitoring the contextcsn value seems to not be usefull in a n-way setup. Any ideas/hints how we can monitor the n-way replication ? Thanks André

1 0

connection.c segfault with new sasl mechanism
by Francesco Grossi ITQL 15 Feb '09

15 Feb '09

Dear team We hope you can help us in discovering where or how we are wrong. We are providing a new sasl mechanism for third party strong authentication and we are in the final delivery step. We are current with openldap 2.3.38. We used strong authentication server to carry out the authorization part of the mech and our backside (sasl client) is Openldap 2.3.38. On the client side we have pam-ldap+ssh. sasl libs are cyrus 2.1.22 os is linux red-hat cent-os 4.7 final During our functional and stress tests everything works fine but once in a while when openldap crashes and this happens only, but not always, under a certain condition: Before explaining such a condition we would like to establish the meaning of some terms: 1) straight authentication session: a simple (not interactive) authentication, being either successfull or not (right or wrong passcode) 2) interactive authentication session: a complex (interactive) authentication with iterated tcp/ip requests such as next-token or new-pin Crash scenario: one ore more straight authentication scripts are running in parallel, emulating parallel ssh authentication sessions with either right or wrong passcode; one interactive authentication session: in the error-originating session the whole user back-and-forth got his way to the authentication server, that is to say next-token or new-pin procedure comes to a complete end: user gives its next token or new pin (twice) and the strong authentication is fully accomplished and reported by the authentication manager. What is wrong is that (by average 2 attempts out of 3) make openldap crash. Sasl speaking our server-step mechanism closes fine and we expect its dispose step to be called by openldap (by the sasl_server_end) That is not going to happen being Openldap crashed meanwhile. Again this happens only but not always when the stress scripts are running. Does it smell of thread concurrency and safety? Our different use cases tests run almost always successfully when done individually or in parallel but manually (real people operating). Conversely when stress test are going on the problem arise very often but not always. We had the Opeldap crash both on linux and solaris installations though on linux the crash happens some steps earlier than with solaris. On linux we have had the opportunity to rebuild openldap with some debug instruction inside. what came out is connection.c crashing at: op->o_tmpfree( op->orb_edn.bv_val, op->o_tmpmemctx ); in both successful and error cases either the values passed and the function address look alike. op->orb_edn.bv_val shows the distinguished name of the user just logged in (op->orb_edn.bv_len is correctly set with its length). Based on the function name we guess ldap is about to free the DN allocated storage. On Solaris9 we had the segfault symptom but we have some more line on the log, one of which shows a almost empty DN (!!!) made just of uid="" GDB has the following from the linux core dump: gdb -c core.5785 GNU gdb Red Hat Linux (6.3.0.0-1.159.el4rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu". Core was generated by `/usr/sbin/slapd -h ldap:///'. Program terminated with signal 11, Segmentation fault. #0 0x00268934 in ?? () THE FOLLOWING CODE IS AN EXCERPT OF THE FINAL SERVER_MECH_STEP FUNCTION OF THE MECHANISM WHICH RUN BEHIND THE SASL_SERVER_STEP ONLY WHEN CRASH HAPPENS: static int mymech_server_mech_step(void *conn_context __attribute__((unused)), sasl_server_params_t *params, const char *clientin, unsigned clientinlen, const char **serverout, unsigned *serveroutlen, sasl_out_params_t *oparams) { server_context_t *text = (server_context_t *) conn_context; *serverout = NULL; *serveroutlen = 0; oparams->doneflag = 1; oparams->mech_ssf = 0; oparams->maxoutbuf = 0; oparams->encode_context = NULL; oparams->encode = NULL; oparams->decode_context = NULL; oparams->decode = NULL; oparams->param_version = 0; oparams->authid = text->authid; return SASL_OK; } SLAPD.LOG OF THE CRASH CASE (WITH OUR ADDED SYSLOGS): Feb 4 12:09:15 yavcentos slapd: SASL [conn=48] Debug MMYMECH====================== SERVER mymech_server_mech_step END == Feb 4 12:09:15 yavcentos mymech: sasl.c label slap_sasl_authorize Feb 4 12:09:15 yavcentos slapd: SASL proxy authorize [conn=48]: authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:09:15 yavcentos slapd: conn=48 op=4 BIND authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:09:15 yavcentos slapd: SASL Authorize [conn=48]: proxy authorization allowed authzDN="" Feb 4 12:09:15 yavcentos mymech: sasl.c label1 Feb 4 12:09:15 yavcentos mymech: result.c label2 Feb 4 12:09:15 yavcentos slapd: send_ldap_sasl: err=0 len=-1 Feb 4 12:09:15 yavcentos mymech: result.c label6a Feb 4 12:09:15 yavcentos mymech: result.c label61 Feb 4 12:09:15 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:09:15 yavcentos mymech: result.c label61b Feb 4 12:09:15 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x8926cb0 rs=0x17551a0 Feb 4 12:09:15 yavcentos mymech: connection.c label1 Feb 4 12:09:15 yavcentos mymech: connection.c label1a Feb 4 12:09:15 yavcentos mymech: connection.c label11a Feb 4 12:09:15 yavcentos mymech: connection.c label111a Feb 4 12:09:15 yavcentos mymech: connection.c label12a Feb 4 12:09:15 yavcentos mymech: connection.c label12a op->o_tmpfree=0x809c3e8 op->orb_edn.bv_val=uid=alfredo@yavcentos,ou= people,dc=my-domain,dc=com op->orb_edn.bv_len=51 op->o_tmpmemctx=0x8926c10 (slab malloc context) END SLAPD.LOG OF A SUCCESSFUL LOGIN CASE (WITH OUR ADDED SYSLOGS): Feb 4 12:13:13 yavcentos mymech: sasl.c label slap_sasl_authorize Feb 4 12:13:13 yavcentos slapd: SASL proxy authorize [conn=3]: authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:13:14 yavcentos slapd: conn=3 op=4 BIND authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:13:14 yavcentos slapd: SASL Authorize [conn=3]: proxy authorization allowed authzDN="" Feb 4 12:13:14 yavcentos mymech: sasl.c label1 Feb 4 12:13:14 yavcentos mymech: result.c label2 Feb 4 12:13:14 yavcentos slapd: send_ldap_sasl: err=0 len=-1 Feb 4 12:13:14 yavcentos mymech: result.c label6a Feb 4 12:13:14 yavcentos mymech: result.c label61 Feb 4 12:13:14 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:13:14 yavcentos mymech: result.c label61b Feb 4 12:13:14 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x86667b8 rs=0x51271a0 Feb 4 12:13:14 yavcentos mymech: connection.c label1 Feb 4 12:13:14 yavcentos mymech: connection.c label1a Feb 4 12:13:14 yavcentos mymech: connection.c label11a Feb 4 12:13:14 yavcentos mymech: connection.c label111a Feb 4 12:13:14 yavcentos mymech: connection.c label12a Feb 4 12:13:14 yavcentos mymech: connection.c label12a op->o_tmpfree=0x809c3e8 op->orb_edn.bv_val=uid=alfredo@yavcentos,ou= people,dc=my-domain,dc=com op->orb_edn.bv_len=51 op->o_tmpmemctx=0x86660c0 (slab malloc context) Feb 4 12:13:14 yavcentos mymech: connection.c label13a Feb 4 12:13:14 yavcentos mymech: connection.c label14a Feb 4 12:13:14 yavcentos mymech: connection.c label15a Feb 4 12:13:14 yavcentos mymech: connection.c label151a Feb 4 12:13:14 yavcentos mymech: connection.c label151b Feb 4 12:13:14 yavcentos mymech: connection.c label2 Feb 4 12:13:14 yavcentos slapd: conn=3 op=4 BIND dn="uid=alfredo@yavcentos,ou=people,dc=my-domain,dc=com" mech=MYMECH sasl_ ssf=0 ssf=0 Feb 4 12:13:14 yavcentos slapd: do_bind: SASL/MYMECH bind: dn="uid=alfredo@yavcentos,ou=people,dc=my-domain,dc=com" sasl_ss f=0 Feb 4 12:13:14 yavcentos mymech: connection.c label3 Feb 4 12:13:14 yavcentos mymech: result.c label61c Feb 4 12:13:14 yavcentos mymech: result.c label61d Feb 4 12:13:14 yavcentos mymech: result.c label61d2 Feb 4 12:13:14 yavcentos mymech: result.c label61e Feb 4 12:13:14 yavcentos slapd: send_ldap_response: msgid=5 tag=97 err=0 Feb 4 12:13:14 yavcentos mymech: result.c label1 Feb 4 12:13:14 yavcentos mymech: result.c label11 Feb 4 12:13:14 yavcentos mymech: result.c label12 Feb 4 12:13:14 yavcentos mymech: result.c label13 Feb 4 12:13:14 yavcentos mymech: result.c label14 Feb 4 12:13:14 yavcentos mymech: result.c label14e Feb 4 12:13:14 yavcentos mymech: result.c label14f Feb 4 12:13:14 yavcentos mymech: result.c label14g Feb 4 12:13:14 yavcentos mymech: result.c label14h Feb 4 12:13:14 yavcentos mymech: result.c label15 Feb 4 12:13:14 yavcentos mymech: result.c label16 Feb 4 12:13:14 yavcentos mymech: result.c label18 Feb 4 12:13:14 yavcentos mymech: result.c label19 Feb 4 12:13:14 yavcentos mymech: result.c label20 Feb 4 12:13:14 yavcentos mymech: result.c label21 Feb 4 12:13:14 yavcentos mymech: result.c label6b e qui2 Feb 4 12:13:14 yavcentos mymech: daemon: activity on 1 descriptor Feb 4 12:13:15 yavcentos slapd: daemon: activity on: Feb 4 12:13:15 yavcentos slapd: 13r Feb 4 12:13:15 yavcentos slapd: Feb 4 12:13:15 yavcentos slapd: daemon: read active on 13 Feb 4 12:13:15 yavcentos slapd: connection_get(13) Feb 4 12:13:15 yavcentos slapd: connection_get(13): got connid=3 Feb 4 12:13:15 yavcentos slapd: connection_read(13): checking for input on id=3 Feb 4 12:13:15 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:15 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 4 12:13:15 yavcentos slapd: conn=3 op=4 RESULT tag=97 err=0 text= Feb 4 12:13:15 yavcentos mymech: sasl.c label4 Feb 4 12:13:15 yavcentos slapd: <== slap_sasl_bind: rc=0 Feb 4 12:13:15 yavcentos mymech: bind.c do_bind label1 Feb 4 12:13:15 yavcentos slapd: do_bind Feb 4 12:13:15 yavcentos slapd: conn=3 op=5 BIND anonymous mech=implicit ssf=0 Feb 4 12:13:15 yavcentos slapd: >>> dnPrettyNormal: <> Feb 4 12:13:15 yavcentos slapd: <<< dnPrettyNormal: <>, <> Feb 4 12:13:15 yavcentos slapd: do_bind: version=3 dn="" method=128 Feb 4 12:13:15 yavcentos slapd: conn=3 op=5 BIND dn="" method=128 Feb 4 12:13:15 yavcentos mymech: sasl.c label slap_sasl_reset Feb 4 12:13:15 yavcentos slapd: send_ldap_result: conn=3 op=5 p=3 Feb 4 12:13:15 yavcentos slapd: send_ldap_result: err=0 matched="" text="" Feb 4 12:13:15 yavcentos mymech: result.c label22a Feb 4 12:13:15 yavcentos mymech: result.c label61 Feb 4 12:13:15 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:13:15 yavcentos mymech: result.c label61b Feb 4 12:13:15 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x8668158 rs=0x2afc1a0 Feb 4 12:13:15 yavcentos mymech: connection.c label1 Feb 4 12:13:15 yavcentos mymech: connection.c label3 Feb 4 12:13:15 yavcentos mymech: result.c label61c Feb 4 12:13:15 yavcentos mymech: result.c label61d Feb 4 12:13:15 yavcentos mymech: result.c label61d2 Feb 4 12:13:15 yavcentos mymech: result.c label61e Feb 4 12:13:15 yavcentos slapd: send_ldap_response: msgid=6 tag=97 err=0 Feb 4 12:13:15 yavcentos mymech: result.c label1 Feb 4 12:13:15 yavcentos mymech: result.c label11 Feb 4 12:13:15 yavcentos mymech: result.c label12 Feb 4 12:13:15 yavcentos mymech: result.c label13 Feb 4 12:13:15 yavcentos mymech: result.c label14 Feb 4 12:13:15 yavcentos mymech: result.c label14e Feb 4 12:13:15 yavcentos mymech: result.c label14f Feb 4 12:13:15 yavcentos mymech: result.c label14g Feb 4 12:13:15 yavcentos mymech: result.c label14h Feb 4 12:13:15 yavcentos mymech: result.c label15 Feb 4 12:13:15 yavcentos mymech: result.c label16 Feb 4 12:13:15 yavcentos mymech: result.c label18 Feb 4 12:13:15 yavcentos mymech: result.c label19 Feb 4 12:13:16 yavcentos mymech: result.c label20 Feb 4 12:13:16 yavcentos mymech: result.c label21 Feb 4 12:13:16 yavcentos mymech: result.c label22b Feb 4 12:13:16 yavcentos mymech: result.c label5 e qui1 Feb 4 12:13:16 yavcentos slapd: conn=3 op=5 RESULT tag=97 err=0 text= Feb 4 12:13:16 yavcentos slapd: do_bind: v3 anonymous bind Feb 4 12:13:15 yavcentos mymech: daemon: activity on 1 descriptor Feb 4 12:13:16 yavcentos slapd: daemon: activity on: Feb 4 12:13:16 yavcentos slapd: 13r Feb 4 12:13:16 yavcentos slapd: Feb 4 12:13:16 yavcentos slapd: daemon: read active on 13 Feb 4 12:13:16 yavcentos slapd: connection_get(13) Feb 4 12:13:16 yavcentos slapd: connection_get(13): got connid=3 Feb 4 12:13:16 yavcentos slapd: connection_read(13): checking for input on id=3 Feb 4 12:13:16 yavcentos slapd: ber_get_next on fd 13 failed errno=0 (Success) Feb 4 12:13:16 yavcentos slapd: connection_read(13): input error=-2 id=3, closing. Feb 4 12:13:16 yavcentos slapd: connection_closing: readying conn=3 sd=13 for close Feb 4 12:13:16 yavcentos slapd: connection_close: conn=3 sd=-1 Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_close Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:16 yavcentos slapd: SASL [conn=-1] Debug: MMYMECHSERVER mymech_server_mech_dispose Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:16 yavcentos slapd: SASL [conn=-1] Error: MMYMECHSERVER mymech_server_mech_dispose: start - receives *conn_co ntext=0x8666a10 *utils=0x8666188 Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:17 yavcentos slapd: SASL [conn=-1] Error: MMYMECHSERVER mymech_server_mech_dispose Feb 4 12:13:17 yavcentos slapd: daemon: removing 13 Feb 4 12:13:17 yavcentos slapd: conn=3 fd=13 closed (connection lost) Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: activity on 1 descriptor Feb 4 12:13:17 yavcentos slapd: daemon: activity on: Feb 4 12:13:17 yavcentos slapd: Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL END Compile and link options of mymech: gcc -I ..... -v -Wall -W -O2 -MT mymech.lo -MD -MP -MF .deps/mymech.Tpo -c mymech.c -fPIC -DPIC -o mymech.lo gcc -shared mymech.lo mymech _init.lo plugin_common.lo -lpthread -lcrypt -lresolv -lc -Wl,-soname -Wl,lib mymech.so.2 -o .libs/lib mymech.so.2.0.22 Would you have a clue or a though for us about some further check to do over either our code or compile options, (maybe particularly on the thread-safe topic)? Would you suggest some thread safe programming strategy? Many many thanks Francesco Grossi

2 6

Question about subtree renaming
by Philipp Foeckeler 14 Feb '09

14 Feb '09

Hi, Could someone explain me please the prerequisites for subtree renames/moves support by slapd (LDAP ModifyDN for non-leaf objects)? Currently i use slapd 2.2.6-37.19 with bdb backend without. What backend do i need to support subtree renames/moves? What slapd versions could support it? Do i need any special config for this? I understand that Overlay salpo-refint would be a good idea, any other overlays i should use then? Thank you, Philipp

2 1

OpenLDAP coredumps on startup (Solaris 10)
by Daniel Hoffend 14 Feb '09

14 Feb '09

Hello I'm setting up an openldap directory server (2.4.13) including a 2nd one for as backup/failover partner. After i compiled everything, installing, configuring everything (database, sync, schema, etc) and imported the basic LDAP Layout (ou=Users,ou=Groups, etc), I wanted to use this directory as Userdirectory for Userauthentication on ldap. I was switching user/group lookups using the 'ldapclient' command and modified to /etc/nsswitch.conf to refer for "files ldap" for passwd and group. Everything seems to work. 'genent passwd' and 'getent group' is listing my ldap user and groups. But when i try to restart the slapd server it crashes sometimes with a coredump. ---------------------------------------------------------------------- # /usr/local/libexec/slapd -d 65535 -u openldap -g openldap @(#) $OpenLDAP: slapd 2.4.13 (Jan 30 2009 12:02:48) $ root@ldapserver:/usr/local/src/openldap-2.4.13/servers/slapd ldap_pvt_gethostbyname_a: host=ldapserver, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened ldap_create Bus Error (core dumped) ---------------------------------------------------------------------- Not everytime, sometimes several times in a row, sometimes after a 2nd start. I've no clue what it could be. In the ldap logfile, i found the 2 following lines ---------------------------------------------------------------------- an 30 16:26:56 ldapserver slapd[9494]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported Jan 30 16:26:56 ldapserver slapd[9494]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported ---------------------------------------------------------------------- I started to run the slapd server using "truss" to see when the server starts to coredump. ---------------------------------------------------------------------- # truss /usr/local/libexec/slapd -d 65535 -u openldap -g openldap [...] open("/etc/nsswitch.conf", O_RDONLY|O_LARGEFILE) = 9 fcntl(9, F_DUPFD, 0x00000100) Err#22 EINVAL read(9, " #\n # C o p y r i g h".., 1024) = 1024 read(9, " g u r e i t o u t ".., 1024) = 245 read(9, 0xFF092400, 1024) = 0 close(9) = 0 fstat(3, 0xFFBFCAE8) = 0 time() = 1233329411 getpid() = 9512 [9511] putmsg(3, 0xFFBFC1A0, 0xFFBFC194, 0) = 0 open("/var/run/syslog_door", O_RDONLY) = 9 door_info(9, 0xFFBFC0D8) = 0 getpid() = 9512 [9511] door_call(9, 0xFFBFC0C0) = 0 close(9) = 0 fstat(3, 0xFFBFCB88) = 0 time() = 1233329411 getpid() = 9512 [9511] putmsg(3, 0xFFBFC240, 0xFFBFC234, 0) = 0 open("/var/run/syslog_door", O_RDONLY) = 9 door_info(9, 0xFFBFC178) = 0 getpid() = 9512 [9511] door_call(9, 0xFFBFC160) = 0 close(9) = 0 Incurred fault #5, FLTACCESS %pc = 0x0008E1FC siginfo: SIGBUS BUS_ADRALN addr=0x00000191 Received signal #10, SIGBUS [default] siginfo: SIGBUS BUS_ADRALN addr=0x00000191 ---------------------------------------------------------------------- It looks like after reading nsswitch.conf, the server starts to crash. I changed the following lines in the nsswitch.conf and the server starts fine without any further problems. (even 20x in a row) ---------------------------------------------------------------------- Before: group files ldap After: group files ---------------------------------------------------------------------- Another thing is: If the server could startup without problems, it never crashed again. It's only sometimes during the initial startup. I would be happy if anyone could help me or point me what i could adjust. If needed i could provide more information. -- Best regards Daniel Hoffend

6 10

run time link options
by Brett ＠Google 14 Feb '09

14 Feb '09

Is there any likelyhood of -R${PREFIX}/lib making it into the default build options to help mitigate system library mismatches ? Likewise a -with-bdb-home=/my/berkeley/home, which results in a -L/my/berkeley/home/lib and/or -R/my/berkeley/home/lib option being added to the LDFLAGS variable (-L in the case of a static build, -L and -R in the case of a dynamic build) and -I/my/berkeley/home/include being added to CPPFLAGS ? I guess -R may not be available on every platform, buy maybe the presence of -R is detectable ?

1 0

upgrading an openldap v1 ldbm database to a v2 bdb database?
by Kevin Martin 13 Feb '09

13 Feb '09

So I've got an openldap v1 database with .oc.conf and .at.conf files describing the database that get included in the slapd.conf and I need to be able to migrate to a v2 database (bdb or ldbm, I don't care which). I find no mention of how to migrate the .oc and/or .at file entries to a usable .schema/(s) file(s) and I apparently can't ldapsearch and dump the schema from the old database (using ldapsearch -b cn=schema -L “(objectclass=*)” )...it doesn't find a cn=schema. I can copy the ldbm format ldap database lock, stock, and barrel from the old machine to a new machine but ldap2 won't allow me to include the .at.conf and .oc.conf files that describe the database. I've also dumped the old database entries into a .ldif file at this point but have nowhere to import it to. All constructive thoughts appreciated. Kevin

3 2

Can OpenLDAP get password from AD
by Duong Pham Tung 13 Feb '09

13 Feb '09

Hi, I am building a solution for web-based application authentication using OpenLDAP as a backend data source. But, in my case, OpenLDAP acts as a proxy and all user information are stored on AD servers. I can get some field from AD to OpenLDAP, but it is not enough for my apps to authentication user because OpenLDAP can’t get password field from ADs. So, can OpenLDAP have other solutions to solve my problem? Thanks and Best regards, Phạm Tùng Dương

5 5

kerberosSecurityObject object Class
by Chavez, James R. 12 Feb '09

12 Feb '09

Hello List, I am inquiring about the kerberosSecurityObject object class and the krbName Attribute type. How can these be utilized in the LDAP environment? I do have an associated kerberos realm that I would not mind using for authentication. Can these help me to leverage this? Any pointers to documentation is appreciated as are any explanations. I have extended the OPenLDAP schema to include the kerberos schema in a test environment but am unsure how to leverage it. Thanks James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

1 0

Multiple Databases not replicating.
by Tom Cooper 12 Feb '09

12 Feb '09

Hi all, I am running openldap-2.4.12 in a mirror configuration with each master also having a slave updated with syncrepl. Each master contains multiple databases but replication between the masters happens only for the first database. I have checked my configuration and there is nothing obvious. An extract of my slapd.conf follows: # Free Radius OpenLDAP Server database bdb suffix "dc=radius,dc=xxxxxxx,dc=co,dc=za" rootdn "cn=Manager,dc=radius,dc=xxxxxxxx,dc=co,dc=za" directory /var/lib/ldapradius rootpw XXXXXXXXX access to * by * read overlay syncprov syncprov-checkpoint 5 1 syncrepl rid=001 provider=ldap://dev-ldap-master-03.xxxxxxxx.co.za bindmethod=simple binddn="cn=Manager,dc=radius,dc=xxxxxxxxx,dc=co,dc=za" credentials=XXXXXXXXXX searchbase="dc=radius,dc=xxxxxxxxx,dc=co,dc=za" schemachecking=off type=refreshAndPersist interval=00:00:05:00 retry="60 +" mirrormode true # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq ################################################################### # Portal OpenLDAP Server database bdb suffix "dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" rootdn "cn=Manager,dc=portal,dc=xxxxxxxxxxx,dc=co,dc=za" directory /var/lib/ldapPortal rootpw XXXXXXXXXXXXXXXX access to * by * read overlay syncprov syncprov-checkpoint 5 1 syncrepl rid=002 provider=ldap://dev-ldap-master-03.xxxxxxxxxxx.co.za bindmethod=simple binddn="cn=Manager,dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" credentials=XXXXXXXXXXX searchbase="dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" schemachecking=off type=refreshAndPersist interval=00:00:05:00 retry="60 +" mirrormode true # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index fnbConnectProfileId eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq Thanks, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

1 0

LDAP at the UKUUG Spring 2009 Conference
by Andrew Findlay 11 Feb '09

11 Feb '09

The UKUUG Spring 2009 Conference (24-26 March 2009 in London) has a strong LDAP flavour. OpenLDAP and other LDAP technologies are covered by several papers: * OpenLDAP Replication Strategies Gavin Henry (Suretec Systems & OpenLDAP project) * OpenLDAP and MySQL: Bridging the Data Model Divide Howard Chu (Symas Corp. & OpenLDAP project) * Writing Access Control Policies for LDAP Andrew Findlay (Skills 1st) * Securing Access to UNIX, Linux and Mac with Active Directory Barry Scott (Centrify) There is also a Kerberos tutorial and several papers on systems monitoring. The programme is here: http://www.ukuug.org/events/spring2009/programme/ Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Openldap RWM/AD Bind
by Chris Natter 11 Feb '09

11 Feb '09

Hi, I'm hoping someone can help me out on this. At the moment I have this setup: database ldap suffix "ou=foo.com,o=mail" uri "ldap://4.4.4.4:389/" rootdn "cn=Overlord,dc=foo,dc=com" idassert-bind bindmethod=simple binddn="cn=BAR LDAP Proxy Account,cn=Users,dc=bar,dc=local" credentials="w00tz0r" mode=none flags=override,prescriptive rebind-as-user yes overlay rwm rwm-suffixmassage "dc=bar,dc=local" rwm-map attribute proxyAddresses * rwm-map attribute sAMAccountName * rwm-map attribute cn * rwm-map attribute givenName * rwm-map attribute mail * rwm-map attribute sn * rwm-map attribute * 4.4.4.4 is an Active Directory server. This seems to work fine for simple searches and the like again ou=foo.com,o=mail, however I need to setup an application against it. The way the application works for authentication is it uses an openldap service account, finds the user's email address in the directory via proxy, then tries to rebind as that user to the directory via proxy. I'm imagining this setup doesn't work because of the service account handling the bind for the actual directory search transparently, you can't just bind as a user through it. (specifically, I get inappropriateAuthentication/error code 48) Is there a way to implement what I need? Thanks for any help in advance. -Chris

1 0

ssh certificate ldap
by Peter Gordon 11 Feb '09

11 Feb '09

Hi. I have the following setup: pam.d/ssh #%PAM0.0 auth required /lib/security/pam_nologin.so auth sufficient /lib/security/pam_ldap.so auth required /lib/security/pam_unix_auth.so try_first_pass account [success=ok perm_denied=die default=ignore] /lib/security/pam_ldap.so account required /lib/security/pam_unix_acct.so password sufficient /lib/security/pam_ldap.so session required /lib/security/pam_unix_session.so User logins are filtered by the line pam_filter in /etc/ldap.conf. All the conf files are soft links to this file. The configuration works for a user without a certificate. Which is to say, users belonging to the correct group as defined in the filter can login, others cannot. If the user has an ssh certificate pair, and the public key appears on the target, and there is no password needed, the pam_filter is not used. Is there any way to ensure that even users with certificates have to pass the pam_filter? Thanks, Peter

1 0

Block IP address after failure Bind
by jakjr 11 Feb '09

11 Feb '09

Hello, Is there a way to block a specific ip address when this ip attempt to bind many times if failure result ?? This could be useful to prevent a brute-force attack. I know that ppolicy can lockout the user after some failed attempts. But I would like to block new connections from the IP, after this IP try to make a number of fail binds. Best regards, Jakjr

4 4

Problem when using OpenLDAP query to AD server
by Duong Pham Tung 10 Feb '09

10 Feb '09

Hi all, I am testing a OpenLDAP act as LDAP proxy server using meta-backend. My back-end server contain AD servers and some OpenLDAP servers. When this OpenLDAP server connects to other OpenLDAP servers to query data, everything is okie, I get any data as I desire. But, when I use this server query to AD server, the return code is always Operation Error. I debug this process and I get a error which AD server return to my OpenLDAP server "errorMessage: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece" although I had configured a binddn and bindpw for my OpenLDAP server. But if I using ldapsearch, query directly to AD server and specify username and password, everything is okie :-(. Here is a piece of my sldapd.conf: database meta suffix "dc=abc,dc=com " uri "ldap://10.3.0.24/dc=abc,dc=com " binddn "cn=root,dc=abc,dc=com " bindpw 123 suffix "dc=xyz,dc=net" uri "ldap://10.3.0.26/dc=xyz,dc=net" binddn "cn=openldap,cn=Users,dc=xyz,dc=net" bindpw 123 map attribute uid sAMAccountName map attribute cn name map attribute mail userPrincipalName map objectClass account user map attribute * Note: 10.3.0.24 is a OpenLDAP server IP and 10.3.0.26 is AD server IP. I used openldap(a)xyz.net to query data from AD server directly and It is okie. But in this case, I got an error. Any idea for my problem? Thanks and best regards,

2 4

nss_ldap SSL/TLS problems..
by Arjun Singh 10 Feb '09

10 Feb '09

Hi, I'm trying to set up an ldap server on FreeBSD 7.1-RELEASE. I sent this to the freebsd-support list as well, but I don't think this is FreeBSD specific so I thought I'd ask here too. I installed all of the latest versions of openldap24-server, openldap24-client, nss_ldap, and pam_ldap. When I do any sort of ldapsearch or 'getent passwd' or anything, everything works perfectly. The only time I have trouble is when I'm logging in via SSH..then it gets really weird. 1.) When I log in as a user in LDAP only and give the incorrect password first and then supply the correct password, everything works fine. If the user is in wheel, I can sudo. 2.) When I log in as the same user and give only the correct password the first time, it hangs for roughly 45 seconds and then lets me in. Even though this user is in wheel, it says that the user is not in the sudoers file. Here are the log messages I get in auth.log that correspond to the events above: sshd[54031]: pam_ldap: error trying to bind as user "uid=user..(cut)..." (Invalid credentials) # This is the incorrect pw sshd[54029]: error: PAM: authentication error for user from localhost #Incorrect pw sshd[54032]: nss_ldap: could not search LDAP server - Server is unavailable # correct pw sshd[54029]: Accepted keyboard-interactive/pam for user from localhost port 32935 ssh2 #correct pw When I enter just the right password, the first time, I get this in the log: sshd[54047]: Accepted keyboard-interactive/pam for user from localhost port 51972 ssh2 sshd[54050]: nss_ldap: could not get LDAP result - Can't contact LDAP server Again, when SSL/TLS are disabled, I get normal log output and none of the weird stuff above.. I turned on debugging in nss_ldap.conf and found that each time I gave only the correct password (corresponding with the 45 second hang) I found this in the debug output: ...bunch of normal looking output... ldap_chkResponseList ld 0x801b31480 msgid 5 all 0 ldap_chkResponseList returns ld 0x801b31480 NULL ldap_int_select read1msg: ld 0x801b31480 msgid 5 all 0 ber_get_next TLS trace: SSL3 alert write:fatal:bad record mac <--- what is the cause of this? ldap_free_connection 1 0 ldap_free_connection: actually freed ldap_err2string ldap_result ld 0x801b31480 msgid 5 wait4msg ld 0x801b31480 msgid 5 (timeout 30000000 usec) wait4msg continue ld 0x801b31480 msgid 5 all 0 ** ld 0x801b31480 Connections: ** ld 0x801b31480 Outstanding Requests: Empty ld 0x801b31480 request count 0 (abandoned 0) ** ld 0x801b31480 Response Queue: Empty I get the above regardless of whether I'm using start_tls or ssl. If you have any insight, it'd be really useful. I've spent tons of time scouring lists for help and haven't found anything yet.. Thanks, -Arjun

1 0

User to administrate a OU
by Leandro Repolho 10 Feb '09

10 Feb '09

Hello, i don't know if is it possible to do it but i would like to create a User inside an OU of my OpenLDAP server and when this user connects to a ldap manager like phpLdapAdmin he needs to see all objects inside his OU and manage them. Is it possible to do it? Thank you very much, -- Leandro Cascino Repolho

2 1

help in ldap and webmin
by Sufyan Aqtam 10 Feb '09

10 Feb '09

Hi all I have a problem in openldap server. I configured an ldap server with bdb that contains about 25000 user. It works perfect to answer the authentication requests and modifying existing users. I am using the webmin "LDAP Users and Groups" module to create new users. When I fill the information for a new user and click on create button it takes a very long time to create the user. I check the log file of ldap server and I find that it starts access all users in the database. The messages in the log file as below and it is repeated for all users: conn=19 op=1 ENTRY dn="uid=testuser,ou=users,dc=example,dc=com" Feb 7 10:38:42 testserver slapd[25075]: <= send_search_entry: conn 19 exit. Feb 7 10:38:42 testserver slapd[25075]: entry_decode: "uid=testuser,ou=Users,dc=example,dc=com" Feb 7 10:38:42 testserver slapd[25075]: <= entry_decode(uid=testuser,ou=Users,dc=example,dc=com) Feb 7 10:38:42 testserver slapd[25075]: => bdb_dn2id("uid=testuser,ou=users,dc=example,dc=com") Feb 7 10:38:42 testserver slapd[25075]: <= bdb_dn2id: got id=0x24 Feb 7 10:38:42 testserver slapd[25075]: => test_filter Feb 7 10:38:42 testserver slapd[25075]: EQUALITY Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: search access to "uid=testuser,ou=Users,dc=example,dc=com" "objectClass" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: <= test_filter 6 Feb 7 10:38:42 testserver slapd[25075]: => send_search_entry: conn 19 dn="uid=testuser,ou=Users,dc=example,dc=com" Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "entry" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "uid" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "cn" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "objectClass" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "userPassword" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "shadowLastChange" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "shadowMax" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "shadowWarning" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "loginShell" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "uidNumber" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "gidNumber" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "homeDirectory" requested Feb 7 10:38:43 testserver slapd[25075]: <= root access granted I hope to help me with many thanks to your efforts. Regards

2 4

Unable to logon to any server as a locally defined user if the OpenLDAP server is unavailable.
by Sean Leinart 10 Feb '09

10 Feb '09

Greetings OpenLDAP Technical Mailing List, I would generally consider myself at the newb status when it comes to LDAP in the Linux environment. I have acquired a network from a previous admin and my issue is that if the LDAP server is offline I can not authenticate locally on any of my servers, which is obviously a huge problem. The version of Open LDAP is: [user@server:/usr/sbin]slapd -VV @(#) $OpenLDAP: slapd 2.2.13 (Jul 11 2008 09:16:05) $ mockbuild@builder16.centos.org:/builddir/build/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd The Linux Version is: [user@server:/]uname -a Linux server.host.local 2.6.9-42.0.10.ELsmp #1 SMP Tue Feb 27 10:11:19 EST 2007 i686 i686 i386 GNU/Linux I have read several items regarding the fact that this can be a common issue when using LDAP authentication. I have read to check the settings in the nsswitch.conf file on the systems in question to verify that "Files" are being looked at first etc. and all of these settings appear to be correct. I am looking for guidance on what would be the best thing to do in this case, and why is it broken when the ldap server is not available. What happens is, if the LDAP server is not available, and you attempt to logon to a server locally, you enter the userid and password and you will have no activity for a minute or so then the prompt goes directly back to the login prompt. The userid and password that is being used is locally defined on the server. Also PAM LDAP is being utilized. Any help or ideas on what to look for would be greatly appreciated. Is there a way to just turn off the LDAP authentication on the servers. I feel that the answer to this is probably no. That would simply be too easy. Thanks in advance for any responses. sean sleinart(a)fscarolina.com No virus found in this outgoing message. Checked by AVG. Version: 7.5.552 / Virus Database: 270.10.19/1941 - Release Date: 2/9/2009 6:50 AM

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

Thanks all for your comments / answers / criticisms on this issue. It's been helpful and informative and is much appreciated. Andy.

1 0

N-way replication config file help
by Mike Simonton 09 Feb '09

09 Feb '09

Hello everyone, I'm trying to convert my two node replicated OpenLDAP pair to a three-way pair and am having trouble with configuring the slapd.conf files. Can anyone tell me what I need to add here? Below is my newly modified slapd.conf file with the system03 addition: ----- slapd.conf on system01 replicating to system02 and system03 ----- include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/promptu.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args serverID 001 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=mydomain,dc=local" rootdn "cn=Manager,dc=mydomain,dc=local" rootpw secret directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=0 provider=ldap://sys02 type=refreshAndPersist interval=00:00:00:30 retry="5 5 300 +" searchbase="dc=mydomain,dc=local" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=local" credentials="secret" updateref ldap://sys02 syncrepl rid=0 provider=ldap://sys03 type=refreshAndPersist interval=00:00:00:30 retry="5 5 300 +" searchbase="dc=mydomain,dc=local" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=local" credentials="secret" updateref ldap://sys03 mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 Thank you for your help! Mike

2 3

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/9 Quanah Gibson-Mount <quanah(a)zimbra.com>: > I'm not sure why you feel it is necessary to set the server read-only before > you run slapcat anyway. It was purely in relation to point 18.1.2 in this doc... http://www.openldap.org/doc/admin24/maintenance.html To quote... "Slapcat can be run while slapd is active. However, one runs the risk of an inconsistent database- not from the point of slapd, but from the point of the applications using LDAP. For example, if a provisioning application performed tasks that consisted of several LDAP operations, and the slapcat took place concurrently with those operations, then there might be inconsistencies in the LDAP database from the point of view of that provisioning application and applications that depended on it. One must, therefore, be convinced something like that won't happen. One way to do that would be to put the database in read-only mode while performing the slapcat."

2 1

Re: How to set BDB "read-only" before slapcat command ?
by William Jojo 09 Feb '09

09 Feb '09

---- Original message ---- >Date: Mon, 09 Feb 2009 08:08:32 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: How to set BDB "read-only" before slapcat command ? >To: Andrew Hall <whippyhubbles(a)googlemail.com>,Michael Ströder <michael(a)stroeder.com> >Cc: openldap-technical(a)openldap.org > >--On Monday, February 09, 2009 3:44 PM +0000 Andrew Hall ><whippyhubbles(a)googlemail.com> wrote: > > >> The possible problem I see with that setup is what happens if the >> slapcat occurs during an update from the provider to the consumer ? > > >I'm not sure why you feel it is necessary to set the server read-only >before you run slapcat anyway. Do you actually have a process that knows >exactly what changes occurred in any given second, so that, if say, your >backup starts at 1:00:00, you can then replay all the changes from that >point in time? > >If you do, then it doesn't matter whether or not it was in read-only. >Simply replay the changes. If you don't, then it doesn't matter whether or >not it was in read-only, because you don't know what changes happened after >that point. > >I honestly am not aware of anyone who bothers to put their DB into >read-only before slapcatting, although they may be out there. > Admittedly we stop one slapd in our group of servers (usually a master) to take a point in time snapshot with slapcat, then simply restart it. It is used solely as part of our disaster recovery. In the event of BDB corruption that is unrecoverable, we can build a new server from the full-text export. Just basic DBA paranoia policy. :-) :-) Cheers, Bill

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/9 Michael Ströder <michael(a)stroeder.com>: > No matter what you do at the LDAP server's side it could happen in > between a series of related write operations leading to inconsistent > state of data (from the application's point of view). > > If you want better hints then you have to provide more details about > your deployment. > > Ciao, Michael. We have a primary "hidden" master and two replicating secondaries which both get queried in a round-robin DNS fashion. Applications such as phpLDAPadmin are configured to connect to these secondaries which pass writes to the primary via an updateref chain overlay. At the moment I am using slapcat on the primary for backups but am open to other suggestions. Perhaps I should just create a third read-only replicating secondary which no applications connect to and backup from that ? The possible problem I see with that setup is what happens if the slapcat occurs during an update from the provider to the consumer ?

2 1

LDAP - Password and userId length
by yukti kaura 09 Feb '09

09 Feb '09

Hi, I required to perform length validation on the credential used to log in to LDAP. Could you please help me with the *length *of userId & password used to log in to LDAP Thanks for all your help Yukti

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

Dieter KlÃnter writes... > man slapd.conf(5), readonly on Thanks for the info. So I would need to edit the .conf file and restart the service for this to take effect ? Is there no "on the fly" solution similar to "FLUSH TABLES WITH READ LOCK;" for example ? Thanks.

2 2

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/8 Michael Ströder <michael(a)stroeder.com>: > Note that this is only needed if you have to ensure the integrity of > inter-related LDAP entries. So this depends on your deployment, > especially the writing LDAP client applications. > > But thinking more thoroughly about this it could be also a problem if a > client application trys to modify several entries and you're switching > to read-only mode in between as preparation for a backup. Even if the > application would theoretically be capable of rolling back all the > changes it wouldn't help since the LDAP server is read-only then. > > So the solution would be rather to really make sure that no > admin/provisioning application is running anymore. > > I think the admin guide could clarify this. I can't really close client applications unless I gracefully terminate all connections on the LDAP server perhaps ? I guess that could be one option.

1 0

How to set BDB "read-only" before slapcat command ?
by Andrew Hall 08 Feb '09

08 Feb '09

Hi there. According to this doc... http://www.openldap.org/doc/admin24/maintenance.html#Directory Backups Prior to slapcat being used for a backup the DB should be set to read-only. How exactly is this done ? I am using a BDB backend and all I can find is in this doc... http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/… Which also doesn't describe how. Is there an OpenLDAP or BDB command / tool which I can use to do this ? Thanks very much.

2 1

ldap_search_s hangs with ms active directory
by Sankhadip Sengupta 07 Feb '09

07 Feb '09

Hi, I have written a C ldap client to interact with a MS Active Directory in Win Server 2003. When I search for the base DNs from scope LDAP_SCOPE_BASE I get all the results perfectly.But when I try to search for an existing user anonymously( I set all the permissions in the ACLS ) it hangs indefinitely. Now, surprisingly when I search with the ldapsearch tool it works fine. I use this : attrs[0]=LDAP_ALL_USER_ATTRIBUTES; attrs[1]=NULL; attrsonly=0; ldap_search_s(ld,"dc=test,dc=com",LDAP_SCOPE_SUBTREE,"uid=test",NULL,0,&msg) After a long period when it returns, I get return code 0 (Success) but there is no entry in that. Can anyone help me? This works fine with slapd server 2.4.12.I am totally confused. Thanks, Sankhadip

4 5

Access to a sync provider via back-meta
by ali.pouya＠free.fr 07 Feb '09

07 Feb '09

Hi, I need to connect my replica to a sync provider via an intermediate slapd configured with back-meta. My goal is to use the rewrite/map functions of back-meta. But I find that slapd crashes each time the replica is started. May be back-meta does not support LDAP controls ? or LDAP partial responses ? Does any one have an experience with this ? I precise that I cannot use the RWM overlay for many reasons : -The RWM overlay has to be installed in the remote sync provider server that is managed by another team. -the overlay is incompatible with the other uses of that server. -The overlay is still experimental but back-meta is not. -And finally, when I configure the overlay on my test server (by simply adding the line "overlay rwm" in the config) slapd crashes each time I make an LDAP search ! (I'm using OpenLdap 2.4.13). I do not send an issue (ITS) for theses crashes because I think that I'm not using a standard feature of slapd. Can any one help me ? Thanks & best regards Ali

2 3

objectClass: ...
by Brian Krusic 06 Feb '09

06 Feb '09

Hi all, I'm back to ask for proper population of ldap dirs so I start with good habits. I've done all three on test servers and haven't noticed any functional issues. What is the best way to define my top level nodes; objectClass: dcObject objectClass: organizationalUnit or objectClass: top objectClass: dcObject objectClass: organization or objectClass: domain Humbly your, - Brian

3 3

Moving Old Certs to New Servers
by James Angell 05 Feb '09

05 Feb '09

Hi Guys, We have just built new replacement LDAP servers and are about to make to switch from the old ones. All of the certs we use are currently authenticated against the old servers. Does anyone know if it is possible to use these certs to authenticate against the new servers or are we going to have to create all new certs for all servers and workstations? Thanks in advance. - Jim -- Regards Jim Angell Cade Network Operations College Of Engineering Phone: 581-7551

1 0

RE: Forgotten password recovery
by Brett Maxfield 05 Feb '09

05 Feb '09

Maybe generate a random challenge, store it in ldap as an additional hashed password value maybe with a special {challenge} hash type as a marker, assuming ldap will try *all* passwords when logging in. openldap would need to know the marker {challenge} hash type is like {plain} or some other hash type for purposes of comparison. You cannot allow reset of a password (destroying the old one) immediately, as otherwise you are allowing a denial of service attack where people could randomly reset passwords. But given the random challenge (returned by the user) could now be used for authentication, the user could authenticate as themselves and reset thier own password, and remove the temporary challenge password. This probably requires a marker "hash" type to identify temporary hash password, to allow reliable removal of old or expired challenge passwords. -----Original Message----- From: Vincent Panel <yohonet(a)gmail.com> Sent: Thursday, 5 February 2009 1:59 AM To: openldap-technical(a)openldap.org Subject: Forgotten password recovery On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

3 2

[openldap] Newbie question: can the server (slapd) show incoming search queries?
by sol myr 05 Feb '09

05 Feb '09

Hi, I'm new to ldap, and would appreciate help on the following: I'm running the stand-alone server (slapd), and allow some client machines run search queries against it (ldapsearch). My question: I'd like the "slapd" server to show the incoming search queries. Can it be done? For example: - If the client runs "ldapsearch -h myhost -b "dc=example,dc=com" -s sub "objectclass=*" - I'd like the server console(or log file) to show something like: Incoming query: -b "dc=example,dc=com" -s sub "objectclass=*" I'd tries running "slapd" in debug mode (slupd -d 1), but couldn't quite deduce the query from it (it logs lot of detailed lines, but I couldn't gather the qeury from them. Probably my fault for being a newbie). Thanks :)

3 2

slave dbd files and timestamps
by Ken McLauchlin 05 Feb '09

05 Feb '09

Hi there, We're running openldap 4.1.25 on 4 servers. 2 servers on a site running in master/slave configuration and 2 more on a remote site running as slaves receiving updates from the slurpd running on the master. The question I have isn't really anything to do with the configuration but with what files should be updated on the remote slave servers on update? The slave running at the same site as the master has all the files (dc.bdb, db2id.bdb, id2entry.bdb and objectClass.bdb) all updated with the same timestamp. However on the remote slaves the objectClass.bdb is NOT updated at the same time as the others. Is this a problem? As an aside, we are getting a log.00000xxxx file created every couple of days on the remote slave servers which isn't happening on the primary site slave server. Is this a configuration issue? Hope you can help. Cheers, Ken

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

1 0

Re: Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Thanks, but as discussed, even creating a user able to reset all the userPassword attributes of all other users is not security risk free. This is what I call a privileged user and I would like to avoid it. Drupal already supports such a solution, but I don't find it secure enough. I had an interesting suggestion on the list : to create a database of temporary security objects where drupal is the only one who knows the passwords. Each temporary security object is able to reset one password in the main database (by the use of regex ACLs) and only once. On 2/4/09, Brett Maxfield <brett.maxfield(a)gmail.com> wrote: > If we are talking about openldap, not drupal, there are probably many ways > of doing so.. My thoughts.. > > You cannot bind as the user in this case, as presumably the reason they want > to reset password is that they dont know it. > > You should probably give the website it's own standard read-only user, which > has been (only) allowed to update userPassword. > > Giving the website manager/root access just to change a password would be > extremely unwise and inasvisable. > > Drupal should let you specify any ldap user for password resers.. > > -----Original Message----- > From: Vincent Panel <yohonet(a)gmail.com> > Sent: Wednesday, 4 February 2009 2:16 AM > To: openldap-technical(a)openldap.org > Subject: Forgotten password recovery > > Hello, > > Many websites now provide a feature which allow users to reset their > password on their own, without being helped by an administrator or > another privileged person. > > A website I'm working on is using drupal which is able to handle such > a situation by sending a mail to the user. The body of this mail > contains a specific url crafted by drupal so that when the user clicks > on the link, drupal can automatically authenticate the user. This URL > is only valid once. > > If you try to integrate drupal with openldap, you'll find that > openldap does not support such an authentication scheme. So you are > either forced to create a privileged user in LDAP which is able to > reset all users' passwords or live with it and give up this feature. > > So I'm writing to this list to know if anyone already had a similar > issue and which solution was found ? Would it be possible for openldap > or an openldap overlay to implement such an authentication mechanism ? > Is there any IETF draft about it (one can dream) ? > > Vincent > >

2 1

user home directory perms
by Geoffrey 04 Feb '09

04 Feb '09

We are using a combination of ldap and samba, therefore are adding users via the smbldap-useradd script. How do we set the permissions for the home directory when the user logs in for the first time. The directories are being created, but not with the permissions we want. Thanks. -- Until later, Geoffrey Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Hello, Many websites now provide a feature which allow users to reset their password on their own, without being helped by an administrator or another privileged person. A website I'm working on is using drupal which is able to handle such a situation by sending a mail to the user. The body of this mail contains a specific url crafted by drupal so that when the user clicks on the link, drupal can automatically authenticate the user. This URL is only valid once. If you try to integrate drupal with openldap, you'll find that openldap does not support such an authentication scheme. So you are either forced to create a privileged user in LDAP which is able to reset all users' passwords or live with it and give up this feature. So I'm writing to this list to know if anyone already had a similar issue and which solution was found ? Would it be possible for openldap or an openldap overlay to implement such an authentication mechanism ? Is there any IETF draft about it (one can dream) ? Vincent

3 4

best practices - dn:
by Brian Krusic 03 Feb '09

03 Feb '09

Hi all, I've read and config'd my ldifs as follows; option 1; dn: uid=fbar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= option 2; dn: cn=Foo Bar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= My OpenLDAP server is used for company white pages and authentication for Linux, OSX clients. What do you think the most reliable dn value should be; with uid or with cn? - Brian

2 2

multiple groups not showing up in "groups" cmd
by Justin Lintz 03 Feb '09

03 Feb '09

Hi, I've configured a user to be a member of another posixGroup as so... dn: cn=dev2,ou=groups,dc=test,dc=net cn: dev2 gidNumber: 1003 objectClass: posixGroup objectClass: top memberUid: dave The users info: dn: cn=David FooBar,ou=people,dc=test,dc=net givenName: David sn: FooBar cn: David FooBar uid: dave userPassword:: uidNumber: 1009 gidNumber: 1004 homeDirectory: /home/dave loginShell: /bin/bash objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top If I log into a server with the users account, it shows him properly a member of gid 1004, but does not list his seconday group of dev2. My /etc/ldap.conf file is base dc=test,dc=net binddn cn=Manager,dc=test,dc=net bindpw timelimit 15 bind_timelimit 15 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman pam_filter objectclass=posixaccount pam_member_attribute memberuid nss_base_passwd ou=People,dc=test,dc=net?one nss_base_shadow ou=People,dc=test,dc=net?one nss_base_group ou=Groups,dc=test,dc=net?one uri ldaps://prodldap01/ ldaps://prodldap02/ ssl on tls_cacertdir /etc/openldap/cacerts tls_checkpeer no pam_password md5 I also tried changing the value of memberUid to the DN of the user, but that did not work as well. Any suggestions are appreciated. Thanks - Justin Lintz

2 2

Active Directory & Open LDAP Synchronization
by Paul bob 03 Feb '09

03 Feb '09

Hi - I have installed Active directory authentication for windows servers and users and LDAP for Linux servers, now I am planning to use single sign on system windows and Linux. How can I sync with these two directory? I would appreciate your advice! Thanks, PB

3 2

supportedSASLMechanisms not Work in Debian Lenny
by Jarbas Peixoto Júnior 02 Feb '09

02 Feb '09

I have two servers: * Server A: Debian Etch - Works Fine * Server B: Debian Lenny - Do not Works supportedSASLMechanisms EXTERNAL In Server A I have: # ldapsearch -v -H ldap://server-Etch -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Etch ) SASL/EXTERNAL authentication started SASL username: emailAddress=jarbas.peixoto(a)previdencia.gov.br,CN=jarbas.peixoto,OU=DATAPREV,O=Previdencia Social,L=Campo Grande,ST=Mato Grosso do Sul,C=BR SASL SSF: 0 filter: (objectclass=*) requesting: supportedSASLMechanisms dn: supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: NTLM supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: EXTERNAL In Server B I have: # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Lenny:389/??base ) ldap_start_tls: Connect error (-11 # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ -d 1 ldap_url_parse_ext(ldap://server-Lenny) ldap_create ldap_url_parse_ext(ldap://server-Lenny:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP server-Lenny:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.82.0.234:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x9d73280 msgid 1 wait4msg ld 0x9d73280 msgid 1 (infinite timeout) wait4msg continue ld 0x9d73280 msgid 1 all 1 ** ld 0x9d73280 Connections: * host: www-mmldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 29 18:17:22 2009 ** ld 0x9d73280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x9d73280 request count 1 (abandoned 0) ** ld 0x9d73280 Response Queue: Empty ld 0x9d73280 response count 0 ldap_chkResponseList ld 0x9d73280 msgid 1 all 1 ldap_chkResponseList returns ld 0x9d73280 NULL ldap_int_select read1msg: ld 0x9d73280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x9d73280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x9d73280 0 new referrals read1msg: mark request completed, ld 0x9d73280 msgid 1 request done: ld 0x9d73280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_start_tls: Connect error (-11) In the /var/log/syslog I have: Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 ACCEPT from IP=10.82.0.234:50441 (IP=0.0.0.0:389) Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 STARTTLS Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 RESULT oid= err=0 text= Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 closed (TLS negotiation failure) This is very important for use openldap with user certificates. Anybody have a help for me? Tanks!

3 3

RE: ldap_bind fails in vpn tunnel
by Christopher Barry 30 Jan '09

30 Jan '09

> -----Original Message----- > From: Shankhadeep Sen [mailto:shanks.iit@gmail.com] > Sent: Friday, January 30, 2009 1:25 PM > To: Christopher Barry > Subject: Re: ldap_bind fails in vpn tunnel > > Hi Christopher, > > Thanks for your email.It seems that > without TLS , the search works first but next when I initiate > a TLS session, the ldap api says "SERVER DOWN".I must mention > that the bandwidth is very low in that VPN tunnel and there > is only one route. > > Now I used tcpdump to check the packets on port 389 , it > seems that there are a lot of packets being exchanged.My > guess is that because of the low b/w even if one packet gets > dropped because of router overflow, the SSL handshake will be > terminated. > > What do you think? > > Thanks, > > Sankhadip > > > On Fri, Jan 30, 2009 at 9:05 AM, Christopher Barry > <christopher.barry(a)qlogic.com> wrote: > > > > -----Original Message----- > > From: > > openldap-technical-bounces+christopher.barry=qlogic.com@openld > > ap.org > > [mailto:openldap-technical-bounces+christopher.barry > <mailto:openldap-technical-bounces%2Bchristopher.barry> =qlogic.co > > m(a)openldap.org] On Behalf Of Sankhadip Sengupta > > Sent: Friday, January 30, 2009 9:34 AM > > To: openldap-technical(a)openldap.org > > Subject: ldap_bind fails in vpn tunnel > > > > Hi, > > > > In a VPN tunnel, using TLS, ldap_search works but the > > ldap_bind fails with error :Can't contact LDAP server(-1). > > > > Can any one help me? I am using the openldap sdk. > > > > Thanks, > > > > Sankhadip > > > > > You might try putting the LDAP server's name and IP > address in the hosts file of the client. > > -C > > > > > Is this link helpful to you? http://www.openldap.org/lists/openldap-software/200201/msg00625.html

2 1

ldap_bind fails in vpn tunnel
by Sankhadip Sengupta 30 Jan '09

30 Jan '09

Hi, In a VPN tunnel, using TLS, ldap_search works but the ldap_bind fails with error :Can't contact LDAP server(-1). Can any one help me? I am using the openldap sdk. Thanks, Sankhadip

1 0

Sudo Access
by Paul bob 29 Jan '09

29 Jan '09

Hi! I need to give some of ldap users to sudo access. I am not sure how to configure SUDO access in LDAP. Your valuable suggestion appreciated! Thanks in Advance! -

3 2

LDAP password information update failed: Insufficient access
by Paul bob 28 Jan '09

28 Jan '09

I am experiencing a problem trying to configure a ldap server for users authentication. Basically, I am at a point where users can login properly, but they can not change their password. Some info for troubleshooting: slapd.conf access info access to attr=userPassword access to * by self write by users read by anonymous auth I would appreciate your help! Thanks, bob

2 1

Hello
by Donny George 27 Jan '09

27 Jan '09

Hello I have been trying to set up an Ldap server with openssl certificates. the certificates were generated and the ldap were given access to them but once slapd restart was put it, we received an error *main*: *TLS init def ctx failed*: -207 does some one have a clue as to why this comes up ? -- Donny George

1 0

Syslog and symas openldap
by ian.g.fox＠bt.com 26 Jan '09

26 Jan '09

Hi, I am using Symas' OpenLDAP s/w on a solaris 10 box. The package I have installed is symas-openldap-silver-2.4.12.0.sun4u.pkg. # pkginfo -l symas-openldap-silver PKGINST: symas-openldap-silver NAME: Symas OpenLDAP Silver CATEGORY: application ARCH: sun4u VERSION: Dev Release 10/17/2008 BASEDIR: / PSTAMP: gamba20081017182137 INSTDATE: Dec 09 2008 16:36 STATUS: completely installed FILES: 279 installed pathnames 24 directories 72 executables 60155 blocks used (approx) I want to get syslogging from slapd out to a file. I have configured /etc/syslog.conf with the following lines: # LDAP logging local4.debug /var/log/slapd.log The file /var/log/slapd.log exists: # ls -l /var/log/slapd.log -rw-r--r-- 1 root root 0 Dec 10 09:25 /var/log/slapd.log and I have restarted syslog: # svcadm restart svc:/system/system-log In /opt/symas/etc/openldap/slapd.conf I have included a line: loglevel -1 and restarted my slapd server using: /opt/symas/etc/solserver restart Having done all this I am still not getting anything written out to /var/log/slapd.log. Does anyone know what I need to do to get this working please? My regards Ian G Fox

1 0

Re: web apps and client certificate authentication
by Kurt Zeilenga 24 Jan '09

24 Jan '09

On Jan 11, 2009, at 10:07 AM, Emmanuel Dreyfus wrote: > Hello > > I am not sure this is the right place for that question, but I cannot > figure a better one. Please point me to the right place if there is a > better one than here. [[from openldap-software]] > > > I know how to use x509 certificate to authenticate a client against > OpenLDAP. It works great with ldap{search|add|modify|delete| > whatever}.` > > Now I would like to do the same with the client being a web browser > and > with a web application between the browser and slapd: > > browser (client cert) --> apache (PHP web application) --> slapd > > Client certificate authentication from the browser to apache is > strightforward. Yes, so why complicate it? > > > Therefore I can easily have the client authenticating to the web > application, and the web application operating on the directory on > behalf on the client (the web app should bind to the directory as a > privilegied user that would have authzTo: *) The web application should just authenticate as itself and then use proxy authorization to act on behalf of the client. Of course, it has to be authorized to do so. > > > But it would be nicer to actually have the client authenticate to > slapd > using its own client certificate. Why? Generally, the web application is part of the service which encompasses the web server and directory service. They should already have an appropriate trust relationship. > That is, having the web application > behaving as a kind of proxy, without any special privilege on the > directory. Is that possible? If it is, where should I start? Would require cooperation between the web server and the directory server. So nothing gained, IMO, except complexity. > > > -- > Emmanuel Dreyfus > http://hcpnet.free.fr/pubz > manu(a)netbsd.org

4 12

OpenLDAP locks
by Gaëtan Slongo 24 Jan '09

24 Jan '09

Hello all, I saw on a book that OpenLDAP locks parent entries when an entry is updating... It's true ? Example : If I'm updating "uid=username,ou=Users,dc=mydomain", "ou=Users,dc=mydomain" and all children will be locked (write lock?) while the update is performing ?? Thanks. -- Slongo Gaëtan Tel: +32 (0)65/84.23.85 (+6005) GPG/PGP : http://www.gslongo.eu/gslongo_it-optics.pub.asc -- OpenPGP E-Mail Security : http://enigmail.mozdev.org/home/index.php

2 1

LDAP data for JUnit
by yukti kaura 24 Jan '09

24 Jan '09

Hi All, I am using LDAP as a back end for my application. Howeve my JUnit have become LDAPServer dependant. i.e. they read the data from a particular server which I specify as the ldapUrl Do we have a mechanism that for the testing purpose alone I can introduce a static LDIF file ported alongwith the code. The JUnit will then read from LDIF in a manner that they read from LDAP Server. Is there such a method?? Please guide... Thanks for all your help!!!! Yukti Kaura

1 0

openldap C sdk help
by Sankhadip Sengupta 24 Jan '09

24 Jan '09

Hi , I am a developer and I have set up openldap2.4.12 and wrote an ldap client in C using the ldap C sdk. Over lan everything looks fine but when I try to connect and do the same thing over an external IP it fails saying ldap_bind_s :Can;t contact ldap server(-1). The server runnign with d127 shows " error:broken pipe connection reset by peer " Could you please help me? Thanks Sankhadip

1 0

Self-signed server cert within our corp = failure
by Jeff Blaine 23 Jan '09

23 Jan '09

OpenLDAP 2.4.11 client How do I subvert this bogusness? The cert is legit. % /usr/rcf/bin/ldapsearch -d 1 -v -ZZ -h ldap.our.com -p 4890 -D uid=jblaine -W mail=jblaine(a)our.com emailmailbox ... res_errno: 0, res_error: <Start TLS request accepted.Server willing to negotiate SSL.>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 2, err: 19, subject: /O=our.com/OU=Certificate Authority/CN=SuperDuper Corporation Root CA-1, issuer: /O=our.com/OU=Certificate Authority/CN=SuperDuper Corporation Root CA-1 TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed. ldap_err2string ldap_start_tls: Connect error (-11)

4 5

Equality matching on facsimileTelephoneNumber
by Sean Burford 22 Jan '09

22 Jan '09

Hi, ITS 2571 is suspended (since 2003) pending IETF action: http://www.openldap.org/its/index.cgi/Contrib?id=2571 Has the IETF decided how facsimile telephone number matching should work, if at all? Our users would like to replace fax numbers, and there doesn't seem to be an appropriate matching rule. -- Thanks, Sean Burford

1 0

ldap_simple_bind_s fails intermittently, when run in an loop
by bharath.venkata＠wipro.com 22 Jan '09

22 Jan '09

Hi all, I am trying to use openldap api's to connect to ldap from my code. I tried to connect to ldap server 1,00,000 times(just intiliazing , binding and unbinding) Intilaly Binding to the ldap server works fine, but after some time say after reaching more than 10,000 binds. bind continously fails with below error . "Can't connect to the LDAP server - Cannot assign requested address". and error number is 91 below is my code snapshot. int main() { int ret,version,i; i=0; LDAP *ld=0; while(100000) { const char *s=0; cout<<"count is "<<i++<<endl; ld=ldap_init(HOSTNAME,PORTNUMBER); // HOSTNAME and PORTNUMBER are defined if(ld == NULL) { cout<<" error in initiliaze "<<endl; return 2; } ret=ldap_simple_bind_s(ld,"",""); ldap_perror(ld,s); if(ret != LDAP_SUCCESS) { cout<<" error in bin "<<ret<<endl; cout<<ldap_err2string(ret)<<" is the error"<<endl; } else { cout<<"bind success "<<endl; } ldap_unbind(ld); ld=NULL; } return 0; } i am clue less why this happened. Is there any restriction or bug (already present) that only certain number of binds are possible in a given time. Your help will be highly help full in my further proceedings. Regards, Bharath. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

openldap syncrepl
by Brad C 21 Jan '09

21 Jan '09

Hi There, Im having trouble with openldap synrepl. Ive turned on debugging. http://pastebin.com/d2da66c02 OpenLDAP versions itshare:~ # rpm -qa | grep -i openldap openldap2-client-2.4.12-5.3 openldap2-devel-2.4.12-5.3 openldap2-2.4.12-5.4 OpenSUSE 11.1 Linux itshare 2.6.27.7-9-pae #1 SMP 2008-12-04 18:10:04 +0100 i686 i686 i386 GNU/Linux Any advice would be most welcome. This is a vanilla system, is it because it has not created the ldap database locally?Jan 21 16:39:05 itshare slapd[3321]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Kind Regards Brad

1 0

How can I configure overlays during runtime of slapd?
by Andreas Micheler 20 Jan '09

20 Jan '09

Hallo all, I am new to OpenLDAP, and I am trying to configure slapd during runtime to add/remove one or more Overlays. I have already converted slapd.conf to a config directory slapd.d before. The command I use to add the overlay is: slapadd -F slapd.d -n 0 -l myovondelta The ldif file myovondelta is: dn: olcOverlay=constraint,olcDatabase=bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcConstraintConfig olcOverlay: constraint olcConstraintAttribute: mail regex ^[:alnum:]+@mydomain.com$ olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?su$ But the output I get is: <= str2entry: str2ad(changetype): attribute type undefined slapadd: could not parse entry (line=1) Can anyone please point me in the right direction? Where is my mistake? Thanks, Andreas

2 1

trailing characters in olcserverids after conversion
by Oliver Liebel 19 Jan '09

19 Jan '09

using openldap 2.4.13 (compiled from openldap.org source-package) i have noticed the following, reproducable behaviour when converting a slapd.conf to slapd.d: if slapd.conf contains serverids with ldap-urls, e.g. in this format: ServerID 1 "ldap://ldapmaster.local.site:9000" ServerID 2 "ldap://ldapslave.local.site:9000" the olcserverids always contains some trailing (garbage) characters after the conversion, and are base64 encoded. when i set them manually in cn=config with ldapmodify, they are displayed "clean". the serverid-lines in slapd.conf are "clean" (they contain no whsp/tabs at the end of the line or similar, invisible chars). i have tested it without \"\ and without portnumber, tested conversion with slaptest and slapd, in virtual and real machines, result is always the same. any ideas? greetings, oliver

2 2

ppolicy in openldap
by Allgood, John 19 Jan '09

19 Jan '09

Hello All I am fairly new to openldap and have some questions about password policys. We are running ldap on RHEL5 and using openldap 2.3.27. The ppolicy overlay gives me a lot of what I need but RHEL5 does not seem to have it installed. How can I get this installed? Also the best that I can tell is that ppolicy does not have any dictionary checks either. Is this true or did I just miss something? What I would like to setup is what we currently have in place using cracklib. Minlen=8 at least 1 Uppercase, 1 Lowercase, 1 Number, 1 special char. Best Regars John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com www.ohl.com

3 2

Ldapsearch
by Juan Pablo Roig 18 Jan '09

18 Jan '09

Hi alln i am new to the list and i have 2 questions: 1- i ve just configured my openldap server in a freebsd to use tls an to require client certificates, my problem is that i cant test the connection with the ldapsearch command. Is this posible? 2- is there any gui ldap browser that supports client certificates? Thanks a lot Juan 2009/1/17, openldap-technical-request(a)openldap.org <openldap-technical-request(a)openldap.org>: > Welcome to the openldap-technical(a)openldap.org mailing list! This list > is intended to be used for technical discussions of issues related to > use of OpenLDAP Software. This list is lightly moderated. > > To submit a message to this list, send your email to > openldap-technical(a)openldap.org. > > General information about the mailing list is at: > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > If you ever want to unsubscribe or change your options (eg, switch to > or from digest mode, change your password, etc.), visit your > subscription page at: > > http://www.openldap.org/lists/mm/options/openldap-technical/juan.pablo.roig… > > > You can also make such adjustments via email by sending a message to: > openldap-technical-request(a)openldap.org > > with the word `help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. > > You must know your password to change your options (including changing > the password, itself) or to unsubscribe. It is: > ilap11 > > Normally, Mailman will remind you of your openldap.org mailing list > passwords once every month, although you can disable this if you > prefer. This reminder will also include instructions on how to > unsubscribe or change your account options. There is also a button on > your options page that will email your current password to you. > -- Enviado desde mi dispositivo móvil

2 1

openldap group filter and websphere
by hai wu 17 Jan '09

17 Jan '09

Hi, We have one openldap server, and for dev environment, groups are put under 'ou=devgroup,dc=example,dc=com', and for production environment, groups are put under 'ou=group,dc=example,dc=com'. When integrating websphere to openldap, we can only specify one search base, which is set to 'dc=example,dc=com', and for the group filter, it is set to '(&cn=%v)(objectclass=posixGroup))'. But in this case, it is pulling all groups from both dev and production environment. Is there a way to set the group filter so that for our dev environment, it would only pull dev groups, and for production environment, it would only pull production groups? I tried ldapsearch by applying the group filter, modified it a little bit, but still could not get it to work in our case. Thanks, Hai

1 0

Why TLS is always fail with OpenLdap 2.4.11
by Hunter hu 16 Jan '09

16 Jan '09

H <openldap-technical(a)openldap.org>i, I have to get help from here , because I was struggling with TLS configuration for weeks. during those days , I searched google include this list , still cant pass ,my god. Does anyone could provide some guide on how to configure the openldap TLS connection with step by step, so can reduce our pain ? Here I expose the step and try to get help from the senior ldap engineer. 1. installed openldap with-tls=openssl I add the openssl specially to avoid use gnutls, sometimes, openldap will goto find gnutls if c header is there install and start slapd succesfully. 2. using ldapsearch -v -h 10.192.183.73 -b "dc=example,dc=com" -s base "objectclass=*" I can get the listed information from openldap server, that is ok 3. now go for certificate genearation with numerous guide in google , but not fit to pass for me 3.1 cd /var/myca /usr/local/ssl/misc/CA.sh -newCA then will generate demoCA, and cacert.pem is there, that is ok 3.2 /usr/local/ssl/misc/CA.sh -newreq newkey.pem newreq.pem notes : I am using 10.192.183.73 as the common name, is there any issue here? 3.3 /usr/local/ssl/misc/CA.sh -sign then you got newcert.pem now copy into /var/ldap and try to insert into slapd and restart TLSCipherSuite MEDIUM:+TLSv1+SSL3+SSL2 TLSCertificateFile /var/ldap/newcert.pem TLSCertificateKeyFile /var/ldap/newkey.pem ( some guide said should be newreq.pem) TLSCACertificateFile /var/ldap/cacert.pem 4. ftp cacert.pem into client and copy into /var/myca using s-client to test at first penssl s_client -connect 10.192.183.73:389 -showcerts -state -CAfile /var/myca/cacert.pem -tls1 you will got the error always CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:failed in SSLv3 read server hello A 14719:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: could any kind man to give some help to save me? -- Hunter

2 1

Re: Syncrepl Questions
by Gavin Henry 15 Jan '09

15 Jan '09

> I am not understanding what happens to my clients if something happens > to my provider. In some replication systems when the main server fails > you can start using the machine that was replicated to as your > primary. This is called Active-Active Hot Standby and can be done with MirrorMode. > Does the consumer act as a slave machine? It can be, depends how you've set it up, which you have told us ;-) > On each of my > clients do I point them to the provider/consumer. It depends on what your clients are doing, if it's all readonly, then point them at both. Tell us more. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 4

Re: Syncrepl Questions
by Gavin Henry 15 Jan '09

15 Jan '09

----- "John Allgood" <jallgood(a)ohl.com> wrote: > Hello Again Hi, > Maybe by the end of this project I will be somewhat of an ldap expert > until them please bear with me. It will take many years to get there (I'm no where near), trust me ;-) > I think I have gotten a little more understanding to how this will > work. I have a provider and a consumer up and running and I am > pointing each application and or server to both the provider and the > consumer. Also there is something called referrals that are talked > about for the consumer. Is this something I will need to use. If you understand referrals you will be able to answer this yourself. Anyway, referrals "refer" a client to the Provider if it is trying to write a consumer that doesn't accept writes, think of it as "Go speak to the boss". > We started building the ldap server about a month ago. We have not > really had the time to do proper research due to time constraints. This can be a big problem. > We > just used the rpms that Redhat provided with RHEL5 which is openldap > 2.3. The rpms built from Redhat did not have the ppolicy overlay built > in. I found the overlays on the Beta channels from Redhat Network and > used those to get the ppolicy. I wish Redhat would stay a little more > up2date. Anyways if there is anymore advise that can be provided I > would appreciate it. Oh one more thing. When I was setting up syncprov > for the first time I missed the part about loading the module in the > slapd.conf. I did enter the overlay syncprov to my config and it > appears to work. Can syncprov be built into openldap and not loaded as > an module. Just wanted some verification on this issue. Build it how you like, it's best to build from source to start with to get a feel for everything. Then depending on how you company works you can move to a commercially supported version. I would never recommend the RHEL version, but please visit the list archives for why. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Re: Re: N-Way Multi-Master replication - delete problem
by Adrien Futschik 15 Jan '09

15 Jan '09

It seems like I am not the only one facing this problem. Is this officially reported as a bug ? I found out that when deleting an entry on the master I added it to, it is removed only on this master and deleting is not replicated until I make some other operation on the other master. Seems like the delete is "queued". When deleting an entry on the "other" master (not the one I added the entry to), the delete works fine and is correctly replicated. Anyone to help me with N-Way Multi-Master replication ? Adrien Futschik ======================================== Message date : Jan 07 2009, 06:35 PM From : "jakjr" <joao.alfredo(a)gmail.com> To : adrien.futschik(a)atosorigin.com Copy to : Subject : Re: N-Way Multi-Master replication - delete problem Hello Adrien, I have the same problem deleting entries on N-Way MultiMaster. Did you resolved this problem ? Best Regards. On Mon, Dec 22, 2008 at 6:10 AM, Adrien Futschik < adrien.futschik(a)atosorigin.com> wrote: > OK, But then what did I do wrong ? delete an entry shouldn't be a problem > with N-Way Multi-Master replication ? should it ? > > Here is how I have setup-ed my masters : > > m1 -config : > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW:< file://$CONFIGPWF > > m2 - config : > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW:< file://$CONFIGPWF > > m1 - syncprov : > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > m2 - syncrepl : > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > m1 - schema : > include: file://$ABS_SCHEMADIR/core.ldif > include: file://$ABS_SCHEMADIR/cosine.ldif > include: file://$ABS_SCHEMADIR/inetorgperson.ldif > include: file://$ABS_SCHEMADIR/openldap.ldif > include: file://$ABS_SCHEMADIR/nis.ldif > > m1 - backend : > dn: olcDatabase={1}$BACKEND,cn=config > objectClass: olcDatabaseConfig > objectClass: olc${BACKEND}Config > olcDatabase: {1}$BACKEND > olcSuffix: $BASEDN > olcDbDirectory: ./openldap-data > olcRootDN: $MANAGERDN > olcRootPW: $PASSWD > olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=$INTERVAL retry="5 5 300 5" timeout=3 > olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=$INTERVAL retry="5 5 300 5" timeout=3 > olcMirrorMode: TRUE > > dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > Did I miss something ? > Has anyone tested N-way Multi-master replication & encountered the same > problem as me ? > > Adrien > > ======================================== > Message date : Dec 19 2008, 07:11 PM > From : "Quanah Gibson-Mount" <quanah(a)zimbra.com> > To : adrien.futschik(a)atosorigin.com, openldap-technical(a)openldap.org > Copy to : "Miguel Jinez" <miguel.jinez(a)gmail.com> > Subject : Re: Re: N-Way Multi-Master replication - delete problem > > > > --On December 19, 2008 9:28:41 AM +0100 Adrien Futschik > <adrien.futschik(a)atosorigin.com> wrote: > > > Hy everyone, > > > > I have just tested the same procedure with OpenLDAP 2.4.13. The problem > > remains the same. > > > > Did I miss something ? Is this supposed to be like this ? > > > > I'm joining the modified script I'm using to setup both masters and the > > LDIF files I'm using to add and remove an entry (+ attributes). > > > > I did not use access-log, is this supposed to work with N-Way > > Multi-Master replication ? I thought it was only used in case of Delta > > Synchronization/Replication. > > Correct, delta-syncrepl and MMR are not currently supported together (that > may change in the future). > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > > > > Adrien Futschik >

2 1

ppolicy
by Allgood, John 15 Jan '09

15 Jan '09

Hey Guys I have another question in regards to using ppolicy. I have built my policy into ldap. How do I apply that policy to my existing user objects. Thanks John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com <mailto:jallgood@ohl.com> www.ohl.com <http://www.ohl.com>

3 2

Syncrepl Questions
by Allgood, John 14 Jan '09

14 Jan '09

Hey All I am working on setting up sync replication for ldap. I have it working but I am not sure exactly what I can do with it. How do I failover to it? I may be missing a piece that would help tie it all together. Thanks for any input. John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com <mailto:jallgood@ohl.com> www.ohl.com <http://www.ohl.com>

2 1

OpenLDAP centralized authentication with Active Directory
by Duong Pham Tung (FIM HN) 13 Jan '09

13 Jan '09

Hello, My company network have some different domains such as abc.net, abc.com and xyz.com (I don't use real domain name because of our company's security policy). Each domain is managed by a dedicated Active Directory server. Now, I want to use one OpenLDAP server to authenticate all users from these domains because we want manage services they use focusly (such as Mail, Portal). But now, I have'nt any solutions to solve this problem. Because the number of users is very large (approximately 10.000 users) so I can't build database by hand. Can anyone suggest me the solution to solve this problem. Thanks and Best regards, Duong Pham.

4 3

Re: AW: Question about the manager acccount for the openldap-database
by Quanah Gibson-Mount 09 Jan '09

09 Jan '09

--On Friday, January 09, 2009 8:43 AM +0100 Oliver Steffens <osteffens(a)gc-heat.de> wrote: > Thank you for your quick reply. We will check this solution. Please keep replies on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Need information
by Buddhadeb Bhakta 09 Jan '09

09 Jan '09

Hi All, I would like to use the below C functions which is inside ldap.h header file. ldap_init() ldap_simple_bind_s() ldap_search_s() ldap_unbind() Could anyone please let me know to use these functions, what package should I install? I am using HP-UX B.11.00 version of OS. Please advise. Thanks Buddhadeb

1 0

OpenLDAP as a 'generic' hierarchical data store
by Lorenzo Pastrana 09 Jan '09

09 Jan '09

Hello list, I was wondering lately if I could use OpenLDAP as a 'generic' hierarchical data store for the application I'm planning, and tried to get any hint about feasibility. I found a blog post about OpenDS (http://blogs.sun.com/treydrake/entry/ldap_vs_relational_database), where the author states about Read/write performance parity ... That was the kind of news I just wanted to hear because I'm thinking about a persistence back-end, not just an almost static dataset, but I'm in a genuine PHP environment and Java is not an option; so I naturally tried to get some infos regarding OpenLDAP performance but found nothing recent, and the references I could find are quite discouraging on that matter ... However since 4 to 8 years have passed since the tests I've been reading, I'm still in the hope of a 'a pleasant surprise' as the sun guy sayz ... Does someone has an experience to share about that kind of (mis-)usage of OpenLDAP ? Any pointers to some good and recent reference on the matter are of course well come. Thanks in advance for any information. LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

5 9

Question about the manager acccount for the openldap-database
by Oliver Steffens 08 Jan '09

08 Jan '09

Hi together, Unfortunately the current (md5-encrypted) password is lost... Is it possible to change the "rootpw" in the "slapd.conf" from an md5-one into a new plain-text one without any problems respectively additional efforts? Thank you for your help in advance! Best regards Oliver Steffens

2 1

LDAP Host access best practices
by Mathew Rowley 07 Jan '09

07 Jan '09

I am fairly new to LDAP in general, so please excuse any syntax errors. I have a radius proxy which will query an LDAP data store to determine if a user has access to a host. I want to reuse the concept of how users are defined: Ou=users -> defines all users Ou=groups -> defines all groups Ou=groups,cn=groupname -> links the users to the group With hosts. My problem is that I cannot find any specific formal definition on how this is done (in terms of what each subtree¹s objectClass should be). Has anyone done this, or can point me in the right direction? All the user/groups based stuff is based on posixGroup, which im pretty sure is unix/linux concept can this be used for what I am trying to do with hosts? Basic architecutre: Ou=hosts -> defines a host Ou=hostGroups -> defines a group name (organizationlUnit?) Ou=hostGroups,cn=hostGroupName -> this will link what hosts are in the group Thanks for any help. -- MAT

1 0

replication on 2.4.13
by jakjr 07 Jan '09

07 Jan '09

Hello, I'm testing a multimaster config on openldap 2.4.13. I have 2 servers. Adds and Modifies are ok on both. But, when I deleted 300 entries, with server B down and this server goes up again, those entries deleted from server A are no replicated. Server B still keeping those entries. This is a bug or a config error. This is my config: ServerID XXX syncrepl rid=001 provider=ldap://<IP> type=refreshAndPersist retry="5 5 10 +" searchbase="dc=br" bindmethod=simple binddn="cn=admin,dc=br" credentials=** schemachecking=off mirrormode on overlay syncprov syncprov-checkpoint 100 1 syncprov-reloadhint TRUE syncprov-sessionlog 100 Thanks

1 1

authenticate a user to LDAP server using GSS-SPNEGO and Kerberos
by Deepika Srivastava 07 Jan '09

07 Jan '09

Hi I have to authenticate a user to LDAP server using GSS-SPNEGO and Kerberos as base mechanism. I have successfully generated the TGT. Now I want to use ldap_sasl_bind_s() function with "GSS-SPNEGO" as mechanism. I am not sure of the parameters to pass. I read on http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/apis… in case of Kerberos,we can use the above mentioned ticket if we have the TGT.Just we need to pass 'cred' and 'dn' as NULL and the functional will automatically take care of the rest of the mechanism under covers. ldap_sasl_bind_s (g_hLDAP,"", "GSS-SPNEGO" ,NULL,NULL,NULL, &servercredp ) This is how I am calling the function but is throwing LDAP_PARAM_ERROR. I am not sure of the reason. Can anyone help me on the reason? Also i wanted to know that do we need to any configurations at the LDAP server end to do enable kerberos authentication. Also do i need to call krb5_mk_req() before calling ldap_sasl_bind_s() or can i directly call ldap_sasl_bind_s()? Can anyone help me on the flow of API for achieving complete authentication after achieving the kerberos ticket. . Any thoughts?

2 1

ldap.conf location help
by Sankhadip Sengupta 06 Jan '09

06 Jan '09

Hi, I am trying to make a client which will query users via an LDAP server.Now in the code I use TLS to encrypt the session. Using TLS , I face a problem that the client is unable to verify the server certificate. Connect error(-11) ssl error(1490086). When I use ldapsearch to do that it works fine.I have LDAP server on the same machine and running via loopback. I figured this problem is due to location of ldap.conf file as when I changed the entry of TLS_CACERT in the ldap.conf file (commented it out) the ldapsearch also failed which shows it is unable to locate the certificate. Is there any way to make sure that the client tools always find the correct ldap.conf file? Please help. Sankhadip

1 0

Question about ldap filter
by Jason Voorhees 06 Jan '09

06 Jan '09

Hi there: I'm trying to understand how ldap filters work. Based on this simple logic expression: EXPR_1 (or) EXPR_2 if EXPR1 returns TRUE, will slapd still try to evaluate EXPR2? or will slapd evaluate EXPR2 anyway even if EXPR_1 is true? I think that while the ldap filter is bigger then performance is worse, right? could somebody explain me a little about this logic of evaluation in ldap filters? Thanks

3 7

acl to allow access to specific parts of the tree only for a particular dn
by ben thielsen 05 Jan '09

05 Jan '09

i'd like to prevent the dn "cn=foo, ou=services, ou=accounts, dc=example, dc=com" from accessing any part of the tree outside of "ou=test, ou=other, ou=users, ou=accounts, dc=example, dc=com" and "ou=test, ou=other, ou=users, ou=groups, dc=example, dc=com", and would like that dn to have only read access to those two subtrees - the exception being that that user should of course be able/required to authenticate. i'm having trouble constructing a working acl that accomplishes this. one example attempt: dn: olcDatabase={2}bdb,cn=config changetype: modify replace: olcAccess olcAccess: to dn.base="" by * read olcAccess: to attrs=userPassword by self write by anonymous auth by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=groups,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to * by self write by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" none by users read by * none that particular example gets me: >ldapsearch -uxLLLWP 3 -H 'ldaps://ldap.ltn.lvc.com' -D 'cn=montage_test, ou=services, ou=accounts, dc=ltn, dc=lvc, dc=com' -b 'dc=ltn, dc=lvc, dc=com' "(objectclass=groupofnames)" dn | grep -i 'dn:' Enter LDAP Password: No such object (32) what am i missing? thanks -ben

1 0

problem with ldap_start_tls_s
by Sankhadip Sengupta 05 Jan '09

05 Jan '09

Hi everyone, I am trying to write an LDAP browser that uses both plain text and TLS.The plain text works fine but when I am using "ldap_start_tls_s" I get an error: ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Also just to note ldapsearch works fine. ldapsearch -vLxZZ -b "dc=example,dc=com" "(objectClass=*)" no problem with this. My code fragment is below: if ((ld = ldap_init(ldap_host, LDAP_PORT)) == NULL ) { perror( "ldap_init failed" ); exit( EXIT_FAILURE ); } /* set the LDAP version to be 3 */ if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version) != LDAP_OPT_SUCCESS) { ldap_perror(ld, "ldap_set_option"); exit(EXIT_FAILURE); } if(ldap_start_tls_s(ld,NULL,NULL)!=LDAP_SUCCESS) { ldap_perror(ld, "ldap_start_tls"); exit(EXIT_FAILURE); } Please help :( Thanks, Shawn

1 0

contextCSN
by jakjr 05 Jan '09

05 Jan '09

Hello, I'm testing a multi-master installation of openldap 2.4.11 (debian lenny). To check if the masters are consistent, I search for the contextCSN of each one, and check this value. If the values are the same, the masters are consistents, rigth ?? But now, after many, many changes (ADD/DELETE), I am searching for the contextCSN and the server is reporting three contextCSN's. Is this correct ?? EG: # ldapsearch -x -h <IP> objectClass=organization contextCSN -b dc=pr,dc=gov,dc=br -LLL -z 1 dn: dc=org contextCSN: 20081226121401.392297Z#000000#000#000000 contextCSN: 20081226173429.931124Z#000000#001#000000 contextCSN: 20081226173327.189304Z#000000#002#000000 Thanks. João Alfredo

2 2

Database is getting corrupted
by Jason Voorhees 05 Jan '09

05 Jan '09

Hi all: I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf: database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660 index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub I always do the following: 1. # rm /var/lib/ldap/* (to be sure i'm starting from scratch) 2. # slapadd -b dc=redtube,dc=com redtube.ldif After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct? Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following: 3. # chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already) 4. I check against posible errors and then start OpenLDAP: # slapd -Tt # service ldap start 5. OpenLDAP starts correctly, it works perfectly. I can even do modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok. My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs: Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)" Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me. Then I stop and start OpenLDAP and I start getting this: # /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ] Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks

3 6

Help with understandig behaviour of crashed OpenLDAP Server
by yukti kaura 04 Jan '09

04 Jan '09

Dear All, I would like to seek clarification with one aspect of LDAP server recovery When a crashed Server in replicated mode is restarted does it immediately start publishing its services or it publishes itself only after resynchronizing Please guide Thanks Yukti Kaura

2 1

LDAP - Samba
by Terry Haley 30 Dec '08

30 Dec '08

Ok, I'm trying to wrangle this under control with this setup I've inherited and have run across a few speed bumps. Here's the state of things as is. I've made a few changes to the setup thinking that I've fixed an issue or two and have in fact only confused myself and possibly my configuration. The downside is that I don't know a few key passwords that was used in the original setup. (yay no overlap with my predecessor). I have a samba server acting as my PDC with an LDAP server used for authentication. Question #1: the password contained within the LDAP directory for my 'admin' account should = the 'rootpw' entry in slapd.conf correct? Question #2: the 'ldap admin dn' entry in my smb.conf file should equal the 'rootdn' entry in my slapd.conf file, afterwhich, this should be updated to samba using smbpasswd -w correct? Question #3: the 'admin users' entry within the smb.conf are the users that allow access to the domain correct? Currently, what I'm working with here is that I don't know the 'admin, samba or the samba-admin' passwords. The samba-admin account is just an LDAP admin account but Not the root account. This should be fixed to the above question 2 yes? I would like to change all of these passwords but am fearful that I could make things worse. Also, regarding the components on my network (machines specifically), will there be an issue if I change the 'samba' account (domain account) password with their ability to connect to the domain? Thank you in advance for any help and advice! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

4 3

Constant corruptions
by Jason Voorhees 30 Dec '08

30 Dec '08

Hi there: I'm still having problems with my OpenLDAP 2.3.27 from CentOS 5. I know that index directive in slapd.conf causes the creation of .bdb files in /var/lib/ldap, right? If I have this in slapd.conf: index uid,smtpAuth eq,pres ... so in some moment uid.bdb and smtpAuth.bdb will be created in /var/lib/ldap, right? When I create my ldap tree using slapadd and an LDIF file then several .bdb files get created under /var/lib/ldap, but some other no because of there are no attributes of that type in LDIF file. But when OpenLDAP is already running thanks to a simple search like "(smtpAuth=TRUE)" then slapd tries to create smtpAuth.bdb but that's when it fails. I get this message: slapd[11954]: bdb(dc=redtube,dc=com): /var/lib/ldap/smtpAuth.bdb: Permission denied slapd[11954]: bdb_db_cache: db_open(smtpAuth) failed: Permission denied (13) Does anybody know why slapd isn't able to create new index files? Permissions and ownership are totally correct. Any help? :( P.D.: I'm running openldap in a centos paravirtualized with Xen. It could be this the problem?

1 0

Re: Re: TLS config causes Object class violation
by forumuser＠online.de 30 Dec '08

30 Dec '08

Thanks!!! That's it! Like you said, I changed my TLSconfiguration.ldif file to point to "dn: cn=config" and it worked. I've once already seen the olcTLS* in the olcGlobal, however, I am new to LDAP backend database configuration, only used slapd.conf before. Thank you very much for the solution! I wish you a happy new year Belem ----- Ursprüngliche Nachricht ----- Von: Pierangelo Masarati Gesendet: 28.12.08 21:35 Uhr An: forumuser(a)online.de Betreff: Re: TLS config causes Object class violation olcTLSCACertificateFile belongs to olcGlobal, while you're trying to add it to a database object. Add it to cn=config instead. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

TLS config causes Object class violation
by forumuser＠online.de 28 Dec '08

28 Dec '08

Recently I upgraded my Ubuntu Server 8.04 to 8.10 and had to reconfigure OpenLDAP (installed by apt-get) through slapd backend database (I used slapd.config before). I have reconfigured OpenLDAP by "sudo dpkg-reconfigure slapd" and confirmed all prior settings, however the old database was moved to /var/backup/ and a fresh one was generated (please see config tree at the end). The problem is, I get following error message..: ldap_modify: Object class violation (65) additional info: attribute 'olcTLSCACertificateFile' not allowed (even olcTLSCertificateFile, if I leave out olcTLSCACertificateFile... olcTLS* seems "not allowed") ..when I try to configure TLS by ldapmodify: ldapmodify -D cn=admin,cn=config -W -x by entering this: dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/servercert.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/serverkey.pem The config tree is as follows (I will change "mydomain" and ACL later): dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=org olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=mydomain,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq Here's my "sudo apt-cache show slapd" packet information: Package: slapd Priority: optional Section: net Installed-Size: 3872 Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Original-Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Architecture: i386 Source: openldap Version: 2.4.11-0ubuntu6 Replaces: apparmor-profiles (<< 2.1+1075-0ubuntu4), ldap-utils (<< 2.2.23-3), libldap2 Provides: ldap-server, libslapi-2.4-2 Depends: libc6 (>= 2.4), libdb4.2, libgcrypt11 (>= 1.4.0), libgnutls26 (>= 2.4.0-0), libldap-2.4-2 (= 2.4.11-0ubuntu6), libltdl7 (>= 2.2.4), libperl5.10 (>= 5.10.0), libsasl2-2, libslp1, libtasn1-3 (>= 0.3.4), libwrap0 (>= 7.6-4~), unixodbc (>= 2.2.11-1), zlib1g (>= 1:1.1.4), coreutils (>= 4.5.1-1), psmisc, perl (>> 5.8.0) | libmime-base64-perl, adduser Pre-Depends: debconf (>= 0.5) | debconf-2.0 Recommends: libsasl2-modules, apparmor (>= 2.1+1075-0ubuntu6) Suggests: ldap-utils Conflicts: apparmor-profiles (<< 2.1+1075-0ubuntu4), ldap-server, libltdl3 (= 1.5.4-1), umich-ldapd Filename: pool/main/o/openldap/slapd_2.4.11-0ubuntu6_i386.deb Size: 1466528 MD5sum: 41047db9f250c0e73e2e3c43c5d90f5a SHA1: 4c23c98d55851fef7ec4ff5e4fa8d7cd1c885da9 SHA256: 107e5df3dea5a0571a2f99df1d7c919247a4223a991a99e8393b0915e39f1fc9 Description-de: OpenLDAP-Server (slapd) This is the OpenLDAP (Lightweight Directory Access Protocol) server (slapd). The server can be used to provide a standalone directory service. Homepage: http://www.openldap.org/ Bugs: mailto:ubuntu-users@lists.ubuntu.com Origin: Ubuntu (libgnutls26 is of version: 2.4.1-1build1) Can someone help me with this "Object class violation (65)" problem concerning TLS? Belem

2 1

Named pipe to local ldap slave fails when master is down.
by Jan Hugo Prins 27 Dec '08

27 Dec '08

Hi I've got a strange thing yesterday. The server that is doing my master ldap went down due to some software glitch. Al my MDA's are running there own slave ldap so they don't have to go to the master server, but what surprised me, the slaves didn't want to service anything on there named pipe while the master server was down. Why is this? The MTA's also use the ldap on the MDA's but they didn't have any problem during this master ldap outage. The only difference between the MDA's and the MTA's is that the MTA's connect to ldap with TCP/IP while the MDA's connect to ldap with a named pipe. I use syncrepl for replication. My master server is running version 2.4.12 on Fedora 10. My slave servers are running 2.3.43 on Fedora 7. In the near future I want to make this master server a dual master setup with a different server that I'm currently building. But for now I have just one master. This really breaks my whole anti SPOF setup. Can anyone tell me what is causing this? Greetings, Jan Hugo Prins

2 1

Check out my Facebook profile
by Rakesh Yadav 25 Dec '08

25 Dec '08

Hi openldap-technical, I set up a Facebook profile where I can post my pictures, videos and events and I want to add you as a friend so you can see it. First, you need to join Facebook! Once you join, you can also create your own profile. Thanks, Rakesh To sign up for Facebook, follow the link below: http://www.facebook.com/p.php?i=682100664&k=64D665VZRWVM5CEDXA64U4&r

1 0

CSN too old, ignoring, N-way multi-master replication
by Adrien Futschik 24 Dec '08

24 Dec '08

I'm starting a new thread to make it easier to understand my problem. I'm testing N-way multimaster replication with OpenLDAP 2.4.13. I'm able to successfully import data into an instance and have my two masters to sync correctly but then when I try to add a new entry in one of the two masters, I'm getting strange messages : let's say we have m1 & m2 (m1 & m2 are on the same server): I initial import data into m1, it is successfully imported into m2 (at least it looks like it). Then I'm trying to add an entry on m2 (cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm getting strange message on m1 & m2 : m1 log :(repetitively) [...] Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224125950.481561Z#000000#001#000000 older or equal to ctx 20081224125950.481561Z#000000#001#000000 Entry cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr changed by peer, ignored syncprov_search_response: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT [...] m2 log : (repetitively) [...] master where I added an entry : do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 [...] Is this a bug ? Am-I doing something wrong ? If I add the same entry to m1 and not m2 I get the following messages : on m2 : syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed syncprov_search_response: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 syncrepl_entry: rid=004 be_add (0) do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 <= bdb_inequality_candidates: (entryCSN) not indexed nonpresent_callback: rid=004 present UUID 96268508-6609-102d-9d8e-9742e72db399, dn c=fr nonpresent_callback: rid=004 present UUID 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630bfa0-6609-102d-9d9d-9742e72db399, dn ou=administrateurs,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID ae0e93d6-6609-102d-9d9e-9742e72db399, dn cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x83d6410 20081224132238.790862Z#000000#001#000000 on m1 : slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x9703700 20081224132238.790862Z#000000#001#000000 <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224132158.749532Z#000000#001#000000 older or equal to ctx 20081224132158.749532Z#000000#001#000000 syncprov_search_response: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 Here is the entry I'm adding : dn: cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf, c=fr objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: ditPerson cn: adrien-externe.futschik(a)edfgdf.fr sn: Futschik givenName: Adrien uid: adrien-externe.futschik(a)edfgdf.fr mail: adrien-externe.futschik(a)edfgdf.fr telephonenumber: 0123456789 userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r allowedServices: appli20 pretty simple isn't it ? What's going wrong ? You'll find in attachment the script I'm using to set up the replication (modified version of test050-syncrepl-multimaster). Here is the config : initialization of m1 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} initialization of m2 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} syncprov overlay on m1 : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE syncrepl on m2: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE schema on m1: include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif include: file://$ABS_SCHEMADIR/corba.ldif include: file://$ABS_SCHEMADIR/java.ldif include: file://$ABS_SCHEMADIR/misc.ldif include: file://$ABS_SCHEMADIR/nds.ldif include: file://$ABS_SCHEMADIR/dit.ldif database en m1: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: ${PASSWD} olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,seeAlso,entryUUID eq olcDbIndex: mail,givenName,uid pres,eq,sub olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov After that I populate m1 with attached arbre.ldif. Thanks in advance. Adrien

1 0

Re: Re: CSN too old, ignoring - and therefore not syncing
by Adrien Futschik 24 Dec '08

24 Dec '08

You're right I might have forgotten the most essential :) You'll find in attachment the script I'm using to set up the replication (modified version of test050-syncrepl-multimaster). Here is the config : initialization of m1 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} initialization of m2 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} syncprov overlay on m1 : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE syncrepl on m2: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE schema on m1: include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif include: file://$ABS_SCHEMADIR/corba.ldif include: file://$ABS_SCHEMADIR/java.ldif include: file://$ABS_SCHEMADIR/misc.ldif include: file://$ABS_SCHEMADIR/nds.ldif include: file://$ABS_SCHEMADIR/dit.ldif database en m1: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: ${PASSWD} olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,seeAlso,entryUUID eq olcDbIndex: mail,givenName,uid pres,eq,sub olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov After that I populate m1 with attached arbre.ldif. Thanks in advance. Adrien ======================================== Message date : Dec 24 2008, 03:23 PM From : "Gavin Henry" <gavin.henry(a)gmail.com> To : adrien.futschik(a)atosorigin.com, openldap-technical(a)openldap.org Copy to : Subject : Re: CSN too old, ignoring - and therefore not syncing Config? On 24/12/2008, Adrien Futschik <adrien.futschik(a)atosorigin.com> wrote: > I'm facing a similar problem. > I'm testing N-way multimaster replication with OpenLDAP 2.4.13. > > I'm able to successfully import data into an instance and have my two > masters to sync correctly but then when I try to add a new entry in one of > the two masters, I'm getting strange messages : > > let's say we have m1 & m2 (m1 & m2 are on the same server): > I initial import data into m1, it is successfully imported into m2 (at least > it looks like it). > Then I'm trying to add an entry on m2 > (cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm > getting strange message on m1 & m2 : > > m1 log :(repetitively) > [...] > Entry ou=administrateurs,o=gazdefrance,c=fr CSN > 20081224125950.481561Z#000000#001#000000 older or equal to ctx > 20081224125950.481561Z#000000#001#000000 > Entry cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr > changed by peer, ignored > syncprov_search_response: > cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 > do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT > [...] > > > m2 log : (repetitively) > [...] > master where I added an entry : > do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET > do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT > do_syncrep2: > cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 > [...] > > Is this a bug ? Am-I doing something wrong ? > > If I add the same entry to m1 and not m2 I get the following messages : > > on m2 : > syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) > syncrepl_entry: rid=004 be_search (0) > syncrepl_entry: rid=004 > cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr > <= bdb_equality_candidates: (entryCSN) not indexed > <= bdb_inequality_candidates: (entryCSN) not indexed > <= bdb_inequality_candidates: (entryCSN) not indexed > syncprov_search_response: > cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 > syncrepl_entry: rid=004 be_add (0) > do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT > do_syncrep2: > cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 > <= bdb_inequality_candidates: (entryCSN) not indexed > nonpresent_callback: rid=004 present UUID > 96268508-6609-102d-9d8e-9742e72db399, dn c=fr > nonpresent_callback: rid=004 present UUID > 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 9630bfa0-6609-102d-9d9d-9742e72db399, dn > ou=administrateurs,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > ae0e93d6-6609-102d-9d9e-9742e72db399, dn > cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr > slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 > slap_graduate_commit_csn: removing 0x83d6410 > 20081224132238.790862Z#000000#001#000000 > > on m1 : > slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 > slap_graduate_commit_csn: removing 0x9703700 > 20081224132238.790862Z#000000#001#000000 > <= bdb_equality_candidates: (entryCSN) not indexed > <= bdb_inequality_candidates: (entryCSN) not indexed > Entry ou=administrateurs,o=gazdefrance,c=fr CSN > 20081224132158.749532Z#000000#001#000000 older or equal to ctx > 20081224132158.749532Z#000000#001#000000 > syncprov_search_response: > cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 > do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET > do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT > do_syncrep2: > cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 > > Here is the entry I'm adding : > > dn: cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf, c=fr > objectclass: top > objectclass: person > objectclass: organizationalPerson > objectclass: inetorgPerson > objectclass: ditPerson > cn: adrien-externe.futschik(a)edfgdf.fr > sn: Futschik > givenName: Adrien > uid: adrien-externe.futschik(a)edfgdf.fr > mail: adrien-externe.futschik(a)edfgdf.fr > telephonenumber: 0123456789 > userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r > allowedServices: appli20 > > pretty simple isn't it ? What's going wrong ? > > Adrien > > ======================================== > Message date : Dec 23 2008, 07:39 PM > From : "Gavin Henry" <gavin.henry(a)gmail.com> > To : openldap-technical(a)openldap.org > Copy to : > Subject : Fwd: CSN too old, ignoring - and therefore not syncing > > ---------- Forwarded message ---------- > From: Pat Riehecky <prieheck(a)iwu.edu> > Date: Tue, 23 Dec 2008 12:34:33 -0600 > Subject: Re: CSN too old, ignoring - and therefore not syncing > To: Gavin Henry <gavin.henry(a)gmail.com> > > On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: > > Where did you read that those were needed anyway? If it was the admin > > guide then I need to fix it ;-) > > > > Gavin. > > I have no idea where I found those at... I know it wasn't the (recent) > admin guide. It may have been from around the 2.4.8 release, but that > is long gone... > > Pat > > > > > On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: > > >> Try dropping nopresent and reloadhint relating to ITS5669. You only > > >> need these two syncprov settings on an accesslog db. > > >> > > >> Gavin. > > > > > > Thanks, that did the job! > > > > > > Pat > > > > > >> > > >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > > >> >> Can you post your config somewhere? > > >> > > > >> > > > >> > allow bind_v2 > > >> > > > >> > include /etc/ldap/schema/core.schema > > >> > include /etc/ldap/schema/cosine.schema > > >> > include /etc/ldap/schema/nis.schema > > >> > include /etc/ldap/schema/inetorgperson.schema > > >> > include /etc/ldap/schema/samba.schema > > >> > include /etc/ldap/schema/eduperson-200412.schema > > >> > include /etc/ldap/schema/hdb.schema > > >> > include /etc/ldap/schema/IWU.schema > > >> > > > >> > pidfile /var/run/slapd/slapd.pid > > >> > argsfile /var/run/slapd/slapd.args > > >> > > > >> > modulepath /usr/lib/ldap > > >> > moduleload back_hdb > > >> > moduleload back_monitor > > >> > moduleload memberof > > >> > moduleload syncprov > > >> > moduleload smbk5pwd > > >> > > > >> > tool-threads 2 > > >> > sizelimit 500 > > >> > idletimeout 7200 > > >> > > > >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt > > >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt > > >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key > > >> > TLSVerifyClient allow > > >> > > > >> > localSSF 160 > > >> > security ssf=1 update_ssf=128 simple_bind=112 > > >> > sasl-secprops noanonymous > > >> > > > >> > access to dn.base="" by * read > > >> > access to dn.base="cn=Subschema" by * read > > >> > > > >> > backend hdb > > >> > database hdb > > >> > > > >> > overlay memberof > > >> > overlay smbk5pwd > > >> > overlay syncprov > > >> > > > >> > smbk5pwd-enable samba > > >> > smbk5pwd-enable krb5 > > >> > smbk5pwd-must-change 0 > > >> > > > >> > syncprov-checkpoint 100 10 > > >> > syncprov-sessionlog 200 > > >> > syncprov-nopresent TRUE > > >> > syncprov-reloadhint TRUE > > >> > > > >> > suffix "dc=iwu,dc=edu" > > >> > > > >> > rootdn "cn=admin,dc=iwu,dc=edu" > > >> > rootpw {redacted} > > >> > > > >> > authz-regexp "uidNumber=0\\\ > > >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" > > >> > "cn=ldapi,dc=iwu,dc=edu" > > >> > authz-regexp "gidNumber=.*\\\ > > >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" > > >> > "cn=ldapi,dc=iwu,dc=edu" > > >> > > > >> > authz-regexp "uid=(.+),cn=.+,cn=auth" > "uid=$1,ou=People,dc=iwu,dc=edu" > > >> > > > >> > directory "/var/lib/ldap/" > > >> > > > >> > dbconfig set_cachesize 0 62914560 0 > > >> > dbconfig set_lk_max_objects 1500 > > >> > dbconfig set_lk_max_locks 1500 > > >> > dbconfig set_lk_max_lockers 1500 > > >> > > > >> > # Make sure to do a nightly slapcat > > >> > dbconfig set_flags DB_LOG_AUTOREMOVE > > >> > > > >> > index objectClass eq,pres > > >> > index default eq,sub,pres > > >> > index mail eq,sub,pres > > >> > index sn eq,sub,pres > > >> > index cn eq,sub,pres > > >> > index displayName eq,sub,pres > > >> > index gecos eq,sub,pres > > >> > index uid eq,sub,pres > > >> > index memberUid eq,sub,pres > > >> > index uidNumber eq,pres > > >> > index gidNumber eq,pres > > >> > index entryCSN eq,pres > > >> > index entryUUID eq,pres > > >> > index uniqueMember eq,pres > > >> > index userPassword eq,pres > > >> > index krb5PrincipalName eq,pres > > >> > index krb5PrincipalRealm eq,pres > > >> > index sambaDomainName eq,pres > > >> > index sambaSID eq,pres > > >> > index sambaPrimaryGroupSID eq,pres > > >> > index sambaSIDList eq,pres > > >> > > > >> > lastmod on > > >> > > > >> > checkpoint 256 15 > > >> > > > >> > password-hash {SSHA} > > >> > > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write > > >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write > > >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read > > >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key > > >> > by anonymous auth > > >> > by self write > > >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write > > >> > by users auth > > >> > by * break > > >> > > > >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none > > >> > > > >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read > by * > > >> > none > > >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none > > >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none > > >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self > read > > >> > by * none > > >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by > self > > >> > read by * none > > >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read > by * > > >> > none > > >> > > > >> > access to > > >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by > self > > >> > read by * none > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName > > >> > by self write > > >> > by users read > > >> > by anonymous none > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber > > >> > by self read > > >> > by anonymous none > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid > > >> > by * none > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength > > >> > by self read > > >> > by anonymous none > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" by * read > > >> > > > >> > serverID 1 > > >> > > > >> > syncrepl rid=2 > > >> > provider=ldap://ldap2.iwu.edu/ > > >> > schemachecking=off > > >> > searchbase="dc=iwu,dc=edu" > > >> > scope=sub > > >> > type=refreshAndPersist > > >> > binddn="cn=mirror,dc=iwu,dc=edu" > > >> > credentials={redacted} > > >> > bindmethod=simple > > >> > starttls=yes > > >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt > > >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key > > >> > tls_cacert=/etc/ldap/ssl/IWU.crt > > >> > tls_reqcert=try > > >> > interval=00:00:00:30 > > >> > retry="15 +" > > >> > timeout=1 > > >> > timelimit=unlimited > > >> > sizelimit=unlimited > > >> > > > >> > mirrormode on > > >> > > > >> > ############################### > > >> > database monitor > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > > > >> > access to dn.exact="cn=Monitor" > > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > > >> > by * none > > >> > > > >> > access to dn.subtree="cn=Monitor" > > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > > >> > by * none > > >> > > > >> > > > >> >> > > >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > >> >> > Here is the quick and dirty what I am trying to do: > > >> >> > > > >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > > >> >> > synced > > >> >> > to pool.ntp.org and each other (if they drift I would rather they > > >> >> > sorta > > >> >> > drift together, but pool should be keeping that in check). > > >> >> > > > >> >> > Right now I am just beating them up to see how 2.4.13 performs. > (So > > >> >> > far > > >> >> > VERY well, minus this little problem) > > >> >> > > > >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm > > >> >> > starting small). Debug gives me > > >> >> > > > >> >> > ber_scanf fmt (m}) ber: > > >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > > >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > > >> >> > 30 .<rid=001,sid=00 > > >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > > >> >> > 2,csn=2008122217 > > >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > > >> >> > 4721.855904Z#000 > > >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > > >> >> > 000#001#000000 > > >> >> > do_syncrep2: > > >> >> > > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 > > >> >> > do_syncrep2: rid=001 CSN too old, ignoring > > >> >> > 20081222174721.855904Z#000000#001#000000 > > >> >> > ldap_msgfree > > >> >> > > > >> >> > I am not exactly sure how it gotten to be "too old." The ldif I > am > > >> >> > importing is not the result of a slapcat or anything that would > > >> >> > preserve > > >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am > > >> >> > loading > > >> >> > one single file with ldapadd which, in my understanding, sets up > the > > >> >> > CSN > > >> >> > and wouldn't let me import one anyway. > > >> >> > > > >> >> > Each server has no entries until I load the one, so there > shouldn't > > >> >> > be > > >> >> > any weird stale CSNs causing this. They are "sync'ed" almost > > >> >> > instantly > > >> >> > after the one system is loaded - I just don't have everything. > > >> >> > > > >> >> > After a sync: > > >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 > > >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 > > >> >> > > > >> >> > Right now I can get them in sync with a slapcat/slapadd, but when > the > > >> >> > go > > >> >> > into production I wont be able to say for certain which one is > > >> >> > authoritative. That is the purpose of multi-master.... > > >> >> > > > >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux > 32 > > >> >> > bit > > >> >> > > > >> >> > Any ideas as to what I can do to stop this from happening? > > >> >> > > > >> >> > Pat > > >> >> > > > >> >> > > > >> >> > > > >> >> > > > >> >> > > >> > > > >> > > > >> > > > > > > > > > > > -- > Sent from my mobile device > > http://www.suretecsystems.com/services/openldap/ > > > > > Adrien Futschik > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/ Adrien Futschik

2 1

Re: Fwd: CSN too old, ignoring - and therefore not syncing
by Adrien Futschik 24 Dec '08

24 Dec '08

I'm facing a similar problem. I'm testing N-way multimaster replication with OpenLDAP 2.4.13. I'm able to successfully import data into an instance and have my two masters to sync correctly but then when I try to add a new entry in one of the two masters, I'm getting strange messages : let's say we have m1 & m2 (m1 & m2 are on the same server): I initial import data into m1, it is successfully imported into m2 (at least it looks like it). Then I'm trying to add an entry on m2 (cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm getting strange message on m1 & m2 : m1 log :(repetitively) [...] Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224125950.481561Z#000000#001#000000 older or equal to ctx 20081224125950.481561Z#000000#001#000000 Entry cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr changed by peer, ignored syncprov_search_response: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT [...] m2 log : (repetitively) [...] master where I added an entry : do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 [...] Is this a bug ? Am-I doing something wrong ? If I add the same entry to m1 and not m2 I get the following messages : on m2 : syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed syncprov_search_response: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 syncrepl_entry: rid=004 be_add (0) do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 <= bdb_inequality_candidates: (entryCSN) not indexed nonpresent_callback: rid=004 present UUID 96268508-6609-102d-9d8e-9742e72db399, dn c=fr nonpresent_callback: rid=004 present UUID 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630bfa0-6609-102d-9d9d-9742e72db399, dn ou=administrateurs,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID ae0e93d6-6609-102d-9d9e-9742e72db399, dn cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x83d6410 20081224132238.790862Z#000000#001#000000 on m1 : slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x9703700 20081224132238.790862Z#000000#001#000000 <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224132158.749532Z#000000#001#000000 older or equal to ctx 20081224132158.749532Z#000000#001#000000 syncprov_search_response: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 Here is the entry I'm adding : dn: cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf, c=fr objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: ditPerson cn: adrien-externe.futschik(a)edfgdf.fr sn: Futschik givenName: Adrien uid: adrien-externe.futschik(a)edfgdf.fr mail: adrien-externe.futschik(a)edfgdf.fr telephonenumber: 0123456789 userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r allowedServices: appli20 pretty simple isn't it ? What's going wrong ? Adrien ======================================== Message date : Dec 23 2008, 07:39 PM From : "Gavin Henry" <gavin.henry(a)gmail.com> To : openldap-technical(a)openldap.org Copy to : Subject : Fwd: CSN too old, ignoring - and therefore not syncing ---------- Forwarded message ---------- From: Pat Riehecky <prieheck(a)iwu.edu> Date: Tue, 23 Dec 2008 12:34:33 -0600 Subject: Re: CSN too old, ignoring - and therefore not syncing To: Gavin Henry <gavin.henry(a)gmail.com> On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: > Where did you read that those were needed anyway? If it was the admin > guide then I need to fix it ;-) > > Gavin. I have no idea where I found those at... I know it wasn't the (recent) admin guide. It may have been from around the 2.4.8 release, but that is long gone... Pat > > On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: > >> Try dropping nopresent and reloadhint relating to ITS5669. You only > >> need these two syncprov settings on an accesslog db. > >> > >> Gavin. > > > > Thanks, that did the job! > > > > Pat > > > >> > >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > >> >> Can you post your config somewhere? > >> > > >> > > >> > allow bind_v2 > >> > > >> > include /etc/ldap/schema/core.schema > >> > include /etc/ldap/schema/cosine.schema > >> > include /etc/ldap/schema/nis.schema > >> > include /etc/ldap/schema/inetorgperson.schema > >> > include /etc/ldap/schema/samba.schema > >> > include /etc/ldap/schema/eduperson-200412.schema > >> > include /etc/ldap/schema/hdb.schema > >> > include /etc/ldap/schema/IWU.schema > >> > > >> > pidfile /var/run/slapd/slapd.pid > >> > argsfile /var/run/slapd/slapd.args > >> > > >> > modulepath /usr/lib/ldap > >> > moduleload back_hdb > >> > moduleload back_monitor > >> > moduleload memberof > >> > moduleload syncprov > >> > moduleload smbk5pwd > >> > > >> > tool-threads 2 > >> > sizelimit 500 > >> > idletimeout 7200 > >> > > >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt > >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt > >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key > >> > TLSVerifyClient allow > >> > > >> > localSSF 160 > >> > security ssf=1 update_ssf=128 simple_bind=112 > >> > sasl-secprops noanonymous > >> > > >> > access to dn.base="" by * read > >> > access to dn.base="cn=Subschema" by * read > >> > > >> > backend hdb > >> > database hdb > >> > > >> > overlay memberof > >> > overlay smbk5pwd > >> > overlay syncprov > >> > > >> > smbk5pwd-enable samba > >> > smbk5pwd-enable krb5 > >> > smbk5pwd-must-change 0 > >> > > >> > syncprov-checkpoint 100 10 > >> > syncprov-sessionlog 200 > >> > syncprov-nopresent TRUE > >> > syncprov-reloadhint TRUE > >> > > >> > suffix "dc=iwu,dc=edu" > >> > > >> > rootdn "cn=admin,dc=iwu,dc=edu" > >> > rootpw {redacted} > >> > > >> > authz-regexp "uidNumber=0\\\ > >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > authz-regexp "gidNumber=.*\\\ > >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > > >> > authz-regexp "uid=(.+),cn=.+,cn=auth" "uid=$1,ou=People,dc=iwu,dc=edu" > >> > > >> > directory "/var/lib/ldap/" > >> > > >> > dbconfig set_cachesize 0 62914560 0 > >> > dbconfig set_lk_max_objects 1500 > >> > dbconfig set_lk_max_locks 1500 > >> > dbconfig set_lk_max_lockers 1500 > >> > > >> > # Make sure to do a nightly slapcat > >> > dbconfig set_flags DB_LOG_AUTOREMOVE > >> > > >> > index objectClass eq,pres > >> > index default eq,sub,pres > >> > index mail eq,sub,pres > >> > index sn eq,sub,pres > >> > index cn eq,sub,pres > >> > index displayName eq,sub,pres > >> > index gecos eq,sub,pres > >> > index uid eq,sub,pres > >> > index memberUid eq,sub,pres > >> > index uidNumber eq,pres > >> > index gidNumber eq,pres > >> > index entryCSN eq,pres > >> > index entryUUID eq,pres > >> > index uniqueMember eq,pres > >> > index userPassword eq,pres > >> > index krb5PrincipalName eq,pres > >> > index krb5PrincipalRealm eq,pres > >> > index sambaDomainName eq,pres > >> > index sambaSID eq,pres > >> > index sambaPrimaryGroupSID eq,pres > >> > index sambaSIDList eq,pres > >> > > >> > lastmod on > >> > > >> > checkpoint 256 15 > >> > > >> > password-hash {SSHA} > >> > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write > >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write > >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read > >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key > >> > by anonymous auth > >> > by self write > >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write > >> > by users auth > >> > by * break > >> > > >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none > >> > > >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none > >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none > >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self read > >> > by * none > >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > > >> > access to > >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName > >> > by self write > >> > by users read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid > >> > by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" by * read > >> > > >> > serverID 1 > >> > > >> > syncrepl rid=2 > >> > provider=ldap://ldap2.iwu.edu/ > >> > schemachecking=off > >> > searchbase="dc=iwu,dc=edu" > >> > scope=sub > >> > type=refreshAndPersist > >> > binddn="cn=mirror,dc=iwu,dc=edu" > >> > credentials={redacted} > >> > bindmethod=simple > >> > starttls=yes > >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt > >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key > >> > tls_cacert=/etc/ldap/ssl/IWU.crt > >> > tls_reqcert=try > >> > interval=00:00:00:30 > >> > retry="15 +" > >> > timeout=1 > >> > timelimit=unlimited > >> > sizelimit=unlimited > >> > > >> > mirrormode on > >> > > >> > ############################### > >> > database monitor > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.exact="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > access to dn.subtree="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > > >> >> > >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> >> > Here is the quick and dirty what I am trying to do: > >> >> > > >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > >> >> > synced > >> >> > to pool.ntp.org and each other (if they drift I would rather they > >> >> > sorta > >> >> > drift together, but pool should be keeping that in check). > >> >> > > >> >> > Right now I am just beating them up to see how 2.4.13 performs. (So > >> >> > far > >> >> > VERY well, minus this little problem) > >> >> > > >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm > >> >> > starting small). Debug gives me > >> >> > > >> >> > ber_scanf fmt (m}) ber: > >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > >> >> > 30 .<rid=001,sid=00 > >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > >> >> > 2,csn=2008122217 > >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > >> >> > 4721.855904Z#000 > >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > >> >> > 000#001#000000 > >> >> > do_syncrep2: > >> >> > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 > >> >> > do_syncrep2: rid=001 CSN too old, ignoring > >> >> > 20081222174721.855904Z#000000#001#000000 > >> >> > ldap_msgfree > >> >> > > >> >> > I am not exactly sure how it gotten to be "too old." The ldif I am > >> >> > importing is not the result of a slapcat or anything that would > >> >> > preserve > >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am > >> >> > loading > >> >> > one single file with ldapadd which, in my understanding, sets up the > >> >> > CSN > >> >> > and wouldn't let me import one anyway. > >> >> > > >> >> > Each server has no entries until I load the one, so there shouldn't > >> >> > be > >> >> > any weird stale CSNs causing this. They are "sync'ed" almost > >> >> > instantly > >> >> > after the one system is loaded - I just don't have everything. > >> >> > > >> >> > After a sync: > >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 > >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 > >> >> > > >> >> > Right now I can get them in sync with a slapcat/slapadd, but when the > >> >> > go > >> >> > into production I wont be able to say for certain which one is > >> >> > authoritative. That is the purpose of multi-master.... > >> >> > > >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 > >> >> > bit > >> >> > > >> >> > Any ideas as to what I can do to stop this from happening? > >> >> > > >> >> > Pat > >> >> > > >> >> > > >> >> > > >> >> > > >> >> > >> > > >> > > >> > > > > > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/ Adrien Futschik

2 1

Different shells ¿how to workaround?
by Jordi Espasa Clofent 24 Dec '08

24 Dec '08

Hi all, I'm just learning OpenLDAP; I'm hope it isn't a silly question. I've mounted a OpenLDAP (version 2.4 in a FreeBSD 7.x platform) as account authentication server and all works fine. The clients are FreeBSD and GNU/Linux Debian. One problem I've found is related to loginShell field in posixAccount schema. It's because of when I was setting up the servers, I've configured /bin/csh as the default shell for the users It's ok in FreeBSD clients (csh exists in default instalation), but you get an error when you try to authenticate a Debian client. ¿Why? Simple, the default shell in Debian is /bin/bash, not the defined /bin/csh. Currently, do you have two options to workaround this issue: * install csh in Debian clients and assure that the binary path is /bin/csh * make a symlink /bin/csh which point to /bin/bash At present, I've chosen the second option. ¿Is correct this workaround or maybe I don't know some other obvious method to get it? -- Thanks, Jordi Espasa Clofent

2 1

Fwd: CSN too old, ignoring - and therefore not syncing
by Gavin Henry 23 Dec '08

23 Dec '08

---------- Forwarded message ---------- From: Pat Riehecky <prieheck(a)iwu.edu> Date: Tue, 23 Dec 2008 12:34:33 -0600 Subject: Re: CSN too old, ignoring - and therefore not syncing To: Gavin Henry <gavin.henry(a)gmail.com> On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: > Where did you read that those were needed anyway? If it was the admin > guide then I need to fix it ;-) > > Gavin. I have no idea where I found those at... I know it wasn't the (recent) admin guide. It may have been from around the 2.4.8 release, but that is long gone... Pat > > On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: > >> Try dropping nopresent and reloadhint relating to ITS5669. You only > >> need these two syncprov settings on an accesslog db. > >> > >> Gavin. > > > > Thanks, that did the job! > > > > Pat > > > >> > >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > >> >> Can you post your config somewhere? > >> > > >> > > >> > allow bind_v2 > >> > > >> > include /etc/ldap/schema/core.schema > >> > include /etc/ldap/schema/cosine.schema > >> > include /etc/ldap/schema/nis.schema > >> > include /etc/ldap/schema/inetorgperson.schema > >> > include /etc/ldap/schema/samba.schema > >> > include /etc/ldap/schema/eduperson-200412.schema > >> > include /etc/ldap/schema/hdb.schema > >> > include /etc/ldap/schema/IWU.schema > >> > > >> > pidfile /var/run/slapd/slapd.pid > >> > argsfile /var/run/slapd/slapd.args > >> > > >> > modulepath /usr/lib/ldap > >> > moduleload back_hdb > >> > moduleload back_monitor > >> > moduleload memberof > >> > moduleload syncprov > >> > moduleload smbk5pwd > >> > > >> > tool-threads 2 > >> > sizelimit 500 > >> > idletimeout 7200 > >> > > >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt > >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt > >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key > >> > TLSVerifyClient allow > >> > > >> > localSSF 160 > >> > security ssf=1 update_ssf=128 simple_bind=112 > >> > sasl-secprops noanonymous > >> > > >> > access to dn.base="" by * read > >> > access to dn.base="cn=Subschema" by * read > >> > > >> > backend hdb > >> > database hdb > >> > > >> > overlay memberof > >> > overlay smbk5pwd > >> > overlay syncprov > >> > > >> > smbk5pwd-enable samba > >> > smbk5pwd-enable krb5 > >> > smbk5pwd-must-change 0 > >> > > >> > syncprov-checkpoint 100 10 > >> > syncprov-sessionlog 200 > >> > syncprov-nopresent TRUE > >> > syncprov-reloadhint TRUE > >> > > >> > suffix "dc=iwu,dc=edu" > >> > > >> > rootdn "cn=admin,dc=iwu,dc=edu" > >> > rootpw {redacted} > >> > > >> > authz-regexp "uidNumber=0\\\ > >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > authz-regexp "gidNumber=.*\\\ > >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > > >> > authz-regexp "uid=(.+),cn=.+,cn=auth" "uid=$1,ou=People,dc=iwu,dc=edu" > >> > > >> > directory "/var/lib/ldap/" > >> > > >> > dbconfig set_cachesize 0 62914560 0 > >> > dbconfig set_lk_max_objects 1500 > >> > dbconfig set_lk_max_locks 1500 > >> > dbconfig set_lk_max_lockers 1500 > >> > > >> > # Make sure to do a nightly slapcat > >> > dbconfig set_flags DB_LOG_AUTOREMOVE > >> > > >> > index objectClass eq,pres > >> > index default eq,sub,pres > >> > index mail eq,sub,pres > >> > index sn eq,sub,pres > >> > index cn eq,sub,pres > >> > index displayName eq,sub,pres > >> > index gecos eq,sub,pres > >> > index uid eq,sub,pres > >> > index memberUid eq,sub,pres > >> > index uidNumber eq,pres > >> > index gidNumber eq,pres > >> > index entryCSN eq,pres > >> > index entryUUID eq,pres > >> > index uniqueMember eq,pres > >> > index userPassword eq,pres > >> > index krb5PrincipalName eq,pres > >> > index krb5PrincipalRealm eq,pres > >> > index sambaDomainName eq,pres > >> > index sambaSID eq,pres > >> > index sambaPrimaryGroupSID eq,pres > >> > index sambaSIDList eq,pres > >> > > >> > lastmod on > >> > > >> > checkpoint 256 15 > >> > > >> > password-hash {SSHA} > >> > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write > >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write > >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read > >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key > >> > by anonymous auth > >> > by self write > >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write > >> > by users auth > >> > by * break > >> > > >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none > >> > > >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none > >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none > >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self read > >> > by * none > >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > > >> > access to > >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName > >> > by self write > >> > by users read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid > >> > by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" by * read > >> > > >> > serverID 1 > >> > > >> > syncrepl rid=2 > >> > provider=ldap://ldap2.iwu.edu/ > >> > schemachecking=off > >> > searchbase="dc=iwu,dc=edu" > >> > scope=sub > >> > type=refreshAndPersist > >> > binddn="cn=mirror,dc=iwu,dc=edu" > >> > credentials={redacted} > >> > bindmethod=simple > >> > starttls=yes > >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt > >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key > >> > tls_cacert=/etc/ldap/ssl/IWU.crt > >> > tls_reqcert=try > >> > interval=00:00:00:30 > >> > retry="15 +" > >> > timeout=1 > >> > timelimit=unlimited > >> > sizelimit=unlimited > >> > > >> > mirrormode on > >> > > >> > ############################### > >> > database monitor > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.exact="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > access to dn.subtree="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > > >> >> > >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> >> > Here is the quick and dirty what I am trying to do: > >> >> > > >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > >> >> > synced > >> >> > to pool.ntp.org and each other (if they drift I would rather they > >> >> > sorta > >> >> > drift together, but pool should be keeping that in check). > >> >> > > >> >> > Right now I am just beating them up to see how 2.4.13 performs. (So > >> >> > far > >> >> > VERY well, minus this little problem) > >> >> > > >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm > >> >> > starting small). Debug gives me > >> >> > > >> >> > ber_scanf fmt (m}) ber: > >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > >> >> > 30 .<rid=001,sid=00 > >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > >> >> > 2,csn=2008122217 > >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > >> >> > 4721.855904Z#000 > >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > >> >> > 000#001#000000 > >> >> > do_syncrep2: > >> >> > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 > >> >> > do_syncrep2: rid=001 CSN too old, ignoring > >> >> > 20081222174721.855904Z#000000#001#000000 > >> >> > ldap_msgfree > >> >> > > >> >> > I am not exactly sure how it gotten to be "too old." The ldif I am > >> >> > importing is not the result of a slapcat or anything that would > >> >> > preserve > >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am > >> >> > loading > >> >> > one single file with ldapadd which, in my understanding, sets up the > >> >> > CSN > >> >> > and wouldn't let me import one anyway. > >> >> > > >> >> > Each server has no entries until I load the one, so there shouldn't > >> >> > be > >> >> > any weird stale CSNs causing this. They are "sync'ed" almost > >> >> > instantly > >> >> > after the one system is loaded - I just don't have everything. > >> >> > > >> >> > After a sync: > >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 > >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 > >> >> > > >> >> > Right now I can get them in sync with a slapcat/slapadd, but when the > >> >> > go > >> >> > into production I wont be able to say for certain which one is > >> >> > authoritative. That is the purpose of multi-master.... > >> >> > > >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 > >> >> > bit > >> >> > > >> >> > Any ideas as to what I can do to stop this from happening? > >> >> > > >> >> > Pat > >> >> > > >> >> > > >> >> > > >> >> > > >> >> > >> > > >> > > >> > > > > > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/

1 0

Re: CSN too old, ignoring - and therefore not syncing
by Gavin Henry 23 Dec '08

23 Dec '08

Ok, thanks. On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: >> Where did you read that those were needed anyway? If it was the admin >> guide then I need to fix it ;-) >> >> Gavin. > > I have no idea where I found those at... I know it wasn't the (recent) > admin guide. It may have been from around the 2.4.8 release, but that > is long gone... > > Pat > >> >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: >> > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: >> >> Try dropping nopresent and reloadhint relating to ITS5669. You only >> >> need these two syncprov settings on an accesslog db. >> >> >> >> Gavin. >> > >> > Thanks, that did the job! >> > >> > Pat >> > >> >> >> >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: >> >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: >> >> >> Can you post your config somewhere? >> >> > >> >> > >> >> > allow bind_v2 >> >> > >> >> > include /etc/ldap/schema/core.schema >> >> > include /etc/ldap/schema/cosine.schema >> >> > include /etc/ldap/schema/nis.schema >> >> > include /etc/ldap/schema/inetorgperson.schema >> >> > include /etc/ldap/schema/samba.schema >> >> > include /etc/ldap/schema/eduperson-200412.schema >> >> > include /etc/ldap/schema/hdb.schema >> >> > include /etc/ldap/schema/IWU.schema >> >> > >> >> > pidfile /var/run/slapd/slapd.pid >> >> > argsfile /var/run/slapd/slapd.args >> >> > >> >> > modulepath /usr/lib/ldap >> >> > moduleload back_hdb >> >> > moduleload back_monitor >> >> > moduleload memberof >> >> > moduleload syncprov >> >> > moduleload smbk5pwd >> >> > >> >> > tool-threads 2 >> >> > sizelimit 500 >> >> > idletimeout 7200 >> >> > >> >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt >> >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt >> >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key >> >> > TLSVerifyClient allow >> >> > >> >> > localSSF 160 >> >> > security ssf=1 update_ssf=128 simple_bind=112 >> >> > sasl-secprops noanonymous >> >> > >> >> > access to dn.base="" by * read >> >> > access to dn.base="cn=Subschema" by * read >> >> > >> >> > backend hdb >> >> > database hdb >> >> > >> >> > overlay memberof >> >> > overlay smbk5pwd >> >> > overlay syncprov >> >> > >> >> > smbk5pwd-enable samba >> >> > smbk5pwd-enable krb5 >> >> > smbk5pwd-must-change 0 >> >> > >> >> > syncprov-checkpoint 100 10 >> >> > syncprov-sessionlog 200 >> >> > syncprov-nopresent TRUE >> >> > syncprov-reloadhint TRUE >> >> > >> >> > suffix "dc=iwu,dc=edu" >> >> > >> >> > rootdn "cn=admin,dc=iwu,dc=edu" >> >> > rootpw {redacted} >> >> > >> >> > authz-regexp "uidNumber=0\\\ >> >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" >> >> > "cn=ldapi,dc=iwu,dc=edu" >> >> > authz-regexp "gidNumber=.*\\\ >> >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" >> >> > "cn=ldapi,dc=iwu,dc=edu" >> >> > >> >> > authz-regexp "uid=(.+),cn=.+,cn=auth" >> >> > "uid=$1,ou=People,dc=iwu,dc=edu" >> >> > >> >> > directory "/var/lib/ldap/" >> >> > >> >> > dbconfig set_cachesize 0 62914560 0 >> >> > dbconfig set_lk_max_objects 1500 >> >> > dbconfig set_lk_max_locks 1500 >> >> > dbconfig set_lk_max_lockers 1500 >> >> > >> >> > # Make sure to do a nightly slapcat >> >> > dbconfig set_flags DB_LOG_AUTOREMOVE >> >> > >> >> > index objectClass eq,pres >> >> > index default eq,sub,pres >> >> > index mail eq,sub,pres >> >> > index sn eq,sub,pres >> >> > index cn eq,sub,pres >> >> > index displayName eq,sub,pres >> >> > index gecos eq,sub,pres >> >> > index uid eq,sub,pres >> >> > index memberUid eq,sub,pres >> >> > index uidNumber eq,pres >> >> > index gidNumber eq,pres >> >> > index entryCSN eq,pres >> >> > index entryUUID eq,pres >> >> > index uniqueMember eq,pres >> >> > index userPassword eq,pres >> >> > index krb5PrincipalName eq,pres >> >> > index krb5PrincipalRealm eq,pres >> >> > index sambaDomainName eq,pres >> >> > index sambaSID eq,pres >> >> > index sambaPrimaryGroupSID eq,pres >> >> > index sambaSIDList eq,pres >> >> > >> >> > lastmod on >> >> > >> >> > checkpoint 256 15 >> >> > >> >> > password-hash {SSHA} >> >> > >> >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write >> >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write >> >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read >> >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key >> >> > by anonymous auth >> >> > by self write >> >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write >> >> > by users auth >> >> > by * break >> >> > >> >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none >> >> > >> >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read by >> >> > * >> >> > none >> >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none >> >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none >> >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self >> >> > read >> >> > by * none >> >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by >> >> > self >> >> > read by * none >> >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read by >> >> > * >> >> > none >> >> > >> >> > access to >> >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by >> >> > self >> >> > read by * none >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName >> >> > by self write >> >> > by users read >> >> > by anonymous none >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber >> >> > by self read >> >> > by anonymous none >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid >> >> > by * none >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength >> >> > by self read >> >> > by anonymous none >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" by * read >> >> > >> >> > serverID 1 >> >> > >> >> > syncrepl rid=2 >> >> > provider=ldap://ldap2.iwu.edu/ >> >> > schemachecking=off >> >> > searchbase="dc=iwu,dc=edu" >> >> > scope=sub >> >> > type=refreshAndPersist >> >> > binddn="cn=mirror,dc=iwu,dc=edu" >> >> > credentials={redacted} >> >> > bindmethod=simple >> >> > starttls=yes >> >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt >> >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key >> >> > tls_cacert=/etc/ldap/ssl/IWU.crt >> >> > tls_reqcert=try >> >> > interval=00:00:00:30 >> >> > retry="15 +" >> >> > timeout=1 >> >> > timelimit=unlimited >> >> > sizelimit=unlimited >> >> > >> >> > mirrormode on >> >> > >> >> > ############################### >> >> > database monitor >> >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > >> >> > access to dn.exact="cn=Monitor" >> >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read >> >> > by * none >> >> > >> >> > access to dn.subtree="cn=Monitor" >> >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read >> >> > by * none >> >> > >> >> > >> >> >> >> >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: >> >> >> > Here is the quick and dirty what I am trying to do: >> >> >> > >> >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time >> >> >> > synced >> >> >> > to pool.ntp.org and each other (if they drift I would rather they >> >> >> > sorta >> >> >> > drift together, but pool should be keeping that in check). >> >> >> > >> >> >> > Right now I am just beating them up to see how 2.4.13 performs. >> >> >> > (So >> >> >> > far >> >> >> > VERY well, minus this little problem) >> >> >> > >> >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm >> >> >> > starting small). Debug gives me >> >> >> > >> >> >> > ber_scanf fmt (m}) ber: >> >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 >> >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 >> >> >> > 30 .<rid=001,sid=00 >> >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 >> >> >> > 2,csn=2008122217 >> >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 >> >> >> > 4721.855904Z#000 >> >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 >> >> >> > 000#001#000000 >> >> >> > do_syncrep2: >> >> >> > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 >> >> >> > do_syncrep2: rid=001 CSN too old, ignoring >> >> >> > 20081222174721.855904Z#000000#001#000000 >> >> >> > ldap_msgfree >> >> >> > >> >> >> > I am not exactly sure how it gotten to be "too old." The ldif I >> >> >> > am >> >> >> > importing is not the result of a slapcat or anything that would >> >> >> > preserve >> >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am >> >> >> > loading >> >> >> > one single file with ldapadd which, in my understanding, sets up >> >> >> > the >> >> >> > CSN >> >> >> > and wouldn't let me import one anyway. >> >> >> > >> >> >> > Each server has no entries until I load the one, so there >> >> >> > shouldn't >> >> >> > be >> >> >> > any weird stale CSNs causing this. They are "sync'ed" almost >> >> >> > instantly >> >> >> > after the one system is loaded - I just don't have everything. >> >> >> > >> >> >> > After a sync: >> >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 >> >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 >> >> >> > >> >> >> > Right now I can get them in sync with a slapcat/slapadd, but when >> >> >> > the >> >> >> > go >> >> >> > into production I wont be able to say for certain which one is >> >> >> > authoritative. That is the purpose of multi-master.... >> >> >> > >> >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 >> >> >> > bit >> >> >> > >> >> >> > Any ideas as to what I can do to stop this from happening? >> >> >> > >> >> >> > Pat >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> >> >> > >> >> > >> >> >> > >> > >> > > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/

1 0

CSN too old, ignoring - and therefore not syncing
by Pat Riehecky 23 Dec '08

23 Dec '08

Here is the quick and dirty what I am trying to do: ldap1 and ldap2 are supposed to be in MultiMaster. They are time synced to pool.ntp.org and each other (if they drift I would rather they sorta drift together, but pool should be keeping that in check). Right now I am just beating them up to see how 2.4.13 performs. (So far VERY well, minus this little problem) I have a rather small ldif (41 entries) that just wont sync (I'm starting small). Debug gives me ber_scanf fmt (m}) ber: ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 .<rid=001,sid=00 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 2,csn=2008122217 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 4721.855904Z#000 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 000#001#000000 do_syncrep2: cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 do_syncrep2: rid=001 CSN too old, ignoring 20081222174721.855904Z#000000#001#000000 ldap_msgfree I am not exactly sure how it gotten to be "too old." The ldif I am importing is not the result of a slapcat or anything that would preserve the CSN or UUID attributes (not that syncrepl uses UUID). I am loading one single file with ldapadd which, in my understanding, sets up the CSN and wouldn't let me import one anyway. Each server has no entries until I load the one, so there shouldn't be any weird stale CSNs causing this. They are "sync'ed" almost instantly after the one system is loaded - I just don't have everything. After a sync: ldap1 - slapcat |grep dn: |wc -l = 41 ldap2 - slapcat |grep dn: |wc -l = 18 Right now I can get them in sync with a slapcat/slapadd, but when the go into production I wont be able to say for certain which one is authoritative. That is the purpose of multi-master.... OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 bit Any ideas as to what I can do to stop this from happening? Pat

4 11

restricting ldap unix groups to groups of hosts.
by Martin Suehowicz 22 Dec '08

22 Dec '08

I am new to openldap. I am trying to restrict groups of users to groups hosts on centos machines. Netgroups or pam_access seem to get me part of the way there. However I do not want to touch the clients very much and would like them to have a uniform configuration. I would like ldap to hold the host groups, user groups and acl's for them. Is there a way do this? Thank You for any help you can provide. Martin

1 0

N-Way Multi-Master replication - delete problem
by Adrien Futschik 22 Dec '08

22 Dec '08

OK, But then what did I do wrong ? delete an entry shouldn't be a problem with N-Way Multi-Master replication ? should it ? Here is how I have setup-ed my masters : m1 -config : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW:< file://$CONFIGPWF m2 - config : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW:< file://$CONFIGPWF m1 - syncprov : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE m2 - syncrepl : dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE m1 - schema : include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif m1 - backend : dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: $PASSWD olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Did I miss something ? Has anyone tested N-way Multi-master replication & encountered the same problem as me ? Adrien ======================================== Message date : Dec 19 2008, 07:11 PM From : "Quanah Gibson-Mount" <quanah(a)zimbra.com> To : adrien.futschik(a)atosorigin.com, openldap-technical(a)openldap.org Copy to : "Miguel Jinez" <miguel.jinez(a)gmail.com> Subject : Re: Re: N-Way Multi-Master replication - delete problem --On December 19, 2008 9:28:41 AM +0100 Adrien Futschik <adrien.futschik(a)atosorigin.com> wrote: > Hy everyone, > > I have just tested the same procedure with OpenLDAP 2.4.13. The problem > remains the same. > > Did I miss something ? Is this supposed to be like this ? > > I'm joining the modified script I'm using to setup both masters and the > LDIF files I'm using to add and remove an entry (+ attributes). > > I did not use access-log, is this supposed to work with N-Way > Multi-Master replication ? I thought it was only used in case of Delta > Synchronization/Replication. Correct, delta-syncrepl and MMR are not currently supported together (that may change in the future). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration Adrien Futschik

1 0

remove the /var/lib/ldap directory mistake !!!
by franck dufau 21 Dec '08

21 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hye all, i have remove the /var/lib/ldap directory by mistake ! darkness.... how rebuild the ldap database ? i can not find information about this ! i do not have backup....arfff.. tks by advance... Franck -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAklOfFoACgkQrKIazktK/hJ8SACfR2+IFx6HwaB77zrryWbaoEby T9YAoJ4YzJTsZdCiwXFWVAUL+I6CMDHH =ih79 -----END PGP SIGNATURE-----

1 0

Versioning entries in the DIT
by Lorenzo Pastrana 21 Dec '08

21 Dec '08

Hi, List I'm planning to store some 'versioned' data into an ldap directory, and trying not to reinvent the wheel ... if anybody has any good resource to share on the subject I'll be glad to hear. Thanks in advance, LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

3 6

handling forward-only links, DN+Binary and DN+String
by Andrew Bartlett 19 Dec '08

19 Dec '08

Having thought I got to the bottom of extended DN behaviour, I've come across more challenges, that I would like thoughts on. Handling renames of one-way links: OpenLDAP already does this, but Samba needs some help here (as we try to infer the rename from the presence of backlinks, but for one-way links, how should we know we are being linked to?) Handling of DN+Binary and DN+String one-way links. For example, wellKnownObjects: B:32:22b70c67d56e4efb91e9300fca3dc1aa:CN=ForeignSecurityPrincipals,DC=samba,DC=org This is a 'DN+Binary' syntax attribute (for resolving well known GUIDs into a DN), and must therefore follow when the well known target renames. MS-ADTS 3.1.1.1.6 specifies the behaviour. The challenge I see here is that I really do need an additional syntax in OpenLDAP. If I map this to just a binary string (as I do now), then the rename will not follow though. If I map it to a DN (as I had tried in the past), then the syntax is invalid. Is it entirely unreasonable to add an additional syntax? This is a bit of a 'hit and run' question, as I won't be able to carry on the discussion during Christmas/New Year, but any thoughts would be most welcome. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

1 0

In memory cache or bdb performance degradation when upgrading from openldap v2.3.27 to v2.4.11 ?
by Chiles, Michael 19 Dec '08

19 Dec '08

Openldap Technical folk, We have inherited an openldap farm that was deployed using openldap v2.3.27. We have been testing a newly compiled v2.4.11 with same compile flags as a possible replacement due to some replication errors we have seen, but have discovered other bigger problems with the new instance. We believe the issue may be related to in memory cache not working as expected, or that 2.4.11 does not use the hdb backend as efficiently as before. Can anyone confirm a negative performance difference between these versions, or an issue with cache? We are seeing major significant differences in the db_stat output with orders of magnitude difference in the number of attempted reads against the backend cache. I assume these are unsual and that in memory entry cache would normally prevent this traffic from reach the bdb cache. I assume we simply have something wrong in configuration, but I don't see an obvious explanation. If anyone has a moment to review, we would appreciate your feedback. Here is the process we followed, with supporting config info: We have a SLAMD benchmark test based on a real world use case where 400 clients make a "near" simultaneous connection to the directory and execute a search like the following: ldapsearch -h server1 -x - b "ou=myou,dc=mydc,dc=com" "objectclass=*" There are nearly 70,000 objects in this ou with 5 attributes each ( 3 of which are objectclass ), and nearly 210,000 objects in the entire directory. We have an objectclass index. 2.4.11 tests were performed on instances compiled on SLES9.3 64bit, 4 way dual core procs, 16GB RAM, using hoard memory manager, bdb 4.6, and cyrus-sasl-2.1.22 . 2.3.27 tests were performaned on SLES9.3 64bit, 2 way single core proc, 8GB RAM, using standard memory manager, and standard bdb ( 4.2 ). On the v2.3.27 instances, we see all 400 clients get a connection, and get their results. On the new v2.4.11 instance, we see around 150-175 clients get a connection, and the rest get a failure that they cannot reach the server. After more benchmarking, tcpdump, and loglevel -1 we know that the client traffic is getting to the box, but the openldap listener thread does not pick up the connection. We also see high numbers of processes waiting in the CPU run queue. Reducing the number of objects in the directory to 100 results in successful connections to all 400 clients, which lead us to believe the issue might be due to differences in read performance between the instances. The same DB_CONFIG was used in both cases, and the slapd.conf was the same, with some minor tweaks due to slightly different cache configuration options between the versions. Please see the DB_CONFIG and the hdb backend stanza from the slapd.conf file included below. We then did some basic single query tests of both instances and looked at the logs with loglevel -1 and the db_stat output. What we saw was a major difference between both instances on the db_stat results. As mentioned in the summary above, we don't have a good explanation for the difference, although it is significant, and reliable across multiple iterations of test. Please see the db_stat differences shown below. Also seems very unusual that the initial db cache stats would be so high on the new version. slapd.conf: 2.4.11 hdb stanza ( also tested these with the same cache numbers as below 2.3.27 instance with no difference. We reduced these to reasonable levels as old version config seemed overkill ): database hdb directory /local/mnt/ldap.2.4.11/cache-data threads 32 suffix "dc=mydc,dc=com" rootdn <<snip>> rootpw <<snip>> cachesize 500000 dncachesize 1000000 idlcachesize 30000000 sizelimit 10000000 loglevel stats sync dirtyread include /opt/ldap/indexes/my.indexes 2.3.27 hdb stanza database hdb directory /local/mnt/ldap/cache-data threads 32 suffix " dc=mydc,dc=com " rootdn <<snip>> rootpw <<snip>> cachesize 20971520 dbcachesize 20971520 ( not a typo - this one is "dBcachesize. The other is dNcachesize ) idlcachesize 20971520 sizelimit 10000000 loglevel stats sync dirtyread include /opt/ldap/indexes/my.indexes DB_config ( Same for both instances ): set_cachesize 1 1048576000 12 set_flags DB_LOG_AUTOREMOVE set_lg_bsize 2097512 set_lg_dir /local/mnt/ldap/cache-data ( this value points to correct directory in both instances ) set_flags DB_TXN_NOSYNC set_lg_regionmax 500000 set_lk_max_locks 30000 set_lk_max_lockers 30000 set_lk_max_objects 30000 set_tmp_dir /dev/shm After startup with no client test ( previous database instance was completely deleted and recreated using slapadd ), here are the db_stat -m output. I excluded some of the index db info for brevity: Version 2.4.11 1GB 1000MB Total cache size 12 Number of caches 12 Maximum number of caches 168MB 688KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 15M Requested pages found in the cache (99%) 24 Requested pages not found in the cache 9225 Pages created in the cache 24 Pages read into the cache 9244 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 9247 Current total page count 9247 Current clean page count 0 Current dirty page count 393252 Number of hash buckets used for page location 14M Total number of times hash chains searched for a page (14773760) 9 The longest hash chain searched for a page 14M Total number of hash chain entries checked for page (14764487) 0 The number of hash bucket locks that required waiting (0%) 0 The maximum number of times any hash bucket lock was waited for (0%) 0 The number of region locks that required waiting (0%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 9309 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 0 Threads waited on page I/O Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 1005002 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 3062 Pages created in the cache 2 Pages read into the cache 3064 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 419925 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 2967 Pages created in the cache 2 Pages read into the cache 2969 Pages written from the cache to the backing file Version 2.3.27 1GB 1000MB Total cache size. 12 Number of caches. 168MB 688KB Pool individual cache size. 0 Requested pages mapped into the process' address space. 22738 Requested pages found in the cache (99%). 285 Requested pages not found in the cache. 0 Pages created in the cache. 285 Pages read into the cache. 0 Pages written from the cache to the backing file. 0 Clean pages forced from the cache. 0 Dirty pages forced from the cache. 0 Dirty pages written by trickle-sync thread. 285 Current total page count. 285 Current clean page count. 0 Current dirty page count. 393252 Number of hash buckets used for page location. 23308 Total number of times hash chains searched for a page. 12 The longest hash chain searched for a page. 22738 Total number of hash buckets examined for page location. 46616 The number of hash bucket locks granted without waiting. 0 The number of hash bucket locks granted after waiting. 0 The maximum number of times any hash bucket lock was waited for. 641 The number of region locks granted without waiting. 0 The number of region locks granted after waiting. 297 The number of page allocations. 0 The number of hash buckets examined during allocations 0 The max number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation Pool File: dn2id.bdb 4096 Page size. 0 Requested pages mapped into the process' address space. 13076 Requested pages found in the cache (99%). 132 Requested pages not found in the cache. 0 Pages created in the cache. 132 Pages read into the cache. 0 Pages written from the cache to the backing file. Pool File: id2entry.bdb 16384 Page size. 0 Requested pages mapped into the process' address space. 9659 Requested pages found in the cache (99%). 138 Requested pages not found in the cache. 0 Pages created in the cache. 138 Pages read into the cache. 0 Pages written from the cache to the backing file. After 1 client query: Version 2.4.11 1GB 1000MB Total cache size 12 Number of caches 12 Maximum number of caches 168MB 688KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 15M Requested pages found in the cache (99%) 24 Requested pages not found in the cache 9244 Pages created in the cache 24 Pages read into the cache 9263 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 9266 Current total page count 9266 Current clean page count 0 Current dirty page count 393252 Number of hash buckets used for page location 14M Total number of times hash chains searched for a page (14753673) 9 The longest hash chain searched for a page 14M Total number of hash chain entries checked for page (14744381) 0 The number of hash bucket locks that required waiting (0%) 0 The maximum number of times any hash bucket lock was waited for (0%) 0 The number of region locks that required waiting (0%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 9328 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 0 Threads waited on page I/O Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 997746 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 3062 Pages created in the cache 2 Pages read into the cache 3064 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 410855 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 2967 Pages created in the cache 2 Pages read into the cache 2969 Pages written from the cache to the backing file Version 2.3.27 1GB 1000MB Total cache size. 12 Number of caches. 168MB 688KB Pool individual cache size. 0 Requested pages mapped into the process' address space. 299222 Requested pages found in the cache (98%). 7144 Requested pages not found in the cache. 0 Pages created in the cache. 7144 Pages read into the cache. 0 Pages written from the cache to the backing file. 0 Clean pages forced from the cache. 0 Dirty pages forced from the cache. 0 Dirty pages written by trickle-sync thread. 7144 Current total page count. 7144 Current clean page count. 0 Current dirty page count. 393252 Number of hash buckets used for page location. 313510 Total number of times hash chains searched for a page. 23 The longest hash chain searched for a page. 300752 Total number of hash buckets examined for page location. 627020 The number of hash bucket locks granted without waiting. 0 The number of hash bucket locks granted after waiting. 0 The maximum number of times any hash bucket lock was waited for. 14400 The number of region locks granted without waiting. 0 The number of region locks granted after waiting. 7164 The number of page allocations. 0 The number of hash buckets examined during allocations 0 The max number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation Pool File: dn2id.bdb 4096 Page size. 0 Requested pages mapped into the process' address space. 173225 Requested pages found in the cache (98%). 3233 Requested pages not found in the cache. 0 Pages created in the cache. 3233 Pages read into the cache. 0 Pages written from the cache to the backing file. Pool File: id2entry.bdb 16384 Page size. 0 Requested pages mapped into the process' address space. 125990 Requested pages found in the cache (97%). 3888 Requested pages not found in the cache. 0 Pages created in the cache. 3888 Pages read into the cache. 0 Pages written from the cache to the backing file. ########################## Thanks! -Michael

1 0

how to solve invalid structural object class chain
by owen nirvana 19 Dec '08

19 Dec '08

I try to a entry like this: cn = .. ,dc=..,dc=..,dc=..,dc=.. cn = .. objectClass: person objectClass: inetOrgPerson objectClass: organizatinoalRole objectClass: device objectClass: pkiUser roleOccupant: ... employeeNumber : .. userCertificate;binary :: BASE64 Encode icSerilNumber: .. tel: ... fax: ... telex: .. log reports " invalid structural object class chain in organizatinoalRole/Person or organizatinoalRole/inetOrgPerson etc" I try many combination about the order of person ,inetOrgPerson and organizatinoalRole, and the same error was reported. thanks for help gtalk:freeespeech@gmail.com

3 2

Re: Re: N-Way Multi-Master replication - delete problem
by Adrien Futschik 19 Dec '08

19 Dec '08

Hy everyone, I have just tested the same procedure with OpenLDAP 2.4.13. The problem remains the same. Did I miss something ? Is this supposed to be like this ? I'm joining the modified script I'm using to setup both masters and the LDIF files I'm using to add and remove an entry (+ attributes). I did not use access-log, is this supposed to work with N-Way Multi-Master replication ? I thought it was only used in case of Delta Synchronization/Replication. Adrien ======================================== Message date : Dec 18 2008, 02:24 PM From : "Miguel Jinez" <miguel.jinez(a)gmail.com> To : adrien.futschik(a)atosorigin.com Copy to : openldap-technical(a)openldap.org Subject : Re: N-Way Multi-Master replication - delete problem Maybe in openLdap 2.4.13 it would be solved. I had that problem, and I fixed it using accesslog, but it makes you lose performance.... 2008/12/18 Adrien Futschik <adrien.futschik(a)atosorigin.com> > I'm testing N-Way Multi-Master replication with OpenLDAP 2.411. > > I have setup 2 Masters (m1 & m2) starting form test050-syncrepl-multimaster > and modifying it. > > Every thing seems to work fine except deleting entries. > > Let me explain. > case 1 : > . When I add an entry on m1 it is successfully replicated on m2. > . When I try to delete this entry on m1, it is successfully removed from > m1, but not replicated on m2. > . When, I try to delete this entry on m2, it is successfully removed from > m2 & m1. > > case 2 : > . When I add an entry on m2 it is successfully replicated on m1. > . When I try to delete this entry on m2, it is successfully removed from > m2, but not replicated on m1. > . When, I try to delete this entry on m1, it is successfully removed from > m1 & m2. > > I don't have the same problem when I delete an attribute or update an > entry. Is this normal ? > > Adrien Futschik > Adrien Futschik

2 1

'Has A' vs 'Is A'
by Lorenzo Pastrana 19 Dec '08

19 Dec '08

Hi list, Me again ... I've got to compose some objects by inheritance of parent classes (Is A), I'm now on the point of building the actual object tree and I was wondering what is the preferred mechanism for aggregation (Has A) and controlling children types ... can I do this in the schema ? Thanks, LP. Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

1 0

Workflow / tools / practice working on a new shema : reload to cn=config or editing cn=config in place ?
by Lorenzo Pastrana 19 Dec '08

19 Dec '08

Hi, list Still a genuine noob.. ;P I'm working on a brand new shema to store my app's data .. What do you guys use to do when working on a 'new' directory ? a) work on a shema file / restart server b) work on a shema file / reload to cn=config c) edit cn=config / a) could be ok .. a little brutal but ... b) sounds tedious c) what tool do you use ? Thx. LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

5 8

how to solve invalid structural object class chain
by owen nirvana 18 Dec '08

18 Dec '08

I try to a entry like this: cn = .. ,dc=..,dc=..,dc=..,dc=.. cn = .. objectClass: person objectClass: inetOrgPerson objectClass: organizatinoalRole objectClass: device objectClass: pkiUser roleOccupant: ... employeeNumber : .. userCertificate;binary :: BASE64 Encode icSerilNumber: .. tel: ... fax: ... telex: .. log reports " invalid structural object class chain in organizatinoalRole/Person or organizatinoalRole/inetOrgPerson etc" I try many combination about the order of person ,inetOrgPerson and organizatinoalRole, and the same error was reported. thanks for help gtalk:freeespeech@gmail.com

1 0

Unix id command and Openldap
by okossuth＠antel.com.uy 18 Dec '08

18 Dec '08

Hi Does the id command works with a system using OPENLDAP authentication ? I have implemented a server with openldap 2.4 and several clients use this system to authenticate users, and works fine except that when I do a "id user" on a client it only gives me the information of the primary group which the user belongs to and not of the suplementary groups that he is also a member of in the LDAP server... any ideas?? Saludos, Oskar Kossuth Administrador UNIX ANTEL Telecomunicaciones El presente correo y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo anexando este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender immediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that is not the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy.

4 9

Solaris 10 LDAP Password issue
by John Gee 18 Dec '08

18 Dec '08

Hello Community, i have a problem with Solaris 10 LDAP password encryption to a OpenLDAP Server. When setting a inital Password with ldapadd login works fine, after the user changed inital Password on a Solaris-Station with 'passwd -r ldap' Solaris commited it with 'password successfully changed for john'. But the user cant login with the new Password. 1) Setting initial Password with ldapadd (Password: 8ASdhXY!Xy) version: 1 dn: uid=john,ou=people,ou=unix,o=kleinfeld,c=ch userPassword: {MD5}khVDRrTSYMHjTw7V6VEZwg== 2) User Login and change password with 'passwd -r ldap' (Password: 9DnxSF!dKS) version: 1 dn: uid=john,ou=people,ou=unix,o=kleinfeld,c=ch userPassword: {crypt}0vUAwIdPR4X2E Has someone a idea whats going wrong? I cant track down this problem. --( nsswitch.conf )--- passwd: compat passwd_compat: files ldap group: files ldap shadow_compat files ldap --( pam.conf )--- login auth sufficient pam_unix_auth.so.1 login auth required pam_ldap.so.1 rlogin auth sufficient pam_unix_auth.so.1 rlogin auth required pam_ldap.so.1 other auth sufficient pam_unix_auth.so.1 other auth required pam_ldap.so.1 --( /etc/security/policy.conf )--- CRYPT_ALGORITHMS_ALLOW=1,2a,md5 CRYPT_DEFAULT=__unix__ Regards John

2 2

Openldap 2.3.39 Solaris 9 (maybe memory leaks).
by Andrea Cirulli 18 Dec '08

18 Dec '08

Hi all, we are experiencing a lot of problems with openldap 2.3.39 on Solaris 9. We have the following set: 1- One producer Solaris 9 openldap 2.3.39 2- 19 Consumer, synchronized with the producer through syncrepl, Solaris 9 openldap 2.3.39 3- We manage the authentication on 2000 systems , almost equally distributed on the 20 ldap server The producer is often going down, each hour and less during the day. We noticed that every time the Producer is going down the virtual memory used is bigger than 3,8 Gb and the RSS (resident set size) is bigger than 2,1 Gb. This is a snapshot of prstat when openldap is about of crashing: PID USERNAME SIZE RSS STATE PRI NICE TIME CPU PROCESS/NLWP 1965 root 3873M 2179M sleep 60 0 0:41:40 0.5% slapd/27. The openldap is compiled in this way: ./configure --enable-bdb --enable-ppolicy --with-tls If these informations are not enough, I could provide other informations. It seems that there is a memory leak. P.S: We are using these systems since 2,5 years, the number of the managment systems is always growing up. We have this problem since 2 weeks. -- Andrea Cirulli

2 1

N-Way Multi-Master replication - delete problem
by Adrien Futschik 18 Dec '08

18 Dec '08

I'm testing N-Way Multi-Master replication with OpenLDAP 2.411. I have setup 2 Masters (m1 & m2) starting form test050-syncrepl-multimaster and modifying it. Every thing seems to work fine except deleting entries. Let me explain. case 1 : . When I add an entry on m1 it is successfully replicated on m2. . When I try to delete this entry on m1, it is successfully removed from m1, but not replicated on m2. . When, I try to delete this entry on m2, it is successfully removed from m2 & m1. case 2 : . When I add an entry on m2 it is successfully replicated on m1. . When I try to delete this entry on m2, it is successfully removed from m2, but not replicated on m1. . When, I try to delete this entry on m1, it is successfully removed from m1 & m2. I don't have the same problem when I delete an attribute or update an entry. Is this normal ? Adrien Futschik

2 1

Re: Versioning entries in the DIT
by Lorenzo Pastrana 18 Dec '08

18 Dec '08

On Wed, 2008-12-17 at 23:47 -0800, Howard Chu wrote: > ere's no standard or transparent way to do this. The most > straightforward > approach is to use a multi-valued RDN for your entries, e.g. instead > of > cn=foo,o=example > use > cn=foo+id=1,o=example > cn=foo+id=2,o=example > and so on. That makes sense ... > Except of course, that you can no longer reference entries without > knowing > their version number. Well if i consider a 'HEAD' entry (without a number) all others are old versions. And that would be also ok for me. Thanks for the tip. LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

1 0

RE: slapd won't run as service
by Quanah Gibson-Mount 16 Dec '08

16 Dec '08

--On Tuesday, December 16, 2008 9:22 PM -0800 Eddie Grenier <edo(a)edwaa.com> wrote: > set_lg_dir /usr/local/var/openldap-logs > ----------------------------------------------------- > > Admittedly, I know very little about these configuration options. I set > these parameters after finding a "suggested" DB_CONFIG file on the > internet. > > Any help is much appreciated! First, I would suggest you keep your replies on the list, so other people can gain knowledge too. Second, it clearly notes it stores the log files in /usr/local/var/openldap-logs. I'm guessing the slapd user can't access that location. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Floating point numbers in ldap
by Lorenzo Pastrana 16 Dec '08

16 Dec '08

I can't find any mentions of floating point/real data types in ldap attributes syntax, I've been reading the laconic 'Numeric Sting' specifications : 6.23. Numeric String ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' ) The encoding of a string in this syntax is the string value itself. Example: 1997 Would this work ok (matching & ordering) with a 1.997 value ? If not, how do I get ldap to match and order floating point scalars ? Thanks. Lo. Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

2 4

ldap user not visible in home directory
by Donny George 16 Dec '08

16 Dec '08

Hello I have set up a ldap and used LAM to populate the database. though i can see the user created both on the server and the client , i cant see the users home directory I am also not able to use the command id username is this specifically because i committed some error in the config file or would it be something other major mistake ? somehow i cant figure out the mistake -- Donny George

1 0

slapd won't run as service
by Eddie Grenier 15 Dec '08

15 Dec '08

I've installed, configured and run OpenLDAP on my server. However, if I try to run it as a service using "service ldap start" it doesn't run. Also, the configuration file step returns "OK" as does the starting slapd step. I've narrowed it down to the fact that if slapd is run as user root things work just fine. I've already done "chown -R ldap:ldap /var/lib/ldap" but that doesn't seem to help. Here is the output I see when trying to run as user ldap: slapd startup: initiated. bdb_db_open: dc=edwaa,dc=com bdb_db_open: dbenv_open(/var/lib/ldap) bdb(dc=edwaa,dc=com): Invalid log file: log.0000000001: No such file or directory bdb(dc=edwaa,dc=com): PANIC: No such file or directory bdb(dc=edwaa,dc=com): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery bdb_db_open: dbenv_open failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30978) backend_startup: bi_db_open(0) failed! (-30978) slapd shutdown: initiated ====> bdb_cache_release_all bdb(dc=edwaa,dc=com): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem slapd shutdown: freeing system resources. bdb(dc=edwaa,dc=com): txn_checkpoint interface requires an environment configured for the transaction subsystem bdb_db_destroy: txn_checkpoint failed: Invalid argument (22) slapd stopped. connections_destroy: nothing to destroy. Any ideas would be much appreciated!

2 1

ACL for DIT structure rules
by Mansour Al Akeel 15 Dec '08

15 Dec '08

Hello all, In a previous email, I was told that we can implement *DIT* *structure* rules with openldap using ACL (http://www.openldap.org/lists/openldap-technical/200811/msg00152.html). Did any one have any success implementing these rules with ACL. I have searched the net for an example, but out of luck. Possibly a simple example will help a lot, just to give me an idea about the syntax for a DIT structure rule using ACL. Thank you.

3 9

Re: OpenLDAP replication
by Justin Lintz 15 Dec '08

15 Dec '08

Gavin, Thanks for your help. That appears to be working. In a failure situation where rid=1 goes down, and writes began occuring to rid=2, when I bring back up the server which was set to rid=1, what is the proper way to get them back in sync? Would it be just to change the rids and reload openldap? - Justin Lintz On Mon, Dec 15, 2008 at 2:57 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > > ----- "Justin Lintz" <jlintz(a)gmail.com> wrote: > >> Quanah, >> >> Looking at >> http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master >> it appears the example is with using cn=config to store the >> configuration. Is there an example somewhere with just using >> slapd.conf? > > I'm in the process of re-writing the replication section, but the following: > > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > > would just go under a database section like other syncrepl statements and look something like: > > overlay syncprov > > syncrepl rid=001 > provider=$URI1 > binddn="cn=config" > bindmethod=simple > credentials=secret > searchbase="cn=config" > type=refreshAndPersist > retry="5 5 300 5" > timeout=1 > > syncrepl rid=002 > provider=$URI1 > binddn="cn=config" > bindmethod=simple > credentials=secret > searchbase="cn=config" > type=refreshAndPersist > retry="5 5 300 5" > timeout=1 > > syncrepl rid=003 > provider=$URI1 > binddn="cn=config" > bindmethod=simple > credentials=secret > searchbase="cn=config" > type=refreshAndPersist > retry="5 5 300 5" > timeout=1 > > mirrormode on > > Remember the above is replicating cn=config though. > > Check back in the new year. > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Querying Attribute Type Definitions Problem
by Kevin Hardiman 15 Dec '08

15 Dec '08

I am trying to query the definition of an attribute type using one of the attribute type's aliases. For example, given: attributetype ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC2256: common name(s) for which the entity is known by' SUP name ) I am using Java's naming API to query the definition, and getting an exception saying the attribute type doesn't exist. Example: DirContext cnSchema = (DirContext)schema.lookup("AttributeDefinition/commonName"); I appreciate that this is not a Java list - I am trying to determine if what I am seeing is consistent with one of the many LDAP RFC's (i.e. I must use the actual attribute type's name to get the definition). If not I'll peddle my query elsewhere :) Thanks, Kevin Hardiman

2 1

schemacheck && valid objects check - just to note slapd behaviour
by Piotr Wadas 15 Dec '08

15 Dec '08

Hello, Using openldap 2.4.10 (x86), bdb backend. I had custom objectClass. I made it to be structuralObjectClass , and then created some object of this class in DIT. Everything works fine. Then (actually weeks later), I edited my objectClass definitionas, and made my custom objectClass to be an auxiliary class, and restarted slapd - everything was still working fine. Schema syntax is still valid, no schemacheck warnings. Then I did a slapcat dump - I realized what happened when came up, that I cannot load dump back with slapadd, because it contains objects, which, actually should generate errors. slapcat backups I did in the meantime was actually useless and I didn't note it. Now, I don't expect slapd to remove or ignore such objects, anyway while SERVING (returning), or indexing existing object of such kind, I'd expect some warning, that existing object does not conform existing schema. Or some tool to verify existing directory objects to find out about such situation - imagine if I hadn't been trying to retrieve from it for months, I wouldn't have learned it became useless :) May I please for some comments on such issue ? Regards, Piotr Wadas

2 1

Re: OpenLDAP replication
by Justin Lintz 15 Dec '08

15 Dec '08

Quanah, Looking at http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master it appears the example is with using cn=config to store the configuration. Is there an example somewhere with just using slapd.conf? - Justin Lintz On Thu, Dec 11, 2008 at 6:13 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 11, 2008 4:30 PM -0500 Justin Lintz > <jlintz(a)gmail.com> wrote: > >> Quanah, >> >> I'm still seeing the issue after making the change. I am able to >> however add entries to ldap02 and have them appear on ldap01, but not >> have them appear on ldap02. And adding anything to ldap01 does not >> get replicated to ldap02. Any other suggestions? >> - Justin Lintz > > Your email confuses me. I thought you were doing simple single > master/replica replication, but if you can modify on ldap02, then that means > it is not a replica. Or, it means you're writing to it via slapadd? That's > not legal. If you have a single master, writes must only occur to that > server. Otherwise, you need to set up MMR. The configs you sent before > certainly didn't indicate you were trying to do MMR. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Synchronizing Openldap with Windows Active Directory
by Aravind Arjunan 14 Dec '08

14 Dec '08

hi, I like to know wheather it is possible to synchronize Windows Active directory with RHEL Openldap. Some of my users are in openldap and some of them in Active Directory all i want to synchronize these users. Am trying for synchronizing the above two,but am not finding any proper link to refer. If any one knows plz help me with the link to refer. with regards aravind

6 9

Re: OpenLDAP replication
by Justin Lintz 11 Dec '08

11 Dec '08

Quanah, Thanks for your quick reply. I've made the change. I thought I had taken it from the openldap documents but clearly did not after reviewing them, I must have gotten mixed up with all the tabs I had open. Looks like its best to stick to the official documents (and this mailing list) rather than the how-tos out there - Justin Lintz On Tue, Dec 9, 2008 at 9:21 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 09, 2008 6:05 PM -0800 Quanah Gibson-Mount > <quanah(a)zimbra.com> wrote: > >> --On Tuesday, December 09, 2008 4:45 PM -0500 Justin Lintz >> <jlintz(a)gmail.com> wrote: >> >>> Hi, >>> >>> I am currently working on trying to configure replication between 2 >>> ldap servers. Here is my current setup.... >>> >>> >>> slapd.conf on ldap02 is": >>> >>> directory /var/lib/ldap2.4 >>> checkpoint 256 5 >>> index objectClass eq >>> index cn,mail,surname,givenname >>> eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember >>> eq index uid >>> eq,subinitial index sambaSID,sambaDomainName,displayName >>> eq referral ldaps://ldap01/ >>> syncrepl rid=123 >>> provider=ldaps://ldap01/ >>> type=refreshAndPersist >>> searchbase="dc=example,dc=net" >>> scope=sub >>> schemachecking=off >>> bindmethod=simple >>> binddn="cn=manager,dc=example,dc=net" >>> attrs="*" >>> credentials= >> >> You should specify an attrs= line unless you know what you're doing. You > > s/should/should NOT/ > > :) > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

Batch delete can't sync to other servers
by Bad Guy 11 Dec '08

11 Dec '08

Dear all, I have 4 LDAP servers running 2.4.11 and configured as 4 way masters. The sync type is refreshOnly and the interval is 30 sec. I create a LDIF file and contains about 500 entries in it. Then, I use ldapdelete -x -W -D "cn=Manager" -f delete.ldif to delete the 500 entries in server 1. Then, I check the other 3 servers, the 500 entries still exists. Only in server 1, those entries are not here. If I delete the entries one by one, the data can be deleted in the other 3 servers. Any idea ? Thanks _________________________________________________________________ 下載 Windows Live Messenger 8.5 搶鮮版，多元溝通、盡情分享，和即時傳訊好友線上同樂！— 立即下載 http://get.live.com/zh-cht-tw/betas/messenger_betas

1 0

not able to delete schema (using back-config)
by benjamin thielsen 10 Dec '08

10 Dec '08

hi- i've been experimenting with using back-config (2.4.11 courtesy of debian), and am able to add schema, but not able to delete the schema after being added. iirc, this should be possible in recent versions? i'm confident that the schema's not in use by any entries. adding the schema is successful: >ldapadd -xWD 'cn=admin,cn=config' -f java_schema.ldif Enter LDAP Password: adding new entry "cn={13}java,cn=schema,cn=config" ldapsearch confirms this: >ldapsearch -xWLLLb 'cn=schema,cn=config' -D 'cn=admin,cn=config' "(cn=*java*)" dn Enter LDAP Password: dn: cn={13}java,cn=schema,cn=config ldapdelete says: >ldapdelete -vxWD 'cn=admin,cn=config' 'cn={13}java,cn=schema,cn=config' ldap_initialize( <DEFAULT> ) Enter LDAP Password: deleting entry "cn={13}java,cn=schema,cn=config" ldap_delete: Server is unwilling to perform (53) i'm not seasoned at interpreting slapd debug output, but nothing specifically jumps out at me when running with -d -1: >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> conn=1 op=0 BIND dn="cn=admin,cn=config" method=128 do_bind: version=3 dn="cn=admin,cn=config" method=128 conn=1 op=0 BIND dn="cn=admin,cn=config" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=admin,cn=config" to "cn=admin,cn=config" send_ldap_result: conn=1 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1 op=0 RESULT tag=97 err=0 text= daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(13) connection_get(13): got connid=1 connection_read(13): checking for input on id=1 ber_get_next ldap_read: want=8, got=8 0000: 30 24 02 01 02 4a 1f 63 0$...J.c ldap_read: want=30, got=30 0000: 6e 3d 7b 31 33 7d 6a 61 76 61 2c 63 6e 3d 73 63 n={13}java,cn=sc 0010: 68 65 6d 61 2c 63 6e 3d 63 6f 6e 66 69 67 hema,cn=config ber_get_next: tag 0x30 len 36 contents: ber_dump: buf=0x8578290 ptr=0x8578290 end=0x85782b4 len=36 0000: 02 01 02 4a 1f 63 6e 3d 7b 31 33 7d 6a 61 76 61 ...J.cn={13}java 0010: 2c 63 6e 3d 73 63 68 65 6d 61 2c 63 6e 3d 63 6f ,cn=schema,cn=co 0020: 6e 66 69 67 nfig ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=1 op=1 do_delete ber_scanf fmt (m) ber: ber_dump: buf=0x8578290 ptr=0x8578293 end=0x85782b4 len=33 0000: 4a 1f 63 6e 3d 7b 31 33 7d 6a 61 76 61 2c 63 6e J.cn={13}java,cn 0010: 3d 73 63 68 65 6d 61 2c 63 6e 3d 63 6f 6e 66 69 =schema,cn=confi 0020: 67 g >>> dnPrettyNormal: <cn={13}java,cn=schema,cn=config> => ldap_bv2dn(cn={13}java,cn=schema,cn=config,0) <= ldap_bv2dn(cn={13}java,cn=schema,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={13}java,cn=schema,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={13}java,cn=schema,cn=config)=0 <<< dnPrettyNormal: <cn={13}java,cn=schema,cn=config>, <cn={13}java,cn=schema,cn=config> conn=1 op=1 DEL dn="cn={13}java,cn=schema,cn=config" send_ldap_result: conn=1 op=1 p=3 send_ldap_result: err=53 matched="" text="" send_ldap_response: msgid=2 tag=107 err=53 ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 02 6b 07 0a 01 35 04 00 04 00 0....k... 5.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 6b 07 0a 01 35 04 00 04 00 0....k... 5.... conn=1 op=1 RESULT tag=107 err=53 text= daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(13) connection_get(13): got connid=1 connection_read(13): checking for input on id=1 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x85e1d60 ptr=0x85e1d60 end=0x85e1d65 len=5 0000: 02 01 03 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 13 failed errno=0 (Success) connection_read(13): input error=-2 id=1, closing. connection_closing: readying conn=1 sd=13 for close connection_close: deferring conn=1 sd=13 conn=1 op=2 do_unbind conn=1 op=2 UNBIND connection_resched: attempting closing conn=1 sd=13 connection_close: conn=1 sd=13 daemon: removing 13 conn=1 fd=13 closed daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL what am i doing wrong? -ben

3 3

trouble with regex type constraint overlay
by benjamin thielsen 10 Dec '08

10 Dec '08

i'm experimenting with the constrain overlay, and have what i think is a fairly simply constraint that's giving me trouble. below are the details. i believe i've followed slapo-constraint(5) (and regex(7)) accurately, but i must be missing something. >cat montage_admin.ldif dn: uid = admin,ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com changetype: modify replace: uidNumber uidNumber: 5000 >ldapmodify -vxWD 'cn=admin,dc=ltn,dc=lvc,dc=com' -f montage_admin.ldif ldap_initialize( <DEFAULT> ) Enter LDAP Password: replace uidNumber: 5000 modifying entry "uid = admin ,ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com" ldap_modify: Constraint violation (19) additional info: modify breaks constraint on uidNumber >ldapsearch -vvxWLLLD 'cn=admin,dc=ltn,dc=lvc,dc=com' "(uid=admin)" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (uid=admin) requesting: All userApplication attributes dn: uid =admin,ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=c om userPassword:: e1NTSEF9TkF5TGVabXFWTU9zT01EZVNWdHA1Mm9uUWtOalg3cXY= objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top homeDirectory: /dev/null cn: admin uid: admin sn: admin givenName: admin gidNumber: 5001 uidNumber: 2016 >ldapsearch -vvxWLLLb 'cn=config' -D 'cn=admin,cn=config' "(objectClass=olcConstraintConfig)" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (objectClass=olcConstraintConfig) requesting: All userApplication attributes dn: olcOverlay={3}constraint,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcConstraintConfig olcOverlay: {3}constraint olcConstraintAttribute: uidNumber regex ^[:digit:]*$ thanks -ben

2 3

olcMonitoring attribute
by benjamin thielsen 10 Dec '08

10 Dec '08

hi- i've recently begun using back-config and was looking for some more detail on the purpose of the olcMonitoring attribute. my googling and searching of the list archives have revealed not much beyond references in cn=schema.ldif. thanks -ben

3 2

Re: bdb encryption
by ghenry＠OpenLDAP.org 09 Dec '08

09 Dec '08

----- "Howard Chu" <hyc(a)symas.com> wrote: > ghenry(a)OpenLDAP.org wrote: > > Hi All, > > > > I'm just testing bdb encryption and it works as expected out of the > box. > > > > But I'm trying to decrypt it using the bdb tools: > > > > [ghenry@suretec openldap-data]$ > /usr/local/BerkeleyDB.4.7/bin/db_verify objectClass.bdb > > db_verify: Encrypted environment: no encryption key supplied > > Segmentation fault > > Interesting. It shouldn't segfault, perhaps you should report that as > a bug to > Oracle. Will do. If I use "cryptkey testing" all tools work. If I enter the wrong password using cryptkey is segfaults again after stating wrong pass. > > So it segfaults, but it's the same with the key: > > > > [ghenry@suretec openldap-data]$ > /usr/local/BerkeleyDB.4.7/bin/db_verify -P "testing" objectClass.bdb > > db_verify: Invalid password > > Segmentation fault > > > > testing is set in slapd.conf via "cryptfile" and has the word > "testing" in it: > > How did you create the file? If you simply created it as a plain text > file, > then it probably has a trailing NewLine as well. In which case, the > NewLine is > part of the password... Checked this and recreated vi vim and just: echo testing > cryptfile. All results in the same invalid password and segfault. Cheers. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

OpenLDAP replication
by Justin Lintz 09 Dec '08

09 Dec '08

Hi, I am currently working on trying to configure replication between 2 ldap servers. Here is my current setup.... 2 servers, ldap01 and ldap02, both running centos 5.2 x86_64 with openldap2.4 installed from http://staff.telkomsa.net/packages/rhel5/openldap/x86_64/ openldap2.4-servers-2.4.11-1.rhel5 my slapd.conf on ldap01 is: modulepath /usr/lib64/openldap2.4 moduleload syncprov.la TLSCertificateFile /etc/ssl/openldap2.4/ldap.pem TLSCertificateKeyFile /etc/ssl/openldap2.4/ldap.pem TLSCACertificateFile /etc/ssl/openldap2.4/ldap.pem loglevel 32 256 1024 database bdb suffix "dc=example,dc=net" rootdn "cn=Manager,dc=example,dc=net" rootpw directory /var/lib/ldap2.4 checkpoint 256 5 index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index sambaSID,sambaDomainName,displayName eq index entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 200 slapd.conf on ldap02 is": directory /var/lib/ldap2.4 checkpoint 256 5 index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index sambaSID,sambaDomainName,displayName eq referral ldaps://ldap01/ syncrepl rid=123 provider=ldaps://ldap01/ type=refreshAndPersist searchbase="dc=example,dc=net" scope=sub schemachecking=off bindmethod=simple binddn="cn=manager,dc=example,dc=net" attrs="*" credentials= This appears to work but it seems after some time the replication stops working , not seeing anything in the logs either. Also with this setup, given a situation where ldap01 died and ldap02 took over, when I brought ldap01 back online, would configuration changes need to be made to ensure any changes that were made to ldap02 were replicated back properly or am I not using the proper replication technique for this situation? I'm still a bit new to OpenLDAP so I apologize if I explained anything incorrrectly. My end goal is to have 2 ldap servers in place where in the event of a failure the secondary could take over and when the primary is restored, have it fail back over without any loss of changes. - Justin Lintz

2 3

Unable to login as local user when LDAP master has problem
by sparklings 09 Dec '08

09 Dec '08

Hi, I'm having about 30 Linux Servers in which I have one LDAP master server and remaining all of them are ldap clients.All the users who login to Linux servers are LDAP users. Whenever there is a problem with the LDAP service in Master, I have the following issues. 1.ldap user anyway cannot login to any of the server but even as root or local user,we are unable to login to any of the client/master server. 2.If I'm already logged in any of the client server and when there is a problem with the LDAP master service, the server becomes extremely unstable/slow and cannot execute any command and everything hangs. Could you suggest if I'm missing any setting in LDAP master or slave?as I should not have problem in login to the servers as a local/root user even when LDAP master is down Thanks in Advance, Rahul

2 1

Cannot start kerberos signing/sealing when using TLS/SSL
by Jeremiah Martell 08 Dec '08

08 Dec '08

I'm using openldap, cyrus-sasl, heimdal, and openssl. I use the standard kerberos "kinit" tool to get my TGT, this is successful. I use the standard openldap "ldapsearch" tool to attempt to do a LDAP+GSSAPI over TLS (cert level "demand") search, and I get two errors. The first error is an "inappropriate auth", which seems to come from openldap. The second error is "Cannot start kerberos signing/sealing when using TLS/SSL", which seems to come from GSSAPI-land. Interesting facts: - This fails against Windows 2003 AD. - But succeeds against a BSD box running an openldap server. - The following all had the cert level set to "demand"... - - LDAP works with the Win2003 AD. - - LDAP+SSL works with the Win2003 AD. - - LDAP+TLS works with the Win2003 AD. - - LDAP+GSSAPI works with the Win2003 AD. - - LDAP+GSSAPI+SSL works with the Win2003 AD. - - But LDAP+GSSAPI+TLS does NOT work with the Win2003 AD. - If I switch the cert level to "allow", then LDAP+GSSAPI+TLS works with Win2003 AD. It seems everything is ok with my kerberos setup, since LDAP+GSSAPI works. It seems everything is ok with my certs, since LDAP+SSL and LDAP+TLS and LDAP+GSSAPI+SSL works. I'm at a loss as to why this particular case: LDAP+GSSAPI+TLS (cert level "demand") against Windows 2003 AD doesn't work. I tried looking through the openldap, cyrus-sasl, heimdal, and openssl code for "Cannot start kerberos signing/sealing when using TLS/SSL" but I didn't find anything. My guess is that this comes from the server. The only thing I could find googling was from here: http://en.gentoo-wiki.com/wiki/Active_Directory_Authentication_using_LDAP that says: "GSSAPI Error: Cannot start kerberos signing/sealing when using TLS/SSL SASL/GSSAPI already encrypts the LDAP traffic, this error is trying to say TLS/SSL is redundant." My questions: (1) Is this simply the fact that Windows 2003 AD doesn't support LDAP+GSSAPI+TLS (with cert level set to "demand")? (2) Why would the Win2003 AD server behave properly with SSL but not TLS? (3) Why does the openldap server work fine, but not the Windows 2003 AD server? (3) Has this been addressed in some newer release of openldap/cyrus-sasl/heimdal/openssl code? (4) Is there anything I could have done wrong in my Win2003 AD setup? (5) Any other general suggestions/ideas to help? Thanks, -- - Jeremiah Martell http://inlovewithGod.com

2 1

bdb encryption
by ghenry＠OpenLDAP.org 08 Dec '08

08 Dec '08

Hi All, I'm just testing bdb encryption and it works as expected out of the box. But I'm trying to decrypt it using the bdb tools: [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_verify objectClass.bdb db_verify: Encrypted environment: no encryption key supplied Segmentation fault So it segfaults, but it's the same with the key: [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_verify -P "testing" objectClass.bdb db_verify: Invalid password Segmentation fault testing is set in slapd.conf via "cryptfile" and has the word "testing" in it: (gdb) run -P testing objectClass.bdb Starting program: /usr/local/BerkeleyDB.4.7/bin/db_verify -P testing objectClass.bdb db_verify: Invalid password [New Thread 0xb7fd86c0 (LWP 17626)] Program received signal SIGSEGV, Segmentation fault. 0x0021f82d in __memp_resize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so Missing separate debuginfos, use: debuginfo-install glibc-2.9-2.i686 (gdb) bt #0 0x0021f82d in __memp_resize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so #1 0x0021bac9 in __memp_set_cachesize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so #2 0x08048cfd in __db_rpath () #3 0x0804b018 in ?? () #4 0x00000000 in ?? () (gdb) q Any ideas? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

why does ldapsearch just hang with SASL/EXTERNAL authentication started?
by borderline_ocd-er 08 Dec '08

08 Dec '08

hello list, :¬O H-E-E-E-E-E-L-L-L-L-P-P-P!!!! for the past week and a half, i've been trying to get an openldap client on a mac os x 10.4.11 (OpenLDAP 2.2) to talk to an ldap directory server (sun iPlanet directory server 5.1) on a solaris 9 sparc box; using client authentication with x509 certificates for both the server and the client. i have successfully configured client authn between the directory server (ds) on the solaris box and a precompiled ldapsearch binary client (also running on that same solaris box). the ldapsearch binary is part of the netscape security services (nss) ldap c sdk 6.0.x that came bundled with - what sun calls it's - "ds resource kit 5.2 (dsrk)". since client authn works successfully between those 2 components running local to each other, i figured a remote client authn setup shouldn't be much of a stretch (if the openldap.org docs are to be believed). BOY! was i wrong! after copying to my mac os x box, the same ca cert and client cert (in .pem format) that worked successfully on the solaris box, i configured ldap.conf and .ldaprc to point to the certs and keys (see below). when i run an openldap ldapsearch on the mac, the tls handshake appears to succeed (see below); then the sasl/external client authn appears to kick off; then it just hangs! the last thing that's output to the shell is "SASL/EXTERNAL authentication started". but the shell cursor just hangs there; flashing away - doing nothing! the solaris ds access logs seem to report that a bind took place as a result of the mac openldap ldapsearch attempt: "...conn=45 SSL client bound as cn=bilbo,ou=development,o=helpme.com" please, will you help me to get my mac openldap ldapsearch client to authenticate to my solaris ds using a client cert? i've read and reread the openldap.org tls docs (http://www.openldap.org/doc/admin24/tls.html); i've read and reread the openldap.org sasl docs (http://www.openldap.org/doc/admin24/sasl.html); i've scoured this list; i've scoured the cyrus sasl list (http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl); i've tried adding the "-I" switch to the ldapsearch command, but that results in an endless loop of being prompted over and over to enter an authorization id. i've tried editing /etc/syslog.conf with the following: "local4.* /var/log/openldap.log" but nothing ever gets logged to that file! i've spent so much time trying to solve this problem on my own, that my wife has threatened to leave me for my best friend if i don't stop spending so much time on this! my dog snarled at me and bit my behind today because he doesn't recognize me anymore! my daughter is talking about becoming an "exotic dancer" because i don't pay her enough attention from working on this! my failure to accomplish such a seemingly simple task has made me consider taking my own life! seriously though: I NEED YOUR HELP! thanks in advance for your help. ========================================================== ds access logs after successful ldapsearch on solaris box: ========================================================== ... [07/Dec/2008:04:29:38 +0000] conn=0 fd=49 slot=49 SSL connection from 127.0.0.1 to 127.0.0.1 [07/Dec/2008:04:29:38 +0000] conn=0 SSL 128-bit RC4; client O=helpme.com, OU=Development, CN=bilbo; issuer E=ldapca(a)helpme.com, CN=ldapca, OU=development, O=helpme.com, L=Chicago, ST=IL, C=US [07/Dec/2008:04:29:38 +0000] conn=0 SSL client bound as cn=bilbo,ou=development,o=helpme.com [07/Dec/2008:04:29:38 +0000] conn=0 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL [07/Dec/2008:04:29:38 +0000] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=bilbo,ou=development,o=helpme.com" [07/Dec/2008:04:29:38 +0000] conn=0 op=1 SRCH base="ou=development,o=helpme.com" scope=2 filter="(cn=bilbo)" attrs=ALL [07/Dec/2008:04:29:38 +0000] conn=0 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [07/Dec/2008:04:29:38 +0000] conn=0 op=2 UNBIND [07/Dec/2008:04:29:38 +0000] conn=0 op=2 fd=49 closed - U1 ... ========================================================== hanging mac osx openldap ldapsearch command results: ========================================================== bilbo$ ldapsearch -v -H ldap://bebop -s sub -b "" -LLL -d -7 -ZZ ldap_initialize( ldap://bebop ) ldap_create ldap_url_parse_ext(ldap://bebop) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP bebop:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.0.8:389 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_ndelay_on: 3 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_open_defconn: successful ldap_send_server_request ber_flush: 31 bytes to sd 3 ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (infinite timeout), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: bebop port: 389 (default) refcnt: 2 status: Connected last used: Sun Dec 7 16:04:48 2008 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ber_get_next ber_get_next: tag 0x30 len 95 contents: ber_dump: buf=0x004044b0 ptr=0x004044b0 end=0x0040450f len=95 0000: 02 01 01 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 ...xZ......;Star 0010: 74 20 54 4c 53 20 72 65 71 75 65 73 74 20 61 63 t TLS request ac 0020: 63 65 70 74 65 64 2e 53 65 72 76 65 72 20 77 69 cepted.Server wi 0030: 6c 6c 69 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 lling to negotia 0040: 74 65 20 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 te SSL...1.3.6.1 0050: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_read: message type extended-result msgid 1, original id 1 ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 ber_scanf fmt (a) ber: ber_dump: buf=0x004044b0 ptr=0x004044f7 end=0x0040450f len=24 0000: 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 ..1.3.6.1.4.1.14 0010: 36 36 2e 32 30 30 33 37 66.20037 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 ber_scanf fmt (x) ber: ber_dump: buf=0x004044b0 ptr=0x004044f7 end=0x0040450f len=24 0000: 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 ..1.3.6.1.4.1.14 0010: 36 36 2e 32 30 30 33 37 66.20037 ber_scanf fmt (}) ber: ber_dump: buf=0x004044b0 ptr=0x0040450f end=0x0040450f len=0 ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com, issuer: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com TLS certificate verification: depth: 0, err: 0, subject: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=bebop, issuer: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write certificate verify A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A ldap_sasl_interactive_bind_s: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_int_sasl_open: host=bebop => ldap_dn2bv(16) ldap_err2string <= ldap_dn2bv(O=helpme.com,OU=Development,CN=bilbo)=0 Success SASL/EXTERNAL authentication started [shell just hangs here] ========================================================== ========================================================== ds access logs after hanging ldapsearch from mac os x: ========================================================== ... [07/Dec/2008:16:04:48 +0000] conn=45 fd=49 slot=49 connection from 10.0.0.9 to 10.0.0.8 [07/Dec/2008:16:04:48 +0000] conn=45 op=0 EXT oid="1.3.6.1.4.1.1466.20037" [07/Dec/2008:16:04:48 +0000] conn=45 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [07/Dec/2008:16:04:49 +0000] conn=45 SSL 128-bit RC4; client O=helpme.com, OU=Development, CN=bilbo; issuer E=ldapca(a)helpme.com, CN=ldapca, OU=development, O=helpme.com, L=Chicago, ST=IL, C=US [07/Dec/2008:16:04:49 +0000] conn=45 SSL client bound as cn=bilbo,ou=development,o=helpme.com [end of file] ========================================================== ldap.conf file: ========================================================== HOST bebop BASE dc=bebop,dc=helpme,dc=net TLS_REQCERT demand TLS_CACERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bebopCACert.pem ========================================================== .ldaprc file: ========================================================== URI ldaps://bebop:636 HOST bebop BASE "" TLS_REQCERT demand TLS_CACERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bebopCACert.pem TLS_CERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bilboClientCert.pem TLS_KEY /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bilboClientKey.pem SASL_MECH EXTERNAL ==========================================================

1 0

Using AD authentication with an external LDAP for authorization
by Stefan Stefansson 08 Dec '08

08 Dec '08

Hi. I'm new to the world of LDAP and directory servers and trying to figure out the best solution to my problem. This isn't exactly OpenLDAP specific, I still haven't figured out whether OpenLDAP is the right thing to use or whether there is any good solution to my situation. So I hope you forgive me for asking this here but I'm hoping to tap into the collective knowledge of this list for ideas. My situation is that I have taken over the systems administration of a group of Linux servers for the Computer Science department at my school. The school has an IT department but we would like to be independent of them, both to relieve them of as much as possible of our demands (which can be quite demanding and unorhadox) as well as having a more agile environment here (again touching on the fact that they are overloaded). The IT department mostly runs Microsoft solutions and the whole domain is controlled by Active Directory. I'm not familiar with AD myself so I don't know whether it's a particularly "good setup" or not but I have no reason to believe otherwise. So, what I want to do is set up our own directory server but of course I would like to use some open source solutions... or at the very least, something that runs on Linux. There I would like to control authorization for different users to different servers, clusters, web systems (such as wiki webs, Subversion, bug tracking software etc). On the other hand, I would prefer that authentication be somehow delegated to the AD server for any user who is on the domain to avoid duplicating data. However, I still would like to be able to define additional users in my LDAP directory server that are not necessarily on the domain. So my setup would have to be able to distinguish whether authentication should be handled by my LDAP server or the AD server. I would think this could happen in two ways: 1) user credentials are replicated over to the LDAP server from AD which means that LDAP would handle all authentication or 2) LDAP server would delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows. I assume 1 is difficult to do as sending the user credentials out from AD is probably considered bad practice (if it is at all possible that is). The backup plan would be for me to get administrative rights to some part of the AD server and then we'd use only that server for all authentication and authorization requirements but as I said, we would like to be as independent from their services as possible in addition to not being particularly fond of having to use AD (is there any sort of a usable web access to that? would this mean I would have to have a Windows box set up to perform any administrative tasks?). This is my situation. Sorry for the log winded explanation. Does anybody have an idea of how to accomplish something like this? I'd be happy to hear about any case studies or white papers on similar subjects (I can't believe I'm the first one to want to do this). I'm also open for suggestions on what tools to use. Open source is not a requirement (but preferred). Best regards, Stefan Freyr.

4 3

OpenLDAP + Active Directory User and Password Sync
by Animesh Bansriyar 07 Dec '08

07 Dec '08

Hi All, I have been working on getting Active Directory User Information (username/password) to sync with OpenLDAP. I have been working on different theories to get them to sync when I chanced upon acctsync. Acctsync (http://acctsync.sourceforge.net/) seems to do the work but looks like there has been no work on it since 2005. I am looking forward to revive the project and want to contribute as well on it. If there is something similar can somebody please point me out to it. This is what I am looking for: 1. Any User Added to Active Directory shall be added to OpenLDAP as well and any password modified from Active Directory should be modified in OpenLDAP as well - where OpenLDAP would be used for System Auth in a Linux environment. 2. Any User Added to OpenLDAP should be added to Active Directory along with the same credentials and any password modified in OpenLDAP should be modified in Active Directory as well. I have somewhat been able to take care of the second requirement but the first seems to be the more difficult one in a Windows 2008 Environment - The appoach I have taken is to have a daemon running which polls the OpenLDAP Server with clear-text passwords every few minutes and adds/modifes accounts in the AD Server accordingly - I know this is the least elegant way to do it but as of now it works for me. Can somebody suggest ways to do the above or maybe share experiences on the same. Thanks, Animesh

1 0

Re: Syncrepl question
by Quanah Gibson-Mount 05 Dec '08

05 Dec '08

--On Friday, December 05, 2008 1:18 PM -0800 Ivan Ordonez <iordonez(a)nature.berkeley.edu> wrote: > Hi Quanah, > > I was able to get it to work earlier when I add the startls=critical > line. It work when I did it on the slave1, at the time, I made the > slave1 as the master. Thanks so much for that. Now moving on the the > real master, things did not go well. Now the issue is that, any changes > I make on the master, doesn't go to the slaves. I have two slaves and I > want those two to get the changes. > > example: > > Master > | > _ _ _ _ _| |_ _ _ _ _ > | | > | | > | | > Slave1 Slave2 > > Now, when I make any change on the master, the changes will take effect > only on master and not on the slaves. I will get this error on both > slaves. > Is this because of the acl.bdc.readonly.conf line I have on both slave's > slapd.conf file? pdbedit -Lv username still work only on account were no > changes are made. Do you see any errors on the master from the slaves binding? Are you sure they have the right permissions to the master? Did you look at what sync logging shows? What is the contextCSN on your master versus your slaves? At this point, I suggest we take this discussion back to the list, since we got back your earlier config issue (starttls not being set in the syncrepl config). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 3

Syncrepl question
by Ivan Ordonez 04 Dec '08

04 Dec '08

Hi all, We have a small size domain with about 500 users and computers. We are using Samba with Openldap integration to authenticate user login and file sharing. Our setup is consist of 3 servers running Gentoo Linux - 1PDC and 2BDCs. As for replication, we are still using "slurpd". Any changes or modification is done through the PDC which replicates the changes to BDC1, then from BDC1, it then goes down to BDC2 - it's like a chain. We want to start using "syncrepl" soon as a way to replicate our database but I'm not sure were to start. We want to setup all of our machine to sync with each other everyday, and not worry which machine is use to make changes, modification, etc.... I'm not sure which syncrepl function to use to achieve what we want to do. Is "N-Way Multi Master replication" the correct choice to do this? We are using "BDB" database on each servers, and would like to achieve this with minimal downtime if possible. What is the best way to do this? Please advise. Any help is greatly appreciated. -Ivan

3 12

How to take backup of the openldap users data from the command prompt in LINUX Fedora
by Jyotishmaan Ray 04 Dec '08

04 Dec '08

My problem. I had been using the phpldapadmin browser 1.0.1 to access the openldap database. Recently when I observed that when I logged onto the phpldapadmin browser, the features of the browser didnt show up as usually it appears. So that was my problem as such now I am not able to use the GUI of the browser to do importing of the ldif files for adding new users to my database. Now that the situation is urgent, I need to take a back up of my openldap database for the users data. Please give me the full comand details, so that I can take a back up of my database safely before exploring the problem of phpldapadmin browser. Thanks, in advance, jmaan Thanks, Jyotishmaan Ray Moderator Of Paradise Groups http://yahoogroups.com/group/Spirituality-Paradise Are You Spiritually Aware !!! Are You Enjoying Yourself !!! See What All You Had Been Missing !!!! Please Join Immediately By Sending A Blank Mail @ Spirituality-Paradise-subscribe(a)yahoogroups.com

3 3

OpenLDAP 2.4.10 Logging
by Lydon, Mark 03 Dec '08

03 Dec '08

I am running OpenLDAP 2.4.10 in a Solaris 10 local zone. All working fine, except that I want to log to a specific file using this command line; nohup /usr/local/libexec/slapd -d 64 -d 256 2> /tmp/slapd.log & This run ok in background, but when I exit my shell the job ends. I've often used nohup like this to start jobs and disassociate them from the users login shell, why doesn't it work here? Regards Mark Lydon AT&T

2 1

Samba objects replication
by mike 03 Dec '08

03 Dec '08

Hello everybody. I have configurated Samba with openLdap. My problem is that openldap slave does not synchronize the samba objects from the openldap master. All the others objects (ou, o, dc) are synchronized normaly Can someone help me please? Thanks Migue

2 1

2.4.13 could not start
by owen nirvana 02 Dec '08

02 Dec '08

libldap_r-2.4.so.2 no version information (reqired by slapd) liblber-2.4.so.2 no version information (reqired by slapd) in debian lenny-081114, I don't remove openldap 2.4.11 debian package which had installed, because synpatic always want to remove many many related package too. But I don't think it is the problem. thanks for instruction gtalk:freeespeech@gmail.com

2 1

Can join Domain but cannot login.
by Emil Sicad - ISD 02 Dec '08

02 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

2 2

hello
by Donny George 01 Dec '08

01 Dec '08

Hello After much work i set up and openldap server and client and established their connectivity and also populated the database with phpldapadmin. but wen i do ldapsearch -x or getent passwd or when i search for the specific ids i cant get the user information which i entered through the gui. as i am not sure the config files which i should look into to correct this error, could someone guide me. did i miss in installing soething or have i not edited any specific file thank you in advance -- Donny George

1 0

RE: Some servers are delay synced...
by Quanah Gibson-Mount 01 Dec '08

01 Dec '08

Look for any change noting fixes to slapo-syncprov and/or syncrepl. --Quanah --On Monday, December 01, 2008 1:56 PM +0000 Bad Guy <badguy9588(a)hotmail.com> wrote: > Would you mind telling me the ITS# related to this ? > > I can't find it in the changes of 2.4.12 and 2.4.13 about this one. > > Thanks > >> Date: Mon, 1 Dec 2008 00:30:24 -0800 >> From: quanah(a)zimbra.com >> To: badguy9588(a)hotmail.com; openldap-technical(a)openldap.org >> Subject: Re: Some servers are delay synced... >> >> --On Monday, December 01, 2008 7:39 AM +0000 Bad Guy >> <badguy9588(a)hotmail.com> wrote: >> >> > Dear sir, >> > >> > We have got a N-way master (N=4) openldap running in version 2.4.11 >> > under linux environment. >> > >> > Any idea on this ? >> >> Yes, read the changelog for the changes between 2.4.11 and 2.4.13. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Principal Software Engineer >> Zimbra, Inc >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration > > > > __________________________________________________ > 用部落格分享照片、影音、趣味小工具和最愛清單，盡捊> 秀出你自己 — Windows Live Spaces -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Authenticate a user
by Mansour Al Akeel 01 Dec '08

01 Dec '08

Hello all, I am trying to create a user and authenticate this user. I need to give an admin a way to access and modify account. I was able to succeffuly add a user, but can not connect using this account. The only way I am able to connect is using the Manager's DN. I keep on getting invalid credentials. I have reset the password for this user few times to make sure it's correct. Still unable to authenticate. I am using JXplorer to connect to that server. Here's the corresponding section from the log file. I hope it helps. Dec 1 13:52:11 neptune slapd[13518]: >>> slap_listener(ldap:///) Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: do_bind Dec 1 13:52:11 neptune slapd[13518]: >>> dnPrettyNormal: <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: <<< dnPrettyNormal: <uid=user,dc=test,dc=com>, <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: do_bind: version=3 dn="uid=user,dc=test,dc=com" method=128 Dec 1 13:52:11 neptune slapd[13518]: bdb_dn2entry("uid=user,dc=test,dc=com") Dec 1 13:52:11 neptune slapd[13518]: send_ldap_result: conn=13 op=0 p=3 Dec 1 13:52:11 neptune slapd[13518]: send_ldap_response: msgid=1 tag=97 err=49 Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: ber_get_next on fd 12 failed errno=0 (Success) Dec 1 13:52:11 neptune slapd[13518]: connection_closing: readying conn=13 sd=12 for close Dec 1 13:52:11 neptune slapd[13518]: connection_close: conn=13 sd=-1 I don't know what I am missing, but I have been trying to resolve this for few hours with no success.

1 1

how group work with samba & openldap ?
by franck dufau 01 Dec '08

01 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hye all, i have install samba as PDC with openldap authentification everything work fine. But i want to create différent group with différent privileges on folder How gestion of group work with Openldap authentification because users are not in /etc/passwd and domain group are not in /etc/group !? I don't find information about this... can you help me ? cordialement Franck Dufau -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkkz66UACgkQrKIazktK/hICSgCeOiQGmEHKk5qHGiC5sMTzyux7 uMgAn2LY3axBykW29YkGQy1k4+5vi0dE =hPaV -----END PGP SIGNATURE-----

2 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 01 Dec '08

01 Dec '08

---- Original message ---- >Date: Tue, 25 Nov 2008 15:52:57 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Monday, November 24, 2008 10:00 PM -0800 Quanah Gibson-Mount ><quanah(a)zimbra.com> wrote: > >> --On Monday, November 24, 2008 6:05 PM -0800 Quanah Gibson-Mount >> <quanah(a)zimbra.com> wrote: >> >>> --On Monday, November 24, 2008 9:00 PM -0500 William Jojo >>> <w.jojo(a)hvcc.edu> wrote: >>> >>>> >>>> >>>> ---- Original message ---- >>>>> Date: Thu, 20 Nov 2008 11:02:40 -0800 >>>>> From: Quanah Gibson-Mount <quanah(a)zimbra.com> >>>>> Subject: Re: Delta-sync symptom in 2.4.11 >>>>> To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org >>>>> >>>>> --On Thursday, November 20, 2008 10:38 AM -0500 William Jojo >>>>> <w.jojo(a)hvcc.edu> wrote: >>>>> >>>>> >>>>>> Otherwise this is just like test043, except or the missing dn's. :-) >>>>>> >>>>>> Any ideas? >>>>> >>>>> Try current RE24 CVS. There have been a number of replication related >>>>> fixes made since 2.4.11. >>>>> >>>> >>>> I just tried 2.4.13. The problem still persists. I will check out the >>>> CVS version in the morning. >>> >>> There's nothing different between RE24 and 2.4.13 at this point in time, >>> so there's no point in trying RE24 if you've tried 2.4.13 and it still >>> fails. >>> >>> I suggest you submit an ITS with a way to easily reproduce the issue. >> >> Also make sure to include your exact configuration on the master & >> replica, and any log messages at loglevel sync, so the contextCSN data is >> gathered. > >Also, does the replicator have unlimited time and size limits to search the >master with? > Quanah, Just got back from holiday to find that tests I launched before hand had completed successfully. I had realized that I had not set unlimited prior to my previous tests. Thank you very much for your persistence in following up. Although not a bug (thankfully), I did realize my ignorance of some configuration options. Cheers, Bill

1 0

Can join domain but cannot login
by Emil Sicad - ISD 01 Dec '08

01 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

1 0

{SSHA} for PHP
by Jack van Rock 01 Dec '08

01 Dec '08

Hi, I want to modify a website-login-system (PHP) to check passwords which are deocoded with SSHA. My script should compare the clear password, which I get from a FORM, with the SSHA-hash of the password, which is in the database (MySQL). The dates in the MySQL-DB comes from a LDAP. This is my script: <?php $password_sub = "test"; //Das Passwort erhalte ich über ein HTML-Formular $passsowrd_hash_db = base64_decode("e1NTSEF9aH...."); //Diesen base64-Hash erhalte ich aus der Datenbank. //Er wird gleich decodiert, da man daraus das $salt benötigt. //Dann hat er die Form {SSHA}hxtMi.... $salt = base64_decode(substr($passsowrd_hash_db , 32)); //Berechnung des $salt $hash = "{SSHA}" . base64_encode(pack("H*", sha1($password_sub.$salt)).$salt); ?> But the script doesn't work, because the generated hash isn't the same as the hash from the database. But I don't now, what's wrong? May someone help me? m@xx

2 1

Some servers are delay synced...
by Bad Guy 01 Dec '08

01 Dec '08

Dear sir, We have got a N-way master (N=4) openldap running in version 2.4.11 under linux environment. The 4 servers can be synced immediately. However, after running for several hours, 2 of the servers are synced immediately while the other 2 servers are synced after around 60 mins. Scenairo : - Server 1, 2, 3, 4 are synced. After running for several hours, the following symptoms occur : - update record in server 3, server 4 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 4, server 3 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 1, server 2 will be updated immediately, but server 3 and server 4 got the update 1 hour later. - update record in server 2, server 1 will be updated immediately, but server 3 and server 4 got the update 1 hour later. Server 1 and server 2 are in same LAN segment, server 3 and server 4 in another LAN segment. There are firewalls between server 1/2 and server 3/4, but for same LAN segment, no firewall in between, only firewall in between different LAN segment. Any idea for this 1 hour delay synced ? Every server are config with syncrepl as shown below : bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=ABCDE" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" # Performance tuning directives sizelimit 5000 threads 50 idletimeout 0 cachesize 10000 checkpoint 256 15 Also, from the LDAP log, it shows a lot of "cmp -1, too old" message. Also, from the log, some error message like the following is found : server01 slapd[6386]: do_syncrep2: rid=004 (-1) Can't contact LDAP server server01 slapd[6386]: do_syncrepl: rid=004 retrying server01 slapd[6386]: syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) server01 slapd[6386]: syncrepl_entry: rid=004 be_search (0) server01 slapd[6386]: syncrepl_entry: rid=004 cn=test1,ou=test,o=ABCD server01 slapd[6386]: syncrepl_entry: rid=004 be_modify (0) Any idea on this ? Thanks a lot.... _________________________________________________________________ 下載 Windows Live Messenger 8.5 搶鮮版，多元溝通、盡情分享，和即時傳訊好友線上同樂！— 立即下載 http://get.live.com/zh-cht-tw/betas/messenger_betas

2 1

SASL error
by Mansour Al Akeel 30 Nov '08

30 Nov '08

I am not able to modify a user from CLI. [root@neptune ~]# ldapsearch -D "cn=Manager,dc=test,dc=com" -W -b "dc=test,dc=com" -x -h localhost I get the all the enteries. However, When I do: [root@neptune ~]# ldapmodify -D "cn=Manager,dc=test,dc=com" -W -h localhost Enter LDAP Password: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database If I use -x option, it hangs there for ever after I enter the password. Any idea ?

2 2

hello
by Donny George 28 Nov '08

28 Nov '08

Hello I installed ldap client and software on two ubuntu machines. but when i try to log in with the phpldapadmin gui it displays Network Error (tcp_error) A communication error occurred: "Connection refused" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time. i am new to ldap and i cudnt really find a forum or thread which was talking about this problem. hope someone can help me -- Donny George

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical