- openldap-technical - openldap.org

Problem when using OpenLDAP query to AD server
by Duong Pham Tung 11 Feb '09

11 Feb '09

Hi all, I am testing a OpenLDAP act as LDAP proxy server using meta-backend. My back-end server contain AD servers and some OpenLDAP servers. When this OpenLDAP server connects to other OpenLDAP servers to query data, everything is okie, I get any data as I desire. But, when I use this server query to AD server, the return code is always Operation Error. I debug this process and I get a error which AD server return to my OpenLDAP server "errorMessage: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece" although I had configured a binddn and bindpw for my OpenLDAP server. But if I using ldapsearch, query directly to AD server and specify username and password, everything is okie :-(. Here is a piece of my sldapd.conf: database meta suffix "dc=abc,dc=com " uri "ldap://10.3.0.24/dc=abc,dc=com " binddn "cn=root,dc=abc,dc=com " bindpw 123 suffix "dc=xyz,dc=net" uri "ldap://10.3.0.26/dc=xyz,dc=net" binddn "cn=openldap,cn=Users,dc=xyz,dc=net" bindpw 123 map attribute uid sAMAccountName map attribute cn name map attribute mail userPrincipalName map objectClass account user map attribute * Note: 10.3.0.24 is a OpenLDAP server IP and 10.3.0.26 is AD server IP. I used openldap(a)xyz.net to query data from AD server directly and It is okie. But in this case, I got an error. Any idea for my problem? Thanks and best regards,

2 4

nss_ldap SSL/TLS problems..
by Arjun Singh 11 Feb '09

11 Feb '09

Hi, I'm trying to set up an ldap server on FreeBSD 7.1-RELEASE. I sent this to the freebsd-support list as well, but I don't think this is FreeBSD specific so I thought I'd ask here too. I installed all of the latest versions of openldap24-server, openldap24-client, nss_ldap, and pam_ldap. When I do any sort of ldapsearch or 'getent passwd' or anything, everything works perfectly. The only time I have trouble is when I'm logging in via SSH..then it gets really weird. 1.) When I log in as a user in LDAP only and give the incorrect password first and then supply the correct password, everything works fine. If the user is in wheel, I can sudo. 2.) When I log in as the same user and give only the correct password the first time, it hangs for roughly 45 seconds and then lets me in. Even though this user is in wheel, it says that the user is not in the sudoers file. Here are the log messages I get in auth.log that correspond to the events above: sshd[54031]: pam_ldap: error trying to bind as user "uid=user..(cut)..." (Invalid credentials) # This is the incorrect pw sshd[54029]: error: PAM: authentication error for user from localhost #Incorrect pw sshd[54032]: nss_ldap: could not search LDAP server - Server is unavailable # correct pw sshd[54029]: Accepted keyboard-interactive/pam for user from localhost port 32935 ssh2 #correct pw When I enter just the right password, the first time, I get this in the log: sshd[54047]: Accepted keyboard-interactive/pam for user from localhost port 51972 ssh2 sshd[54050]: nss_ldap: could not get LDAP result - Can't contact LDAP server Again, when SSL/TLS are disabled, I get normal log output and none of the weird stuff above.. I turned on debugging in nss_ldap.conf and found that each time I gave only the correct password (corresponding with the 45 second hang) I found this in the debug output: ...bunch of normal looking output... ldap_chkResponseList ld 0x801b31480 msgid 5 all 0 ldap_chkResponseList returns ld 0x801b31480 NULL ldap_int_select read1msg: ld 0x801b31480 msgid 5 all 0 ber_get_next TLS trace: SSL3 alert write:fatal:bad record mac <--- what is the cause of this? ldap_free_connection 1 0 ldap_free_connection: actually freed ldap_err2string ldap_result ld 0x801b31480 msgid 5 wait4msg ld 0x801b31480 msgid 5 (timeout 30000000 usec) wait4msg continue ld 0x801b31480 msgid 5 all 0 ** ld 0x801b31480 Connections: ** ld 0x801b31480 Outstanding Requests: Empty ld 0x801b31480 request count 0 (abandoned 0) ** ld 0x801b31480 Response Queue: Empty I get the above regardless of whether I'm using start_tls or ssl. If you have any insight, it'd be really useful. I've spent tons of time scouring lists for help and haven't found anything yet.. Thanks, -Arjun

1 0

User to administrate a OU
by Leandro Repolho 10 Feb '09

10 Feb '09

Hello, i don't know if is it possible to do it but i would like to create a User inside an OU of my OpenLDAP server and when this user connects to a ldap manager like phpLdapAdmin he needs to see all objects inside his OU and manage them. Is it possible to do it? Thank you very much, -- Leandro Cascino Repolho

2 1

help in ldap and webmin
by Sufyan Aqtam 10 Feb '09

10 Feb '09

Hi all I have a problem in openldap server. I configured an ldap server with bdb that contains about 25000 user. It works perfect to answer the authentication requests and modifying existing users. I am using the webmin "LDAP Users and Groups" module to create new users. When I fill the information for a new user and click on create button it takes a very long time to create the user. I check the log file of ldap server and I find that it starts access all users in the database. The messages in the log file as below and it is repeated for all users: conn=19 op=1 ENTRY dn="uid=testuser,ou=users,dc=example,dc=com" Feb 7 10:38:42 testserver slapd[25075]: <= send_search_entry: conn 19 exit. Feb 7 10:38:42 testserver slapd[25075]: entry_decode: "uid=testuser,ou=Users,dc=example,dc=com" Feb 7 10:38:42 testserver slapd[25075]: <= entry_decode(uid=testuser,ou=Users,dc=example,dc=com) Feb 7 10:38:42 testserver slapd[25075]: => bdb_dn2id("uid=testuser,ou=users,dc=example,dc=com") Feb 7 10:38:42 testserver slapd[25075]: <= bdb_dn2id: got id=0x24 Feb 7 10:38:42 testserver slapd[25075]: => test_filter Feb 7 10:38:42 testserver slapd[25075]: EQUALITY Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: search access to "uid=testuser,ou=Users,dc=example,dc=com" "objectClass" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: <= test_filter 6 Feb 7 10:38:42 testserver slapd[25075]: => send_search_entry: conn 19 dn="uid=testuser,ou=Users,dc=example,dc=com" Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "entry" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "uid" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "cn" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "objectClass" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "userPassword" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "shadowLastChange" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "shadowMax" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "shadowWarning" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "loginShell" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "uidNumber" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "gidNumber" requested Feb 7 10:38:42 testserver slapd[25075]: <= root access granted Feb 7 10:38:42 testserver slapd[25075]: => access_allowed: read access to "uid=testuser,ou=Users,dc=example,dc=com" "homeDirectory" requested Feb 7 10:38:43 testserver slapd[25075]: <= root access granted I hope to help me with many thanks to your efforts. Regards

2 4

Unable to logon to any server as a locally defined user if the OpenLDAP server is unavailable.
by Sean Leinart 10 Feb '09

10 Feb '09

Greetings OpenLDAP Technical Mailing List, I would generally consider myself at the newb status when it comes to LDAP in the Linux environment. I have acquired a network from a previous admin and my issue is that if the LDAP server is offline I can not authenticate locally on any of my servers, which is obviously a huge problem. The version of Open LDAP is: [user@server:/usr/sbin]slapd -VV @(#) $OpenLDAP: slapd 2.2.13 (Jul 11 2008 09:16:05) $ mockbuild@builder16.centos.org:/builddir/build/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd The Linux Version is: [user@server:/]uname -a Linux server.host.local 2.6.9-42.0.10.ELsmp #1 SMP Tue Feb 27 10:11:19 EST 2007 i686 i686 i386 GNU/Linux I have read several items regarding the fact that this can be a common issue when using LDAP authentication. I have read to check the settings in the nsswitch.conf file on the systems in question to verify that "Files" are being looked at first etc. and all of these settings appear to be correct. I am looking for guidance on what would be the best thing to do in this case, and why is it broken when the ldap server is not available. What happens is, if the LDAP server is not available, and you attempt to logon to a server locally, you enter the userid and password and you will have no activity for a minute or so then the prompt goes directly back to the login prompt. The userid and password that is being used is locally defined on the server. Also PAM LDAP is being utilized. Any help or ideas on what to look for would be greatly appreciated. Is there a way to just turn off the LDAP authentication on the servers. I feel that the answer to this is probably no. That would simply be too easy. Thanks in advance for any responses. sean sleinart(a)fscarolina.com No virus found in this outgoing message. Checked by AVG. Version: 7.5.552 / Virus Database: 270.10.19/1941 - Release Date: 2/9/2009 6:50 AM

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 10 Feb '09

10 Feb '09

Thanks all for your comments / answers / criticisms on this issue. It's been helpful and informative and is much appreciated. Andy.

1 0

N-way replication config file help
by Mike Simonton 09 Feb '09

09 Feb '09

Hello everyone, I'm trying to convert my two node replicated OpenLDAP pair to a three-way pair and am having trouble with configuring the slapd.conf files. Can anyone tell me what I need to add here? Below is my newly modified slapd.conf file with the system03 addition: ----- slapd.conf on system01 replicating to system02 and system03 ----- include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/promptu.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args serverID 001 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=mydomain,dc=local" rootdn "cn=Manager,dc=mydomain,dc=local" rootpw secret directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=0 provider=ldap://sys02 type=refreshAndPersist interval=00:00:00:30 retry="5 5 300 +" searchbase="dc=mydomain,dc=local" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=local" credentials="secret" updateref ldap://sys02 syncrepl rid=0 provider=ldap://sys03 type=refreshAndPersist interval=00:00:00:30 retry="5 5 300 +" searchbase="dc=mydomain,dc=local" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=local" credentials="secret" updateref ldap://sys03 mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 Thank you for your help! Mike

2 3

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/9 Quanah Gibson-Mount <quanah(a)zimbra.com>: > I'm not sure why you feel it is necessary to set the server read-only before > you run slapcat anyway. It was purely in relation to point 18.1.2 in this doc... http://www.openldap.org/doc/admin24/maintenance.html To quote... "Slapcat can be run while slapd is active. However, one runs the risk of an inconsistent database- not from the point of slapd, but from the point of the applications using LDAP. For example, if a provisioning application performed tasks that consisted of several LDAP operations, and the slapcat took place concurrently with those operations, then there might be inconsistencies in the LDAP database from the point of view of that provisioning application and applications that depended on it. One must, therefore, be convinced something like that won't happen. One way to do that would be to put the database in read-only mode while performing the slapcat."

2 1

Re: How to set BDB "read-only" before slapcat command ?
by William Jojo 09 Feb '09

09 Feb '09

---- Original message ---- >Date: Mon, 09 Feb 2009 08:08:32 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: How to set BDB "read-only" before slapcat command ? >To: Andrew Hall <whippyhubbles(a)googlemail.com>,Michael Ströder <michael(a)stroeder.com> >Cc: openldap-technical(a)openldap.org > >--On Monday, February 09, 2009 3:44 PM +0000 Andrew Hall ><whippyhubbles(a)googlemail.com> wrote: > > >> The possible problem I see with that setup is what happens if the >> slapcat occurs during an update from the provider to the consumer ? > > >I'm not sure why you feel it is necessary to set the server read-only >before you run slapcat anyway. Do you actually have a process that knows >exactly what changes occurred in any given second, so that, if say, your >backup starts at 1:00:00, you can then replay all the changes from that >point in time? > >If you do, then it doesn't matter whether or not it was in read-only. >Simply replay the changes. If you don't, then it doesn't matter whether or >not it was in read-only, because you don't know what changes happened after >that point. > >I honestly am not aware of anyone who bothers to put their DB into >read-only before slapcatting, although they may be out there. > Admittedly we stop one slapd in our group of servers (usually a master) to take a point in time snapshot with slapcat, then simply restart it. It is used solely as part of our disaster recovery. In the event of BDB corruption that is unrecoverable, we can build a new server from the full-text export. Just basic DBA paranoia policy. :-) :-) Cheers, Bill

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/9 Michael Ströder <michael(a)stroeder.com>: > No matter what you do at the LDAP server's side it could happen in > between a series of related write operations leading to inconsistent > state of data (from the application's point of view). > > If you want better hints then you have to provide more details about > your deployment. > > Ciao, Michael. We have a primary "hidden" master and two replicating secondaries which both get queried in a round-robin DNS fashion. Applications such as phpLDAPadmin are configured to connect to these secondaries which pass writes to the primary via an updateref chain overlay. At the moment I am using slapcat on the primary for backups but am open to other suggestions. Perhaps I should just create a third read-only replicating secondary which no applications connect to and backup from that ? The possible problem I see with that setup is what happens if the slapcat occurs during an update from the provider to the consumer ?

2 1

LDAP - Password and userId length
by yukti kaura 09 Feb '09

09 Feb '09

Hi, I required to perform length validation on the credential used to log in to LDAP. Could you please help me with the *length *of userId & password used to log in to LDAP Thanks for all your help Yukti

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

Dieter KlÃnter writes... > man slapd.conf(5), readonly on Thanks for the info. So I would need to edit the .conf file and restart the service for this to take effect ? Is there no "on the fly" solution similar to "FLUSH TABLES WITH READ LOCK;" for example ? Thanks.

2 2

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/8 Michael Ströder <michael(a)stroeder.com>: > Note that this is only needed if you have to ensure the integrity of > inter-related LDAP entries. So this depends on your deployment, > especially the writing LDAP client applications. > > But thinking more thoroughly about this it could be also a problem if a > client application trys to modify several entries and you're switching > to read-only mode in between as preparation for a backup. Even if the > application would theoretically be capable of rolling back all the > changes it wouldn't help since the LDAP server is read-only then. > > So the solution would be rather to really make sure that no > admin/provisioning application is running anymore. > > I think the admin guide could clarify this. I can't really close client applications unless I gracefully terminate all connections on the LDAP server perhaps ? I guess that could be one option.

1 0

How to set BDB "read-only" before slapcat command ?
by Andrew Hall 08 Feb '09

08 Feb '09

Hi there. According to this doc... http://www.openldap.org/doc/admin24/maintenance.html#Directory Backups Prior to slapcat being used for a backup the DB should be set to read-only. How exactly is this done ? I am using a BDB backend and all I can find is in this doc... http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/… Which also doesn't describe how. Is there an OpenLDAP or BDB command / tool which I can use to do this ? Thanks very much.

2 1

ldap_search_s hangs with ms active directory
by Sankhadip Sengupta 08 Feb '09

08 Feb '09

Hi, I have written a C ldap client to interact with a MS Active Directory in Win Server 2003. When I search for the base DNs from scope LDAP_SCOPE_BASE I get all the results perfectly.But when I try to search for an existing user anonymously( I set all the permissions in the ACLS ) it hangs indefinitely. Now, surprisingly when I search with the ldapsearch tool it works fine. I use this : attrs[0]=LDAP_ALL_USER_ATTRIBUTES; attrs[1]=NULL; attrsonly=0; ldap_search_s(ld,"dc=test,dc=com",LDAP_SCOPE_SUBTREE,"uid=test",NULL,0,&msg) After a long period when it returns, I get return code 0 (Success) but there is no entry in that. Can anyone help me? This works fine with slapd server 2.4.12.I am totally confused. Thanks, Sankhadip

4 5

Access to a sync provider via back-meta
by ali.pouya＠free.fr 07 Feb '09

07 Feb '09

Hi, I need to connect my replica to a sync provider via an intermediate slapd configured with back-meta. My goal is to use the rewrite/map functions of back-meta. But I find that slapd crashes each time the replica is started. May be back-meta does not support LDAP controls ? or LDAP partial responses ? Does any one have an experience with this ? I precise that I cannot use the RWM overlay for many reasons : -The RWM overlay has to be installed in the remote sync provider server that is managed by another team. -the overlay is incompatible with the other uses of that server. -The overlay is still experimental but back-meta is not. -And finally, when I configure the overlay on my test server (by simply adding the line "overlay rwm" in the config) slapd crashes each time I make an LDAP search ! (I'm using OpenLdap 2.4.13). I do not send an issue (ITS) for theses crashes because I think that I'm not using a standard feature of slapd. Can any one help me ? Thanks & best regards Ali

2 3

objectClass: ...
by Brian Krusic 06 Feb '09

06 Feb '09

Hi all, I'm back to ask for proper population of ldap dirs so I start with good habits. I've done all three on test servers and haven't noticed any functional issues. What is the best way to define my top level nodes; objectClass: dcObject objectClass: organizationalUnit or objectClass: top objectClass: dcObject objectClass: organization or objectClass: domain Humbly your, - Brian

3 3

Moving Old Certs to New Servers
by James Angell 05 Feb '09

05 Feb '09

Hi Guys, We have just built new replacement LDAP servers and are about to make to switch from the old ones. All of the certs we use are currently authenticated against the old servers. Does anyone know if it is possible to use these certs to authenticate against the new servers or are we going to have to create all new certs for all servers and workstations? Thanks in advance. - Jim -- Regards Jim Angell Cade Network Operations College Of Engineering Phone: 581-7551

1 0

RE: Forgotten password recovery
by Brett Maxfield 05 Feb '09

05 Feb '09

Maybe generate a random challenge, store it in ldap as an additional hashed password value maybe with a special {challenge} hash type as a marker, assuming ldap will try *all* passwords when logging in. openldap would need to know the marker {challenge} hash type is like {plain} or some other hash type for purposes of comparison. You cannot allow reset of a password (destroying the old one) immediately, as otherwise you are allowing a denial of service attack where people could randomly reset passwords. But given the random challenge (returned by the user) could now be used for authentication, the user could authenticate as themselves and reset thier own password, and remove the temporary challenge password. This probably requires a marker "hash" type to identify temporary hash password, to allow reliable removal of old or expired challenge passwords. -----Original Message----- From: Vincent Panel <yohonet(a)gmail.com> Sent: Thursday, 5 February 2009 1:59 AM To: openldap-technical(a)openldap.org Subject: Forgotten password recovery On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

3 2

[openldap] Newbie question: can the server (slapd) show incoming search queries?
by sol myr 05 Feb '09

05 Feb '09

Hi, I'm new to ldap, and would appreciate help on the following: I'm running the stand-alone server (slapd), and allow some client machines run search queries against it (ldapsearch). My question: I'd like the "slapd" server to show the incoming search queries. Can it be done? For example: - If the client runs "ldapsearch -h myhost -b "dc=example,dc=com" -s sub "objectclass=*" - I'd like the server console(or log file) to show something like: Incoming query: -b "dc=example,dc=com" -s sub "objectclass=*" I'd tries running "slapd" in debug mode (slupd -d 1), but couldn't quite deduce the query from it (it logs lot of detailed lines, but I couldn't gather the qeury from them. Probably my fault for being a newbie). Thanks :)

3 2

slave dbd files and timestamps
by Ken McLauchlin 05 Feb '09

05 Feb '09

Hi there, We're running openldap 4.1.25 on 4 servers. 2 servers on a site running in master/slave configuration and 2 more on a remote site running as slaves receiving updates from the slurpd running on the master. The question I have isn't really anything to do with the configuration but with what files should be updated on the remote slave servers on update? The slave running at the same site as the master has all the files (dc.bdb, db2id.bdb, id2entry.bdb and objectClass.bdb) all updated with the same timestamp. However on the remote slaves the objectClass.bdb is NOT updated at the same time as the others. Is this a problem? As an aside, we are getting a log.00000xxxx file created every couple of days on the remote slave servers which isn't happening on the primary site slave server. Is this a configuration issue? Hope you can help. Cheers, Ken

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

1 0

Re: Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Thanks, but as discussed, even creating a user able to reset all the userPassword attributes of all other users is not security risk free. This is what I call a privileged user and I would like to avoid it. Drupal already supports such a solution, but I don't find it secure enough. I had an interesting suggestion on the list : to create a database of temporary security objects where drupal is the only one who knows the passwords. Each temporary security object is able to reset one password in the main database (by the use of regex ACLs) and only once. On 2/4/09, Brett Maxfield <brett.maxfield(a)gmail.com> wrote: > If we are talking about openldap, not drupal, there are probably many ways > of doing so.. My thoughts.. > > You cannot bind as the user in this case, as presumably the reason they want > to reset password is that they dont know it. > > You should probably give the website it's own standard read-only user, which > has been (only) allowed to update userPassword. > > Giving the website manager/root access just to change a password would be > extremely unwise and inasvisable. > > Drupal should let you specify any ldap user for password resers.. > > -----Original Message----- > From: Vincent Panel <yohonet(a)gmail.com> > Sent: Wednesday, 4 February 2009 2:16 AM > To: openldap-technical(a)openldap.org > Subject: Forgotten password recovery > > Hello, > > Many websites now provide a feature which allow users to reset their > password on their own, without being helped by an administrator or > another privileged person. > > A website I'm working on is using drupal which is able to handle such > a situation by sending a mail to the user. The body of this mail > contains a specific url crafted by drupal so that when the user clicks > on the link, drupal can automatically authenticate the user. This URL > is only valid once. > > If you try to integrate drupal with openldap, you'll find that > openldap does not support such an authentication scheme. So you are > either forced to create a privileged user in LDAP which is able to > reset all users' passwords or live with it and give up this feature. > > So I'm writing to this list to know if anyone already had a similar > issue and which solution was found ? Would it be possible for openldap > or an openldap overlay to implement such an authentication mechanism ? > Is there any IETF draft about it (one can dream) ? > > Vincent > >

2 1

user home directory perms
by Geoffrey 04 Feb '09

04 Feb '09

We are using a combination of ldap and samba, therefore are adding users via the smbldap-useradd script. How do we set the permissions for the home directory when the user logs in for the first time. The directories are being created, but not with the permissions we want. Thanks. -- Until later, Geoffrey Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Hello, Many websites now provide a feature which allow users to reset their password on their own, without being helped by an administrator or another privileged person. A website I'm working on is using drupal which is able to handle such a situation by sending a mail to the user. The body of this mail contains a specific url crafted by drupal so that when the user clicks on the link, drupal can automatically authenticate the user. This URL is only valid once. If you try to integrate drupal with openldap, you'll find that openldap does not support such an authentication scheme. So you are either forced to create a privileged user in LDAP which is able to reset all users' passwords or live with it and give up this feature. So I'm writing to this list to know if anyone already had a similar issue and which solution was found ? Would it be possible for openldap or an openldap overlay to implement such an authentication mechanism ? Is there any IETF draft about it (one can dream) ? Vincent

3 4

best practices - dn:
by Brian Krusic 04 Feb '09

04 Feb '09

Hi all, I've read and config'd my ldifs as follows; option 1; dn: uid=fbar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= option 2; dn: cn=Foo Bar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= My OpenLDAP server is used for company white pages and authentication for Linux, OSX clients. What do you think the most reliable dn value should be; with uid or with cn? - Brian

2 2

multiple groups not showing up in "groups" cmd
by Justin Lintz 03 Feb '09

03 Feb '09

Hi, I've configured a user to be a member of another posixGroup as so... dn: cn=dev2,ou=groups,dc=test,dc=net cn: dev2 gidNumber: 1003 objectClass: posixGroup objectClass: top memberUid: dave The users info: dn: cn=David FooBar,ou=people,dc=test,dc=net givenName: David sn: FooBar cn: David FooBar uid: dave userPassword:: uidNumber: 1009 gidNumber: 1004 homeDirectory: /home/dave loginShell: /bin/bash objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top If I log into a server with the users account, it shows him properly a member of gid 1004, but does not list his seconday group of dev2. My /etc/ldap.conf file is base dc=test,dc=net binddn cn=Manager,dc=test,dc=net bindpw timelimit 15 bind_timelimit 15 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman pam_filter objectclass=posixaccount pam_member_attribute memberuid nss_base_passwd ou=People,dc=test,dc=net?one nss_base_shadow ou=People,dc=test,dc=net?one nss_base_group ou=Groups,dc=test,dc=net?one uri ldaps://prodldap01/ ldaps://prodldap02/ ssl on tls_cacertdir /etc/openldap/cacerts tls_checkpeer no pam_password md5 I also tried changing the value of memberUid to the DN of the user, but that did not work as well. Any suggestions are appreciated. Thanks - Justin Lintz

2 2

Active Directory & Open LDAP Synchronization
by Paul bob 03 Feb '09

03 Feb '09

Hi - I have installed Active directory authentication for windows servers and users and LDAP for Linux servers, now I am planning to use single sign on system windows and Linux. How can I sync with these two directory? I would appreciate your advice! Thanks, PB

3 2

supportedSASLMechanisms not Work in Debian Lenny
by Jarbas Peixoto Júnior 03 Feb '09

03 Feb '09

I have two servers: * Server A: Debian Etch - Works Fine * Server B: Debian Lenny - Do not Works supportedSASLMechanisms EXTERNAL In Server A I have: # ldapsearch -v -H ldap://server-Etch -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Etch ) SASL/EXTERNAL authentication started SASL username: emailAddress=jarbas.peixoto(a)previdencia.gov.br,CN=jarbas.peixoto,OU=DATAPREV,O=Previdencia Social,L=Campo Grande,ST=Mato Grosso do Sul,C=BR SASL SSF: 0 filter: (objectclass=*) requesting: supportedSASLMechanisms dn: supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: NTLM supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: EXTERNAL In Server B I have: # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Lenny:389/??base ) ldap_start_tls: Connect error (-11 # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ -d 1 ldap_url_parse_ext(ldap://server-Lenny) ldap_create ldap_url_parse_ext(ldap://server-Lenny:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP server-Lenny:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.82.0.234:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x9d73280 msgid 1 wait4msg ld 0x9d73280 msgid 1 (infinite timeout) wait4msg continue ld 0x9d73280 msgid 1 all 1 ** ld 0x9d73280 Connections: * host: www-mmldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 29 18:17:22 2009 ** ld 0x9d73280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x9d73280 request count 1 (abandoned 0) ** ld 0x9d73280 Response Queue: Empty ld 0x9d73280 response count 0 ldap_chkResponseList ld 0x9d73280 msgid 1 all 1 ldap_chkResponseList returns ld 0x9d73280 NULL ldap_int_select read1msg: ld 0x9d73280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x9d73280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x9d73280 0 new referrals read1msg: mark request completed, ld 0x9d73280 msgid 1 request done: ld 0x9d73280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_start_tls: Connect error (-11) In the /var/log/syslog I have: Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 ACCEPT from IP=10.82.0.234:50441 (IP=0.0.0.0:389) Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 STARTTLS Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 RESULT oid= err=0 text= Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 closed (TLS negotiation failure) This is very important for use openldap with user certificates. Anybody have a help for me? Tanks!

3 3

RE: ldap_bind fails in vpn tunnel
by Christopher Barry 30 Jan '09

30 Jan '09

> -----Original Message----- > From: Shankhadeep Sen [mailto:shanks.iit@gmail.com] > Sent: Friday, January 30, 2009 1:25 PM > To: Christopher Barry > Subject: Re: ldap_bind fails in vpn tunnel > > Hi Christopher, > > Thanks for your email.It seems that > without TLS , the search works first but next when I initiate > a TLS session, the ldap api says "SERVER DOWN".I must mention > that the bandwidth is very low in that VPN tunnel and there > is only one route. > > Now I used tcpdump to check the packets on port 389 , it > seems that there are a lot of packets being exchanged.My > guess is that because of the low b/w even if one packet gets > dropped because of router overflow, the SSL handshake will be > terminated. > > What do you think? > > Thanks, > > Sankhadip > > > On Fri, Jan 30, 2009 at 9:05 AM, Christopher Barry > <christopher.barry(a)qlogic.com> wrote: > > > > -----Original Message----- > > From: > > openldap-technical-bounces+christopher.barry=qlogic.com@openld > > ap.org > > [mailto:openldap-technical-bounces+christopher.barry > <mailto:openldap-technical-bounces%2Bchristopher.barry> =qlogic.co > > m(a)openldap.org] On Behalf Of Sankhadip Sengupta > > Sent: Friday, January 30, 2009 9:34 AM > > To: openldap-technical(a)openldap.org > > Subject: ldap_bind fails in vpn tunnel > > > > Hi, > > > > In a VPN tunnel, using TLS, ldap_search works but the > > ldap_bind fails with error :Can't contact LDAP server(-1). > > > > Can any one help me? I am using the openldap sdk. > > > > Thanks, > > > > Sankhadip > > > > > You might try putting the LDAP server's name and IP > address in the hosts file of the client. > > -C > > > > > Is this link helpful to you? http://www.openldap.org/lists/openldap-software/200201/msg00625.html

2 1

ldap_bind fails in vpn tunnel
by Sankhadip Sengupta 30 Jan '09

30 Jan '09

Hi, In a VPN tunnel, using TLS, ldap_search works but the ldap_bind fails with error :Can't contact LDAP server(-1). Can any one help me? I am using the openldap sdk. Thanks, Sankhadip

1 0

Sudo Access
by Paul bob 29 Jan '09

29 Jan '09

Hi! I need to give some of ldap users to sudo access. I am not sure how to configure SUDO access in LDAP. Your valuable suggestion appreciated! Thanks in Advance! -

3 2

LDAP password information update failed: Insufficient access
by Paul bob 28 Jan '09

28 Jan '09

I am experiencing a problem trying to configure a ldap server for users authentication. Basically, I am at a point where users can login properly, but they can not change their password. Some info for troubleshooting: slapd.conf access info access to attr=userPassword access to * by self write by users read by anonymous auth I would appreciate your help! Thanks, bob

2 1

Hello
by Donny George 27 Jan '09

27 Jan '09

Hello I have been trying to set up an Ldap server with openssl certificates. the certificates were generated and the ldap were given access to them but once slapd restart was put it, we received an error *main*: *TLS init def ctx failed*: -207 does some one have a clue as to why this comes up ? -- Donny George

1 0

Syslog and symas openldap
by ian.g.fox＠bt.com 26 Jan '09

26 Jan '09

Hi, I am using Symas' OpenLDAP s/w on a solaris 10 box. The package I have installed is symas-openldap-silver-2.4.12.0.sun4u.pkg. # pkginfo -l symas-openldap-silver PKGINST: symas-openldap-silver NAME: Symas OpenLDAP Silver CATEGORY: application ARCH: sun4u VERSION: Dev Release 10/17/2008 BASEDIR: / PSTAMP: gamba20081017182137 INSTDATE: Dec 09 2008 16:36 STATUS: completely installed FILES: 279 installed pathnames 24 directories 72 executables 60155 blocks used (approx) I want to get syslogging from slapd out to a file. I have configured /etc/syslog.conf with the following lines: # LDAP logging local4.debug /var/log/slapd.log The file /var/log/slapd.log exists: # ls -l /var/log/slapd.log -rw-r--r-- 1 root root 0 Dec 10 09:25 /var/log/slapd.log and I have restarted syslog: # svcadm restart svc:/system/system-log In /opt/symas/etc/openldap/slapd.conf I have included a line: loglevel -1 and restarted my slapd server using: /opt/symas/etc/solserver restart Having done all this I am still not getting anything written out to /var/log/slapd.log. Does anyone know what I need to do to get this working please? My regards Ian G Fox

1 0

Re: web apps and client certificate authentication
by Kurt Zeilenga 25 Jan '09

25 Jan '09

On Jan 11, 2009, at 10:07 AM, Emmanuel Dreyfus wrote: > Hello > > I am not sure this is the right place for that question, but I cannot > figure a better one. Please point me to the right place if there is a > better one than here. [[from openldap-software]] > > > I know how to use x509 certificate to authenticate a client against > OpenLDAP. It works great with ldap{search|add|modify|delete| > whatever}.` > > Now I would like to do the same with the client being a web browser > and > with a web application between the browser and slapd: > > browser (client cert) --> apache (PHP web application) --> slapd > > Client certificate authentication from the browser to apache is > strightforward. Yes, so why complicate it? > > > Therefore I can easily have the client authenticating to the web > application, and the web application operating on the directory on > behalf on the client (the web app should bind to the directory as a > privilegied user that would have authzTo: *) The web application should just authenticate as itself and then use proxy authorization to act on behalf of the client. Of course, it has to be authorized to do so. > > > But it would be nicer to actually have the client authenticate to > slapd > using its own client certificate. Why? Generally, the web application is part of the service which encompasses the web server and directory service. They should already have an appropriate trust relationship. > That is, having the web application > behaving as a kind of proxy, without any special privilege on the > directory. Is that possible? If it is, where should I start? Would require cooperation between the web server and the directory server. So nothing gained, IMO, except complexity. > > > -- > Emmanuel Dreyfus > http://hcpnet.free.fr/pubz > manu(a)netbsd.org

4 12

OpenLDAP locks
by Gaëtan Slongo 24 Jan '09

24 Jan '09

Hello all, I saw on a book that OpenLDAP locks parent entries when an entry is updating... It's true ? Example : If I'm updating "uid=username,ou=Users,dc=mydomain", "ou=Users,dc=mydomain" and all children will be locked (write lock?) while the update is performing ?? Thanks. -- Slongo Gaëtan Tel: +32 (0)65/84.23.85 (+6005) GPG/PGP : http://www.gslongo.eu/gslongo_it-optics.pub.asc -- OpenPGP E-Mail Security : http://enigmail.mozdev.org/home/index.php

2 1

LDAP data for JUnit
by yukti kaura 24 Jan '09

24 Jan '09

Hi All, I am using LDAP as a back end for my application. Howeve my JUnit have become LDAPServer dependant. i.e. they read the data from a particular server which I specify as the ldapUrl Do we have a mechanism that for the testing purpose alone I can introduce a static LDIF file ported alongwith the code. The JUnit will then read from LDIF in a manner that they read from LDAP Server. Is there such a method?? Please guide... Thanks for all your help!!!! Yukti Kaura

1 0

openldap C sdk help
by Sankhadip Sengupta 24 Jan '09

24 Jan '09

Hi , I am a developer and I have set up openldap2.4.12 and wrote an ldap client in C using the ldap C sdk. Over lan everything looks fine but when I try to connect and do the same thing over an external IP it fails saying ldap_bind_s :Can;t contact ldap server(-1). The server runnign with d127 shows " error:broken pipe connection reset by peer " Could you please help me? Thanks Sankhadip

1 0

Self-signed server cert within our corp = failure
by Jeff Blaine 23 Jan '09

23 Jan '09

OpenLDAP 2.4.11 client How do I subvert this bogusness? The cert is legit. % /usr/rcf/bin/ldapsearch -d 1 -v -ZZ -h ldap.our.com -p 4890 -D uid=jblaine -W mail=jblaine(a)our.com emailmailbox ... res_errno: 0, res_error: <Start TLS request accepted.Server willing to negotiate SSL.>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 2, err: 19, subject: /O=our.com/OU=Certificate Authority/CN=SuperDuper Corporation Root CA-1, issuer: /O=our.com/OU=Certificate Authority/CN=SuperDuper Corporation Root CA-1 TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed. ldap_err2string ldap_start_tls: Connect error (-11)

4 5

Equality matching on facsimileTelephoneNumber
by Sean Burford 23 Jan '09

23 Jan '09

Hi, ITS 2571 is suspended (since 2003) pending IETF action: http://www.openldap.org/its/index.cgi/Contrib?id=2571 Has the IETF decided how facsimile telephone number matching should work, if at all? Our users would like to replace fax numbers, and there doesn't seem to be an appropriate matching rule. -- Thanks, Sean Burford

1 0

ldap_simple_bind_s fails intermittently, when run in an loop
by bharath.venkata＠wipro.com 22 Jan '09

22 Jan '09

Hi all, I am trying to use openldap api's to connect to ldap from my code. I tried to connect to ldap server 1,00,000 times(just intiliazing , binding and unbinding) Intilaly Binding to the ldap server works fine, but after some time say after reaching more than 10,000 binds. bind continously fails with below error . "Can't connect to the LDAP server - Cannot assign requested address". and error number is 91 below is my code snapshot. int main() { int ret,version,i; i=0; LDAP *ld=0; while(100000) { const char *s=0; cout<<"count is "<<i++<<endl; ld=ldap_init(HOSTNAME,PORTNUMBER); // HOSTNAME and PORTNUMBER are defined if(ld == NULL) { cout<<" error in initiliaze "<<endl; return 2; } ret=ldap_simple_bind_s(ld,"",""); ldap_perror(ld,s); if(ret != LDAP_SUCCESS) { cout<<" error in bin "<<ret<<endl; cout<<ldap_err2string(ret)<<" is the error"<<endl; } else { cout<<"bind success "<<endl; } ldap_unbind(ld); ld=NULL; } return 0; } i am clue less why this happened. Is there any restriction or bug (already present) that only certain number of binds are possible in a given time. Your help will be highly help full in my further proceedings. Regards, Bharath. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

openldap syncrepl
by Brad C 21 Jan '09

21 Jan '09

Hi There, Im having trouble with openldap synrepl. Ive turned on debugging. http://pastebin.com/d2da66c02 OpenLDAP versions itshare:~ # rpm -qa | grep -i openldap openldap2-client-2.4.12-5.3 openldap2-devel-2.4.12-5.3 openldap2-2.4.12-5.4 OpenSUSE 11.1 Linux itshare 2.6.27.7-9-pae #1 SMP 2008-12-04 18:10:04 +0100 i686 i686 i386 GNU/Linux Any advice would be most welcome. This is a vanilla system, is it because it has not created the ldap database locally?Jan 21 16:39:05 itshare slapd[3321]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Kind Regards Brad

1 0

How can I configure overlays during runtime of slapd?
by Andreas Micheler 20 Jan '09

20 Jan '09

Hallo all, I am new to OpenLDAP, and I am trying to configure slapd during runtime to add/remove one or more Overlays. I have already converted slapd.conf to a config directory slapd.d before. The command I use to add the overlay is: slapadd -F slapd.d -n 0 -l myovondelta The ldif file myovondelta is: dn: olcOverlay=constraint,olcDatabase=bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcConstraintConfig olcOverlay: constraint olcConstraintAttribute: mail regex ^[:alnum:]+@mydomain.com$ olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?su$ But the output I get is: <= str2entry: str2ad(changetype): attribute type undefined slapadd: could not parse entry (line=1) Can anyone please point me in the right direction? Where is my mistake? Thanks, Andreas

2 1

trailing characters in olcserverids after conversion
by Oliver Liebel 19 Jan '09

19 Jan '09

using openldap 2.4.13 (compiled from openldap.org source-package) i have noticed the following, reproducable behaviour when converting a slapd.conf to slapd.d: if slapd.conf contains serverids with ldap-urls, e.g. in this format: ServerID 1 "ldap://ldapmaster.local.site:9000" ServerID 2 "ldap://ldapslave.local.site:9000" the olcserverids always contains some trailing (garbage) characters after the conversion, and are base64 encoded. when i set them manually in cn=config with ldapmodify, they are displayed "clean". the serverid-lines in slapd.conf are "clean" (they contain no whsp/tabs at the end of the line or similar, invisible chars). i have tested it without \"\ and without portnumber, tested conversion with slaptest and slapd, in virtual and real machines, result is always the same. any ideas? greetings, oliver

2 2

ppolicy in openldap
by Allgood, John 19 Jan '09

19 Jan '09

Hello All I am fairly new to openldap and have some questions about password policys. We are running ldap on RHEL5 and using openldap 2.3.27. The ppolicy overlay gives me a lot of what I need but RHEL5 does not seem to have it installed. How can I get this installed? Also the best that I can tell is that ppolicy does not have any dictionary checks either. Is this true or did I just miss something? What I would like to setup is what we currently have in place using cracklib. Minlen=8 at least 1 Uppercase, 1 Lowercase, 1 Number, 1 special char. Best Regars John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com www.ohl.com

3 2

Ldapsearch
by Juan Pablo Roig 18 Jan '09

18 Jan '09

Hi alln i am new to the list and i have 2 questions: 1- i ve just configured my openldap server in a freebsd to use tls an to require client certificates, my problem is that i cant test the connection with the ldapsearch command. Is this posible? 2- is there any gui ldap browser that supports client certificates? Thanks a lot Juan 2009/1/17, openldap-technical-request(a)openldap.org <openldap-technical-request(a)openldap.org>: > Welcome to the openldap-technical(a)openldap.org mailing list! This list > is intended to be used for technical discussions of issues related to > use of OpenLDAP Software. This list is lightly moderated. > > To submit a message to this list, send your email to > openldap-technical(a)openldap.org. > > General information about the mailing list is at: > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > If you ever want to unsubscribe or change your options (eg, switch to > or from digest mode, change your password, etc.), visit your > subscription page at: > > http://www.openldap.org/lists/mm/options/openldap-technical/juan.pablo.roig… > > > You can also make such adjustments via email by sending a message to: > openldap-technical-request(a)openldap.org > > with the word `help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. > > You must know your password to change your options (including changing > the password, itself) or to unsubscribe. It is: > ilap11 > > Normally, Mailman will remind you of your openldap.org mailing list > passwords once every month, although you can disable this if you > prefer. This reminder will also include instructions on how to > unsubscribe or change your account options. There is also a button on > your options page that will email your current password to you. > -- Enviado desde mi dispositivo móvil

2 1

openldap group filter and websphere
by hai wu 18 Jan '09

18 Jan '09

Hi, We have one openldap server, and for dev environment, groups are put under 'ou=devgroup,dc=example,dc=com', and for production environment, groups are put under 'ou=group,dc=example,dc=com'. When integrating websphere to openldap, we can only specify one search base, which is set to 'dc=example,dc=com', and for the group filter, it is set to '(&cn=%v)(objectclass=posixGroup))'. But in this case, it is pulling all groups from both dev and production environment. Is there a way to set the group filter so that for our dev environment, it would only pull dev groups, and for production environment, it would only pull production groups? I tried ldapsearch by applying the group filter, modified it a little bit, but still could not get it to work in our case. Thanks, Hai

1 0

Why TLS is always fail with OpenLdap 2.4.11
by Hunter hu 16 Jan '09

16 Jan '09

H <openldap-technical(a)openldap.org>i, I have to get help from here , because I was struggling with TLS configuration for weeks. during those days , I searched google include this list , still cant pass ,my god. Does anyone could provide some guide on how to configure the openldap TLS connection with step by step, so can reduce our pain ? Here I expose the step and try to get help from the senior ldap engineer. 1. installed openldap with-tls=openssl I add the openssl specially to avoid use gnutls, sometimes, openldap will goto find gnutls if c header is there install and start slapd succesfully. 2. using ldapsearch -v -h 10.192.183.73 -b "dc=example,dc=com" -s base "objectclass=*" I can get the listed information from openldap server, that is ok 3. now go for certificate genearation with numerous guide in google , but not fit to pass for me 3.1 cd /var/myca /usr/local/ssl/misc/CA.sh -newCA then will generate demoCA, and cacert.pem is there, that is ok 3.2 /usr/local/ssl/misc/CA.sh -newreq newkey.pem newreq.pem notes : I am using 10.192.183.73 as the common name, is there any issue here? 3.3 /usr/local/ssl/misc/CA.sh -sign then you got newcert.pem now copy into /var/ldap and try to insert into slapd and restart TLSCipherSuite MEDIUM:+TLSv1+SSL3+SSL2 TLSCertificateFile /var/ldap/newcert.pem TLSCertificateKeyFile /var/ldap/newkey.pem ( some guide said should be newreq.pem) TLSCACertificateFile /var/ldap/cacert.pem 4. ftp cacert.pem into client and copy into /var/myca using s-client to test at first penssl s_client -connect 10.192.183.73:389 -showcerts -state -CAfile /var/myca/cacert.pem -tls1 you will got the error always CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:failed in SSLv3 read server hello A 14719:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: could any kind man to give some help to save me? -- Hunter

2 1

Re: Syncrepl Questions
by Gavin Henry 15 Jan '09

15 Jan '09

> I am not understanding what happens to my clients if something happens > to my provider. In some replication systems when the main server fails > you can start using the machine that was replicated to as your > primary. This is called Active-Active Hot Standby and can be done with MirrorMode. > Does the consumer act as a slave machine? It can be, depends how you've set it up, which you have told us ;-) > On each of my > clients do I point them to the provider/consumer. It depends on what your clients are doing, if it's all readonly, then point them at both. Tell us more. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 4

Re: Syncrepl Questions
by Gavin Henry 15 Jan '09

15 Jan '09

----- "John Allgood" <jallgood(a)ohl.com> wrote: > Hello Again Hi, > Maybe by the end of this project I will be somewhat of an ldap expert > until them please bear with me. It will take many years to get there (I'm no where near), trust me ;-) > I think I have gotten a little more understanding to how this will > work. I have a provider and a consumer up and running and I am > pointing each application and or server to both the provider and the > consumer. Also there is something called referrals that are talked > about for the consumer. Is this something I will need to use. If you understand referrals you will be able to answer this yourself. Anyway, referrals "refer" a client to the Provider if it is trying to write a consumer that doesn't accept writes, think of it as "Go speak to the boss". > We started building the ldap server about a month ago. We have not > really had the time to do proper research due to time constraints. This can be a big problem. > We > just used the rpms that Redhat provided with RHEL5 which is openldap > 2.3. The rpms built from Redhat did not have the ppolicy overlay built > in. I found the overlays on the Beta channels from Redhat Network and > used those to get the ppolicy. I wish Redhat would stay a little more > up2date. Anyways if there is anymore advise that can be provided I > would appreciate it. Oh one more thing. When I was setting up syncprov > for the first time I missed the part about loading the module in the > slapd.conf. I did enter the overlay syncprov to my config and it > appears to work. Can syncprov be built into openldap and not loaded as > an module. Just wanted some verification on this issue. Build it how you like, it's best to build from source to start with to get a feel for everything. Then depending on how you company works you can move to a commercially supported version. I would never recommend the RHEL version, but please visit the list archives for why. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Re: Re: N-Way Multi-Master replication - delete problem
by Adrien Futschik 15 Jan '09

15 Jan '09

It seems like I am not the only one facing this problem. Is this officially reported as a bug ? I found out that when deleting an entry on the master I added it to, it is removed only on this master and deleting is not replicated until I make some other operation on the other master. Seems like the delete is "queued". When deleting an entry on the "other" master (not the one I added the entry to), the delete works fine and is correctly replicated. Anyone to help me with N-Way Multi-Master replication ? Adrien Futschik ======================================== Message date : Jan 07 2009, 06:35 PM From : "jakjr" <joao.alfredo(a)gmail.com> To : adrien.futschik(a)atosorigin.com Copy to : Subject : Re: N-Way Multi-Master replication - delete problem Hello Adrien, I have the same problem deleting entries on N-Way MultiMaster. Did you resolved this problem ? Best Regards. On Mon, Dec 22, 2008 at 6:10 AM, Adrien Futschik < adrien.futschik(a)atosorigin.com> wrote: > OK, But then what did I do wrong ? delete an entry shouldn't be a problem > with N-Way Multi-Master replication ? should it ? > > Here is how I have setup-ed my masters : > > m1 -config : > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW:< file://$CONFIGPWF > > m2 - config : > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW:< file://$CONFIGPWF > > m1 - syncprov : > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > m2 - syncrepl : > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=3 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > m1 - schema : > include: file://$ABS_SCHEMADIR/core.ldif > include: file://$ABS_SCHEMADIR/cosine.ldif > include: file://$ABS_SCHEMADIR/inetorgperson.ldif > include: file://$ABS_SCHEMADIR/openldap.ldif > include: file://$ABS_SCHEMADIR/nis.ldif > > m1 - backend : > dn: olcDatabase={1}$BACKEND,cn=config > objectClass: olcDatabaseConfig > objectClass: olc${BACKEND}Config > olcDatabase: {1}$BACKEND > olcSuffix: $BASEDN > olcDbDirectory: ./openldap-data > olcRootDN: $MANAGERDN > olcRootPW: $PASSWD > olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=$INTERVAL retry="5 5 300 5" timeout=3 > olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=$INTERVAL retry="5 5 300 5" timeout=3 > olcMirrorMode: TRUE > > dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > Did I miss something ? > Has anyone tested N-way Multi-master replication & encountered the same > problem as me ? > > Adrien > > ======================================== > Message date : Dec 19 2008, 07:11 PM > From : "Quanah Gibson-Mount" <quanah(a)zimbra.com> > To : adrien.futschik(a)atosorigin.com, openldap-technical(a)openldap.org > Copy to : "Miguel Jinez" <miguel.jinez(a)gmail.com> > Subject : Re: Re: N-Way Multi-Master replication - delete problem > > > > --On December 19, 2008 9:28:41 AM +0100 Adrien Futschik > <adrien.futschik(a)atosorigin.com> wrote: > > > Hy everyone, > > > > I have just tested the same procedure with OpenLDAP 2.4.13. The problem > > remains the same. > > > > Did I miss something ? Is this supposed to be like this ? > > > > I'm joining the modified script I'm using to setup both masters and the > > LDIF files I'm using to add and remove an entry (+ attributes). > > > > I did not use access-log, is this supposed to work with N-Way > > Multi-Master replication ? I thought it was only used in case of Delta > > Synchronization/Replication. > > Correct, delta-syncrepl and MMR are not currently supported together (that > may change in the future). > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > > > > Adrien Futschik >

2 1

ppolicy
by Allgood, John 15 Jan '09

15 Jan '09

Hey Guys I have another question in regards to using ppolicy. I have built my policy into ldap. How do I apply that policy to my existing user objects. Thanks John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com <mailto:jallgood@ohl.com> www.ohl.com <http://www.ohl.com>

3 2

Syncrepl Questions
by Allgood, John 14 Jan '09

14 Jan '09

Hey All I am working on setting up sync replication for ldap. I have it working but I am not sure exactly what I can do with it. How do I failover to it? I may be missing a piece that would help tie it all together. Thanks for any input. John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com <mailto:jallgood@ohl.com> www.ohl.com <http://www.ohl.com>

2 1

OpenLDAP centralized authentication with Active Directory
by Duong Pham Tung (FIM HN) 13 Jan '09

13 Jan '09

Hello, My company network have some different domains such as abc.net, abc.com and xyz.com (I don't use real domain name because of our company's security policy). Each domain is managed by a dedicated Active Directory server. Now, I want to use one OpenLDAP server to authenticate all users from these domains because we want manage services they use focusly (such as Mail, Portal). But now, I have'nt any solutions to solve this problem. Because the number of users is very large (approximately 10.000 users) so I can't build database by hand. Can anyone suggest me the solution to solve this problem. Thanks and Best regards, Duong Pham.

4 3

Re: AW: Question about the manager acccount for the openldap-database
by Quanah Gibson-Mount 09 Jan '09

09 Jan '09

--On Friday, January 09, 2009 8:43 AM +0100 Oliver Steffens <osteffens(a)gc-heat.de> wrote: > Thank you for your quick reply. We will check this solution. Please keep replies on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Need information
by Buddhadeb Bhakta 09 Jan '09

09 Jan '09

Hi All, I would like to use the below C functions which is inside ldap.h header file. ldap_init() ldap_simple_bind_s() ldap_search_s() ldap_unbind() Could anyone please let me know to use these functions, what package should I install? I am using HP-UX B.11.00 version of OS. Please advise. Thanks Buddhadeb

1 0

OpenLDAP as a 'generic' hierarchical data store
by Lorenzo Pastrana 09 Jan '09

09 Jan '09

Hello list, I was wondering lately if I could use OpenLDAP as a 'generic' hierarchical data store for the application I'm planning, and tried to get any hint about feasibility. I found a blog post about OpenDS (http://blogs.sun.com/treydrake/entry/ldap_vs_relational_database), where the author states about Read/write performance parity ... That was the kind of news I just wanted to hear because I'm thinking about a persistence back-end, not just an almost static dataset, but I'm in a genuine PHP environment and Java is not an option; so I naturally tried to get some infos regarding OpenLDAP performance but found nothing recent, and the references I could find are quite discouraging on that matter ... However since 4 to 8 years have passed since the tests I've been reading, I'm still in the hope of a 'a pleasant surprise' as the sun guy sayz ... Does someone has an experience to share about that kind of (mis-)usage of OpenLDAP ? Any pointers to some good and recent reference on the matter are of course well come. Thanks in advance for any information. LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

5 9

Question about the manager acccount for the openldap-database
by Oliver Steffens 08 Jan '09

08 Jan '09

Hi together, Unfortunately the current (md5-encrypted) password is lost... Is it possible to change the "rootpw" in the "slapd.conf" from an md5-one into a new plain-text one without any problems respectively additional efforts? Thank you for your help in advance! Best regards Oliver Steffens

2 1

LDAP Host access best practices
by Mathew Rowley 07 Jan '09

07 Jan '09

I am fairly new to LDAP in general, so please excuse any syntax errors. I have a radius proxy which will query an LDAP data store to determine if a user has access to a host. I want to reuse the concept of how users are defined: Ou=users -> defines all users Ou=groups -> defines all groups Ou=groups,cn=groupname -> links the users to the group With hosts. My problem is that I cannot find any specific formal definition on how this is done (in terms of what each subtree¹s objectClass should be). Has anyone done this, or can point me in the right direction? All the user/groups based stuff is based on posixGroup, which im pretty sure is unix/linux concept can this be used for what I am trying to do with hosts? Basic architecutre: Ou=hosts -> defines a host Ou=hostGroups -> defines a group name (organizationlUnit?) Ou=hostGroups,cn=hostGroupName -> this will link what hosts are in the group Thanks for any help. -- MAT

1 0

replication on 2.4.13
by jakjr 07 Jan '09

07 Jan '09

Hello, I'm testing a multimaster config on openldap 2.4.13. I have 2 servers. Adds and Modifies are ok on both. But, when I deleted 300 entries, with server B down and this server goes up again, those entries deleted from server A are no replicated. Server B still keeping those entries. This is a bug or a config error. This is my config: ServerID XXX syncrepl rid=001 provider=ldap://<IP> type=refreshAndPersist retry="5 5 10 +" searchbase="dc=br" bindmethod=simple binddn="cn=admin,dc=br" credentials=** schemachecking=off mirrormode on overlay syncprov syncprov-checkpoint 100 1 syncprov-reloadhint TRUE syncprov-sessionlog 100 Thanks

1 1

authenticate a user to LDAP server using GSS-SPNEGO and Kerberos
by Deepika Srivastava 07 Jan '09

07 Jan '09

Hi I have to authenticate a user to LDAP server using GSS-SPNEGO and Kerberos as base mechanism. I have successfully generated the TGT. Now I want to use ldap_sasl_bind_s() function with "GSS-SPNEGO" as mechanism. I am not sure of the parameters to pass. I read on http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/apis… in case of Kerberos,we can use the above mentioned ticket if we have the TGT.Just we need to pass 'cred' and 'dn' as NULL and the functional will automatically take care of the rest of the mechanism under covers. ldap_sasl_bind_s (g_hLDAP,"", "GSS-SPNEGO" ,NULL,NULL,NULL, &servercredp ) This is how I am calling the function but is throwing LDAP_PARAM_ERROR. I am not sure of the reason. Can anyone help me on the reason? Also i wanted to know that do we need to any configurations at the LDAP server end to do enable kerberos authentication. Also do i need to call krb5_mk_req() before calling ldap_sasl_bind_s() or can i directly call ldap_sasl_bind_s()? Can anyone help me on the flow of API for achieving complete authentication after achieving the kerberos ticket. . Any thoughts?

2 1

ldap.conf location help
by Sankhadip Sengupta 07 Jan '09

07 Jan '09

Hi, I am trying to make a client which will query users via an LDAP server.Now in the code I use TLS to encrypt the session. Using TLS , I face a problem that the client is unable to verify the server certificate. Connect error(-11) ssl error(1490086). When I use ldapsearch to do that it works fine.I have LDAP server on the same machine and running via loopback. I figured this problem is due to location of ldap.conf file as when I changed the entry of TLS_CACERT in the ldap.conf file (commented it out) the ldapsearch also failed which shows it is unable to locate the certificate. Is there any way to make sure that the client tools always find the correct ldap.conf file? Please help. Sankhadip

1 0

Question about ldap filter
by Jason Voorhees 06 Jan '09

06 Jan '09

Hi there: I'm trying to understand how ldap filters work. Based on this simple logic expression: EXPR_1 (or) EXPR_2 if EXPR1 returns TRUE, will slapd still try to evaluate EXPR2? or will slapd evaluate EXPR2 anyway even if EXPR_1 is true? I think that while the ldap filter is bigger then performance is worse, right? could somebody explain me a little about this logic of evaluation in ldap filters? Thanks

3 7

acl to allow access to specific parts of the tree only for a particular dn
by ben thielsen 06 Jan '09

06 Jan '09

i'd like to prevent the dn "cn=foo, ou=services, ou=accounts, dc=example, dc=com" from accessing any part of the tree outside of "ou=test, ou=other, ou=users, ou=accounts, dc=example, dc=com" and "ou=test, ou=other, ou=users, ou=groups, dc=example, dc=com", and would like that dn to have only read access to those two subtrees - the exception being that that user should of course be able/required to authenticate. i'm having trouble constructing a working acl that accomplishes this. one example attempt: dn: olcDatabase={2}bdb,cn=config changetype: modify replace: olcAccess olcAccess: to dn.base="" by * read olcAccess: to attrs=userPassword by self write by anonymous auth by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=groups,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to * by self write by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" none by users read by * none that particular example gets me: >ldapsearch -uxLLLWP 3 -H 'ldaps://ldap.ltn.lvc.com' -D 'cn=montage_test, ou=services, ou=accounts, dc=ltn, dc=lvc, dc=com' -b 'dc=ltn, dc=lvc, dc=com' "(objectclass=groupofnames)" dn | grep -i 'dn:' Enter LDAP Password: No such object (32) what am i missing? thanks -ben

1 0

problem with ldap_start_tls_s
by Sankhadip Sengupta 06 Jan '09

06 Jan '09

Hi everyone, I am trying to write an LDAP browser that uses both plain text and TLS.The plain text works fine but when I am using "ldap_start_tls_s" I get an error: ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Also just to note ldapsearch works fine. ldapsearch -vLxZZ -b "dc=example,dc=com" "(objectClass=*)" no problem with this. My code fragment is below: if ((ld = ldap_init(ldap_host, LDAP_PORT)) == NULL ) { perror( "ldap_init failed" ); exit( EXIT_FAILURE ); } /* set the LDAP version to be 3 */ if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version) != LDAP_OPT_SUCCESS) { ldap_perror(ld, "ldap_set_option"); exit(EXIT_FAILURE); } if(ldap_start_tls_s(ld,NULL,NULL)!=LDAP_SUCCESS) { ldap_perror(ld, "ldap_start_tls"); exit(EXIT_FAILURE); } Please help :( Thanks, Shawn

1 0

contextCSN
by jakjr 05 Jan '09

05 Jan '09

Hello, I'm testing a multi-master installation of openldap 2.4.11 (debian lenny). To check if the masters are consistent, I search for the contextCSN of each one, and check this value. If the values are the same, the masters are consistents, rigth ?? But now, after many, many changes (ADD/DELETE), I am searching for the contextCSN and the server is reporting three contextCSN's. Is this correct ?? EG: # ldapsearch -x -h <IP> objectClass=organization contextCSN -b dc=pr,dc=gov,dc=br -LLL -z 1 dn: dc=org contextCSN: 20081226121401.392297Z#000000#000#000000 contextCSN: 20081226173429.931124Z#000000#001#000000 contextCSN: 20081226173327.189304Z#000000#002#000000 Thanks. João Alfredo

2 2

Database is getting corrupted
by Jason Voorhees 05 Jan '09

05 Jan '09

Hi all: I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf: database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660 index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub I always do the following: 1. # rm /var/lib/ldap/* (to be sure i'm starting from scratch) 2. # slapadd -b dc=redtube,dc=com redtube.ldif After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct? Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following: 3. # chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already) 4. I check against posible errors and then start OpenLDAP: # slapd -Tt # service ldap start 5. OpenLDAP starts correctly, it works perfectly. I can even do modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok. My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs: Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)" Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me. Then I stop and start OpenLDAP and I start getting this: # /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ] Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks

3 6

Help with understandig behaviour of crashed OpenLDAP Server
by yukti kaura 04 Jan '09

04 Jan '09

Dear All, I would like to seek clarification with one aspect of LDAP server recovery When a crashed Server in replicated mode is restarted does it immediately start publishing its services or it publishes itself only after resynchronizing Please guide Thanks Yukti Kaura

2 1

LDAP - Samba
by Terry Haley 31 Dec '08

31 Dec '08

Ok, I'm trying to wrangle this under control with this setup I've inherited and have run across a few speed bumps. Here's the state of things as is. I've made a few changes to the setup thinking that I've fixed an issue or two and have in fact only confused myself and possibly my configuration. The downside is that I don't know a few key passwords that was used in the original setup. (yay no overlap with my predecessor). I have a samba server acting as my PDC with an LDAP server used for authentication. Question #1: the password contained within the LDAP directory for my 'admin' account should = the 'rootpw' entry in slapd.conf correct? Question #2: the 'ldap admin dn' entry in my smb.conf file should equal the 'rootdn' entry in my slapd.conf file, afterwhich, this should be updated to samba using smbpasswd -w correct? Question #3: the 'admin users' entry within the smb.conf are the users that allow access to the domain correct? Currently, what I'm working with here is that I don't know the 'admin, samba or the samba-admin' passwords. The samba-admin account is just an LDAP admin account but Not the root account. This should be fixed to the above question 2 yes? I would like to change all of these passwords but am fearful that I could make things worse. Also, regarding the components on my network (machines specifically), will there be an issue if I change the 'samba' account (domain account) password with their ability to connect to the domain? Thank you in advance for any help and advice! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

4 3

Constant corruptions
by Jason Voorhees 30 Dec '08

30 Dec '08

Hi there: I'm still having problems with my OpenLDAP 2.3.27 from CentOS 5. I know that index directive in slapd.conf causes the creation of .bdb files in /var/lib/ldap, right? If I have this in slapd.conf: index uid,smtpAuth eq,pres ... so in some moment uid.bdb and smtpAuth.bdb will be created in /var/lib/ldap, right? When I create my ldap tree using slapadd and an LDIF file then several .bdb files get created under /var/lib/ldap, but some other no because of there are no attributes of that type in LDIF file. But when OpenLDAP is already running thanks to a simple search like "(smtpAuth=TRUE)" then slapd tries to create smtpAuth.bdb but that's when it fails. I get this message: slapd[11954]: bdb(dc=redtube,dc=com): /var/lib/ldap/smtpAuth.bdb: Permission denied slapd[11954]: bdb_db_cache: db_open(smtpAuth) failed: Permission denied (13) Does anybody know why slapd isn't able to create new index files? Permissions and ownership are totally correct. Any help? :( P.D.: I'm running openldap in a centos paravirtualized with Xen. It could be this the problem?

1 0

Re: Re: TLS config causes Object class violation
by forumuser＠online.de 30 Dec '08

30 Dec '08

Thanks!!! That's it! Like you said, I changed my TLSconfiguration.ldif file to point to "dn: cn=config" and it worked. I've once already seen the olcTLS* in the olcGlobal, however, I am new to LDAP backend database configuration, only used slapd.conf before. Thank you very much for the solution! I wish you a happy new year Belem ----- Ursprüngliche Nachricht ----- Von: Pierangelo Masarati Gesendet: 28.12.08 21:35 Uhr An: forumuser(a)online.de Betreff: Re: TLS config causes Object class violation olcTLSCACertificateFile belongs to olcGlobal, while you're trying to add it to a database object. Add it to cn=config instead. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

TLS config causes Object class violation
by forumuser＠online.de 28 Dec '08

28 Dec '08

Recently I upgraded my Ubuntu Server 8.04 to 8.10 and had to reconfigure OpenLDAP (installed by apt-get) through slapd backend database (I used slapd.config before). I have reconfigured OpenLDAP by "sudo dpkg-reconfigure slapd" and confirmed all prior settings, however the old database was moved to /var/backup/ and a fresh one was generated (please see config tree at the end). The problem is, I get following error message..: ldap_modify: Object class violation (65) additional info: attribute 'olcTLSCACertificateFile' not allowed (even olcTLSCertificateFile, if I leave out olcTLSCACertificateFile... olcTLS* seems "not allowed") ..when I try to configure TLS by ldapmodify: ldapmodify -D cn=admin,cn=config -W -x by entering this: dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/servercert.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/serverkey.pem The config tree is as follows (I will change "mydomain" and ACL later): dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=org olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=mydomain,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq Here's my "sudo apt-cache show slapd" packet information: Package: slapd Priority: optional Section: net Installed-Size: 3872 Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Original-Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Architecture: i386 Source: openldap Version: 2.4.11-0ubuntu6 Replaces: apparmor-profiles (<< 2.1+1075-0ubuntu4), ldap-utils (<< 2.2.23-3), libldap2 Provides: ldap-server, libslapi-2.4-2 Depends: libc6 (>= 2.4), libdb4.2, libgcrypt11 (>= 1.4.0), libgnutls26 (>= 2.4.0-0), libldap-2.4-2 (= 2.4.11-0ubuntu6), libltdl7 (>= 2.2.4), libperl5.10 (>= 5.10.0), libsasl2-2, libslp1, libtasn1-3 (>= 0.3.4), libwrap0 (>= 7.6-4~), unixodbc (>= 2.2.11-1), zlib1g (>= 1:1.1.4), coreutils (>= 4.5.1-1), psmisc, perl (>> 5.8.0) | libmime-base64-perl, adduser Pre-Depends: debconf (>= 0.5) | debconf-2.0 Recommends: libsasl2-modules, apparmor (>= 2.1+1075-0ubuntu6) Suggests: ldap-utils Conflicts: apparmor-profiles (<< 2.1+1075-0ubuntu4), ldap-server, libltdl3 (= 1.5.4-1), umich-ldapd Filename: pool/main/o/openldap/slapd_2.4.11-0ubuntu6_i386.deb Size: 1466528 MD5sum: 41047db9f250c0e73e2e3c43c5d90f5a SHA1: 4c23c98d55851fef7ec4ff5e4fa8d7cd1c885da9 SHA256: 107e5df3dea5a0571a2f99df1d7c919247a4223a991a99e8393b0915e39f1fc9 Description-de: OpenLDAP-Server (slapd) This is the OpenLDAP (Lightweight Directory Access Protocol) server (slapd). The server can be used to provide a standalone directory service. Homepage: http://www.openldap.org/ Bugs: mailto:ubuntu-users@lists.ubuntu.com Origin: Ubuntu (libgnutls26 is of version: 2.4.1-1build1) Can someone help me with this "Object class violation (65)" problem concerning TLS? Belem

2 1

Named pipe to local ldap slave fails when master is down.
by Jan Hugo Prins 27 Dec '08

27 Dec '08

Hi I've got a strange thing yesterday. The server that is doing my master ldap went down due to some software glitch. Al my MDA's are running there own slave ldap so they don't have to go to the master server, but what surprised me, the slaves didn't want to service anything on there named pipe while the master server was down. Why is this? The MTA's also use the ldap on the MDA's but they didn't have any problem during this master ldap outage. The only difference between the MDA's and the MTA's is that the MTA's connect to ldap with TCP/IP while the MDA's connect to ldap with a named pipe. I use syncrepl for replication. My master server is running version 2.4.12 on Fedora 10. My slave servers are running 2.3.43 on Fedora 7. In the near future I want to make this master server a dual master setup with a different server that I'm currently building. But for now I have just one master. This really breaks my whole anti SPOF setup. Can anyone tell me what is causing this? Greetings, Jan Hugo Prins

2 1

Check out my Facebook profile
by Rakesh Yadav 26 Dec '08

26 Dec '08

Hi openldap-technical, I set up a Facebook profile where I can post my pictures, videos and events and I want to add you as a friend so you can see it. First, you need to join Facebook! Once you join, you can also create your own profile. Thanks, Rakesh To sign up for Facebook, follow the link below: http://www.facebook.com/p.php?i=682100664&k=64D665VZRWVM5CEDXA64U4&r

1 0

CSN too old, ignoring, N-way multi-master replication
by Adrien Futschik 24 Dec '08

24 Dec '08

I'm starting a new thread to make it easier to understand my problem. I'm testing N-way multimaster replication with OpenLDAP 2.4.13. I'm able to successfully import data into an instance and have my two masters to sync correctly but then when I try to add a new entry in one of the two masters, I'm getting strange messages : let's say we have m1 & m2 (m1 & m2 are on the same server): I initial import data into m1, it is successfully imported into m2 (at least it looks like it). Then I'm trying to add an entry on m2 (cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm getting strange message on m1 & m2 : m1 log :(repetitively) [...] Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224125950.481561Z#000000#001#000000 older or equal to ctx 20081224125950.481561Z#000000#001#000000 Entry cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr changed by peer, ignored syncprov_search_response: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT [...] m2 log : (repetitively) [...] master where I added an entry : do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 [...] Is this a bug ? Am-I doing something wrong ? If I add the same entry to m1 and not m2 I get the following messages : on m2 : syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed syncprov_search_response: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 syncrepl_entry: rid=004 be_add (0) do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 <= bdb_inequality_candidates: (entryCSN) not indexed nonpresent_callback: rid=004 present UUID 96268508-6609-102d-9d8e-9742e72db399, dn c=fr nonpresent_callback: rid=004 present UUID 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630bfa0-6609-102d-9d9d-9742e72db399, dn ou=administrateurs,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID ae0e93d6-6609-102d-9d9e-9742e72db399, dn cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x83d6410 20081224132238.790862Z#000000#001#000000 on m1 : slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x9703700 20081224132238.790862Z#000000#001#000000 <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224132158.749532Z#000000#001#000000 older or equal to ctx 20081224132158.749532Z#000000#001#000000 syncprov_search_response: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 Here is the entry I'm adding : dn: cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf, c=fr objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: ditPerson cn: adrien-externe.futschik(a)edfgdf.fr sn: Futschik givenName: Adrien uid: adrien-externe.futschik(a)edfgdf.fr mail: adrien-externe.futschik(a)edfgdf.fr telephonenumber: 0123456789 userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r allowedServices: appli20 pretty simple isn't it ? What's going wrong ? You'll find in attachment the script I'm using to set up the replication (modified version of test050-syncrepl-multimaster). Here is the config : initialization of m1 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} initialization of m2 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} syncprov overlay on m1 : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE syncrepl on m2: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE schema on m1: include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif include: file://$ABS_SCHEMADIR/corba.ldif include: file://$ABS_SCHEMADIR/java.ldif include: file://$ABS_SCHEMADIR/misc.ldif include: file://$ABS_SCHEMADIR/nds.ldif include: file://$ABS_SCHEMADIR/dit.ldif database en m1: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: ${PASSWD} olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,seeAlso,entryUUID eq olcDbIndex: mail,givenName,uid pres,eq,sub olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov After that I populate m1 with attached arbre.ldif. Thanks in advance. Adrien

1 0

Re: Re: CSN too old, ignoring - and therefore not syncing
by Adrien Futschik 24 Dec '08

24 Dec '08

You're right I might have forgotten the most essential :) You'll find in attachment the script I'm using to set up the replication (modified version of test050-syncrepl-multimaster). Here is the config : initialization of m1 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} initialization of m2 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD} syncprov overlay on m1 : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE syncrepl on m2: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE schema on m1: include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif include: file://$ABS_SCHEMADIR/corba.ldif include: file://$ABS_SCHEMADIR/java.ldif include: file://$ABS_SCHEMADIR/misc.ldif include: file://$ABS_SCHEMADIR/nds.ldif include: file://$ABS_SCHEMADIR/dit.ldif database en m1: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: ${PASSWD} olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,seeAlso,entryUUID eq olcDbIndex: mail,givenName,uid pres,eq,sub olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov After that I populate m1 with attached arbre.ldif. Thanks in advance. Adrien ======================================== Message date : Dec 24 2008, 03:23 PM From : "Gavin Henry" <gavin.henry(a)gmail.com> To : adrien.futschik(a)atosorigin.com, openldap-technical(a)openldap.org Copy to : Subject : Re: CSN too old, ignoring - and therefore not syncing Config? On 24/12/2008, Adrien Futschik <adrien.futschik(a)atosorigin.com> wrote: > I'm facing a similar problem. > I'm testing N-way multimaster replication with OpenLDAP 2.4.13. > > I'm able to successfully import data into an instance and have my two > masters to sync correctly but then when I try to add a new entry in one of > the two masters, I'm getting strange messages : > > let's say we have m1 & m2 (m1 & m2 are on the same server): > I initial import data into m1, it is successfully imported into m2 (at least > it looks like it). > Then I'm trying to add an entry on m2 > (cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm > getting strange message on m1 & m2 : > > m1 log :(repetitively) > [...] > Entry ou=administrateurs,o=gazdefrance,c=fr CSN > 20081224125950.481561Z#000000#001#000000 older or equal to ctx > 20081224125950.481561Z#000000#001#000000 > Entry cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr > changed by peer, ignored > syncprov_search_response: > cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 > do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT > [...] > > > m2 log : (repetitively) > [...] > master where I added an entry : > do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET > do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT > do_syncrep2: > cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 > [...] > > Is this a bug ? Am-I doing something wrong ? > > If I add the same entry to m1 and not m2 I get the following messages : > > on m2 : > syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) > syncrepl_entry: rid=004 be_search (0) > syncrepl_entry: rid=004 > cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr > <= bdb_equality_candidates: (entryCSN) not indexed > <= bdb_inequality_candidates: (entryCSN) not indexed > <= bdb_inequality_candidates: (entryCSN) not indexed > syncprov_search_response: > cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 > syncrepl_entry: rid=004 be_add (0) > do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT > do_syncrep2: > cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 > <= bdb_inequality_candidates: (entryCSN) not indexed > nonpresent_callback: rid=004 present UUID > 96268508-6609-102d-9d8e-9742e72db399, dn c=fr > nonpresent_callback: rid=004 present UUID > 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr > nonpresent_callback: rid=004 present UUID > 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr > nonpresent_callback: rid=004 present UUID > 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > 9630bfa0-6609-102d-9d9d-9742e72db399, dn > ou=administrateurs,o=gazdefrance,c=fr > nonpresent_callback: rid=004 present UUID > ae0e93d6-6609-102d-9d9e-9742e72db399, dn > cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr > slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 > slap_graduate_commit_csn: removing 0x83d6410 > 20081224132238.790862Z#000000#001#000000 > > on m1 : > slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 > slap_graduate_commit_csn: removing 0x9703700 > 20081224132238.790862Z#000000#001#000000 > <= bdb_equality_candidates: (entryCSN) not indexed > <= bdb_inequality_candidates: (entryCSN) not indexed > Entry ou=administrateurs,o=gazdefrance,c=fr CSN > 20081224132158.749532Z#000000#001#000000 older or equal to ctx > 20081224132158.749532Z#000000#001#000000 > syncprov_search_response: > cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 > do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET > do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT > do_syncrep2: > cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 > > Here is the entry I'm adding : > > dn: cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf, c=fr > objectclass: top > objectclass: person > objectclass: organizationalPerson > objectclass: inetorgPerson > objectclass: ditPerson > cn: adrien-externe.futschik(a)edfgdf.fr > sn: Futschik > givenName: Adrien > uid: adrien-externe.futschik(a)edfgdf.fr > mail: adrien-externe.futschik(a)edfgdf.fr > telephonenumber: 0123456789 > userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r > allowedServices: appli20 > > pretty simple isn't it ? What's going wrong ? > > Adrien > > ======================================== > Message date : Dec 23 2008, 07:39 PM > From : "Gavin Henry" <gavin.henry(a)gmail.com> > To : openldap-technical(a)openldap.org > Copy to : > Subject : Fwd: CSN too old, ignoring - and therefore not syncing > > ---------- Forwarded message ---------- > From: Pat Riehecky <prieheck(a)iwu.edu> > Date: Tue, 23 Dec 2008 12:34:33 -0600 > Subject: Re: CSN too old, ignoring - and therefore not syncing > To: Gavin Henry <gavin.henry(a)gmail.com> > > On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: > > Where did you read that those were needed anyway? If it was the admin > > guide then I need to fix it ;-) > > > > Gavin. > > I have no idea where I found those at... I know it wasn't the (recent) > admin guide. It may have been from around the 2.4.8 release, but that > is long gone... > > Pat > > > > > On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: > > >> Try dropping nopresent and reloadhint relating to ITS5669. You only > > >> need these two syncprov settings on an accesslog db. > > >> > > >> Gavin. > > > > > > Thanks, that did the job! > > > > > > Pat > > > > > >> > > >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > > >> >> Can you post your config somewhere? > > >> > > > >> > > > >> > allow bind_v2 > > >> > > > >> > include /etc/ldap/schema/core.schema > > >> > include /etc/ldap/schema/cosine.schema > > >> > include /etc/ldap/schema/nis.schema > > >> > include /etc/ldap/schema/inetorgperson.schema > > >> > include /etc/ldap/schema/samba.schema > > >> > include /etc/ldap/schema/eduperson-200412.schema > > >> > include /etc/ldap/schema/hdb.schema > > >> > include /etc/ldap/schema/IWU.schema > > >> > > > >> > pidfile /var/run/slapd/slapd.pid > > >> > argsfile /var/run/slapd/slapd.args > > >> > > > >> > modulepath /usr/lib/ldap > > >> > moduleload back_hdb > > >> > moduleload back_monitor > > >> > moduleload memberof > > >> > moduleload syncprov > > >> > moduleload smbk5pwd > > >> > > > >> > tool-threads 2 > > >> > sizelimit 500 > > >> > idletimeout 7200 > > >> > > > >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt > > >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt > > >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key > > >> > TLSVerifyClient allow > > >> > > > >> > localSSF 160 > > >> > security ssf=1 update_ssf=128 simple_bind=112 > > >> > sasl-secprops noanonymous > > >> > > > >> > access to dn.base="" by * read > > >> > access to dn.base="cn=Subschema" by * read > > >> > > > >> > backend hdb > > >> > database hdb > > >> > > > >> > overlay memberof > > >> > overlay smbk5pwd > > >> > overlay syncprov > > >> > > > >> > smbk5pwd-enable samba > > >> > smbk5pwd-enable krb5 > > >> > smbk5pwd-must-change 0 > > >> > > > >> > syncprov-checkpoint 100 10 > > >> > syncprov-sessionlog 200 > > >> > syncprov-nopresent TRUE > > >> > syncprov-reloadhint TRUE > > >> > > > >> > suffix "dc=iwu,dc=edu" > > >> > > > >> > rootdn "cn=admin,dc=iwu,dc=edu" > > >> > rootpw {redacted} > > >> > > > >> > authz-regexp "uidNumber=0\\\ > > >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" > > >> > "cn=ldapi,dc=iwu,dc=edu" > > >> > authz-regexp "gidNumber=.*\\\ > > >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" > > >> > "cn=ldapi,dc=iwu,dc=edu" > > >> > > > >> > authz-regexp "uid=(.+),cn=.+,cn=auth" > "uid=$1,ou=People,dc=iwu,dc=edu" > > >> > > > >> > directory "/var/lib/ldap/" > > >> > > > >> > dbconfig set_cachesize 0 62914560 0 > > >> > dbconfig set_lk_max_objects 1500 > > >> > dbconfig set_lk_max_locks 1500 > > >> > dbconfig set_lk_max_lockers 1500 > > >> > > > >> > # Make sure to do a nightly slapcat > > >> > dbconfig set_flags DB_LOG_AUTOREMOVE > > >> > > > >> > index objectClass eq,pres > > >> > index default eq,sub,pres > > >> > index mail eq,sub,pres > > >> > index sn eq,sub,pres > > >> > index cn eq,sub,pres > > >> > index displayName eq,sub,pres > > >> > index gecos eq,sub,pres > > >> > index uid eq,sub,pres > > >> > index memberUid eq,sub,pres > > >> > index uidNumber eq,pres > > >> > index gidNumber eq,pres > > >> > index entryCSN eq,pres > > >> > index entryUUID eq,pres > > >> > index uniqueMember eq,pres > > >> > index userPassword eq,pres > > >> > index krb5PrincipalName eq,pres > > >> > index krb5PrincipalRealm eq,pres > > >> > index sambaDomainName eq,pres > > >> > index sambaSID eq,pres > > >> > index sambaPrimaryGroupSID eq,pres > > >> > index sambaSIDList eq,pres > > >> > > > >> > lastmod on > > >> > > > >> > checkpoint 256 15 > > >> > > > >> > password-hash {SSHA} > > >> > > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write > > >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write > > >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read > > >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key > > >> > by anonymous auth > > >> > by self write > > >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write > > >> > by users auth > > >> > by * break > > >> > > > >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none > > >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none > > >> > > > >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read > by * > > >> > none > > >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none > > >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none > > >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self > read > > >> > by * none > > >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by > self > > >> > read by * none > > >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read > by * > > >> > none > > >> > > > >> > access to > > >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by > self > > >> > read by * none > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName > > >> > by self write > > >> > by users read > > >> > by anonymous none > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber > > >> > by self read > > >> > by anonymous none > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid > > >> > by * none > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" > > >> > > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength > > >> > by self read > > >> > by anonymous none > > >> > by * break > > >> > > > >> > access to dn.sub="dc=iwu,dc=edu" by * read > > >> > > > >> > serverID 1 > > >> > > > >> > syncrepl rid=2 > > >> > provider=ldap://ldap2.iwu.edu/ > > >> > schemachecking=off > > >> > searchbase="dc=iwu,dc=edu" > > >> > scope=sub > > >> > type=refreshAndPersist > > >> > binddn="cn=mirror,dc=iwu,dc=edu" > > >> > credentials={redacted} > > >> > bindmethod=simple > > >> > starttls=yes > > >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt > > >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key > > >> > tls_cacert=/etc/ldap/ssl/IWU.crt > > >> > tls_reqcert=try > > >> > interval=00:00:00:30 > > >> > retry="15 +" > > >> > timeout=1 > > >> > timelimit=unlimited > > >> > sizelimit=unlimited > > >> > > > >> > mirrormode on > > >> > > > >> > ############################### > > >> > database monitor > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > > >> > > > >> > access to dn.exact="cn=Monitor" > > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > > >> > by * none > > >> > > > >> > access to dn.subtree="cn=Monitor" > > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > > >> > by * none > > >> > > > >> > > > >> >> > > >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > >> >> > Here is the quick and dirty what I am trying to do: > > >> >> > > > >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > > >> >> > synced > > >> >> > to pool.ntp.org and each other (if they drift I would rather they > > >> >> > sorta > > >> >> > drift together, but pool should be keeping that in check). > > >> >> > > > >> >> > Right now I am just beating them up to see how 2.4.13 performs. > (So > > >> >> > far > > >> >> > VERY well, minus this little problem) > > >> >> > > > >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm > > >> >> > starting small). Debug gives me > > >> >> > > > >> >> > ber_scanf fmt (m}) ber: > > >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > > >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > > >> >> > 30 .<rid=001,sid=00 > > >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > > >> >> > 2,csn=2008122217 > > >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > > >> >> > 4721.855904Z#000 > > >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > > >> >> > 000#001#000000 > > >> >> > do_syncrep2: > > >> >> > > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 > > >> >> > do_syncrep2: rid=001 CSN too old, ignoring > > >> >> > 20081222174721.855904Z#000000#001#000000 > > >> >> > ldap_msgfree > > >> >> > > > >> >> > I am not exactly sure how it gotten to be "too old." The ldif I > am > > >> >> > importing is not the result of a slapcat or anything that would > > >> >> > preserve > > >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am > > >> >> > loading > > >> >> > one single file with ldapadd which, in my understanding, sets up > the > > >> >> > CSN > > >> >> > and wouldn't let me import one anyway. > > >> >> > > > >> >> > Each server has no entries until I load the one, so there > shouldn't > > >> >> > be > > >> >> > any weird stale CSNs causing this. They are "sync'ed" almost > > >> >> > instantly > > >> >> > after the one system is loaded - I just don't have everything. > > >> >> > > > >> >> > After a sync: > > >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 > > >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 > > >> >> > > > >> >> > Right now I can get them in sync with a slapcat/slapadd, but when > the > > >> >> > go > > >> >> > into production I wont be able to say for certain which one is > > >> >> > authoritative. That is the purpose of multi-master.... > > >> >> > > > >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux > 32 > > >> >> > bit > > >> >> > > > >> >> > Any ideas as to what I can do to stop this from happening? > > >> >> > > > >> >> > Pat > > >> >> > > > >> >> > > > >> >> > > > >> >> > > > >> >> > > >> > > > >> > > > >> > > > > > > > > > > > -- > Sent from my mobile device > > http://www.suretecsystems.com/services/openldap/ > > > > > Adrien Futschik > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/ Adrien Futschik

2 1

Re: Fwd: CSN too old, ignoring - and therefore not syncing
by Adrien Futschik 24 Dec '08

24 Dec '08

I'm facing a similar problem. I'm testing N-way multimaster replication with OpenLDAP 2.4.13. I'm able to successfully import data into an instance and have my two masters to sync correctly but then when I try to add a new entry in one of the two masters, I'm getting strange messages : let's say we have m1 & m2 (m1 & m2 are on the same server): I initial import data into m1, it is successfully imported into m2 (at least it looks like it). Then I'm trying to add an entry on m2 (cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm getting strange message on m1 & m2 : m1 log :(repetitively) [...] Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224125950.481561Z#000000#001#000000 older or equal to ctx 20081224125950.481561Z#000000#001#000000 Entry cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr changed by peer, ignored syncprov_search_response: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT [...] m2 log : (repetitively) [...] master where I added an entry : do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 [...] Is this a bug ? Am-I doing something wrong ? If I add the same entry to m1 and not m2 I get the following messages : on m2 : syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed syncprov_search_response: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 syncrepl_entry: rid=004 be_add (0) do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 <= bdb_inequality_candidates: (entryCSN) not indexed nonpresent_callback: rid=004 present UUID 96268508-6609-102d-9d8e-9742e72db399, dn c=fr nonpresent_callback: rid=004 present UUID 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630bfa0-6609-102d-9d9d-9742e72db399, dn ou=administrateurs,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID ae0e93d6-6609-102d-9d9e-9742e72db399, dn cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf,c=fr slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x83d6410 20081224132238.790862Z#000000#001#000000 on m1 : slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x9703700 20081224132238.790862Z#000000#001#000000 <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224132158.749532Z#000000#001#000000 older or equal to ctx 20081224132158.749532Z#000000#001#000000 syncprov_search_response: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 Here is the entry I'm adding : dn: cn=adrien-externe.futschik(a)edfgdf.fr,ou=personnes,o=edfgdf, c=fr objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: ditPerson cn: adrien-externe.futschik(a)edfgdf.fr sn: Futschik givenName: Adrien uid: adrien-externe.futschik(a)edfgdf.fr mail: adrien-externe.futschik(a)edfgdf.fr telephonenumber: 0123456789 userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r allowedServices: appli20 pretty simple isn't it ? What's going wrong ? Adrien ======================================== Message date : Dec 23 2008, 07:39 PM From : "Gavin Henry" <gavin.henry(a)gmail.com> To : openldap-technical(a)openldap.org Copy to : Subject : Fwd: CSN too old, ignoring - and therefore not syncing ---------- Forwarded message ---------- From: Pat Riehecky <prieheck(a)iwu.edu> Date: Tue, 23 Dec 2008 12:34:33 -0600 Subject: Re: CSN too old, ignoring - and therefore not syncing To: Gavin Henry <gavin.henry(a)gmail.com> On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: > Where did you read that those were needed anyway? If it was the admin > guide then I need to fix it ;-) > > Gavin. I have no idea where I found those at... I know it wasn't the (recent) admin guide. It may have been from around the 2.4.8 release, but that is long gone... Pat > > On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: > >> Try dropping nopresent and reloadhint relating to ITS5669. You only > >> need these two syncprov settings on an accesslog db. > >> > >> Gavin. > > > > Thanks, that did the job! > > > > Pat > > > >> > >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > >> >> Can you post your config somewhere? > >> > > >> > > >> > allow bind_v2 > >> > > >> > include /etc/ldap/schema/core.schema > >> > include /etc/ldap/schema/cosine.schema > >> > include /etc/ldap/schema/nis.schema > >> > include /etc/ldap/schema/inetorgperson.schema > >> > include /etc/ldap/schema/samba.schema > >> > include /etc/ldap/schema/eduperson-200412.schema > >> > include /etc/ldap/schema/hdb.schema > >> > include /etc/ldap/schema/IWU.schema > >> > > >> > pidfile /var/run/slapd/slapd.pid > >> > argsfile /var/run/slapd/slapd.args > >> > > >> > modulepath /usr/lib/ldap > >> > moduleload back_hdb > >> > moduleload back_monitor > >> > moduleload memberof > >> > moduleload syncprov > >> > moduleload smbk5pwd > >> > > >> > tool-threads 2 > >> > sizelimit 500 > >> > idletimeout 7200 > >> > > >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt > >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt > >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key > >> > TLSVerifyClient allow > >> > > >> > localSSF 160 > >> > security ssf=1 update_ssf=128 simple_bind=112 > >> > sasl-secprops noanonymous > >> > > >> > access to dn.base="" by * read > >> > access to dn.base="cn=Subschema" by * read > >> > > >> > backend hdb > >> > database hdb > >> > > >> > overlay memberof > >> > overlay smbk5pwd > >> > overlay syncprov > >> > > >> > smbk5pwd-enable samba > >> > smbk5pwd-enable krb5 > >> > smbk5pwd-must-change 0 > >> > > >> > syncprov-checkpoint 100 10 > >> > syncprov-sessionlog 200 > >> > syncprov-nopresent TRUE > >> > syncprov-reloadhint TRUE > >> > > >> > suffix "dc=iwu,dc=edu" > >> > > >> > rootdn "cn=admin,dc=iwu,dc=edu" > >> > rootpw {redacted} > >> > > >> > authz-regexp "uidNumber=0\\\ > >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > authz-regexp "gidNumber=.*\\\ > >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > > >> > authz-regexp "uid=(.+),cn=.+,cn=auth" "uid=$1,ou=People,dc=iwu,dc=edu" > >> > > >> > directory "/var/lib/ldap/" > >> > > >> > dbconfig set_cachesize 0 62914560 0 > >> > dbconfig set_lk_max_objects 1500 > >> > dbconfig set_lk_max_locks 1500 > >> > dbconfig set_lk_max_lockers 1500 > >> > > >> > # Make sure to do a nightly slapcat > >> > dbconfig set_flags DB_LOG_AUTOREMOVE > >> > > >> > index objectClass eq,pres > >> > index default eq,sub,pres > >> > index mail eq,sub,pres > >> > index sn eq,sub,pres > >> > index cn eq,sub,pres > >> > index displayName eq,sub,pres > >> > index gecos eq,sub,pres > >> > index uid eq,sub,pres > >> > index memberUid eq,sub,pres > >> > index uidNumber eq,pres > >> > index gidNumber eq,pres > >> > index entryCSN eq,pres > >> > index entryUUID eq,pres > >> > index uniqueMember eq,pres > >> > index userPassword eq,pres > >> > index krb5PrincipalName eq,pres > >> > index krb5PrincipalRealm eq,pres > >> > index sambaDomainName eq,pres > >> > index sambaSID eq,pres > >> > index sambaPrimaryGroupSID eq,pres > >> > index sambaSIDList eq,pres > >> > > >> > lastmod on > >> > > >> > checkpoint 256 15 > >> > > >> > password-hash {SSHA} > >> > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write > >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write > >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read > >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key > >> > by anonymous auth > >> > by self write > >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write > >> > by users auth > >> > by * break > >> > > >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none > >> > > >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none > >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none > >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self read > >> > by * none > >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > > >> > access to > >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName > >> > by self write > >> > by users read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid > >> > by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" by * read > >> > > >> > serverID 1 > >> > > >> > syncrepl rid=2 > >> > provider=ldap://ldap2.iwu.edu/ > >> > schemachecking=off > >> > searchbase="dc=iwu,dc=edu" > >> > scope=sub > >> > type=refreshAndPersist > >> > binddn="cn=mirror,dc=iwu,dc=edu" > >> > credentials={redacted} > >> > bindmethod=simple > >> > starttls=yes > >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt > >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key > >> > tls_cacert=/etc/ldap/ssl/IWU.crt > >> > tls_reqcert=try > >> > interval=00:00:00:30 > >> > retry="15 +" > >> > timeout=1 > >> > timelimit=unlimited > >> > sizelimit=unlimited > >> > > >> > mirrormode on > >> > > >> > ############################### > >> > database monitor > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.exact="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > access to dn.subtree="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > > >> >> > >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> >> > Here is the quick and dirty what I am trying to do: > >> >> > > >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > >> >> > synced > >> >> > to pool.ntp.org and each other (if they drift I would rather they > >> >> > sorta > >> >> > drift together, but pool should be keeping that in check). > >> >> > > >> >> > Right now I am just beating them up to see how 2.4.13 performs. (So > >> >> > far > >> >> > VERY well, minus this little problem) > >> >> > > >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm > >> >> > starting small). Debug gives me > >> >> > > >> >> > ber_scanf fmt (m}) ber: > >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > >> >> > 30 .<rid=001,sid=00 > >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > >> >> > 2,csn=2008122217 > >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > >> >> > 4721.855904Z#000 > >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > >> >> > 000#001#000000 > >> >> > do_syncrep2: > >> >> > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 > >> >> > do_syncrep2: rid=001 CSN too old, ignoring > >> >> > 20081222174721.855904Z#000000#001#000000 > >> >> > ldap_msgfree > >> >> > > >> >> > I am not exactly sure how it gotten to be "too old." The ldif I am > >> >> > importing is not the result of a slapcat or anything that would > >> >> > preserve > >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am > >> >> > loading > >> >> > one single file with ldapadd which, in my understanding, sets up the > >> >> > CSN > >> >> > and wouldn't let me import one anyway. > >> >> > > >> >> > Each server has no entries until I load the one, so there shouldn't > >> >> > be > >> >> > any weird stale CSNs causing this. They are "sync'ed" almost > >> >> > instantly > >> >> > after the one system is loaded - I just don't have everything. > >> >> > > >> >> > After a sync: > >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 > >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 > >> >> > > >> >> > Right now I can get them in sync with a slapcat/slapadd, but when the > >> >> > go > >> >> > into production I wont be able to say for certain which one is > >> >> > authoritative. That is the purpose of multi-master.... > >> >> > > >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 > >> >> > bit > >> >> > > >> >> > Any ideas as to what I can do to stop this from happening? > >> >> > > >> >> > Pat > >> >> > > >> >> > > >> >> > > >> >> > > >> >> > >> > > >> > > >> > > > > > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/ Adrien Futschik

2 1

Different shells ¿how to workaround?
by Jordi Espasa Clofent 24 Dec '08

24 Dec '08

Hi all, I'm just learning OpenLDAP; I'm hope it isn't a silly question. I've mounted a OpenLDAP (version 2.4 in a FreeBSD 7.x platform) as account authentication server and all works fine. The clients are FreeBSD and GNU/Linux Debian. One problem I've found is related to loginShell field in posixAccount schema. It's because of when I was setting up the servers, I've configured /bin/csh as the default shell for the users It's ok in FreeBSD clients (csh exists in default instalation), but you get an error when you try to authenticate a Debian client. ¿Why? Simple, the default shell in Debian is /bin/bash, not the defined /bin/csh. Currently, do you have two options to workaround this issue: * install csh in Debian clients and assure that the binary path is /bin/csh * make a symlink /bin/csh which point to /bin/bash At present, I've chosen the second option. ¿Is correct this workaround or maybe I don't know some other obvious method to get it? -- Thanks, Jordi Espasa Clofent

2 1

Fwd: CSN too old, ignoring - and therefore not syncing
by Gavin Henry 23 Dec '08

23 Dec '08

---------- Forwarded message ---------- From: Pat Riehecky <prieheck(a)iwu.edu> Date: Tue, 23 Dec 2008 12:34:33 -0600 Subject: Re: CSN too old, ignoring - and therefore not syncing To: Gavin Henry <gavin.henry(a)gmail.com> On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: > Where did you read that those were needed anyway? If it was the admin > guide then I need to fix it ;-) > > Gavin. I have no idea where I found those at... I know it wasn't the (recent) admin guide. It may have been from around the 2.4.8 release, but that is long gone... Pat > > On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: > >> Try dropping nopresent and reloadhint relating to ITS5669. You only > >> need these two syncprov settings on an accesslog db. > >> > >> Gavin. > > > > Thanks, that did the job! > > > > Pat > > > >> > >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > >> >> Can you post your config somewhere? > >> > > >> > > >> > allow bind_v2 > >> > > >> > include /etc/ldap/schema/core.schema > >> > include /etc/ldap/schema/cosine.schema > >> > include /etc/ldap/schema/nis.schema > >> > include /etc/ldap/schema/inetorgperson.schema > >> > include /etc/ldap/schema/samba.schema > >> > include /etc/ldap/schema/eduperson-200412.schema > >> > include /etc/ldap/schema/hdb.schema > >> > include /etc/ldap/schema/IWU.schema > >> > > >> > pidfile /var/run/slapd/slapd.pid > >> > argsfile /var/run/slapd/slapd.args > >> > > >> > modulepath /usr/lib/ldap > >> > moduleload back_hdb > >> > moduleload back_monitor > >> > moduleload memberof > >> > moduleload syncprov > >> > moduleload smbk5pwd > >> > > >> > tool-threads 2 > >> > sizelimit 500 > >> > idletimeout 7200 > >> > > >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt > >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt > >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key > >> > TLSVerifyClient allow > >> > > >> > localSSF 160 > >> > security ssf=1 update_ssf=128 simple_bind=112 > >> > sasl-secprops noanonymous > >> > > >> > access to dn.base="" by * read > >> > access to dn.base="cn=Subschema" by * read > >> > > >> > backend hdb > >> > database hdb > >> > > >> > overlay memberof > >> > overlay smbk5pwd > >> > overlay syncprov > >> > > >> > smbk5pwd-enable samba > >> > smbk5pwd-enable krb5 > >> > smbk5pwd-must-change 0 > >> > > >> > syncprov-checkpoint 100 10 > >> > syncprov-sessionlog 200 > >> > syncprov-nopresent TRUE > >> > syncprov-reloadhint TRUE > >> > > >> > suffix "dc=iwu,dc=edu" > >> > > >> > rootdn "cn=admin,dc=iwu,dc=edu" > >> > rootpw {redacted} > >> > > >> > authz-regexp "uidNumber=0\\\ > >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > authz-regexp "gidNumber=.*\\\ > >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" > >> > "cn=ldapi,dc=iwu,dc=edu" > >> > > >> > authz-regexp "uid=(.+),cn=.+,cn=auth" "uid=$1,ou=People,dc=iwu,dc=edu" > >> > > >> > directory "/var/lib/ldap/" > >> > > >> > dbconfig set_cachesize 0 62914560 0 > >> > dbconfig set_lk_max_objects 1500 > >> > dbconfig set_lk_max_locks 1500 > >> > dbconfig set_lk_max_lockers 1500 > >> > > >> > # Make sure to do a nightly slapcat > >> > dbconfig set_flags DB_LOG_AUTOREMOVE > >> > > >> > index objectClass eq,pres > >> > index default eq,sub,pres > >> > index mail eq,sub,pres > >> > index sn eq,sub,pres > >> > index cn eq,sub,pres > >> > index displayName eq,sub,pres > >> > index gecos eq,sub,pres > >> > index uid eq,sub,pres > >> > index memberUid eq,sub,pres > >> > index uidNumber eq,pres > >> > index gidNumber eq,pres > >> > index entryCSN eq,pres > >> > index entryUUID eq,pres > >> > index uniqueMember eq,pres > >> > index userPassword eq,pres > >> > index krb5PrincipalName eq,pres > >> > index krb5PrincipalRealm eq,pres > >> > index sambaDomainName eq,pres > >> > index sambaSID eq,pres > >> > index sambaPrimaryGroupSID eq,pres > >> > index sambaSIDList eq,pres > >> > > >> > lastmod on > >> > > >> > checkpoint 256 15 > >> > > >> > password-hash {SSHA} > >> > > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write > >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write > >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read > >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key > >> > by anonymous auth > >> > by self write > >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write > >> > by users auth > >> > by * break > >> > > >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none > >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none > >> > > >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none > >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none > >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self read > >> > by * none > >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read by * > >> > none > >> > > >> > access to > >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by self > >> > read by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName > >> > by self write > >> > by users read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid > >> > by * none > >> > > >> > access to dn.sub="dc=iwu,dc=edu" > >> > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength > >> > by self read > >> > by anonymous none > >> > by * break > >> > > >> > access to dn.sub="dc=iwu,dc=edu" by * read > >> > > >> > serverID 1 > >> > > >> > syncrepl rid=2 > >> > provider=ldap://ldap2.iwu.edu/ > >> > schemachecking=off > >> > searchbase="dc=iwu,dc=edu" > >> > scope=sub > >> > type=refreshAndPersist > >> > binddn="cn=mirror,dc=iwu,dc=edu" > >> > credentials={redacted} > >> > bindmethod=simple > >> > starttls=yes > >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt > >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key > >> > tls_cacert=/etc/ldap/ssl/IWU.crt > >> > tls_reqcert=try > >> > interval=00:00:00:30 > >> > retry="15 +" > >> > timeout=1 > >> > timelimit=unlimited > >> > sizelimit=unlimited > >> > > >> > mirrormode on > >> > > >> > ############################### > >> > database monitor > >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited > >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited > >> > > >> > access to dn.exact="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > access to dn.subtree="cn=Monitor" > >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read > >> > by * none > >> > > >> > > >> >> > >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > >> >> > Here is the quick and dirty what I am trying to do: > >> >> > > >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > >> >> > synced > >> >> > to pool.ntp.org and each other (if they drift I would rather they > >> >> > sorta > >> >> > drift together, but pool should be keeping that in check). > >> >> > > >> >> > Right now I am just beating them up to see how 2.4.13 performs. (So > >> >> > far > >> >> > VERY well, minus this little problem) > >> >> > > >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm > >> >> > starting small). Debug gives me > >> >> > > >> >> > ber_scanf fmt (m}) ber: > >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > >> >> > 30 .<rid=001,sid=00 > >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > >> >> > 2,csn=2008122217 > >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > >> >> > 4721.855904Z#000 > >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > >> >> > 000#001#000000 > >> >> > do_syncrep2: > >> >> > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 > >> >> > do_syncrep2: rid=001 CSN too old, ignoring > >> >> > 20081222174721.855904Z#000000#001#000000 > >> >> > ldap_msgfree > >> >> > > >> >> > I am not exactly sure how it gotten to be "too old." The ldif I am > >> >> > importing is not the result of a slapcat or anything that would > >> >> > preserve > >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am > >> >> > loading > >> >> > one single file with ldapadd which, in my understanding, sets up the > >> >> > CSN > >> >> > and wouldn't let me import one anyway. > >> >> > > >> >> > Each server has no entries until I load the one, so there shouldn't > >> >> > be > >> >> > any weird stale CSNs causing this. They are "sync'ed" almost > >> >> > instantly > >> >> > after the one system is loaded - I just don't have everything. > >> >> > > >> >> > After a sync: > >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 > >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 > >> >> > > >> >> > Right now I can get them in sync with a slapcat/slapadd, but when the > >> >> > go > >> >> > into production I wont be able to say for certain which one is > >> >> > authoritative. That is the purpose of multi-master.... > >> >> > > >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 > >> >> > bit > >> >> > > >> >> > Any ideas as to what I can do to stop this from happening? > >> >> > > >> >> > Pat > >> >> > > >> >> > > >> >> > > >> >> > > >> >> > >> > > >> > > >> > > > > > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/

1 0

Re: CSN too old, ignoring - and therefore not syncing
by Gavin Henry 23 Dec '08

23 Dec '08

Ok, thanks. On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: > On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote: >> Where did you read that those were needed anyway? If it was the admin >> guide then I need to fix it ;-) >> >> Gavin. > > I have no idea where I found those at... I know it wasn't the (recent) > admin guide. It may have been from around the 2.4.8 release, but that > is long gone... > > Pat > >> >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: >> > On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote: >> >> Try dropping nopresent and reloadhint relating to ITS5669. You only >> >> need these two syncprov settings on an accesslog db. >> >> >> >> Gavin. >> > >> > Thanks, that did the job! >> > >> > Pat >> > >> >> >> >> On 23/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: >> >> > On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: >> >> >> Can you post your config somewhere? >> >> > >> >> > >> >> > allow bind_v2 >> >> > >> >> > include /etc/ldap/schema/core.schema >> >> > include /etc/ldap/schema/cosine.schema >> >> > include /etc/ldap/schema/nis.schema >> >> > include /etc/ldap/schema/inetorgperson.schema >> >> > include /etc/ldap/schema/samba.schema >> >> > include /etc/ldap/schema/eduperson-200412.schema >> >> > include /etc/ldap/schema/hdb.schema >> >> > include /etc/ldap/schema/IWU.schema >> >> > >> >> > pidfile /var/run/slapd/slapd.pid >> >> > argsfile /var/run/slapd/slapd.args >> >> > >> >> > modulepath /usr/lib/ldap >> >> > moduleload back_hdb >> >> > moduleload back_monitor >> >> > moduleload memberof >> >> > moduleload syncprov >> >> > moduleload smbk5pwd >> >> > >> >> > tool-threads 2 >> >> > sizelimit 500 >> >> > idletimeout 7200 >> >> > >> >> > TLSCACertificateFile /etc/ldap/ssl/IWU.crt >> >> > TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt >> >> > TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key >> >> > TLSVerifyClient allow >> >> > >> >> > localSSF 160 >> >> > security ssf=1 update_ssf=128 simple_bind=112 >> >> > sasl-secprops noanonymous >> >> > >> >> > access to dn.base="" by * read >> >> > access to dn.base="cn=Subschema" by * read >> >> > >> >> > backend hdb >> >> > database hdb >> >> > >> >> > overlay memberof >> >> > overlay smbk5pwd >> >> > overlay syncprov >> >> > >> >> > smbk5pwd-enable samba >> >> > smbk5pwd-enable krb5 >> >> > smbk5pwd-must-change 0 >> >> > >> >> > syncprov-checkpoint 100 10 >> >> > syncprov-sessionlog 200 >> >> > syncprov-nopresent TRUE >> >> > syncprov-reloadhint TRUE >> >> > >> >> > suffix "dc=iwu,dc=edu" >> >> > >> >> > rootdn "cn=admin,dc=iwu,dc=edu" >> >> > rootpw {redacted} >> >> > >> >> > authz-regexp "uidNumber=0\\\ >> >> > +gidNumber=.*,cn=peercred,cn=external,cn=auth" >> >> > "cn=ldapi,dc=iwu,dc=edu" >> >> > authz-regexp "gidNumber=.*\\\ >> >> > +uidNumber=0,cn=peercred,cn=external,cn=auth" >> >> > "cn=ldapi,dc=iwu,dc=edu" >> >> > >> >> > authz-regexp "uid=(.+),cn=.+,cn=auth" >> >> > "uid=$1,ou=People,dc=iwu,dc=edu" >> >> > >> >> > directory "/var/lib/ldap/" >> >> > >> >> > dbconfig set_cachesize 0 62914560 0 >> >> > dbconfig set_lk_max_objects 1500 >> >> > dbconfig set_lk_max_locks 1500 >> >> > dbconfig set_lk_max_lockers 1500 >> >> > >> >> > # Make sure to do a nightly slapcat >> >> > dbconfig set_flags DB_LOG_AUTOREMOVE >> >> > >> >> > index objectClass eq,pres >> >> > index default eq,sub,pres >> >> > index mail eq,sub,pres >> >> > index sn eq,sub,pres >> >> > index cn eq,sub,pres >> >> > index displayName eq,sub,pres >> >> > index gecos eq,sub,pres >> >> > index uid eq,sub,pres >> >> > index memberUid eq,sub,pres >> >> > index uidNumber eq,pres >> >> > index gidNumber eq,pres >> >> > index entryCSN eq,pres >> >> > index entryUUID eq,pres >> >> > index uniqueMember eq,pres >> >> > index userPassword eq,pres >> >> > index krb5PrincipalName eq,pres >> >> > index krb5PrincipalRealm eq,pres >> >> > index sambaDomainName eq,pres >> >> > index sambaSID eq,pres >> >> > index sambaPrimaryGroupSID eq,pres >> >> > index sambaSIDList eq,pres >> >> > >> >> > lastmod on >> >> > >> >> > checkpoint 256 15 >> >> > >> >> > password-hash {SSHA} >> >> > >> >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > by dn.exact="cn=ldapi,dc=iwu,dc=edu" write >> >> > by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write >> >> > by dn.exact="cn=mirror,dc=iwu,dc=edu" read >> >> > by dn.exact="cn=freeradius,dc=iwu,dc=edu" read >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key >> >> > by anonymous auth >> >> > by self write >> >> > by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" write >> >> > by users auth >> >> > by * break >> >> > >> >> > access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none >> >> > access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none >> >> > >> >> > access to dn.regex="uid=.*\$,ou=People,dc=iwu,dc=edu" by self read by >> >> > * >> >> > none >> >> > access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none >> >> > access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none >> >> > access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self >> >> > read >> >> > by * none >> >> > access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by >> >> > self >> >> > read by * none >> >> > access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read by >> >> > * >> >> > none >> >> > >> >> > access to >> >> > dn.regex="krb5PrincipalName=.*(a)IWU.EDU,ou=People,dc=iwu,dc=edu" by >> >> > self >> >> > read by * none >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName >> >> > by self write >> >> > by users read >> >> > by anonymous none >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber >> >> > by self read >> >> > by anonymous none >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid >> >> > by * none >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" >> >> > attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength >> >> > by self read >> >> > by anonymous none >> >> > by * break >> >> > >> >> > access to dn.sub="dc=iwu,dc=edu" by * read >> >> > >> >> > serverID 1 >> >> > >> >> > syncrepl rid=2 >> >> > provider=ldap://ldap2.iwu.edu/ >> >> > schemachecking=off >> >> > searchbase="dc=iwu,dc=edu" >> >> > scope=sub >> >> > type=refreshAndPersist >> >> > binddn="cn=mirror,dc=iwu,dc=edu" >> >> > credentials={redacted} >> >> > bindmethod=simple >> >> > starttls=yes >> >> > tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt >> >> > tls_key=/etc/ldap/ssl/ldap.iwu.edu.key >> >> > tls_cacert=/etc/ldap/ssl/IWU.crt >> >> > tls_reqcert=try >> >> > interval=00:00:00:30 >> >> > retry="15 +" >> >> > timeout=1 >> >> > timelimit=unlimited >> >> > sizelimit=unlimited >> >> > >> >> > mirrormode on >> >> > >> >> > ############################### >> >> > database monitor >> >> > limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited >> >> > time.hard=unlimited size.soft=unlimited time.soft=unlimited >> >> > >> >> > access to dn.exact="cn=Monitor" >> >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read >> >> > by * none >> >> > >> >> > access to dn.subtree="cn=Monitor" >> >> > by dn.exact="cn=admin,dc=iwu,dc=edu" read >> >> > by * none >> >> > >> >> > >> >> >> >> >> >> On 22/12/2008, Pat Riehecky <prieheck(a)iwu.edu> wrote: >> >> >> > Here is the quick and dirty what I am trying to do: >> >> >> > >> >> >> > ldap1 and ldap2 are supposed to be in MultiMaster. They are time >> >> >> > synced >> >> >> > to pool.ntp.org and each other (if they drift I would rather they >> >> >> > sorta >> >> >> > drift together, but pool should be keeping that in check). >> >> >> > >> >> >> > Right now I am just beating them up to see how 2.4.13 performs. >> >> >> > (So >> >> >> > far >> >> >> > VERY well, minus this little problem) >> >> >> > >> >> >> > I have a rather small ldif (41 entries) that just wont sync (I'm >> >> >> > starting small). Debug gives me >> >> >> > >> >> >> > ber_scanf fmt (m}) ber: >> >> >> > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 >> >> >> > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 >> >> >> > 30 .<rid=001,sid=00 >> >> >> > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 >> >> >> > 2,csn=2008122217 >> >> >> > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 >> >> >> > 4721.855904Z#000 >> >> >> > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 >> >> >> > 000#001#000000 >> >> >> > do_syncrep2: >> >> >> > cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 >> >> >> > do_syncrep2: rid=001 CSN too old, ignoring >> >> >> > 20081222174721.855904Z#000000#001#000000 >> >> >> > ldap_msgfree >> >> >> > >> >> >> > I am not exactly sure how it gotten to be "too old." The ldif I >> >> >> > am >> >> >> > importing is not the result of a slapcat or anything that would >> >> >> > preserve >> >> >> > the CSN or UUID attributes (not that syncrepl uses UUID). I am >> >> >> > loading >> >> >> > one single file with ldapadd which, in my understanding, sets up >> >> >> > the >> >> >> > CSN >> >> >> > and wouldn't let me import one anyway. >> >> >> > >> >> >> > Each server has no entries until I load the one, so there >> >> >> > shouldn't >> >> >> > be >> >> >> > any weird stale CSNs causing this. They are "sync'ed" almost >> >> >> > instantly >> >> >> > after the one system is loaded - I just don't have everything. >> >> >> > >> >> >> > After a sync: >> >> >> > ldap1 - slapcat |grep dn: |wc -l = 41 >> >> >> > ldap2 - slapcat |grep dn: |wc -l = 18 >> >> >> > >> >> >> > Right now I can get them in sync with a slapcat/slapadd, but when >> >> >> > the >> >> >> > go >> >> >> > into production I wont be able to say for certain which one is >> >> >> > authoritative. That is the purpose of multi-master.... >> >> >> > >> >> >> > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 >> >> >> > bit >> >> >> > >> >> >> > Any ideas as to what I can do to stop this from happening? >> >> >> > >> >> >> > Pat >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> >> >> > >> >> > >> >> >> > >> > >> > > -- Sent from my mobile device http://www.suretecsystems.com/services/openldap/

1 0

CSN too old, ignoring - and therefore not syncing
by Pat Riehecky 23 Dec '08

23 Dec '08

Here is the quick and dirty what I am trying to do: ldap1 and ldap2 are supposed to be in MultiMaster. They are time synced to pool.ntp.org and each other (if they drift I would rather they sorta drift together, but pool should be keeping that in check). Right now I am just beating them up to see how 2.4.13 performs. (So far VERY well, minus this little problem) I have a rather small ldif (41 entries) that just wont sync (I'm starting small). Debug gives me ber_scanf fmt (m}) ber: ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 .<rid=001,sid=00 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 2,csn=2008122217 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 4721.855904Z#000 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 000#001#000000 do_syncrep2: cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000 do_syncrep2: rid=001 CSN too old, ignoring 20081222174721.855904Z#000000#001#000000 ldap_msgfree I am not exactly sure how it gotten to be "too old." The ldif I am importing is not the result of a slapcat or anything that would preserve the CSN or UUID attributes (not that syncrepl uses UUID). I am loading one single file with ldapadd which, in my understanding, sets up the CSN and wouldn't let me import one anyway. Each server has no entries until I load the one, so there shouldn't be any weird stale CSNs causing this. They are "sync'ed" almost instantly after the one system is loaded - I just don't have everything. After a sync: ldap1 - slapcat |grep dn: |wc -l = 41 ldap2 - slapcat |grep dn: |wc -l = 18 Right now I can get them in sync with a slapcat/slapadd, but when the go into production I wont be able to say for certain which one is authoritative. That is the purpose of multi-master.... OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux 32 bit Any ideas as to what I can do to stop this from happening? Pat

4 11

restricting ldap unix groups to groups of hosts.
by Martin Suehowicz 22 Dec '08

22 Dec '08

I am new to openldap. I am trying to restrict groups of users to groups hosts on centos machines. Netgroups or pam_access seem to get me part of the way there. However I do not want to touch the clients very much and would like them to have a uniform configuration. I would like ldap to hold the host groups, user groups and acl's for them. Is there a way do this? Thank You for any help you can provide. Martin

1 0

N-Way Multi-Master replication - delete problem
by Adrien Futschik 22 Dec '08

22 Dec '08

OK, But then what did I do wrong ? delete an entry shouldn't be a problem with N-Way Multi-Master replication ? should it ? Here is how I have setup-ed my masters : m1 -config : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW:< file://$CONFIGPWF m2 - config : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW:< file://$CONFIGPWF m1 - syncprov : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE m2 - syncrepl : dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=$CONFIGPW searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE m1 - schema : include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif m1 - backend : dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: $PASSWD olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Did I miss something ? Has anyone tested N-way Multi-master replication & encountered the same problem as me ? Adrien ======================================== Message date : Dec 19 2008, 07:11 PM From : "Quanah Gibson-Mount" <quanah(a)zimbra.com> To : adrien.futschik(a)atosorigin.com, openldap-technical(a)openldap.org Copy to : "Miguel Jinez" <miguel.jinez(a)gmail.com> Subject : Re: Re: N-Way Multi-Master replication - delete problem --On December 19, 2008 9:28:41 AM +0100 Adrien Futschik <adrien.futschik(a)atosorigin.com> wrote: > Hy everyone, > > I have just tested the same procedure with OpenLDAP 2.4.13. The problem > remains the same. > > Did I miss something ? Is this supposed to be like this ? > > I'm joining the modified script I'm using to setup both masters and the > LDIF files I'm using to add and remove an entry (+ attributes). > > I did not use access-log, is this supposed to work with N-Way > Multi-Master replication ? I thought it was only used in case of Delta > Synchronization/Replication. Correct, delta-syncrepl and MMR are not currently supported together (that may change in the future). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration Adrien Futschik

1 0

remove the /var/lib/ldap directory mistake !!!
by franck dufau 21 Dec '08

21 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hye all, i have remove the /var/lib/ldap directory by mistake ! darkness.... how rebuild the ldap database ? i can not find information about this ! i do not have backup....arfff.. tks by advance... Franck -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAklOfFoACgkQrKIazktK/hJ8SACfR2+IFx6HwaB77zrryWbaoEby T9YAoJ4YzJTsZdCiwXFWVAUL+I6CMDHH =ih79 -----END PGP SIGNATURE-----

1 0

Versioning entries in the DIT
by Lorenzo Pastrana 21 Dec '08

21 Dec '08

Hi, List I'm planning to store some 'versioned' data into an ldap directory, and trying not to reinvent the wheel ... if anybody has any good resource to share on the subject I'll be glad to hear. Thanks in advance, LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

3 6

handling forward-only links, DN+Binary and DN+String
by Andrew Bartlett 20 Dec '08

20 Dec '08

Having thought I got to the bottom of extended DN behaviour, I've come across more challenges, that I would like thoughts on. Handling renames of one-way links: OpenLDAP already does this, but Samba needs some help here (as we try to infer the rename from the presence of backlinks, but for one-way links, how should we know we are being linked to?) Handling of DN+Binary and DN+String one-way links. For example, wellKnownObjects: B:32:22b70c67d56e4efb91e9300fca3dc1aa:CN=ForeignSecurityPrincipals,DC=samba,DC=org This is a 'DN+Binary' syntax attribute (for resolving well known GUIDs into a DN), and must therefore follow when the well known target renames. MS-ADTS 3.1.1.1.6 specifies the behaviour. The challenge I see here is that I really do need an additional syntax in OpenLDAP. If I map this to just a binary string (as I do now), then the rename will not follow though. If I map it to a DN (as I had tried in the past), then the syntax is invalid. Is it entirely unreasonable to add an additional syntax? This is a bit of a 'hit and run' question, as I won't be able to carry on the discussion during Christmas/New Year, but any thoughts would be most welcome. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

1 0

In memory cache or bdb performance degradation when upgrading from openldap v2.3.27 to v2.4.11 ?
by Chiles, Michael 20 Dec '08

20 Dec '08

Openldap Technical folk, We have inherited an openldap farm that was deployed using openldap v2.3.27. We have been testing a newly compiled v2.4.11 with same compile flags as a possible replacement due to some replication errors we have seen, but have discovered other bigger problems with the new instance. We believe the issue may be related to in memory cache not working as expected, or that 2.4.11 does not use the hdb backend as efficiently as before. Can anyone confirm a negative performance difference between these versions, or an issue with cache? We are seeing major significant differences in the db_stat output with orders of magnitude difference in the number of attempted reads against the backend cache. I assume these are unsual and that in memory entry cache would normally prevent this traffic from reach the bdb cache. I assume we simply have something wrong in configuration, but I don't see an obvious explanation. If anyone has a moment to review, we would appreciate your feedback. Here is the process we followed, with supporting config info: We have a SLAMD benchmark test based on a real world use case where 400 clients make a "near" simultaneous connection to the directory and execute a search like the following: ldapsearch -h server1 -x - b "ou=myou,dc=mydc,dc=com" "objectclass=*" There are nearly 70,000 objects in this ou with 5 attributes each ( 3 of which are objectclass ), and nearly 210,000 objects in the entire directory. We have an objectclass index. 2.4.11 tests were performed on instances compiled on SLES9.3 64bit, 4 way dual core procs, 16GB RAM, using hoard memory manager, bdb 4.6, and cyrus-sasl-2.1.22 . 2.3.27 tests were performaned on SLES9.3 64bit, 2 way single core proc, 8GB RAM, using standard memory manager, and standard bdb ( 4.2 ). On the v2.3.27 instances, we see all 400 clients get a connection, and get their results. On the new v2.4.11 instance, we see around 150-175 clients get a connection, and the rest get a failure that they cannot reach the server. After more benchmarking, tcpdump, and loglevel -1 we know that the client traffic is getting to the box, but the openldap listener thread does not pick up the connection. We also see high numbers of processes waiting in the CPU run queue. Reducing the number of objects in the directory to 100 results in successful connections to all 400 clients, which lead us to believe the issue might be due to differences in read performance between the instances. The same DB_CONFIG was used in both cases, and the slapd.conf was the same, with some minor tweaks due to slightly different cache configuration options between the versions. Please see the DB_CONFIG and the hdb backend stanza from the slapd.conf file included below. We then did some basic single query tests of both instances and looked at the logs with loglevel -1 and the db_stat output. What we saw was a major difference between both instances on the db_stat results. As mentioned in the summary above, we don't have a good explanation for the difference, although it is significant, and reliable across multiple iterations of test. Please see the db_stat differences shown below. Also seems very unusual that the initial db cache stats would be so high on the new version. slapd.conf: 2.4.11 hdb stanza ( also tested these with the same cache numbers as below 2.3.27 instance with no difference. We reduced these to reasonable levels as old version config seemed overkill ): database hdb directory /local/mnt/ldap.2.4.11/cache-data threads 32 suffix "dc=mydc,dc=com" rootdn <<snip>> rootpw <<snip>> cachesize 500000 dncachesize 1000000 idlcachesize 30000000 sizelimit 10000000 loglevel stats sync dirtyread include /opt/ldap/indexes/my.indexes 2.3.27 hdb stanza database hdb directory /local/mnt/ldap/cache-data threads 32 suffix " dc=mydc,dc=com " rootdn <<snip>> rootpw <<snip>> cachesize 20971520 dbcachesize 20971520 ( not a typo - this one is "dBcachesize. The other is dNcachesize ) idlcachesize 20971520 sizelimit 10000000 loglevel stats sync dirtyread include /opt/ldap/indexes/my.indexes DB_config ( Same for both instances ): set_cachesize 1 1048576000 12 set_flags DB_LOG_AUTOREMOVE set_lg_bsize 2097512 set_lg_dir /local/mnt/ldap/cache-data ( this value points to correct directory in both instances ) set_flags DB_TXN_NOSYNC set_lg_regionmax 500000 set_lk_max_locks 30000 set_lk_max_lockers 30000 set_lk_max_objects 30000 set_tmp_dir /dev/shm After startup with no client test ( previous database instance was completely deleted and recreated using slapadd ), here are the db_stat -m output. I excluded some of the index db info for brevity: Version 2.4.11 1GB 1000MB Total cache size 12 Number of caches 12 Maximum number of caches 168MB 688KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 15M Requested pages found in the cache (99%) 24 Requested pages not found in the cache 9225 Pages created in the cache 24 Pages read into the cache 9244 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 9247 Current total page count 9247 Current clean page count 0 Current dirty page count 393252 Number of hash buckets used for page location 14M Total number of times hash chains searched for a page (14773760) 9 The longest hash chain searched for a page 14M Total number of hash chain entries checked for page (14764487) 0 The number of hash bucket locks that required waiting (0%) 0 The maximum number of times any hash bucket lock was waited for (0%) 0 The number of region locks that required waiting (0%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 9309 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 0 Threads waited on page I/O Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 1005002 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 3062 Pages created in the cache 2 Pages read into the cache 3064 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 419925 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 2967 Pages created in the cache 2 Pages read into the cache 2969 Pages written from the cache to the backing file Version 2.3.27 1GB 1000MB Total cache size. 12 Number of caches. 168MB 688KB Pool individual cache size. 0 Requested pages mapped into the process' address space. 22738 Requested pages found in the cache (99%). 285 Requested pages not found in the cache. 0 Pages created in the cache. 285 Pages read into the cache. 0 Pages written from the cache to the backing file. 0 Clean pages forced from the cache. 0 Dirty pages forced from the cache. 0 Dirty pages written by trickle-sync thread. 285 Current total page count. 285 Current clean page count. 0 Current dirty page count. 393252 Number of hash buckets used for page location. 23308 Total number of times hash chains searched for a page. 12 The longest hash chain searched for a page. 22738 Total number of hash buckets examined for page location. 46616 The number of hash bucket locks granted without waiting. 0 The number of hash bucket locks granted after waiting. 0 The maximum number of times any hash bucket lock was waited for. 641 The number of region locks granted without waiting. 0 The number of region locks granted after waiting. 297 The number of page allocations. 0 The number of hash buckets examined during allocations 0 The max number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation Pool File: dn2id.bdb 4096 Page size. 0 Requested pages mapped into the process' address space. 13076 Requested pages found in the cache (99%). 132 Requested pages not found in the cache. 0 Pages created in the cache. 132 Pages read into the cache. 0 Pages written from the cache to the backing file. Pool File: id2entry.bdb 16384 Page size. 0 Requested pages mapped into the process' address space. 9659 Requested pages found in the cache (99%). 138 Requested pages not found in the cache. 0 Pages created in the cache. 138 Pages read into the cache. 0 Pages written from the cache to the backing file. After 1 client query: Version 2.4.11 1GB 1000MB Total cache size 12 Number of caches 12 Maximum number of caches 168MB 688KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 15M Requested pages found in the cache (99%) 24 Requested pages not found in the cache 9244 Pages created in the cache 24 Pages read into the cache 9263 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 9266 Current total page count 9266 Current clean page count 0 Current dirty page count 393252 Number of hash buckets used for page location 14M Total number of times hash chains searched for a page (14753673) 9 The longest hash chain searched for a page 14M Total number of hash chain entries checked for page (14744381) 0 The number of hash bucket locks that required waiting (0%) 0 The maximum number of times any hash bucket lock was waited for (0%) 0 The number of region locks that required waiting (0%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 9328 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 0 Threads waited on page I/O Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 997746 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 3062 Pages created in the cache 2 Pages read into the cache 3064 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 410855 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 2967 Pages created in the cache 2 Pages read into the cache 2969 Pages written from the cache to the backing file Version 2.3.27 1GB 1000MB Total cache size. 12 Number of caches. 168MB 688KB Pool individual cache size. 0 Requested pages mapped into the process' address space. 299222 Requested pages found in the cache (98%). 7144 Requested pages not found in the cache. 0 Pages created in the cache. 7144 Pages read into the cache. 0 Pages written from the cache to the backing file. 0 Clean pages forced from the cache. 0 Dirty pages forced from the cache. 0 Dirty pages written by trickle-sync thread. 7144 Current total page count. 7144 Current clean page count. 0 Current dirty page count. 393252 Number of hash buckets used for page location. 313510 Total number of times hash chains searched for a page. 23 The longest hash chain searched for a page. 300752 Total number of hash buckets examined for page location. 627020 The number of hash bucket locks granted without waiting. 0 The number of hash bucket locks granted after waiting. 0 The maximum number of times any hash bucket lock was waited for. 14400 The number of region locks granted without waiting. 0 The number of region locks granted after waiting. 7164 The number of page allocations. 0 The number of hash buckets examined during allocations 0 The max number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation Pool File: dn2id.bdb 4096 Page size. 0 Requested pages mapped into the process' address space. 173225 Requested pages found in the cache (98%). 3233 Requested pages not found in the cache. 0 Pages created in the cache. 3233 Pages read into the cache. 0 Pages written from the cache to the backing file. Pool File: id2entry.bdb 16384 Page size. 0 Requested pages mapped into the process' address space. 125990 Requested pages found in the cache (97%). 3888 Requested pages not found in the cache. 0 Pages created in the cache. 3888 Pages read into the cache. 0 Pages written from the cache to the backing file. ########################## Thanks! -Michael

1 0

how to solve invalid structural object class chain
by owen nirvana 19 Dec '08

19 Dec '08

I try to a entry like this: cn = .. ,dc=..,dc=..,dc=..,dc=.. cn = .. objectClass: person objectClass: inetOrgPerson objectClass: organizatinoalRole objectClass: device objectClass: pkiUser roleOccupant: ... employeeNumber : .. userCertificate;binary :: BASE64 Encode icSerilNumber: .. tel: ... fax: ... telex: .. log reports " invalid structural object class chain in organizatinoalRole/Person or organizatinoalRole/inetOrgPerson etc" I try many combination about the order of person ,inetOrgPerson and organizatinoalRole, and the same error was reported. thanks for help gtalk:freeespeech@gmail.com

3 2

Re: Re: N-Way Multi-Master replication - delete problem
by Adrien Futschik 19 Dec '08

19 Dec '08

Hy everyone, I have just tested the same procedure with OpenLDAP 2.4.13. The problem remains the same. Did I miss something ? Is this supposed to be like this ? I'm joining the modified script I'm using to setup both masters and the LDIF files I'm using to add and remove an entry (+ attributes). I did not use access-log, is this supposed to work with N-Way Multi-Master replication ? I thought it was only used in case of Delta Synchronization/Replication. Adrien ======================================== Message date : Dec 18 2008, 02:24 PM From : "Miguel Jinez" <miguel.jinez(a)gmail.com> To : adrien.futschik(a)atosorigin.com Copy to : openldap-technical(a)openldap.org Subject : Re: N-Way Multi-Master replication - delete problem Maybe in openLdap 2.4.13 it would be solved. I had that problem, and I fixed it using accesslog, but it makes you lose performance.... 2008/12/18 Adrien Futschik <adrien.futschik(a)atosorigin.com> > I'm testing N-Way Multi-Master replication with OpenLDAP 2.411. > > I have setup 2 Masters (m1 & m2) starting form test050-syncrepl-multimaster > and modifying it. > > Every thing seems to work fine except deleting entries. > > Let me explain. > case 1 : > . When I add an entry on m1 it is successfully replicated on m2. > . When I try to delete this entry on m1, it is successfully removed from > m1, but not replicated on m2. > . When, I try to delete this entry on m2, it is successfully removed from > m2 & m1. > > case 2 : > . When I add an entry on m2 it is successfully replicated on m1. > . When I try to delete this entry on m2, it is successfully removed from > m2, but not replicated on m1. > . When, I try to delete this entry on m1, it is successfully removed from > m1 & m2. > > I don't have the same problem when I delete an attribute or update an > entry. Is this normal ? > > Adrien Futschik > Adrien Futschik

2 1

'Has A' vs 'Is A'
by Lorenzo Pastrana 19 Dec '08

19 Dec '08

Hi list, Me again ... I've got to compose some objects by inheritance of parent classes (Is A), I'm now on the point of building the actual object tree and I was wondering what is the preferred mechanism for aggregation (Has A) and controlling children types ... can I do this in the schema ? Thanks, LP. Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

1 0

Workflow / tools / practice working on a new shema : reload to cn=config or editing cn=config in place ?
by Lorenzo Pastrana 19 Dec '08

19 Dec '08

Hi, list Still a genuine noob.. ;P I'm working on a brand new shema to store my app's data .. What do you guys use to do when working on a 'new' directory ? a) work on a shema file / restart server b) work on a shema file / reload to cn=config c) edit cn=config / a) could be ok .. a little brutal but ... b) sounds tedious c) what tool do you use ? Thx. LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

5 8

how to solve invalid structural object class chain
by owen nirvana 19 Dec '08

19 Dec '08

I try to a entry like this: cn = .. ,dc=..,dc=..,dc=..,dc=.. cn = .. objectClass: person objectClass: inetOrgPerson objectClass: organizatinoalRole objectClass: device objectClass: pkiUser roleOccupant: ... employeeNumber : .. userCertificate;binary :: BASE64 Encode icSerilNumber: .. tel: ... fax: ... telex: .. log reports " invalid structural object class chain in organizatinoalRole/Person or organizatinoalRole/inetOrgPerson etc" I try many combination about the order of person ,inetOrgPerson and organizatinoalRole, and the same error was reported. thanks for help gtalk:freeespeech@gmail.com

1 0

Unix id command and Openldap
by okossuth＠antel.com.uy 18 Dec '08

18 Dec '08

Hi Does the id command works with a system using OPENLDAP authentication ? I have implemented a server with openldap 2.4 and several clients use this system to authenticate users, and works fine except that when I do a "id user" on a client it only gives me the information of the primary group which the user belongs to and not of the suplementary groups that he is also a member of in the LDAP server... any ideas?? Saludos, Oskar Kossuth Administrador UNIX ANTEL Telecomunicaciones El presente correo y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo anexando este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender immediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that is not the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy.

4 9

Solaris 10 LDAP Password issue
by John Gee 18 Dec '08

18 Dec '08

Hello Community, i have a problem with Solaris 10 LDAP password encryption to a OpenLDAP Server. When setting a inital Password with ldapadd login works fine, after the user changed inital Password on a Solaris-Station with 'passwd -r ldap' Solaris commited it with 'password successfully changed for john'. But the user cant login with the new Password. 1) Setting initial Password with ldapadd (Password: 8ASdhXY!Xy) version: 1 dn: uid=john,ou=people,ou=unix,o=kleinfeld,c=ch userPassword: {MD5}khVDRrTSYMHjTw7V6VEZwg== 2) User Login and change password with 'passwd -r ldap' (Password: 9DnxSF!dKS) version: 1 dn: uid=john,ou=people,ou=unix,o=kleinfeld,c=ch userPassword: {crypt}0vUAwIdPR4X2E Has someone a idea whats going wrong? I cant track down this problem. --( nsswitch.conf )--- passwd: compat passwd_compat: files ldap group: files ldap shadow_compat files ldap --( pam.conf )--- login auth sufficient pam_unix_auth.so.1 login auth required pam_ldap.so.1 rlogin auth sufficient pam_unix_auth.so.1 rlogin auth required pam_ldap.so.1 other auth sufficient pam_unix_auth.so.1 other auth required pam_ldap.so.1 --( /etc/security/policy.conf )--- CRYPT_ALGORITHMS_ALLOW=1,2a,md5 CRYPT_DEFAULT=__unix__ Regards John

2 2

Openldap 2.3.39 Solaris 9 (maybe memory leaks).
by Andrea Cirulli 18 Dec '08

18 Dec '08

Hi all, we are experiencing a lot of problems with openldap 2.3.39 on Solaris 9. We have the following set: 1- One producer Solaris 9 openldap 2.3.39 2- 19 Consumer, synchronized with the producer through syncrepl, Solaris 9 openldap 2.3.39 3- We manage the authentication on 2000 systems , almost equally distributed on the 20 ldap server The producer is often going down, each hour and less during the day. We noticed that every time the Producer is going down the virtual memory used is bigger than 3,8 Gb and the RSS (resident set size) is bigger than 2,1 Gb. This is a snapshot of prstat when openldap is about of crashing: PID USERNAME SIZE RSS STATE PRI NICE TIME CPU PROCESS/NLWP 1965 root 3873M 2179M sleep 60 0 0:41:40 0.5% slapd/27. The openldap is compiled in this way: ./configure --enable-bdb --enable-ppolicy --with-tls If these informations are not enough, I could provide other informations. It seems that there is a memory leak. P.S: We are using these systems since 2,5 years, the number of the managment systems is always growing up. We have this problem since 2 weeks. -- Andrea Cirulli

2 1

N-Way Multi-Master replication - delete problem
by Adrien Futschik 18 Dec '08

18 Dec '08

I'm testing N-Way Multi-Master replication with OpenLDAP 2.411. I have setup 2 Masters (m1 & m2) starting form test050-syncrepl-multimaster and modifying it. Every thing seems to work fine except deleting entries. Let me explain. case 1 : . When I add an entry on m1 it is successfully replicated on m2. . When I try to delete this entry on m1, it is successfully removed from m1, but not replicated on m2. . When, I try to delete this entry on m2, it is successfully removed from m2 & m1. case 2 : . When I add an entry on m2 it is successfully replicated on m1. . When I try to delete this entry on m2, it is successfully removed from m2, but not replicated on m1. . When, I try to delete this entry on m1, it is successfully removed from m1 & m2. I don't have the same problem when I delete an attribute or update an entry. Is this normal ? Adrien Futschik

2 1

Re: Versioning entries in the DIT
by Lorenzo Pastrana 18 Dec '08

18 Dec '08

On Wed, 2008-12-17 at 23:47 -0800, Howard Chu wrote: > ere's no standard or transparent way to do this. The most > straightforward > approach is to use a multi-valued RDN for your entries, e.g. instead > of > cn=foo,o=example > use > cn=foo+id=1,o=example > cn=foo+id=2,o=example > and so on. That makes sense ... > Except of course, that you can no longer reference entries without > knowing > their version number. Well if i consider a 'HEAD' entry (without a number) all others are old versions. And that would be also ok for me. Thanks for the tip. LP Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

1 0

RE: slapd won't run as service
by Quanah Gibson-Mount 17 Dec '08

17 Dec '08

--On Tuesday, December 16, 2008 9:22 PM -0800 Eddie Grenier <edo(a)edwaa.com> wrote: > set_lg_dir /usr/local/var/openldap-logs > ----------------------------------------------------- > > Admittedly, I know very little about these configuration options. I set > these parameters after finding a "suggested" DB_CONFIG file on the > internet. > > Any help is much appreciated! First, I would suggest you keep your replies on the list, so other people can gain knowledge too. Second, it clearly notes it stores the log files in /usr/local/var/openldap-logs. I'm guessing the slapd user can't access that location. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Floating point numbers in ldap
by Lorenzo Pastrana 16 Dec '08

16 Dec '08

I can't find any mentions of floating point/real data types in ldap attributes syntax, I've been reading the laconic 'Numeric Sting' specifications : 6.23. Numeric String ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' ) The encoding of a string in this syntax is the string value itself. Example: 1997 Would this work ok (matching & ordering) with a 1.997 value ? If not, how do I get ldap to match and order floating point scalars ? Thanks. Lo. Lorenzo Pastrana - Happy End Vision -------------------------- Design web Conception multimédia Communication visuelle et édition -------------------------- Tél. : 01 42 47 83 09 Fax : 01 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

2 4

ldap user not visible in home directory
by Donny George 16 Dec '08

16 Dec '08

Hello I have set up a ldap and used LAM to populate the database. though i can see the user created both on the server and the client , i cant see the users home directory I am also not able to use the command id username is this specifically because i committed some error in the config file or would it be something other major mistake ? somehow i cant figure out the mistake -- Donny George

1 0

slapd won't run as service
by Eddie Grenier 16 Dec '08

16 Dec '08

I've installed, configured and run OpenLDAP on my server. However, if I try to run it as a service using "service ldap start" it doesn't run. Also, the configuration file step returns "OK" as does the starting slapd step. I've narrowed it down to the fact that if slapd is run as user root things work just fine. I've already done "chown -R ldap:ldap /var/lib/ldap" but that doesn't seem to help. Here is the output I see when trying to run as user ldap: slapd startup: initiated. bdb_db_open: dc=edwaa,dc=com bdb_db_open: dbenv_open(/var/lib/ldap) bdb(dc=edwaa,dc=com): Invalid log file: log.0000000001: No such file or directory bdb(dc=edwaa,dc=com): PANIC: No such file or directory bdb(dc=edwaa,dc=com): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery bdb_db_open: dbenv_open failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30978) backend_startup: bi_db_open(0) failed! (-30978) slapd shutdown: initiated ====> bdb_cache_release_all bdb(dc=edwaa,dc=com): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem slapd shutdown: freeing system resources. bdb(dc=edwaa,dc=com): txn_checkpoint interface requires an environment configured for the transaction subsystem bdb_db_destroy: txn_checkpoint failed: Invalid argument (22) slapd stopped. connections_destroy: nothing to destroy. Any ideas would be much appreciated!

2 1

ACL for DIT structure rules
by Mansour Al Akeel 15 Dec '08

15 Dec '08

Hello all, In a previous email, I was told that we can implement *DIT* *structure* rules with openldap using ACL (http://www.openldap.org/lists/openldap-technical/200811/msg00152.html). Did any one have any success implementing these rules with ACL. I have searched the net for an example, but out of luck. Possibly a simple example will help a lot, just to give me an idea about the syntax for a DIT structure rule using ACL. Thank you.

3 9

Re: OpenLDAP replication
by Justin Lintz 15 Dec '08

15 Dec '08

Gavin, Thanks for your help. That appears to be working. In a failure situation where rid=1 goes down, and writes began occuring to rid=2, when I bring back up the server which was set to rid=1, what is the proper way to get them back in sync? Would it be just to change the rids and reload openldap? - Justin Lintz On Mon, Dec 15, 2008 at 2:57 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > > ----- "Justin Lintz" <jlintz(a)gmail.com> wrote: > >> Quanah, >> >> Looking at >> http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master >> it appears the example is with using cn=config to store the >> configuration. Is there an example somewhere with just using >> slapd.conf? > > I'm in the process of re-writing the replication section, but the following: > > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > > would just go under a database section like other syncrepl statements and look something like: > > overlay syncprov > > syncrepl rid=001 > provider=$URI1 > binddn="cn=config" > bindmethod=simple > credentials=secret > searchbase="cn=config" > type=refreshAndPersist > retry="5 5 300 5" > timeout=1 > > syncrepl rid=002 > provider=$URI1 > binddn="cn=config" > bindmethod=simple > credentials=secret > searchbase="cn=config" > type=refreshAndPersist > retry="5 5 300 5" > timeout=1 > > syncrepl rid=003 > provider=$URI1 > binddn="cn=config" > bindmethod=simple > credentials=secret > searchbase="cn=config" > type=refreshAndPersist > retry="5 5 300 5" > timeout=1 > > mirrormode on > > Remember the above is replicating cn=config though. > > Check back in the new year. > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Querying Attribute Type Definitions Problem
by Kevin Hardiman 15 Dec '08

15 Dec '08

I am trying to query the definition of an attribute type using one of the attribute type's aliases. For example, given: attributetype ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC2256: common name(s) for which the entity is known by' SUP name ) I am using Java's naming API to query the definition, and getting an exception saying the attribute type doesn't exist. Example: DirContext cnSchema = (DirContext)schema.lookup("AttributeDefinition/commonName"); I appreciate that this is not a Java list - I am trying to determine if what I am seeing is consistent with one of the many LDAP RFC's (i.e. I must use the actual attribute type's name to get the definition). If not I'll peddle my query elsewhere :) Thanks, Kevin Hardiman

2 1

schemacheck && valid objects check - just to note slapd behaviour
by Piotr Wadas 15 Dec '08

15 Dec '08

Hello, Using openldap 2.4.10 (x86), bdb backend. I had custom objectClass. I made it to be structuralObjectClass , and then created some object of this class in DIT. Everything works fine. Then (actually weeks later), I edited my objectClass definitionas, and made my custom objectClass to be an auxiliary class, and restarted slapd - everything was still working fine. Schema syntax is still valid, no schemacheck warnings. Then I did a slapcat dump - I realized what happened when came up, that I cannot load dump back with slapadd, because it contains objects, which, actually should generate errors. slapcat backups I did in the meantime was actually useless and I didn't note it. Now, I don't expect slapd to remove or ignore such objects, anyway while SERVING (returning), or indexing existing object of such kind, I'd expect some warning, that existing object does not conform existing schema. Or some tool to verify existing directory objects to find out about such situation - imagine if I hadn't been trying to retrieve from it for months, I wouldn't have learned it became useless :) May I please for some comments on such issue ? Regards, Piotr Wadas

2 1

Re: OpenLDAP replication
by Justin Lintz 15 Dec '08

15 Dec '08

Quanah, Looking at http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master it appears the example is with using cn=config to store the configuration. Is there an example somewhere with just using slapd.conf? - Justin Lintz On Thu, Dec 11, 2008 at 6:13 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 11, 2008 4:30 PM -0500 Justin Lintz > <jlintz(a)gmail.com> wrote: > >> Quanah, >> >> I'm still seeing the issue after making the change. I am able to >> however add entries to ldap02 and have them appear on ldap01, but not >> have them appear on ldap02. And adding anything to ldap01 does not >> get replicated to ldap02. Any other suggestions? >> - Justin Lintz > > Your email confuses me. I thought you were doing simple single > master/replica replication, but if you can modify on ldap02, then that means > it is not a replica. Or, it means you're writing to it via slapadd? That's > not legal. If you have a single master, writes must only occur to that > server. Otherwise, you need to set up MMR. The configs you sent before > certainly didn't indicate you were trying to do MMR. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Synchronizing Openldap with Windows Active Directory
by Aravind Arjunan 14 Dec '08

14 Dec '08

hi, I like to know wheather it is possible to synchronize Windows Active directory with RHEL Openldap. Some of my users are in openldap and some of them in Active Directory all i want to synchronize these users. Am trying for synchronizing the above two,but am not finding any proper link to refer. If any one knows plz help me with the link to refer. with regards aravind

6 9

Re: OpenLDAP replication
by Justin Lintz 12 Dec '08

12 Dec '08

Quanah, Thanks for your quick reply. I've made the change. I thought I had taken it from the openldap documents but clearly did not after reviewing them, I must have gotten mixed up with all the tabs I had open. Looks like its best to stick to the official documents (and this mailing list) rather than the how-tos out there - Justin Lintz On Tue, Dec 9, 2008 at 9:21 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 09, 2008 6:05 PM -0800 Quanah Gibson-Mount > <quanah(a)zimbra.com> wrote: > >> --On Tuesday, December 09, 2008 4:45 PM -0500 Justin Lintz >> <jlintz(a)gmail.com> wrote: >> >>> Hi, >>> >>> I am currently working on trying to configure replication between 2 >>> ldap servers. Here is my current setup.... >>> >>> >>> slapd.conf on ldap02 is": >>> >>> directory /var/lib/ldap2.4 >>> checkpoint 256 5 >>> index objectClass eq >>> index cn,mail,surname,givenname >>> eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember >>> eq index uid >>> eq,subinitial index sambaSID,sambaDomainName,displayName >>> eq referral ldaps://ldap01/ >>> syncrepl rid=123 >>> provider=ldaps://ldap01/ >>> type=refreshAndPersist >>> searchbase="dc=example,dc=net" >>> scope=sub >>> schemachecking=off >>> bindmethod=simple >>> binddn="cn=manager,dc=example,dc=net" >>> attrs="*" >>> credentials= >> >> You should specify an attrs= line unless you know what you're doing. You > > s/should/should NOT/ > > :) > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

Batch delete can't sync to other servers
by Bad Guy 11 Dec '08

11 Dec '08

Dear all, I have 4 LDAP servers running 2.4.11 and configured as 4 way masters. The sync type is refreshOnly and the interval is 30 sec. I create a LDIF file and contains about 500 entries in it. Then, I use ldapdelete -x -W -D "cn=Manager" -f delete.ldif to delete the 500 entries in server 1. Then, I check the other 3 servers, the 500 entries still exists. Only in server 1, those entries are not here. If I delete the entries one by one, the data can be deleted in the other 3 servers. Any idea ? Thanks _________________________________________________________________ 下載 Windows Live Messenger 8.5 搶鮮版，多元溝通、盡情分享，和即時傳訊好友線上同樂！— 立即下載 http://get.live.com/zh-cht-tw/betas/messenger_betas

1 0

not able to delete schema (using back-config)
by benjamin thielsen 11 Dec '08

11 Dec '08

hi- i've been experimenting with using back-config (2.4.11 courtesy of debian), and am able to add schema, but not able to delete the schema after being added. iirc, this should be possible in recent versions? i'm confident that the schema's not in use by any entries. adding the schema is successful: >ldapadd -xWD 'cn=admin,cn=config' -f java_schema.ldif Enter LDAP Password: adding new entry "cn={13}java,cn=schema,cn=config" ldapsearch confirms this: >ldapsearch -xWLLLb 'cn=schema,cn=config' -D 'cn=admin,cn=config' "(cn=*java*)" dn Enter LDAP Password: dn: cn={13}java,cn=schema,cn=config ldapdelete says: >ldapdelete -vxWD 'cn=admin,cn=config' 'cn={13}java,cn=schema,cn=config' ldap_initialize( <DEFAULT> ) Enter LDAP Password: deleting entry "cn={13}java,cn=schema,cn=config" ldap_delete: Server is unwilling to perform (53) i'm not seasoned at interpreting slapd debug output, but nothing specifically jumps out at me when running with -d -1: >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> conn=1 op=0 BIND dn="cn=admin,cn=config" method=128 do_bind: version=3 dn="cn=admin,cn=config" method=128 conn=1 op=0 BIND dn="cn=admin,cn=config" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=admin,cn=config" to "cn=admin,cn=config" send_ldap_result: conn=1 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1 op=0 RESULT tag=97 err=0 text= daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(13) connection_get(13): got connid=1 connection_read(13): checking for input on id=1 ber_get_next ldap_read: want=8, got=8 0000: 30 24 02 01 02 4a 1f 63 0$...J.c ldap_read: want=30, got=30 0000: 6e 3d 7b 31 33 7d 6a 61 76 61 2c 63 6e 3d 73 63 n={13}java,cn=sc 0010: 68 65 6d 61 2c 63 6e 3d 63 6f 6e 66 69 67 hema,cn=config ber_get_next: tag 0x30 len 36 contents: ber_dump: buf=0x8578290 ptr=0x8578290 end=0x85782b4 len=36 0000: 02 01 02 4a 1f 63 6e 3d 7b 31 33 7d 6a 61 76 61 ...J.cn={13}java 0010: 2c 63 6e 3d 73 63 68 65 6d 61 2c 63 6e 3d 63 6f ,cn=schema,cn=co 0020: 6e 66 69 67 nfig ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=1 op=1 do_delete ber_scanf fmt (m) ber: ber_dump: buf=0x8578290 ptr=0x8578293 end=0x85782b4 len=33 0000: 4a 1f 63 6e 3d 7b 31 33 7d 6a 61 76 61 2c 63 6e J.cn={13}java,cn 0010: 3d 73 63 68 65 6d 61 2c 63 6e 3d 63 6f 6e 66 69 =schema,cn=confi 0020: 67 g >>> dnPrettyNormal: <cn={13}java,cn=schema,cn=config> => ldap_bv2dn(cn={13}java,cn=schema,cn=config,0) <= ldap_bv2dn(cn={13}java,cn=schema,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={13}java,cn=schema,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={13}java,cn=schema,cn=config)=0 <<< dnPrettyNormal: <cn={13}java,cn=schema,cn=config>, <cn={13}java,cn=schema,cn=config> conn=1 op=1 DEL dn="cn={13}java,cn=schema,cn=config" send_ldap_result: conn=1 op=1 p=3 send_ldap_result: err=53 matched="" text="" send_ldap_response: msgid=2 tag=107 err=53 ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 02 6b 07 0a 01 35 04 00 04 00 0....k... 5.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 6b 07 0a 01 35 04 00 04 00 0....k... 5.... conn=1 op=1 RESULT tag=107 err=53 text= daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(13) connection_get(13): got connid=1 connection_read(13): checking for input on id=1 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x85e1d60 ptr=0x85e1d60 end=0x85e1d65 len=5 0000: 02 01 03 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 13 failed errno=0 (Success) connection_read(13): input error=-2 id=1, closing. connection_closing: readying conn=1 sd=13 for close connection_close: deferring conn=1 sd=13 conn=1 op=2 do_unbind conn=1 op=2 UNBIND connection_resched: attempting closing conn=1 sd=13 connection_close: conn=1 sd=13 daemon: removing 13 conn=1 fd=13 closed daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL what am i doing wrong? -ben

3 3

trouble with regex type constraint overlay
by benjamin thielsen 10 Dec '08

10 Dec '08

i'm experimenting with the constrain overlay, and have what i think is a fairly simply constraint that's giving me trouble. below are the details. i believe i've followed slapo-constraint(5) (and regex(7)) accurately, but i must be missing something. >cat montage_admin.ldif dn: uid = admin,ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com changetype: modify replace: uidNumber uidNumber: 5000 >ldapmodify -vxWD 'cn=admin,dc=ltn,dc=lvc,dc=com' -f montage_admin.ldif ldap_initialize( <DEFAULT> ) Enter LDAP Password: replace uidNumber: 5000 modifying entry "uid = admin ,ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com" ldap_modify: Constraint violation (19) additional info: modify breaks constraint on uidNumber >ldapsearch -vvxWLLLD 'cn=admin,dc=ltn,dc=lvc,dc=com' "(uid=admin)" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (uid=admin) requesting: All userApplication attributes dn: uid =admin,ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=c om userPassword:: e1NTSEF9TkF5TGVabXFWTU9zT01EZVNWdHA1Mm9uUWtOalg3cXY= objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top homeDirectory: /dev/null cn: admin uid: admin sn: admin givenName: admin gidNumber: 5001 uidNumber: 2016 >ldapsearch -vvxWLLLb 'cn=config' -D 'cn=admin,cn=config' "(objectClass=olcConstraintConfig)" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (objectClass=olcConstraintConfig) requesting: All userApplication attributes dn: olcOverlay={3}constraint,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcConstraintConfig olcOverlay: {3}constraint olcConstraintAttribute: uidNumber regex ^[:digit:]*$ thanks -ben

2 3

olcMonitoring attribute
by benjamin thielsen 10 Dec '08

10 Dec '08

hi- i've recently begun using back-config and was looking for some more detail on the purpose of the olcMonitoring attribute. my googling and searching of the list archives have revealed not much beyond references in cn=schema.ldif. thanks -ben

3 2

Re: bdb encryption
by ghenry＠OpenLDAP.org 10 Dec '08

10 Dec '08

----- "Howard Chu" <hyc(a)symas.com> wrote: > ghenry(a)OpenLDAP.org wrote: > > Hi All, > > > > I'm just testing bdb encryption and it works as expected out of the > box. > > > > But I'm trying to decrypt it using the bdb tools: > > > > [ghenry@suretec openldap-data]$ > /usr/local/BerkeleyDB.4.7/bin/db_verify objectClass.bdb > > db_verify: Encrypted environment: no encryption key supplied > > Segmentation fault > > Interesting. It shouldn't segfault, perhaps you should report that as > a bug to > Oracle. Will do. If I use "cryptkey testing" all tools work. If I enter the wrong password using cryptkey is segfaults again after stating wrong pass. > > So it segfaults, but it's the same with the key: > > > > [ghenry@suretec openldap-data]$ > /usr/local/BerkeleyDB.4.7/bin/db_verify -P "testing" objectClass.bdb > > db_verify: Invalid password > > Segmentation fault > > > > testing is set in slapd.conf via "cryptfile" and has the word > "testing" in it: > > How did you create the file? If you simply created it as a plain text > file, > then it probably has a trailing NewLine as well. In which case, the > NewLine is > part of the password... Checked this and recreated vi vim and just: echo testing > cryptfile. All results in the same invalid password and segfault. Cheers. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

OpenLDAP replication
by Justin Lintz 10 Dec '08

10 Dec '08

Hi, I am currently working on trying to configure replication between 2 ldap servers. Here is my current setup.... 2 servers, ldap01 and ldap02, both running centos 5.2 x86_64 with openldap2.4 installed from http://staff.telkomsa.net/packages/rhel5/openldap/x86_64/ openldap2.4-servers-2.4.11-1.rhel5 my slapd.conf on ldap01 is: modulepath /usr/lib64/openldap2.4 moduleload syncprov.la TLSCertificateFile /etc/ssl/openldap2.4/ldap.pem TLSCertificateKeyFile /etc/ssl/openldap2.4/ldap.pem TLSCACertificateFile /etc/ssl/openldap2.4/ldap.pem loglevel 32 256 1024 database bdb suffix "dc=example,dc=net" rootdn "cn=Manager,dc=example,dc=net" rootpw directory /var/lib/ldap2.4 checkpoint 256 5 index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index sambaSID,sambaDomainName,displayName eq index entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 200 slapd.conf on ldap02 is": directory /var/lib/ldap2.4 checkpoint 256 5 index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index sambaSID,sambaDomainName,displayName eq referral ldaps://ldap01/ syncrepl rid=123 provider=ldaps://ldap01/ type=refreshAndPersist searchbase="dc=example,dc=net" scope=sub schemachecking=off bindmethod=simple binddn="cn=manager,dc=example,dc=net" attrs="*" credentials= This appears to work but it seems after some time the replication stops working , not seeing anything in the logs either. Also with this setup, given a situation where ldap01 died and ldap02 took over, when I brought ldap01 back online, would configuration changes need to be made to ensure any changes that were made to ldap02 were replicated back properly or am I not using the proper replication technique for this situation? I'm still a bit new to OpenLDAP so I apologize if I explained anything incorrrectly. My end goal is to have 2 ldap servers in place where in the event of a failure the secondary could take over and when the primary is restored, have it fail back over without any loss of changes. - Justin Lintz

2 3

Unable to login as local user when LDAP master has problem
by sparklings 09 Dec '08

09 Dec '08

Hi, I'm having about 30 Linux Servers in which I have one LDAP master server and remaining all of them are ldap clients.All the users who login to Linux servers are LDAP users. Whenever there is a problem with the LDAP service in Master, I have the following issues. 1.ldap user anyway cannot login to any of the server but even as root or local user,we are unable to login to any of the client/master server. 2.If I'm already logged in any of the client server and when there is a problem with the LDAP master service, the server becomes extremely unstable/slow and cannot execute any command and everything hangs. Could you suggest if I'm missing any setting in LDAP master or slave?as I should not have problem in login to the servers as a local/root user even when LDAP master is down Thanks in Advance, Rahul

2 1

Cannot start kerberos signing/sealing when using TLS/SSL
by Jeremiah Martell 09 Dec '08

09 Dec '08

I'm using openldap, cyrus-sasl, heimdal, and openssl. I use the standard kerberos "kinit" tool to get my TGT, this is successful. I use the standard openldap "ldapsearch" tool to attempt to do a LDAP+GSSAPI over TLS (cert level "demand") search, and I get two errors. The first error is an "inappropriate auth", which seems to come from openldap. The second error is "Cannot start kerberos signing/sealing when using TLS/SSL", which seems to come from GSSAPI-land. Interesting facts: - This fails against Windows 2003 AD. - But succeeds against a BSD box running an openldap server. - The following all had the cert level set to "demand"... - - LDAP works with the Win2003 AD. - - LDAP+SSL works with the Win2003 AD. - - LDAP+TLS works with the Win2003 AD. - - LDAP+GSSAPI works with the Win2003 AD. - - LDAP+GSSAPI+SSL works with the Win2003 AD. - - But LDAP+GSSAPI+TLS does NOT work with the Win2003 AD. - If I switch the cert level to "allow", then LDAP+GSSAPI+TLS works with Win2003 AD. It seems everything is ok with my kerberos setup, since LDAP+GSSAPI works. It seems everything is ok with my certs, since LDAP+SSL and LDAP+TLS and LDAP+GSSAPI+SSL works. I'm at a loss as to why this particular case: LDAP+GSSAPI+TLS (cert level "demand") against Windows 2003 AD doesn't work. I tried looking through the openldap, cyrus-sasl, heimdal, and openssl code for "Cannot start kerberos signing/sealing when using TLS/SSL" but I didn't find anything. My guess is that this comes from the server. The only thing I could find googling was from here: http://en.gentoo-wiki.com/wiki/Active_Directory_Authentication_using_LDAP that says: "GSSAPI Error: Cannot start kerberos signing/sealing when using TLS/SSL SASL/GSSAPI already encrypts the LDAP traffic, this error is trying to say TLS/SSL is redundant." My questions: (1) Is this simply the fact that Windows 2003 AD doesn't support LDAP+GSSAPI+TLS (with cert level set to "demand")? (2) Why would the Win2003 AD server behave properly with SSL but not TLS? (3) Why does the openldap server work fine, but not the Windows 2003 AD server? (3) Has this been addressed in some newer release of openldap/cyrus-sasl/heimdal/openssl code? (4) Is there anything I could have done wrong in my Win2003 AD setup? (5) Any other general suggestions/ideas to help? Thanks, -- - Jeremiah Martell http://inlovewithGod.com

2 1

bdb encryption
by ghenry＠OpenLDAP.org 09 Dec '08

09 Dec '08

Hi All, I'm just testing bdb encryption and it works as expected out of the box. But I'm trying to decrypt it using the bdb tools: [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_verify objectClass.bdb db_verify: Encrypted environment: no encryption key supplied Segmentation fault So it segfaults, but it's the same with the key: [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_verify -P "testing" objectClass.bdb db_verify: Invalid password Segmentation fault testing is set in slapd.conf via "cryptfile" and has the word "testing" in it: (gdb) run -P testing objectClass.bdb Starting program: /usr/local/BerkeleyDB.4.7/bin/db_verify -P testing objectClass.bdb db_verify: Invalid password [New Thread 0xb7fd86c0 (LWP 17626)] Program received signal SIGSEGV, Segmentation fault. 0x0021f82d in __memp_resize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so Missing separate debuginfos, use: debuginfo-install glibc-2.9-2.i686 (gdb) bt #0 0x0021f82d in __memp_resize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so #1 0x0021bac9 in __memp_set_cachesize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so #2 0x08048cfd in __db_rpath () #3 0x0804b018 in ?? () #4 0x00000000 in ?? () (gdb) q Any ideas? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

why does ldapsearch just hang with SASL/EXTERNAL authentication started?
by borderline_ocd-er 08 Dec '08

08 Dec '08

hello list, :¬O H-E-E-E-E-E-L-L-L-L-P-P-P!!!! for the past week and a half, i've been trying to get an openldap client on a mac os x 10.4.11 (OpenLDAP 2.2) to talk to an ldap directory server (sun iPlanet directory server 5.1) on a solaris 9 sparc box; using client authentication with x509 certificates for both the server and the client. i have successfully configured client authn between the directory server (ds) on the solaris box and a precompiled ldapsearch binary client (also running on that same solaris box). the ldapsearch binary is part of the netscape security services (nss) ldap c sdk 6.0.x that came bundled with - what sun calls it's - "ds resource kit 5.2 (dsrk)". since client authn works successfully between those 2 components running local to each other, i figured a remote client authn setup shouldn't be much of a stretch (if the openldap.org docs are to be believed). BOY! was i wrong! after copying to my mac os x box, the same ca cert and client cert (in .pem format) that worked successfully on the solaris box, i configured ldap.conf and .ldaprc to point to the certs and keys (see below). when i run an openldap ldapsearch on the mac, the tls handshake appears to succeed (see below); then the sasl/external client authn appears to kick off; then it just hangs! the last thing that's output to the shell is "SASL/EXTERNAL authentication started". but the shell cursor just hangs there; flashing away - doing nothing! the solaris ds access logs seem to report that a bind took place as a result of the mac openldap ldapsearch attempt: "...conn=45 SSL client bound as cn=bilbo,ou=development,o=helpme.com" please, will you help me to get my mac openldap ldapsearch client to authenticate to my solaris ds using a client cert? i've read and reread the openldap.org tls docs (http://www.openldap.org/doc/admin24/tls.html); i've read and reread the openldap.org sasl docs (http://www.openldap.org/doc/admin24/sasl.html); i've scoured this list; i've scoured the cyrus sasl list (http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl); i've tried adding the "-I" switch to the ldapsearch command, but that results in an endless loop of being prompted over and over to enter an authorization id. i've tried editing /etc/syslog.conf with the following: "local4.* /var/log/openldap.log" but nothing ever gets logged to that file! i've spent so much time trying to solve this problem on my own, that my wife has threatened to leave me for my best friend if i don't stop spending so much time on this! my dog snarled at me and bit my behind today because he doesn't recognize me anymore! my daughter is talking about becoming an "exotic dancer" because i don't pay her enough attention from working on this! my failure to accomplish such a seemingly simple task has made me consider taking my own life! seriously though: I NEED YOUR HELP! thanks in advance for your help. ========================================================== ds access logs after successful ldapsearch on solaris box: ========================================================== ... [07/Dec/2008:04:29:38 +0000] conn=0 fd=49 slot=49 SSL connection from 127.0.0.1 to 127.0.0.1 [07/Dec/2008:04:29:38 +0000] conn=0 SSL 128-bit RC4; client O=helpme.com, OU=Development, CN=bilbo; issuer E=ldapca(a)helpme.com, CN=ldapca, OU=development, O=helpme.com, L=Chicago, ST=IL, C=US [07/Dec/2008:04:29:38 +0000] conn=0 SSL client bound as cn=bilbo,ou=development,o=helpme.com [07/Dec/2008:04:29:38 +0000] conn=0 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL [07/Dec/2008:04:29:38 +0000] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=bilbo,ou=development,o=helpme.com" [07/Dec/2008:04:29:38 +0000] conn=0 op=1 SRCH base="ou=development,o=helpme.com" scope=2 filter="(cn=bilbo)" attrs=ALL [07/Dec/2008:04:29:38 +0000] conn=0 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [07/Dec/2008:04:29:38 +0000] conn=0 op=2 UNBIND [07/Dec/2008:04:29:38 +0000] conn=0 op=2 fd=49 closed - U1 ... ========================================================== hanging mac osx openldap ldapsearch command results: ========================================================== bilbo$ ldapsearch -v -H ldap://bebop -s sub -b "" -LLL -d -7 -ZZ ldap_initialize( ldap://bebop ) ldap_create ldap_url_parse_ext(ldap://bebop) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP bebop:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.0.8:389 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_ndelay_on: 3 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_open_defconn: successful ldap_send_server_request ber_flush: 31 bytes to sd 3 ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (infinite timeout), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: bebop port: 389 (default) refcnt: 2 status: Connected last used: Sun Dec 7 16:04:48 2008 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ber_get_next ber_get_next: tag 0x30 len 95 contents: ber_dump: buf=0x004044b0 ptr=0x004044b0 end=0x0040450f len=95 0000: 02 01 01 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 ...xZ......;Star 0010: 74 20 54 4c 53 20 72 65 71 75 65 73 74 20 61 63 t TLS request ac 0020: 63 65 70 74 65 64 2e 53 65 72 76 65 72 20 77 69 cepted.Server wi 0030: 6c 6c 69 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 lling to negotia 0040: 74 65 20 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 te SSL...1.3.6.1 0050: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_read: message type extended-result msgid 1, original id 1 ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 ber_scanf fmt (a) ber: ber_dump: buf=0x004044b0 ptr=0x004044f7 end=0x0040450f len=24 0000: 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 ..1.3.6.1.4.1.14 0010: 36 36 2e 32 30 30 33 37 66.20037 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 ber_scanf fmt (x) ber: ber_dump: buf=0x004044b0 ptr=0x004044f7 end=0x0040450f len=24 0000: 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 ..1.3.6.1.4.1.14 0010: 36 36 2e 32 30 30 33 37 66.20037 ber_scanf fmt (}) ber: ber_dump: buf=0x004044b0 ptr=0x0040450f end=0x0040450f len=0 ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com, issuer: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com TLS certificate verification: depth: 0, err: 0, subject: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=bebop, issuer: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write certificate verify A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A ldap_sasl_interactive_bind_s: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_int_sasl_open: host=bebop => ldap_dn2bv(16) ldap_err2string <= ldap_dn2bv(O=helpme.com,OU=Development,CN=bilbo)=0 Success SASL/EXTERNAL authentication started [shell just hangs here] ========================================================== ========================================================== ds access logs after hanging ldapsearch from mac os x: ========================================================== ... [07/Dec/2008:16:04:48 +0000] conn=45 fd=49 slot=49 connection from 10.0.0.9 to 10.0.0.8 [07/Dec/2008:16:04:48 +0000] conn=45 op=0 EXT oid="1.3.6.1.4.1.1466.20037" [07/Dec/2008:16:04:48 +0000] conn=45 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [07/Dec/2008:16:04:49 +0000] conn=45 SSL 128-bit RC4; client O=helpme.com, OU=Development, CN=bilbo; issuer E=ldapca(a)helpme.com, CN=ldapca, OU=development, O=helpme.com, L=Chicago, ST=IL, C=US [07/Dec/2008:16:04:49 +0000] conn=45 SSL client bound as cn=bilbo,ou=development,o=helpme.com [end of file] ========================================================== ldap.conf file: ========================================================== HOST bebop BASE dc=bebop,dc=helpme,dc=net TLS_REQCERT demand TLS_CACERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bebopCACert.pem ========================================================== .ldaprc file: ========================================================== URI ldaps://bebop:636 HOST bebop BASE "" TLS_REQCERT demand TLS_CACERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bebopCACert.pem TLS_CERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bilboClientCert.pem TLS_KEY /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bilboClientKey.pem SASL_MECH EXTERNAL ==========================================================

1 0

Using AD authentication with an external LDAP for authorization
by Stefan Stefansson 08 Dec '08

08 Dec '08

Hi. I'm new to the world of LDAP and directory servers and trying to figure out the best solution to my problem. This isn't exactly OpenLDAP specific, I still haven't figured out whether OpenLDAP is the right thing to use or whether there is any good solution to my situation. So I hope you forgive me for asking this here but I'm hoping to tap into the collective knowledge of this list for ideas. My situation is that I have taken over the systems administration of a group of Linux servers for the Computer Science department at my school. The school has an IT department but we would like to be independent of them, both to relieve them of as much as possible of our demands (which can be quite demanding and unorhadox) as well as having a more agile environment here (again touching on the fact that they are overloaded). The IT department mostly runs Microsoft solutions and the whole domain is controlled by Active Directory. I'm not familiar with AD myself so I don't know whether it's a particularly "good setup" or not but I have no reason to believe otherwise. So, what I want to do is set up our own directory server but of course I would like to use some open source solutions... or at the very least, something that runs on Linux. There I would like to control authorization for different users to different servers, clusters, web systems (such as wiki webs, Subversion, bug tracking software etc). On the other hand, I would prefer that authentication be somehow delegated to the AD server for any user who is on the domain to avoid duplicating data. However, I still would like to be able to define additional users in my LDAP directory server that are not necessarily on the domain. So my setup would have to be able to distinguish whether authentication should be handled by my LDAP server or the AD server. I would think this could happen in two ways: 1) user credentials are replicated over to the LDAP server from AD which means that LDAP would handle all authentication or 2) LDAP server would delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows. I assume 1 is difficult to do as sending the user credentials out from AD is probably considered bad practice (if it is at all possible that is). The backup plan would be for me to get administrative rights to some part of the AD server and then we'd use only that server for all authentication and authorization requirements but as I said, we would like to be as independent from their services as possible in addition to not being particularly fond of having to use AD (is there any sort of a usable web access to that? would this mean I would have to have a Windows box set up to perform any administrative tasks?). This is my situation. Sorry for the log winded explanation. Does anybody have an idea of how to accomplish something like this? I'd be happy to hear about any case studies or white papers on similar subjects (I can't believe I'm the first one to want to do this). I'm also open for suggestions on what tools to use. Open source is not a requirement (but preferred). Best regards, Stefan Freyr.

4 3

OpenLDAP + Active Directory User and Password Sync
by Animesh Bansriyar 07 Dec '08

07 Dec '08

Hi All, I have been working on getting Active Directory User Information (username/password) to sync with OpenLDAP. I have been working on different theories to get them to sync when I chanced upon acctsync. Acctsync (http://acctsync.sourceforge.net/) seems to do the work but looks like there has been no work on it since 2005. I am looking forward to revive the project and want to contribute as well on it. If there is something similar can somebody please point me out to it. This is what I am looking for: 1. Any User Added to Active Directory shall be added to OpenLDAP as well and any password modified from Active Directory should be modified in OpenLDAP as well - where OpenLDAP would be used for System Auth in a Linux environment. 2. Any User Added to OpenLDAP should be added to Active Directory along with the same credentials and any password modified in OpenLDAP should be modified in Active Directory as well. I have somewhat been able to take care of the second requirement but the first seems to be the more difficult one in a Windows 2008 Environment - The appoach I have taken is to have a daemon running which polls the OpenLDAP Server with clear-text passwords every few minutes and adds/modifes accounts in the AD Server accordingly - I know this is the least elegant way to do it but as of now it works for me. Can somebody suggest ways to do the above or maybe share experiences on the same. Thanks, Animesh

1 0

Re: Syncrepl question
by Quanah Gibson-Mount 06 Dec '08

06 Dec '08

--On Friday, December 05, 2008 1:18 PM -0800 Ivan Ordonez <iordonez(a)nature.berkeley.edu> wrote: > Hi Quanah, > > I was able to get it to work earlier when I add the startls=critical > line. It work when I did it on the slave1, at the time, I made the > slave1 as the master. Thanks so much for that. Now moving on the the > real master, things did not go well. Now the issue is that, any changes > I make on the master, doesn't go to the slaves. I have two slaves and I > want those two to get the changes. > > example: > > Master > | > _ _ _ _ _| |_ _ _ _ _ > | | > | | > | | > Slave1 Slave2 > > Now, when I make any change on the master, the changes will take effect > only on master and not on the slaves. I will get this error on both > slaves. > Is this because of the acl.bdc.readonly.conf line I have on both slave's > slapd.conf file? pdbedit -Lv username still work only on account were no > changes are made. Do you see any errors on the master from the slaves binding? Are you sure they have the right permissions to the master? Did you look at what sync logging shows? What is the contextCSN on your master versus your slaves? At this point, I suggest we take this discussion back to the list, since we got back your earlier config issue (starttls not being set in the syncrepl config). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 3

Syncrepl question
by Ivan Ordonez 04 Dec '08

04 Dec '08

Hi all, We have a small size domain with about 500 users and computers. We are using Samba with Openldap integration to authenticate user login and file sharing. Our setup is consist of 3 servers running Gentoo Linux - 1PDC and 2BDCs. As for replication, we are still using "slurpd". Any changes or modification is done through the PDC which replicates the changes to BDC1, then from BDC1, it then goes down to BDC2 - it's like a chain. We want to start using "syncrepl" soon as a way to replicate our database but I'm not sure were to start. We want to setup all of our machine to sync with each other everyday, and not worry which machine is use to make changes, modification, etc.... I'm not sure which syncrepl function to use to achieve what we want to do. Is "N-Way Multi Master replication" the correct choice to do this? We are using "BDB" database on each servers, and would like to achieve this with minimal downtime if possible. What is the best way to do this? Please advise. Any help is greatly appreciated. -Ivan

3 12

How to take backup of the openldap users data from the command prompt in LINUX Fedora
by Jyotishmaan Ray 04 Dec '08

04 Dec '08

My problem. I had been using the phpldapadmin browser 1.0.1 to access the openldap database. Recently when I observed that when I logged onto the phpldapadmin browser, the features of the browser didnt show up as usually it appears. So that was my problem as such now I am not able to use the GUI of the browser to do importing of the ldif files for adding new users to my database. Now that the situation is urgent, I need to take a back up of my openldap database for the users data. Please give me the full comand details, so that I can take a back up of my database safely before exploring the problem of phpldapadmin browser. Thanks, in advance, jmaan Thanks, Jyotishmaan Ray Moderator Of Paradise Groups http://yahoogroups.com/group/Spirituality-Paradise Are You Spiritually Aware !!! Are You Enjoying Yourself !!! See What All You Had Been Missing !!!! Please Join Immediately By Sending A Blank Mail @ Spirituality-Paradise-subscribe(a)yahoogroups.com

3 3

OpenLDAP 2.4.10 Logging
by Lydon, Mark 03 Dec '08

03 Dec '08

I am running OpenLDAP 2.4.10 in a Solaris 10 local zone. All working fine, except that I want to log to a specific file using this command line; nohup /usr/local/libexec/slapd -d 64 -d 256 2> /tmp/slapd.log & This run ok in background, but when I exit my shell the job ends. I've often used nohup like this to start jobs and disassociate them from the users login shell, why doesn't it work here? Regards Mark Lydon AT&T

2 1

Samba objects replication
by mike 03 Dec '08

03 Dec '08

Hello everybody. I have configurated Samba with openLdap. My problem is that openldap slave does not synchronize the samba objects from the openldap master. All the others objects (ou, o, dc) are synchronized normaly Can someone help me please? Thanks Migue

2 1

2.4.13 could not start
by owen nirvana 02 Dec '08

02 Dec '08

libldap_r-2.4.so.2 no version information (reqired by slapd) liblber-2.4.so.2 no version information (reqired by slapd) in debian lenny-081114, I don't remove openldap 2.4.11 debian package which had installed, because synpatic always want to remove many many related package too. But I don't think it is the problem. thanks for instruction gtalk:freeespeech@gmail.com

2 1

Can join Domain but cannot login.
by Emil Sicad - ISD 02 Dec '08

02 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

2 2

hello
by Donny George 01 Dec '08

01 Dec '08

Hello After much work i set up and openldap server and client and established their connectivity and also populated the database with phpldapadmin. but wen i do ldapsearch -x or getent passwd or when i search for the specific ids i cant get the user information which i entered through the gui. as i am not sure the config files which i should look into to correct this error, could someone guide me. did i miss in installing soething or have i not edited any specific file thank you in advance -- Donny George

1 0

RE: Some servers are delay synced...
by Quanah Gibson-Mount 01 Dec '08

01 Dec '08

Look for any change noting fixes to slapo-syncprov and/or syncrepl. --Quanah --On Monday, December 01, 2008 1:56 PM +0000 Bad Guy <badguy9588(a)hotmail.com> wrote: > Would you mind telling me the ITS# related to this ? > > I can't find it in the changes of 2.4.12 and 2.4.13 about this one. > > Thanks > >> Date: Mon, 1 Dec 2008 00:30:24 -0800 >> From: quanah(a)zimbra.com >> To: badguy9588(a)hotmail.com; openldap-technical(a)openldap.org >> Subject: Re: Some servers are delay synced... >> >> --On Monday, December 01, 2008 7:39 AM +0000 Bad Guy >> <badguy9588(a)hotmail.com> wrote: >> >> > Dear sir, >> > >> > We have got a N-way master (N=4) openldap running in version 2.4.11 >> > under linux environment. >> > >> > Any idea on this ? >> >> Yes, read the changelog for the changes between 2.4.11 and 2.4.13. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Principal Software Engineer >> Zimbra, Inc >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration > > > > __________________________________________________ > 用部落格分享照片、影音、趣味小工具和最愛清單，盡捊> 秀出你自己 — Windows Live Spaces -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Authenticate a user
by Mansour Al Akeel 01 Dec '08

01 Dec '08

Hello all, I am trying to create a user and authenticate this user. I need to give an admin a way to access and modify account. I was able to succeffuly add a user, but can not connect using this account. The only way I am able to connect is using the Manager's DN. I keep on getting invalid credentials. I have reset the password for this user few times to make sure it's correct. Still unable to authenticate. I am using JXplorer to connect to that server. Here's the corresponding section from the log file. I hope it helps. Dec 1 13:52:11 neptune slapd[13518]: >>> slap_listener(ldap:///) Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: do_bind Dec 1 13:52:11 neptune slapd[13518]: >>> dnPrettyNormal: <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: <<< dnPrettyNormal: <uid=user,dc=test,dc=com>, <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: do_bind: version=3 dn="uid=user,dc=test,dc=com" method=128 Dec 1 13:52:11 neptune slapd[13518]: bdb_dn2entry("uid=user,dc=test,dc=com") Dec 1 13:52:11 neptune slapd[13518]: send_ldap_result: conn=13 op=0 p=3 Dec 1 13:52:11 neptune slapd[13518]: send_ldap_response: msgid=1 tag=97 err=49 Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: ber_get_next on fd 12 failed errno=0 (Success) Dec 1 13:52:11 neptune slapd[13518]: connection_closing: readying conn=13 sd=12 for close Dec 1 13:52:11 neptune slapd[13518]: connection_close: conn=13 sd=-1 I don't know what I am missing, but I have been trying to resolve this for few hours with no success.

1 1

how group work with samba & openldap ?
by franck dufau 01 Dec '08

01 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hye all, i have install samba as PDC with openldap authentification everything work fine. But i want to create différent group with différent privileges on folder How gestion of group work with Openldap authentification because users are not in /etc/passwd and domain group are not in /etc/group !? I don't find information about this... can you help me ? cordialement Franck Dufau -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkkz66UACgkQrKIazktK/hICSgCeOiQGmEHKk5qHGiC5sMTzyux7 uMgAn2LY3axBykW29YkGQy1k4+5vi0dE =hPaV -----END PGP SIGNATURE-----

2 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 01 Dec '08

01 Dec '08

---- Original message ---- >Date: Tue, 25 Nov 2008 15:52:57 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Monday, November 24, 2008 10:00 PM -0800 Quanah Gibson-Mount ><quanah(a)zimbra.com> wrote: > >> --On Monday, November 24, 2008 6:05 PM -0800 Quanah Gibson-Mount >> <quanah(a)zimbra.com> wrote: >> >>> --On Monday, November 24, 2008 9:00 PM -0500 William Jojo >>> <w.jojo(a)hvcc.edu> wrote: >>> >>>> >>>> >>>> ---- Original message ---- >>>>> Date: Thu, 20 Nov 2008 11:02:40 -0800 >>>>> From: Quanah Gibson-Mount <quanah(a)zimbra.com> >>>>> Subject: Re: Delta-sync symptom in 2.4.11 >>>>> To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org >>>>> >>>>> --On Thursday, November 20, 2008 10:38 AM -0500 William Jojo >>>>> <w.jojo(a)hvcc.edu> wrote: >>>>> >>>>> >>>>>> Otherwise this is just like test043, except or the missing dn's. :-) >>>>>> >>>>>> Any ideas? >>>>> >>>>> Try current RE24 CVS. There have been a number of replication related >>>>> fixes made since 2.4.11. >>>>> >>>> >>>> I just tried 2.4.13. The problem still persists. I will check out the >>>> CVS version in the morning. >>> >>> There's nothing different between RE24 and 2.4.13 at this point in time, >>> so there's no point in trying RE24 if you've tried 2.4.13 and it still >>> fails. >>> >>> I suggest you submit an ITS with a way to easily reproduce the issue. >> >> Also make sure to include your exact configuration on the master & >> replica, and any log messages at loglevel sync, so the contextCSN data is >> gathered. > >Also, does the replicator have unlimited time and size limits to search the >master with? > Quanah, Just got back from holiday to find that tests I launched before hand had completed successfully. I had realized that I had not set unlimited prior to my previous tests. Thank you very much for your persistence in following up. Although not a bug (thankfully), I did realize my ignorance of some configuration options. Cheers, Bill

1 0

Can join domain but cannot login
by Emil Sicad - ISD 01 Dec '08

01 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

1 0

{SSHA} for PHP
by Jack van Rock 01 Dec '08

01 Dec '08

Hi, I want to modify a website-login-system (PHP) to check passwords which are deocoded with SSHA. My script should compare the clear password, which I get from a FORM, with the SSHA-hash of the password, which is in the database (MySQL). The dates in the MySQL-DB comes from a LDAP. This is my script: <?php $password_sub = "test"; //Das Passwort erhalte ich über ein HTML-Formular $passsowrd_hash_db = base64_decode("e1NTSEF9aH...."); //Diesen base64-Hash erhalte ich aus der Datenbank. //Er wird gleich decodiert, da man daraus das $salt benötigt. //Dann hat er die Form {SSHA}hxtMi.... $salt = base64_decode(substr($passsowrd_hash_db , 32)); //Berechnung des $salt $hash = "{SSHA}" . base64_encode(pack("H*", sha1($password_sub.$salt)).$salt); ?> But the script doesn't work, because the generated hash isn't the same as the hash from the database. But I don't now, what's wrong? May someone help me? m@xx

2 1

Some servers are delay synced...
by Bad Guy 01 Dec '08

01 Dec '08

Dear sir, We have got a N-way master (N=4) openldap running in version 2.4.11 under linux environment. The 4 servers can be synced immediately. However, after running for several hours, 2 of the servers are synced immediately while the other 2 servers are synced after around 60 mins. Scenairo : - Server 1, 2, 3, 4 are synced. After running for several hours, the following symptoms occur : - update record in server 3, server 4 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 4, server 3 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 1, server 2 will be updated immediately, but server 3 and server 4 got the update 1 hour later. - update record in server 2, server 1 will be updated immediately, but server 3 and server 4 got the update 1 hour later. Server 1 and server 2 are in same LAN segment, server 3 and server 4 in another LAN segment. There are firewalls between server 1/2 and server 3/4, but for same LAN segment, no firewall in between, only firewall in between different LAN segment. Any idea for this 1 hour delay synced ? Every server are config with syncrepl as shown below : bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=ABCDE" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" # Performance tuning directives sizelimit 5000 threads 50 idletimeout 0 cachesize 10000 checkpoint 256 15 Also, from the LDAP log, it shows a lot of "cmp -1, too old" message. Also, from the log, some error message like the following is found : server01 slapd[6386]: do_syncrep2: rid=004 (-1) Can't contact LDAP server server01 slapd[6386]: do_syncrepl: rid=004 retrying server01 slapd[6386]: syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) server01 slapd[6386]: syncrepl_entry: rid=004 be_search (0) server01 slapd[6386]: syncrepl_entry: rid=004 cn=test1,ou=test,o=ABCD server01 slapd[6386]: syncrepl_entry: rid=004 be_modify (0) Any idea on this ? Thanks a lot.... _________________________________________________________________ 下載 Windows Live Messenger 8.5 搶鮮版，多元溝通、盡情分享，和即時傳訊好友線上同樂！— 立即下載 http://get.live.com/zh-cht-tw/betas/messenger_betas

2 1

SASL error
by Mansour Al Akeel 30 Nov '08

30 Nov '08

I am not able to modify a user from CLI. [root@neptune ~]# ldapsearch -D "cn=Manager,dc=test,dc=com" -W -b "dc=test,dc=com" -x -h localhost I get the all the enteries. However, When I do: [root@neptune ~]# ldapmodify -D "cn=Manager,dc=test,dc=com" -W -h localhost Enter LDAP Password: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database If I use -x option, it hangs there for ever after I enter the password. Any idea ?

2 2

hello
by Donny George 28 Nov '08

28 Nov '08

Hello I installed ldap client and software on two ubuntu machines. but when i try to log in with the phpldapadmin gui it displays Network Error (tcp_error) A communication error occurred: "Connection refused" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time. i am new to ldap and i cudnt really find a forum or thread which was talking about this problem. hope someone can help me -- Donny George

2 1

Community request: Real World OpenLDAP Deployments
by Gavin Henry 28 Nov '08

28 Nov '08

Dear All, I'd like to get some examples written up for http://www.openldap.org/doc/admin24/appendix-deployments.html If anyone is interested and allowed to share some information, I'd love to hear from you. The more strange the setup the better! Many thanks, Gavin. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

3 2

Samba failed to bind Ldap
by Emil Sicad - ISD 27 Nov '08

27 Nov '08

Good day to all, Im new to LDAP, I've been working with SAMBA-LDAP implem. and i have these messages logs: Nov 25 17:56:59 smbldap slapd[9974]: sql_select option missing Nov 25 17:56:59 smbldap slapd[9974]: auxpropfunc error no mechanism available Nov 25 17:56:59 smbldap ldap: slapd startup succeededs Nov 25 17:57:07 smbldap smbd[9987]: [2008/11/25 17:57:07, 0] lib/smbldap.c:smbldap_connect_system(850) Nov 25 17:57:07 smbldap smbd[9987]: failed to bind to server with dn= cn=Manager,dc=fcb.net,dc=. Error: Can't contact LDAP server Nov 25 17:57:07 smbldap smbd[9987]: (unknown) Nov 25 17:57:23 smbldap smbd[9987]: [2008/11/25 17:57:23, 0] lib/smbldap.c:smbldap_search_suffix(1155) Nov 25 17:57:23 smbldap smbd[9987]: smbldap_search_suffix: Problem during the LDAP search: (unknown) (Timed out) Question 1) Is my ldap working fine? 2) Why can't samba bind to Ldap? Pls teach me to understand those kind errors. Emil Sicad Cebu Mitsumi Inc Information Systems Division

3 5

schema design and schema restrictions
by Mansour Al Akeel 27 Nov '08

27 Nov '08

Hello all, I an new to LDAP, and I have a need to migrate the existing system to ldap as this will ease a bit the management for the new system implementation. I need to authenticate users for a web site, and for the internal system ( linux, windows stations .... etc). Now the available account objectclass is structural so I can not user inetorgperson with account as both are structural. In this case I decided to extend inetOrgPerson, and add username and password as a MUST attributes. This is because all the users have access to the web site and they need authentication, but some users will need to have access to the machines. In this case I will create a new objectClass (ie. accountInfo) which containts the info I need (home directory, shell, loginScript, .... etc). The issue here is how do I restrict the accountInfo to be added under User ? This is in fact not only specific to this senario. I couldn't find any docs about how to prevent objectClass domain to be added under group ! Finally, how do other ldap admin deal with similar cases ? Any advice ? thank you.

4 13

Tracking down persistent OpenLDAP corruption
by Gilbert Wilson 26 Nov '08

26 Nov '08

So... I'm having a problem with persistent corruption in Apple's Open Directory. I believe this corruption is related to OpenLDAP and the BerkeleyDB. I was hoping that folks here might be able to help me track down whether this is the problem or not. Essentially, what is happening is that user accounts will "disappear" from workgroup manager and dscl[1]. Accounts that have maintained a persistent connection will continue to be authenticated. But, accounts that are not authenticated will be unable to authenticate. The Directory Administrator account, for example, cannot authenticate at these times. If I restart slapd, all the missing accounts that had persistent connections will no longer be able to authenticate. An LDIF export, however, will show that the accounts are all still there. A regular repair and a catastrophic repair of of the BerkleyDB does not work.[2] The first time this happened, it DID work, but subsequent events have not been so easily fixed. A restore from backup is the only way to fix it. However, I suspect that there is malformed data lurking somewhere in the OpenLDAP system. The backups all have this malformed data. Thus, it doesn't take very much for the system to get corrupted again. A hard shutdown does it every time, and a minor upgrade to the OS did it, too. The standard suggested fix is destroy and rebuild the Open Directory setup. For obvious reasons, I would like to avoid this. I want to know *what* is happening. If it is, in fact, malformed data that is becoming corrupt, *what* data should I be examining, *where* is it located, and *how* do I check it for anomalies? Has anyone else had this kind of persistent corruption of their LDAP system? What was causing it? How did you find it? Any leads or words of wisdom would be greatly appreciated. Gilbert Wilson [1] http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/dsc… [2] http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/db_…

2 1

Disabling User Account
by piyush joshi 26 Nov '08

26 Nov '08

Dear Team, Is there any Schema or Attribute which can be used to disable user account if that account is not being used from one month or by providing date in advance to disable the account in future automatically. -- Regards Piyush Joshi 9415414376

3 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 26 Nov '08

26 Nov '08

---- Original message ---- >Date: Thu, 20 Nov 2008 11:02:40 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Thursday, November 20, 2008 10:38 AM -0500 William Jojo ><w.jojo(a)hvcc.edu> wrote: > > >> Otherwise this is just like test043, except or the missing dn's. :-) >> >> Any ideas? > >Try current RE24 CVS. There have been a number of replication related >fixes made since 2.4.11. > I just tried 2.4.13. The problem still persists. I will check out the CVS version in the morning. Cheers, Bill >--Quanah > >-- > >Quanah Gibson-Mount >Principal Software Engineer >Zimbra, Inc >-------------------- >Zimbra :: the leader in open source messaging and collaboration

2 3

Re: configuring ppolicy overlay using cn=config
by Quanah Gibson-Mount 25 Nov '08

25 Nov '08

--On Tuesday, November 25, 2008 11:19 AM +0100 Vincent Panel <yohonet(a)gmail.com> wrote: > Well, I've more or less solved the problem : > > I've guessed the equivalent for cn=config was the following ldif entry : > > dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcPPolicyConfig > olcOverlay: {1}ppolicy > olcPPolicyDefault: "cn=default,ou=policies,dc=example,dc=com" > > And here's what I've got when I added this entry : > > ldap_add: Invalid syntax (21) > additional info: olcPPolicyDefault: value #0 invalid per syntax > > Now, I've removed the quotes of the last line and I have another > error, but it seems caused by the PPolicyDefault object not > existing... > > But I'm a bit moving forward without any piece of documentation, it's > a bit hard... Please keep replies on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Issues in Performance Tesing of OpenLDAP using SLAMD
by Shilpa Sethi 25 Nov '08

25 Nov '08

Hi all, Currently I am involved in an activity that deals with measuring performance of OpenLDAP on Solaris 10 - x_86 machine. Hardware Specs - 1. Two identical servers (Servers 'NodeA' and 'NodeB') with the following configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2220 (2.8GHz/1MB) processor * 1x 4GB PC2-5300 DDR2-667 memory * 2x 146GB HDD 15K RPM (Hardware RAID-1, so available disk space is 146 GB). 2. One server 'NodeC' is used as a traffic injector and has the following hardware configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2218 * 4x 2GB PC2-5300 DDR2-667 memory * 4x 73GB HDD 10K RPM. Software installation common to all servers: 1. JDK 1.6 2. Symas CDS Version 3.9.3 For traffic injection, SLAMD v2.0.0-alpha1 is installed on NodeC. Both Node A and B are Mirror-Mode replicas. The database is having 1 Million subscribers and both the cache sizes are set as follows in slapd.conf : cachesize 250000 idlcachesize 250000 i.e 25% of the subscriber base. Two identical SLAMD SearchRate Jobs, one pointing to Node A and other to Node B are run from Node C. However, there is a wide difference in the number of lookups/sec performed in both the servers. The read rates obtained vary in the ratio of 1:7 or so on both the servers. I am using 1 SLAMD client and 2 threads for targeting on 1 server. If I increase the number of thread, SLAMD starts reporting exceptions. Please suggest a way by which Predictable/ similar read rates could be achieved on both the servers as both being exactly same. Thanks a ton in advance for suggesting a solution. Regards Shilpa Sethi A R I C E N T Plot 6, Electronic City, Sector - 18, Gurgaon 122015 Haryana, India ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 11

Symbol problem with 2.4.13
by William Jojo 25 Nov '08

25 Nov '08

AIX 5.3, OpenLDAP 2.4.13, BDB 4.6.21.3 Previously I emailed the list about symlinking libldap.so to libldap_r.so. For OpenLDAP 2.4.11 this worked perfectly. I have built 2.4.13 with the exact same options and now I get the following error from ldapsearch after symlinking: Could not load program ldapsearch: rtld: 0712-001 Symbol ldap_derefresponse_free was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_parse_derefresponse_control was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_create_deref_control_value was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. Is this a problem with lazy runtime resolution or did something library-wise change in this version? Or, am I just being an idiot and missing something obvious? Cheers, Bill

2 1

Lost Replications
by Burton, Kris - Acision 24 Nov '08

24 Nov '08

All, I am running 2.4.11 with ITS 5709 back ported. What I found digging through CVS was that this impacted syncprov.c 1.147.2.38 ctxcsn.c 1.40.2.6 -> 1.40.2.10 proto-slap.h 1.670.2.31 I can attach my patch file if that would be helpful. What we are seeing now is that on our patched version of 2.4.11 that we lose every 32767 or 32768 entry. This is consistent first we lose the 32767 then the 32768 and this pattern continues rotating back and forth. We pulled the latest RE24 branch and the problem appears to be resolved there. I am not sure if this is a separate ITS, that has been resolved or if there is more to the ITS 5709 that I missed. Hopefully this problem is distinct enough that someone recognizes it and can point me to the proper fix. In the test we produced this we were running mirror mode replication and can produce the problem adding 1 million entries via slapadd. We plan to move forward with 2.4.13 when it's released but for now we need to go forward with 2.4.11. Thanks, Kris Burton This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

RE: Data sync tools
by Bad Guy 24 Nov '08

24 Nov '08

The delay seems due to lost of network connections can't be detected (traceroute indicates 7 hops). So, can I use mastercheckint=5 in slapd.conf to periodic check the master server ? 5 means 5 sec ? Also, the parameter "mastercheckint" can be used in N-way master ? Thanks a lot. > Date: Thu, 20 Nov 2008 20:51:02 +0000> From: ghenry(a)OpenLDAP.org> To: badguy9588(a)hotmail.com> CC: openldap-technical(a)openldap.org> Subject: Re: Data sync tools> > > ----- "Bad Guy" <badguy9588(a)hotmail.com> wrote:> > > Dear all,> > > > We are running a multi-master openldap 2.4.11, we always get delay> > sync in some servers.> > > > Is there any way to do a periodic re-sync without restarting the> > openldap slapd daemon ?> > Can you provide more details please.> > -- > Kind Regards,> > Gavin Henry.> OpenLDAP Engineering Team.> > E ghenry(a)OpenLDAP.org> > Community developed LDAP software.> > http://www.openldap.org/project/ _________________________________________________________________ 聰明搜尋和瀏覽網路的免費工具列 — MSN 搜尋工具列 http://toolbar.live.com/

2 2

ldap_simple_bind_s ok ,but ldap_simple_bind no
by owen nirvana 24 Nov '08

24 Nov '08

I write a dll using Novel CLDAP SDK, because no dev files from openLDAP could be use in windows. basically, they are same, and I found the same problems yet. ldap_simple_bind could not work , but ldap_simple_bind_s is ok. the former return "Operations Error", maybe it is the problem of LDAP Server, ( debian lenny, openLDAP 2.4.11 deb) gtalk:freeespeech@gmail.com

2 1

configuring ppolicy overlay using cn=config
by Vincent Panel 22 Nov '08

22 Nov '08

Hi, I was able to succesfully load the module and "assign" the overlay to the database by using cn=config configuration style. I had to import an LDIF similar to this : add olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy to have the equivalent of the "overlay ppolicy" directive in slapd.conf But now, I try to have the equivalent of the "ppolicy_default" directive. I've had a quick look at the code and it seems and attribute olcPPolicyDefault exists, but it doesn't work... Could you give me a hand ? Thanks, Vincent

2 1

Re: import LDIF file from openldap to redhat directory server
by Pierangelo Masarati 21 Nov '08

21 Nov '08

Please keep postings to the list revathi ganesh wrote: > Thanks for your reply.. > Can you give me the procedure how to back up the entire openldap to LDIF file > > # ldapsearch -x -LLL > openldap.ldif > > Is this correct. No. Please read my previous message, which contains an indication of the correct procedure. p. > > Thanks > > > --- On Fri, 21/11/08, Pierangelo Masarati <ando(a)sys-net.it> wrote: > >> From: Pierangelo Masarati <ando(a)sys-net.it> >> Subject: Re: import LDIF file from openldap to redhat directory server >> To: "revathi ganesh" <cholam20(a)yahoo.co.in> >> Cc: openldap-technical(a)openldap.org >> Date: Friday, 21 November, 2008, 12:23 AM >> revathi ganesh wrote: >>> Dear gurus >>> >>> I have installed redhat directory server in a new >> server. The OS is RHEL V5. >>> We already are running openldap in RHEL V4. Now how >> can I import the all the datas (user accounts) from openldap >> to RHDS. >>> Please give me the procedure. >> To extract the data in LDIF, you can use slapcat(8). Then, >> you probably better ask on a RHDS list. >> >> p. >> >> >> Ing. Pierangelo Masarati >> OpenLDAP Core Team >> >> SysNet s.r.l. >> via Dossi, 8 - 27100 Pavia - ITALIA >> http://www.sys-net.it >> ----------------------------------- >> Office: +39 02 23998309 >> Mobile: +39 333 4963172 >> Fax: +39 0382 476497 >> Email: ando(a)sys-net.it >> ----------------------------------- > > > Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/ Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

6 6

Memory consumption issue
by tkohlhepp 21 Nov '08

21 Nov '08

Hi guys, I've discovered a major memory issue. We have an OpenLDAP server (2.4.11) running with almost 2 million entries. When I do a ldapsearch to retrieve the entire tree the memory consumption grows and grows and will never stop before it ate the entire RAM and swap. My slapd.conf file looks like this: include /var/ldap/ldap-ds/etc/schema/core.schema include /var/ldap/ldap-ds/etc/schema/netmobile.schema include /var/ldap/ldap-ds/etc/schema/netmobile.acc.schema include /var/ldap/ldap-ds/etc/schema/netmobile.zMRDB.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/ldap/ldap-ds/var/run/slapd.pid argsfile /var/ldap/ldap-ds/var/run/slapd.args access to * by dn="cn=replica,ou=replica,ou=ldapaccounts,o=netmldap" write by users read by anonymous read access to * by self write by users read by anonymous read #threads 2 # all logging #loglevel -1 # only syncrepl logging loglevel 16640 ####################################################################### # BDB database definitions ####################################################################### database monitor access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,ou=netm,ou=people,o=netmldap" write by dn.exact="cn=admin,ou=netm,ou=people,o=netmldap" read by * none database bdb suffix "cn=accesslog" rootdn "cn=Admin,o=netmldap" directory /var/ldap/ldap-ds/cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=Admin,o=netmldap" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database config rootdn "cn=admin,cn=config" rootpw config database bdb suffix "o=netmldap" rootdn "cn=Admin,o=netmldap" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}5ycg8tSV/i0Z99FKaylr0Az5x1nBA8TC directory /var/ldap/ldap-ds/o=netmldap #dbcachesize 1000000 cachesize 1000 idlcachesize 3000 cachefree 500 searchstack 8 #readonly on # Indices to maintain index default pres,eq index cn index netmzMRDBPhoneNumber index netmAccNumAddr index netmAccNumPort index netmLogin2 index netmPortalName index netmCarrierID # new indices - 2007-01-15 index netmLogin pres,eq index netmClientContractUniqueName index netmPrivateMail index netmContactTecEmail index netmContactBillingEmail index netmFirmEmail index netmContactCommEmail index netmzMRDBCarrier index netmzMRDBblacklistLA index netmzMRDBPortingDate index objectClass pres,eq index entryCSN,entryUUID eq # Save the time that the entry gets modified lastmod on overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 limits dn.exact="cn=Admin,o=netmldap" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited sizelimit -1 The DB_CONFIG look like this set_cachesize 0 8435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 # will automatically remove transaction logs # this setting isn't recommended set_flags DB_LOG_AUTOREMOVE When I start slapd is consumes that much RAM total kB 478476 After doing the search it looks like this total kB 937316 I've done a pmap -x to see where the memory goes but this process is marked as anonymous. So I don't know how to get this memory back. I have to restart the LDAP server to get this memory released. I would appreciate if someone could help me to solve this issue. Thanks Thorsten

5 7

Ldap Add Fail
by karthikeyan.chetty＠wipro.com 21 Nov '08

21 Nov '08

Dear open-ldap Team, Currently we are using ldap Version-2.4.8 on our Fedora Core 9 machine. When we try to create a computer account using ldap-add with non admin user we are getting error "insufficientAccessRights". Please let us know how we can add computer account in Active Directory with non admin users?? Thanks in advance. S.Karthikeyan Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

RE: Debugging a user authentication
by Adrian Marsh 21 Nov '08

21 Nov '08

All, I'm not sure if my questions here are getting through to the group (I don't see a copy to myself) I've diagnosed this issue. The user has a "£" (UK Pound) in his password. Remove it and everything authenticates OK. Are there settings in Apache/LDAP for controlling what characters can be used as passwords? Adrian ________________________________ From: Adrian Marsh Sent: 14 November 2008 11:49 To: 'openldap-technical(a)openldap.org' Subject: Debugging a user authentication Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

5 11

Delta-sync symptom in 2.4.11
by William Jojo 20 Nov '08

20 Nov '08

Running 2.4.11 on AIX 5.3, I have setup a delta-syncrepl test with bdb (not hdb). Now the software passes test043, but when I setup the first copy from the master, the following happened: The master is populated with 62485 dn's. When the replica was started it sync'ed 29786 dn's. I had to stop the replica and restart it to make the sync move along (several times...). second sync pulls 15858 dn's third sync pulls 4428 dn's forth sync pulls nothing, but the replica has only 50072 dn's and does not sync further. Is does not appear to be an ACL issue since the replicator account has read access to * on the master. Otherwise this is just like test043, except or the missing dn's. :-) Any ideas? Cheers, Bill

2 1

import LDIF file from openldap to redhat directory server
by revathi ganesh 20 Nov '08

20 Nov '08

Dear gurus I have installed redhat directory server in a new server. The OS is RHEL V5. We already are running openldap in RHEL V4. Now how can I import the all the datas (user accounts) from openldap to RHDS. Please give me the procedure. Thanks Cholam20 From Chandigarh to Chennai - find friends all over India. Go to http://in.promos.yahoo.com/groups/citygroups/

2 1

RE: cont contact server since 3 days+please help
by Burton, Kris - Acision 20 Nov '08

20 Nov '08

>From the results below it looks like your server is not even coming up. This would explain why you are not able to search or add entries. Next thing to look at is to see if you are getting any useful information in the slapd.log. This should be in /var/log/slapd.log. If you don't know where it is located then try using the locate command I think ubuntu should have that or something equivalent. If you don't find one then you might need to enable the log in /etc/syslog.conf. I use RH so I assume something similar is available on ubuntu. I added the list back to the CC so others that might know more about ubuntu specifics can help and so they can assist you as well. --Kris ________________________________ From: Donny George [mailto:donny008@gmail.com] Sent: Wednesday, November 19, 2008 3:13 PM To: Burton, Kris - Acision Subject: Re: cont contact server since 3 days+please help hello kris this are the results that i get when i try to listen , guess this is not wat u were expecting root@ubuntu:/home/administrator# ps -eaf | grep slapd root 14183 14172 0 22:07 pts/0 00:00:00 grep slapd root@ubuntu:/home/administrator# netstat -na | grep 389 root@ubuntu:/home/administrator# telnet 10.4.139.5<http://10.4.139.5> 389 Trying 10.4.139.5... telnet: Unable to connect to remote host: Connection refused i tried the earlier steps like ldapsearch -d 255 after reading different forums of ldap but please dont misunderstand me to be an expert in openldap could you tell me how to establish the connectivity or where did i go wrong thanking you don On Wed, Nov 19, 2008 at 10:16 AM, Burton, Kris - Acision <kris.burton(a)acision.com<mailto:kris.burton@acision.com>> wrote: Have you on the server side verified that LDAP is up and listening on the proper port? ps -eaf | grep slapd netstat -na | grep 389 tcp 0 0 0.0.0.0:389<http://0.0.0.0:389> 0.0.0.0:* LISTEN If the above come back and indicate it is up and listening see if you can telnet to the <ip> 389 and get something back. Also you could check to see if you are getting errors on server startup by checking the slapd.log on the server side and see if it is reporting any errors. If you are using the command line search are you specifying the remote server using the -h option? Most of the errors seem to indicate there is nothing listening on the server to handle the search request. --Kris Burton ________________________________ From: openldap-technical-bounces+kris.burton=acision.com<http://acision.com>@OpenLDAP.org [mailto:openldap-technical-bounces+kris.burton<mailto:openldap-technical-bounces%2Bkris.burton>=acision.com<http://acision.com>@OpenLDAP.org] On Behalf Of Donny George Sent: Wednesday, November 19, 2008 8:47 AM To: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Subject: cont contact server since 3 days+please help hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389<http://10.4.139.5:389> ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389<http://10.4.139.5:389> ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. -- Donny George This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

3 3

Data sync tools
by Bad Guy 20 Nov '08

20 Nov '08

Dear all, We are running a multi-master openldap 2.4.11, we always get delay sync in some servers. Is there any way to do a periodic re-sync without restarting the openldap slapd daemon ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Error on boot
by Ronni Feldt 20 Nov '08

20 Nov '08

Hi, I've installed and configured LDAP and Kerberos which works fine. The only problem is that when I start my computer, I get the following error: udevd[2282]: nss_ldap: failed to bind to LDAP Server ldap://ldap.one.com: Can't contact LDAP Server udevd[2282]: reconnecting to LDAP Server... udevd[2282]: could not connect to any LDAP Server as (null) - Can't contact LDAP Server udevd[2282]: could not search LDAP Server - Server is unavailable I then have restart and boot into another dist I have installed and edit the following files: nsswitch.conf pam.d/common-auth common-account common-password common-session And remove kerberos & ldap Restart and then I can login, but without Kerberos and LDAP. How do I solve this? Best Regards Ronni

3 2

Advise on tuning
by Maykel Moya 19 Nov '08

19 Nov '08

I have a box (Proliant DL560) with this features: - 4GB RAM - 3 x Xeon 2.8 GHz - 2 x HD SCSI 10k RPM (No RAID) I have the BDB in one of those HD and the logs in the other one. When I installed the server I wasn't enough sure about a correct value for cachesize so I decided to play safe. sldcu DB_CONFIG --------------- set_cachesize 0 1073741824 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/sldcu set_flags DB_LOG_AUTOREMOVE accesslog DB_CONFIG ------------------- set_cachesize 0 715827883 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/accesslog set_flags DB_LOG_AUTOREMOVE I was reading this[1] yesterday and found out that a I have a very large value. For my dc=sld,dc=cu DB I have a 6.2 MB dn2id.bdb and a 56 MB id2entry.bdb, the DIT contains about 60k entries. Normally I larger value is a Good Thing(TM) but I'm specially worried about slapd using around 40%-50% time of (one) CPU and eventually a message of 'deferring operation' gets logged. The server is attending 30 connections per second sustained during working hours. Read Waiters are about 100 sustained during this same period. Yesterday I sent a message to the list asking for opinions about that value for Read Waiters because it doesn't sound good to me, but well, I know that 'sounds good' is very subjective. I was running 2.3.38 yesterday morning and upgraded to 2.4.11. With the same setup (only the slapd changed) the mail service got deeply affected. Dovecot began to take several (+10) seconds to authenticate, in other cases, the POP3/IMAP connection was dropped due to timeout. While Dovecot was failing my slapd.log were solid filled by 'deferring operation' messages. I stopped Dovecot, the messages dissapears, I started Dovecot, the message began again to fill logs. So, I thank it could be some problem on Dovecot side (although it was playing nice with slapd 2.3.38). Thanks God I hit man slapd-hdb and learn about cache tuning values there. I then raised olcDbCacheSize / olcDbDNCacheSize / olcDbIDLCacheSize and things began to calm down. I wonder how slapd 2.3.38 were nicely serving Dovecot without the tuning I made. On the other hand I have the suspiction, based on benchmark data published on the list, that there is something wrong with that large cache plus 50% CPU for less than 30 connections per second. I very much appreciate any help/advise/hint someone could give me about this issue. Regards, maykel [1] http://www.openldap.org/faq/data/cache/1075.html

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Will do. I'm glad that there are community as such. This is a great place to learn and get help. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Thanks very much Gavin for all your help. All is working as it should. >> > > No problem. Just make sure you pass on what you've learned :-) > >

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Thanks very much Gavin for all your help. All is working as it should. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Few more questions Gavin. >> >> Our primary domain controller certificate is also expiring next month. >> What is the best way to handle this? Does the certificate and keys on >> the backup domain controller has any connection to the certs and keys >> of the primary domain controller and the other backup domain >> controller? >> > > Other than being signed by the Certificate Authority, none. As long as > you use the same FQDN for the certs as before and the CA doesn't change, > then all is good. > > >> I would be relieve to hear that I can make brand new certificate and >> keys for each machine and they have no connection with each other. >> >> Thanks for all your help. >> >> -Ivan >> >> >> ghenry(a)OpenLDAP.org wrote: >> >> ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: >> >> Looking at the debug log, it is expired. It puzzle me because the >> certs on the other two machine are working correctly. Check their >> expiry dates with: >> >> openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text >> >> Since this is the case (certificate expires), is it safe to create a >> new one for this machine? Of course, then sign it with the cacert, >> something like: >> >> ./CA.sh -newreq >> ./CA.sh -sign >> > >

1 0

cont contact server since 3 days+please help
by Donny George 19 Nov '08

19 Nov '08

hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George

2 1

Re: Openldap and TLS issue
by ghenry＠OpenLDAP.org 19 Nov '08

19 Nov '08

----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > Looking at the debug log, it is expired. It puzzle me because the > certs on the other two machine are working correctly. Check their expiry dates with: openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text > Since this is the case (certificate expires), is it safe to create a > new one for this machine? Of course, then sign it with the cacert, something like: ./CA.sh -newreq ./CA.sh -sign -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Looking at the debug log, it is expired. It puzzle me because the certs on the other two machine are working correctly. Since this is the case (certificate expires), is it safe to create a new one for this machine? Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Hi, >> >> Our environment is consist of 3 domain controllers - 1 primary and 2 >> backup. All domain controller are running on Gentoo platform using >> Samba with Openldap for user login and authentication. One of the >> backup domain controller has been acting up lately and will not start >> >> samba properly. A quick look at the log showed: >> >> slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= >> slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) >> slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 >> (IP=0.0.0.0:389) >> >> It seems obvious that the issue is with certificate. The certificate >> we >> are using was created using the primary domain controller and were >> then >> copied to both backup domain controller. If I create a brand new >> certificate using the backup domain controller having certificate >> issue, >> will that interfere with the certificate on the primary domain >> controller? Will that cause confusion on the domain? Creating a brand >> >> new certificate is the only solution I can think of to fix this issue. >> > > http://www.openldap.org/faq/data/cache/185.html > > Has one of your certs expired? By default OpenSSL scripts do 365 days. > >

1 0

Slow Data sync
by Bad Guy 19 Nov '08

19 Nov '08

Hi all, I am using openldap 2.4.11, and configure as 4-way Master, config files for server A,B,C,D are shown below : Server A : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 001 Server B : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 002 Server C : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 003 Server D : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 004 I find a strange behaviour, data can be synced within all 4 servers, however, after some time, I find that when I add/update data in server A, it can sync to server B immediately, server C and server D can't receive the updated data., I check the log in server C and server D, there is no data push to C and D. (I set the log level 16384 to log the sync) When I add record in server C, data can be sync to server D immediately, server A and server B can't receive the updated data. But after some time (may be 1-2 hours), the data between the 4 servers are synced finally. Another information is that server A and B are in same segment, server C and server D are in same segment, but server A and C/D are in different segment. The ping test between servers are fast. I also use telnet server A/B/C/D 389, the response is fast. Any idea ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Must pwdReset always be set explicitly?
by Akke Bengtsson 19 Nov '08

19 Nov '08

The draft description of ppolicy (draft-behera-ldap-password-policy-09.txt) from July 17 2005 says among other things "If the value the pwdMustChange is TRUE and the modification is performed by a password administrator, then the pwdReset attribute is set to TRUE. My impression, using OpenLDAP up to v.2.4.10 is that it rather is implemented as "...and the pwdReset attribute is set to TRUE, the user has to change his password." (i.e. to set pwdReset signals the very fact that I am a password administrator.)? (On the other hand - the reset of the pwdReset attribute when the user actually chooses a new password is as expected automatically performed by the OpenLDAP software.) The Behera draft expired more than two years ago - in a more recent IETF draft by Zeilenga from march 2008, there is a suggestion to replace pwdReset by passwdChangeRequired. Also this draft is expired by now - did it make way into any OpenLDAP code? Best Regards Akke Bengtsson IT-Forum, IT-Arkitektur och systemutveckling Karolinska Universitetssjukhuset 141 86 STOCKHOLM

1 0

Openldap and TLS issue
by Ivan Ordonez 18 Nov '08

18 Nov '08

Hi, Our environment is consist of 3 domain controllers - 1 primary and 2 backup. All domain controller are running on Gentoo platform using Samba with Openldap for user login and authentication. One of the backup domain controller has been acting up lately and will not start samba properly. A quick look at the log showed: slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 (IP=0.0.0.0:389) It seems obvious that the issue is with certificate. The certificate we are using was created using the primary domain controller and were then copied to both backup domain controller. If I create a brand new certificate using the backup domain controller having certificate issue, will that interfere with the certificate on the primary domain controller? Will that cause confusion on the domain? Creating a brand new certificate is the only solution I can think of to fix this issue. I've already re-install samba, openldap and smbldap-tools twice to no avail. samba 3.0.32 openldap 2.3.43 smbldap-tools 0.9.4-r1 Thanks in advance. -Ivan

1 0

Mailing list query
by Stelios A. 18 Nov '08

18 Nov '08

Hello all, My user.ldif is like: dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Somename sn: Somelastname cn: Somename Somelastname uid: ssomelastname uidNumber: 1002 gidNumber: 100 homeDirectory: /home/ssomelastname loginShell: /bin/bash mail: ssomelastname(a)mydomain.edu.com userPassword: some password encrypted Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com Example ldif: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com What I want is somehow to get all uid of the users belonging to each of my groups in order to build a mailing list with postfix. I've created a file called ldap-aliases.cf with the following inside: server_host = ldaps://myhostname search_base = dc=mydomain,dc=edu,dc=com scope = sub version = 3 query_filter = (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) result_attribute = uid bind = yes bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com bind_pw = mypasswordwithoutencryption The above works ok without errors but it just displays all users in my ldap. I tried several different ways but can't find out how to add to the query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com and also a second more complicated query, that is to show me all users uid where not belonging to any Group (ou=Groups,dc=mydomain,dc=edu,dc=com) Any help is much appreciated. Thanks

4 10

CSN Too Old potential Bug
by Burton, Kris - Acision 17 Nov '08

17 Nov '08

All, I want to ask the list about this before I try to open an ITS to make sure that I am understanding everything correctly. We are running OpenLDAP 2.4.11. I selectively tried to back post ITS 5709 to our source, because we were losing replications. Applying this seemed to help and reduced the number of lost replications. We are running in mirror mode using refreshAndPersist, and doing a high volume of adds to the master, on the order of 100/s. We have run numerous iterations of the same test with very aggressive NTP updates that are keeping both the master and consumer within 50 microseconds of one another. Which I saw recommended as a possible solution in a previous message thread. This seemed to make little to no difference in the replication loss. >From looking at the code I was thinking that the lost replications might be due to entries being queued on the master side in non-ascending order which I was seeing preceding the replication that would be rejected on the consumer side. What I thought was happening is that the logic that traverses the queue to mark committed CSNs and updates the contextCSN was getting out of sync because of this, and orphaning replications that were still pending, because they are too old, but in reality they have never been added to the consumer. I just pulled the latest code from RE24 and reran the test, the latest code is better than before with just the back post of 5709 on 2.4.11, but we are still losing a small percentage of the replications with the "CSN too old" message. With the latest code I am still seeing a correlation between the out of sync queuing on the master and the replications that are rejected on the consumer. During this run NTP was keeping the 2 systems within 10 microseconds of each other, with the most aggressive synch interval that is configurable at 16 seconds. Below I have log snippets and some of the relevant configuration information. If more is desired then please let me know and I will provide it. #### MASTER ##### Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c9568b0 20081114194304.892065Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x42803100 20081114194305.078713Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=14 op=17167 ADD dn="uniqueIdentifier=Evad_Added_tele_5450408582,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4680b100 20081114194305.078878Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43004100 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=12 op=13844 RESULT tag=105 err=0 text= Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c87e670 20081114194305.068251Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 ADD dn="uniqueIdentifier=Evad_Added_tele_5450009858,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4780d100 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=12 op=17496 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5a7f8340 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=13 op=19983 ADD dn="uniqueIdentifier=Evad_Added_tele_5450509990,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ae77160 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=14 op=19598 ADD dn="umbillingnumber=5450409797,uniqueIdentifier=Evad_Added_tele_5450409797,ou=s…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.936884Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=11 op=16763 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.947725Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ad51170 20081114194502.917288Z#000000#001#000000 ### CONSUMER ### Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_add (0) Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002 Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_search (0) Nov 14 14:45:39 ng04be04 slapd[24622]: slap_queue_csn: queing 0x2b4737c990 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: slap_graduate_commit_csn: removing 0x2b473ca890 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.936884Z#000000#001#000000 ### Replication Config ### dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig ... olcSyncrepl: {0}rid=2 provider=ldap://ldap.server.com bindmethod=si mple timeout=0 network-timeout=0 binddn="cn=Directory Manager,o=ricuc.com" cr edentials="secret" starttls=no filter="(objectclass=*)" searchbase="o=ricuc.com" scope=sub schemachecking=off type=refreshandpersist retry="60 +" olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 ### Hardware ### Dual Quad Core Xeon 2.83GHz 32GB RAM 8x15000rpm RAID10 Separate LUNS for db and txn logs Kris Burton Software Engineer ________________________________________ Acision. Innovation. Assured. www.acision.com 4870 Sadler Road Suite 200 Glen Allen, VA 23060 USA This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 4

openldap client over ssl
by Beijing Normal Univ 17 Nov '08

17 Nov '08

Hi I am new to openldap and ssl. I would like to use only the openldap client sdk. What I want to do is use the openldap client sdk to develop some tools which could comunicate with ldap server over ssl channel. Do I still need openssl? Maybe I should ask my question this way: Openssl will need to be used to generate the certificate etc. Does my application itself requre openssl libraries if it needs to support ssl? I think the answer probably is yes. Thanks

1 0

OpenLDAP interop with AD questions
by Christopher Barry 17 Nov '08

17 Nov '08

Hi All, I'm still researching methods, and trying to find the best way to integrate our Unix hosts with AD in a way that makes sense for us. The goal is to have a single user/password db in AD, and have all of the old NIS map data in OpenLDAP. SSO would be a nice to have feature too. I've read more stuff than I can count, but I'm still more than a little confused. The translucent overlay looks cool (if it'll even work with AD), but I'm not sure it's the right answer for us with respect to keeping the maps local to OpenLDAP. Any suggestions or doc links you can post? Thanks, -C

4 3

Re: Mailing list query
by Stelios A. 15 Nov '08

15 Nov '08

That query does not return any result. root@myserver:/etc/postfix# postmap -q mail_Group ldap:/etc/postfix/ldap-aliases.cf postmap: warning: dict_ldap_open: /etc/postfix/ldap-aliases.cf: Fixed query_filter cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr is probably useless root@myserver:/etc/postfix# Regarding my second query, I have 5 groups where only staff is assigned to each one depending the department. Then the rest of the users (students) does not belong to any group so in order to get all uid's of students I need to query the whole ldap excluding the groups. 2008/11/15 Chris <cjl(a)viptalk.net>: > > On Nov 15, 2008, at 12:22 AM, Stelios A. wrote: > >> Hello all, >> >> My user.ldif is like: >> >> dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com >> objectClass: inetOrgPerson >> objectClass: posixAccount >> objectClass: person >> objectClass: organizationalPerson >> objectClass: top >> givenName: Somename >> sn: Somelastname >> cn: Somename Somelastname >> uid: ssomelastname >> uidNumber: 1002 >> gidNumber: 100 >> homeDirectory: /home/ssomelastname >> loginShell: /bin/bash >> mail: ssomelastname(a)mydomain.edu.com >> userPassword: some password encrypted >> >> Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com >> Example ldif: >> >> dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr >> cn: IT >> objectClass: groupOfUniqueNames >> uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com >> >> What I want is somehow to get all uid of the users belonging to each >> of my groups in order to build a mailing list with postfix. >> >> I've created a file called ldap-aliases.cf with the following inside: >> >> server_host = ldaps://myhostname >> search_base = dc=mydomain,dc=edu,dc=com >> scope = sub >> version = 3 >> query_filter = >> (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) >> result_attribute = uid >> bind = yes >> bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com >> bind_pw = mypasswordwithoutencryption >> >> The above works ok without errors but it just displays all users in my >> ldap. >> I tried several different ways but can't find out how to add to the >> query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > > Try setting this as your search base: > cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > >> and also a second more complicated query, that is to show me all users >> uid where not belonging to any Group >> (ou=Groups,dc=mydomain,dc=edu,dc=com) > > Not quite sure I understand what you're looking for there. > > -- Stelios A

1 0

Active Directory caching
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, I'm looking for some references/answers as to how OpenLDAP and Active Directory work with regards to caching. The scenario I'm seeing is this: I have Apache on a RHEL5 machine authenticating users via LDAP. Its set to cache for 600s, so I dont overload the server unnecessarily. What I'm seeing though, is that something somewhere is caching old passwords. I can change the users password several times, and LDAP will authenticate using any of the passwords previously used. I've tried some timing tests of my own, and it seems that it takes up to 50mins for me first password change to take effect (an odd time to me). So I'm trying to figure out whos caching the other passwords, is it LDAP, or is it AD ? And if so where are the settings to look at? And what timers are involved? I actually don't mind the idea of caching older passwords, but only so long as I know how long it will be for, and what mechanism is doing it, then I can change it if need be. I'm setting these directives (taken straight from the Apache examples). LDAPSharedCacheSize 200000 LDAPCacheEntries 1024 LDAPCacheTTL 600 LDAPOpCacheEntries 1024 LDAPOpCacheTTL 600 My setups quite simple. Ive one Domain Controller. No proxies involved. I've read what I can online, and am getting stuck. Thanks, Adrian

2 1

Debugging a user authentication
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

2 2

LDAP logs
by Tom Cooper 14 Nov '08

14 Nov '08

Hi all, I am running openldap 2.3.27 and in the database directory log files are created called log.00000xxxx where xxxx is an incrementing number. Each log file is 10MB in size. Searching for it it looks like Berkely DB logs. How do I get rid of it as it chews up my disk space quite quickly? I have noticed that if they are deleted, my database becomes corrupted. Thanks. Tom To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

3 2

startup ldap problem
by GanGan 13 Nov '08

13 Nov '08

hello all, My problem, when I start my server ldap in my log Nov 13 12:34:10 srvtest3 slapd[3738]: daemon: shutdown requested and initiated. Nov 13 12:34:10 srvtest3 slapd[3738]: slapd shutdown: waiting for 0 threads to terminate Nov 13 12:34:10 srvtest3 slapd[3738]: slapd stopped. Nov 13 12:34:12 srvtest3 slapd[3800]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 2 2008 04:29:17) $ brewbuilder@hs20-bc2-2.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 55: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 60: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 65: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3801]: slapd starting I do not understand where is the problem, in my /etc/ldap.conf ? this command : getent passwd no user displays ldap someone would have an idea? thanks -- - GanGan -

4 4

(no subject)
by Bad Guy 13 Nov '08

13 Nov '08

Dear all, I am running the openldap 2.4.11 with 4 way masters (SID=001 to 004) configured. (my suffix is empty in slapd.conf) The data can be synced initially. I add records in 1 server and all the other 3 servers will have the new record added. However, I found that after running for some time, one server will have corrupted contextCSN in SID=001. dn: contextCSN:: sCttCIio0wAxNTQzMTMuMDQ1Mjk3WiMwMDAwMDAjMDAyIzAwMDAwMA== contextCSN: 20081107061013.853051Z#000000#001#000000 contextCSN: 20081107073602.911356Z#000000#003#000000 contextCSN: 20081107061028.825773Z#000000#004#000000 The contextCSN for SID=002 in server 1 is corrupted. So, whenever there is an update in SID=002 server, the SID=001 server will never get the update, however, when there is update in SID=003 or SID=004 server, the records will get updated in SID=001. We have a background cron job in each server running at 1 minutes interval to retrieve the records and set some user defined attributes if it meet some certain criteria. What's the cause to this corruption ? Is there any way to recover the corrupted contextCSN by command or script without rebuild the data ? Thanks _________________________________________________________________ 用部落格分享照片、影音、趣味小工具和最愛清單，盡情秀出你自己 — Windows Live Spaces http://spaces.live.com/

3 4

Password protection of TLS key
by Akke Bengtsson 12 Nov '08

12 Nov '08

Is it still a requirement that TLS keys must have their password nullified before using them in an openldap context? Some experimentation with slapd startup has revealed that for some combinations of OS and OpenLDAP version, I will be given a prompt for the TLS password and can also input it and the slapd daemon starts correctly. On other systems, I was prompted for the password but before I even could enter it, the slapd startup crashed. The tests were all performed doing a manual startup via "/etc/init.d/ldap start". Automatic startup means that the password, instead of being entered by a person, has to reside on file and thereby be accessible to potential intruders. Is there any way to prevent unprotected keys or passwords to keys in this context? Akke Bengtsson

2 1

Cannot modify directory entry with custom attribute
by James S. White 10 Nov '08

10 Nov '08

I cannot add a custom objectclass to a directory entry. When I remove my custom objectclass and attributes, I can modify the entry normally. When I add them, I get an "Invalid Syntax (21)" error. I've googled extensively, and can find other cases of this happening, but not an effective solution. What am I missing here? Details: #/etc/ldap/schema/venn.schema attributetype ( 1.1.2.1.1 NAME 'vennBase' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.2 NAME 'vennClass' DESC 'A single set this host belongs to' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClass ( 1.1.2.2.1 NAME 'vennHost' SUP top AUXILIARY MUST ( vennBase $ vennClass ) ) #added to /etc/ldap/slapd.conf include /etc/ldap/schema/venn.schema # command /etc/init.d/slapd restart #freyr.ldif dn: cn=freyr,ou=Hosts,dc=websages,dc=com cn: freyr objectclass: top objectclass: ipHost objectclass: device objectclass: vennHost ipHostNumber: 72.14.177.235 vennBase: debian-etch vennClass: ldap_server vennClass: bind9_server vennClass: cfengine_server vennClass: openldap_server vennClass: irc_server # command ldapmodify -xh freyr.websages.com -D "cn=root,dc=websages,dc=com" -f freyr.ldif -W #error modifying entry "cn=freyr,ou=Hosts,dc=websages,dc=com" ldap_modify: Invalid syntax (21) additional info: objectclass: value #3 invalid per syntax if I remove all the venn* stuff from the .ldif, everything works fine... Any help would be appreciated.

1 1

moving ldap-db via file-copying?
by Silvana 10 Nov '08

10 Nov '08

Hello! I hope you can help me, migrate my old ldap-db, problem is this: Our old server was running with ldap2.2.7? to serve as backend to the sambaserver and as of today its refusing to work or give errors (the ldap-daemon seems to start, but doesn't open the port, is not accessible, gives no errors and has to be killed, because stopping it gives no reaction) now, i've set up a new machine, to use ldap, given it the same suffix, cn, etc. the version of ldap is a newer one, than on the old box, although i'm not sure, how far they are removed. is it in some way possible, to just copy the files in /var/lib/ldap/ from the old server and insert them into the new box in the same folder? if so, which files would be ok to overwrite, which not? or woul i have to tweak some other files for that as well? or is this completely inconceivable (as i dread is the case), and if yes, how am i to get the files from the old server to the new one? any help on this would be greatly appreciated bye silvana

3 3

Re: ldap attributes - performance problem?
by Pavlos Parissis 09 Nov '08

09 Nov '08

On Sun, 09 Nov 2008 08:52:21 -0800 radim.roska(a)gmail.com wrote: > Hi, > > ok..then i guess there is not a problem :)..of course I'll add indexes, but > I was just thinking if its ok to have a lot of same attributes.. If the schema allows multiple values for this attribute then from OL point of view is fine. I assume that apache or any other LDAP client which is going to fetch this attribute will correctly handle the multiple values. Cheers, Pavlos > > thanks, > Radim > > On Nov 9, 2008 11:43am, Pavlos Parissis <p_pavlos(a)freemail.gr> wrote: > > Hi, > > > > > > > > I don't real understand your concerns. > > > > > > > > Are you worry about LDAP search performance? > > > > Adding indexes is your solution on this. > > > > > > > > Cheers, > > > > Pavlos > > > > > > > > > > > > On Sat, 8 Nov 2008 21:15:02 +0100 > > > > "Radim Roska" wrote: > > > > > > > > > Hi, > > > > > > > > > > I'm thinking about solution to following problem: authorization to > > > > > directories on our file server (accessed by webdav). Is it a performance > > > > > issue to build solution on following pattern? > > > > > > > > > > part of user's ldif > > > > > ... > > > > > uid=someone > > > > > allow_dir: directory1 > > > > > allow_dir: directory2 > > > > > allow_dir: directory3 > > > > > allow_dir: directory4 > > > > > > > > > > and then just htaccess directives in apache for every of these > directories > > > > > :) > > > > > > > > > > > > > > > it could happen that someone would have eg 50 of these > attributes...would > > > > > it be a problem? > > > > > > > > > > Thanks for advice and advanced opinion :) > > > > > Radim > > > > > > > >

1 0

ldap attributes - performance problem?
by Radim Roska 09 Nov '08

09 Nov '08

Hi, I'm thinking about solution to following problem: authorization to directories on our file server (accessed by webdav). Is it a performance issue to build solution on following pattern? part of user's ldif ... uid=someone allow_dir: directory1 allow_dir: directory2 allow_dir: directory3 allow_dir: directory4 and then just htaccess directives in apache for every of these directories :) it could happen that someone would have e.g. 50 of these attributes...would it be a problem? Thanks for advice and advanced opinion :) Radim

2 1

Re: any tools for data resync....
by Gavin Henry 07 Nov '08

07 Nov '08

----- "Paul Lee" <paul(a)hk.fujitsu.com> wrote: > Dear all, > > My customers is very concern on the data synchronization on the 4-way > > masters openldap servers. > > If in case there is record unsync (due to whatever reason, e.g. > network > failure, CSN too old, etc), will there be any tools to resync the data > ? > > If there is such tools, we can execute a cron job to do this. They will retry depending on what settings you have if there is a connection problem. Can you try on 2.4.12, not 2.4.9 and also host your config somewhere. You can quickly check all contextCSN are the same via: [ghenry@suretec ~]$ ldapsearch -x -LLL -H ldap://host1 -s base -b 'dc=suretecsystems,dc=com' contextCSN dn: dc=suretecsystems,dc=com contextCSN: 20081025222436.822813Z#000000#000#000000 [ghenry@suretec ~]$ ldapsearch -x -LLL -H ldap://host2 -s base -b 'dc=suretecsystems,dc=com' contextCSN dn: dc=suretecsystems,dc=com contextCSN: 20081025222436.822813Z#000000#000#000000 -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

2 1

Indexing integers
by Sean Burford 07 Nov '08

07 Nov '08

Hi, I have been looking for the index to apply to integer attributes to speed up less than/greater than filters, but have turned up nothing. These searches work, but eq and pres indexes don't seem to affect their speed. Is there an index that help with integer ordering searches? Thanks Sean

2 1

any tools for data resync....
by Paul Lee 06 Nov '08

06 Nov '08

Dear all, My customers is very concern on the data synchronization on the 4-way masters openldap servers. If in case there is record unsync (due to whatever reason, e.g. network failure, CSN too old, etc), will there be any tools to resync the data ? If there is such tools, we can execute a cron job to do this. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

OPENLDAP installation error
by Sujeet Vanage 05 Nov '08

05 Nov '08

Hi I am getting following error when tried to configure open ldap Basically I just need OPEN LDAP client library and not directory server I issued following command $ ./configure --disable-slapd --disable-slurpd and got this error message configure:4505: error: C compiler cannot create executables See `config.log' for more details. I checked that cc and gcc are installed and in PATH any idea how to solve? Pleas help below are some details from config.log >>>>>>>>>>>>>>>>>> ## ----------- ## ## Core tests. ## ## ----------- ## configure:1616: checking build system type configure:1634: result: sparc-sun-solaris2.10 configure:1642: checking host system type configure:1656: result: sparc-sun-solaris2.10 configure:1664: checking target system type configure:1678: result: sparc-sun-solaris2.10 configure:1707: checking for a BSD-compatible install configure:1762: result: build/shtool install -c configure:1773: checking whether build environment is sane configure:1816: result: yes configure:1881: checking for gawk configure:1910: result: no configure:1881: checking for mawk configure:1910: result: no configure:1881: checking for nawk configure:1897: found /usr/bin/nawk configure:1907: result: nawk configure:1917: checking whether make sets $(MAKE) configure:1937: result: yes configure:2146: checking configure arguments configure:3644: WARNING: slapd disabled, ignoring --enable-bdb argument configure:3644: WARNING: slapd disabled, ignoring --enable-hdb argument configure:3644: WARNING: slapd disabled, ignoring --enable-monitor argument configure:3644: WARNING: slapd disabled, ignoring --enable-relay argument configure:3680: WARNING: slapd disabled, ignoring --enable-seqmod argument configure:3680: WARNING: slapd disabled, ignoring --enable-syncprov argument configure:3748: result: done configure:3917: checking for cc configure:3933: found /usr/ucb/cc configure:3943: result: cc configure:3967: checking for ar configure:3983: found /usr/ccs/bin/ar configure:3993: result: ar configure:4052: checking for style of include used by make configure:4080: result: GNU configure:4421: checking for C compiler version configure:4424: cc --version </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4427: $? = 1 configure:4429: cc -v </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4432: $? = 1 configure:4434: cc -V </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4437: $? = 1 configure:4460: checking for C compiler default output file name configure:4463: cc conftest.c >&5 /usr/ucb/cc: language optional software package not installed configure:4466: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define OPENLDAP_PACKAGE "OpenLDAP" | #define OPENLDAP_VERSION "2.4.11" | #define LDAP_VENDOR_VERSION 20411 | #define LDAP_VENDOR_VERSION_MAJOR 2 | #define LDAP_VENDOR_VERSION_MINOR 4 | #define LDAP_VENDOR_VERSION_PATCH 11 | #define HAVE_MKVERSION 1 | /* end confdefs.h. */ | | int | main () | { | | ; | return 0; | } configure:4505: error: C compiler cannot create executables See `config.log' for more details. ## ---------------- ## ## Cache variables. ## ## ---------------- ## ac_cv_build=sparc-sun-solaris2.10 ac_cv_build_alias=sparc-sun-solaris2.10 ac_cv_env_CC_set= ac_cv_env_CC_value= ac_cv_env_CFLAGS_set= ac_cv_env_CFLAGS_value= ac_cv_env_CPPFLAGS_set= ac_cv_env_CPPFLAGS_value= ac_cv_env_CPP_set= ac_cv_env_CPP_value= ac_cv_env_LDFLAGS_set= ac_cv_env_LDFLAGS_value= ac_cv_env_build_alias_set= ac_cv_env_build_alias_value= ac_cv_env_host_alias_set= ac_cv_env_host_alias_value= ac_cv_env_target_alias_set= ac_cv_env_target_alias_value= ac_cv_host=sparc-sun-solaris2.10 ac_cv_host_alias=sparc-sun-solaris2.10 ac_cv_prog_AR=ar ac_cv_prog_AWK=nawk ac_cv_prog_CC=cc ac_cv_prog_make_make_set=yes ac_cv_shtool=build/shtool ac_cv_target=sparc-sun-solaris2.10 >>>>>>>>>>> Thanks Sujeet Vanage

2 1

Ldap Add Fail
by ahmed.feroz＠wipro.com 05 Nov '08

05 Nov '08

Dear open-ldap Team, Currently we are using ldap Version-2.4.8 on our Fedora Core 9 machine. When we try to create a computer account using ldap-add with non admin user we are getting error "insufficientAccessRights". Please let us know how we can add computer account in Active Directory with non admin users?? Thanks in advance. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

CSN too old again....
by Paul Lee 05 Nov '08

05 Nov '08

Dear all, I have 4 servers with version 2.4.9 configured into 4 way masters, the name of the servers are disb01 (SID:001), disb02 (SID:002), pisb01 (SID:003) and pisb02 (SID:004). Attached is the config file for the 4 servers. All the 4 servers are configured and started on Oct 29 night. At that time, I test the data synchronization, the result is positive. However, today, customer reported that data synchronization occurs, then, I perform the following simple test and find that data is really can't replicated. - When I added a record (the key is 20081104105123.573091Z#000000#003#000000) in pisb01, the data can be replicated to pisb02, but the other 2 servers disb01 and disb02 cannot find this record. The log in disb01 and disb02 indicates that the CSN is too old. - When I added a record (the key is 20081104105455.436768Z#000000#001#000000) in disb01, the data can be replicated to pisb01, but the other 2 servers disb02 and pisb02 cannot find this record. The log in disb01 and disb02 indicates that the CSN is too old. The log for the 4 servers is attached... Any possible reasons for this error "CSN too old" ? I find from the log that seems all servers received update at the same time (up to seconds, no millisecond is shown in the log) Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 002 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 001 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 003 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 004 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15

1 0

LDAP_RES_ENTRY vs LDAP_RES_RESULT
by owen nirvana 04 Nov '08

04 Nov '08

i'm a newbie. I am writing an application about pki, which needs openldap, when I try to query an entry from ldap server, openLDAP return LDAP_RES_ENTRY or LDAP_RES_RESULT if successful. I could not understande the difference between them. In my opnion , ENTRY is inferior to RESULT, LDAP should give me a result, and I get one or more entries from this result. I don't know why LDAP have to give me a message not LDAP_RES_RESULT ,but LDAP_RES_ENTRY in some conditions. btw, I try to complie the source 2.4.11 or 12, the make is successful, but the test script maybe could not start slapd. without doubt, openldap 2.4.11 from debian package works fine, I don't know why? os: debian lenny 20080902 gtalk:freeespeech@gmail.com

2 2

Trigerring an action after an ldapadd or modify
by daniel rahmeh 04 Nov '08

04 Nov '08

hi, is it possible with openldap to trigger an action (like a shell script) after a succesfull ldapadd or ldapmodify operation. I was looking for an overlay that does the job but i didn't find it. any help will be appreciated. thank you

3 3

Re: regarding ldap filters "extensible match search"
by Hamidreza Hamedtoolloei 02 Nov '08

02 Nov '08

Hey Hallvard, thanks for your prompt response. My big concern is that at the time of search I am not aware of the ldap tree structure. In other words, I only know about root, project, and site1, and dont have any info about rest of the tree (existence of site 2 etc). Perhaps I can do one search for excluded sites like site2, and use the result to return appropriate users. this should be possible as I am using jLDAP to connect to ldap directory from my java code. I would like to do one query though.....not sure if it is possible! ________________________________ From: Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no> To: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Sunday, November 2, 2008 9:26:54 AM Subject: Re: regarding ldap filters "extensible match search" Hamidreza Hamedtoolloei writes: > given the partial tree below, how can I return users in the root, > project, and site1 (i.e. dont want to return site2 users). ldapsearch -x ... '(&(uid=hamedtoolloei)(!(ou:dn:=site2)))' This omits results that have ou=site2 in the DN. -- Hallvard

1 0

regarding ldap filters "extensible match search"
by Hamidreza Hamedtoolloei 02 Nov '08

02 Nov '08

Hi all, given the partial tree below, how can I return users in the root, project, and site1 (i.e. dont want to return site2 users). note that site2 might have nested sites. I would rather to perform only one query. I've been playing with the "extensible match search", but site the rootDN is part of the site2DN, it returns the site2 users as well... dc=example,dc=com | | | | | ou=users,dc=example,dc=com | o=project,dc=example,dc=com | | | | | | | | ou=users,o=project,dc=example,dc=com | | | | ou=site1,o=project,dc=example,dc=com ou=site2,o=project,dc=example,dc=com | | | | ou=users, ou=site1,o=project,dc=example,dc=com ou=users,ou=site2,o=project,dc=example,dc=co

2 1

GSSAPI Error: An invalid name was supplied (Not enough space)
by Ben Lentz 31 Oct '08

31 Oct '08

Greetings list, I am using openldap-2.4.12 with cyrus-sasl 2.1.22 with mit krb5-1.6.3 on an AIX 5.3, TL8, SP2 machine. Whenever I try to use GSSAPI with ldapsearch against a Microsoft Active Directory server, I get the following error: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) When I run the process through truss -rall -wall -f, I see the following error near the failure: GSSAPI Error: An invalid name was supplied (Not enough space) I am able to acquire a kerberos ticket, I can list the GSSAPI plugin using pluginviewer, and I can ldapsearch against the MSAD server using simple authentication. I have searched Google and can find no reference to the "Not enough space" error. Has anyone else seen this before or can anyone shed any light on this? Thanks in advance.

1 0

Password hash in openldap
by Paul Lee 31 Oct '08

31 Oct '08

Dear all, Last time I changes the slapd.conf to restrict anonymous user to see the userPassword attribute from 3rd party LDAP browser. However, our client still wants to encrypt/hash the password stored in LDAP because he says that he can user other users auth to the LDAP and then can see other users' password (e.g. he can see his boss's password). Since we have the admin portal to change the user password as well, seems it can't restrict userpassword attribute by self read/write. Also, we will use the password policy and restrict users to re-use the last 12 passwords. So, my question is that is it possible to hash the password stored in openldap, also, the password stored in the password history is also hashed so that even other users can't see the password of others. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 1

create quota to openldap group
by Kermito le kermit 29 Oct '08

29 Oct '08

hello all, I am use openldap to debian all work fine i use openldap +samba pdc to my domain. now i wabt to add a quota to the groupe in my openldap which a tool quota (edquota etc ..). I can but quota to sambausers but no for other groups any ideas

1 0

difference between /etc/ldap.conf /etc/openldap/ldap.conf
by GanGan 29 Oct '08

29 Oct '08

hello all one question ! What is the difference between /etc/ldap.conf and /etc/openldap/ldap.conf ? thanks in advance -- - GanGan -

4 7

ldap queries to AD server
by Lynn York 28 Oct '08

28 Oct '08

Hello, I am seeing a large amount of queries for users such as vpopmail, postmaster, anonymous and a few other users being sent to the AD server via the openldap proxy. Below is a snippet of the log, I was curious how I could stop the servers from searching for these users via ldap? [ snippet ] Oct 28 14:32:54 ldap-proxy slapd[21165]: conn=2828 op=56 SRCH base="ou=Internal,dc=mgmt,dc=test,dc=net" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=vpopmail))" Oct 28 14:32:54 ldap-proxy slapd[21165]: conn=2828 op=56 SRCH attr=uid userPassword shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire shadowFlag [ end snippet ]

1 0

"bulk-reload" of database and replication
by Sebastian Benoit 28 Oct '08

28 Oct '08

Hi, we are developing a application using openldap and have the following problem: We plan a setup using one master-ldap server (with normally few write operations). The database will be replicated to (initially) two slave-servers using syncrepl replication. Now, at the beginning (until the complete system is set up to work with the ldap-server) we will need to re-initialize the complete database from scratch. This reload takes about 10 minutes using perl-ldap and a tcp-connection to the server. During this time the application accessing the slave servers should still see the old view of the database. The switch from old data to new data on the slave-servers should be as fast as possible to avoid clients seeing wrong (or not existing) data. I thought about writing data in LDIF format and the create a new database from that using slapadd. But then there still is the replication problem. What methods to others use to solve this? Thanks for you help, /Benno -- Sebastian Benoit <benoit-lists(a)fb12.de>

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical