- openldap-technical - openldap.org

slurpd replication problem.
by Choi, Justin 28 Oct '08

28 Oct '08

I am seeing invalid credential error logs a lot. Could you guys let me know how to solve this issue? Thanks. Server Log(slurpd -d 2) Replicated Log (/usr/sbin/slapd -u ldap -d 2 -h ldap:///) Slapd.conf database bdb suffix "dc=ijji,dc=com" rootdn "cn=Manager,dc=ijji,dc=com" rootpw {SSHA}EpkPadkANDlpX7yfcsa2WbA+bSssh0S4 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/ijji.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub #updatedn cn=Replication Manager,dc=ijji,dc=com #updateref ldap://ca1xc115.ijji.com access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Manager,dc=ijji,dc=com" write by * read access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * read # Replicas of this database replogfile /var/lib/ldap/openldap-master-replog replica host=ca1xc115.ijji.com:389 binddn="cn=Replication Manager,dc=ijji,dc=com" bindmethod=simple credentials=skdltmwkq loglevel -1 database bdb suffix "dc=ijji,dc=com" rootdn "cn=Manager,dc=ijji,dc=com" rootpw {SSHA}EpkPadkANDlpX7yfcsa2WbA+bSssh0S4 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/ijji.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub updatedn "cn=Replication Manager,dc=ijji,dc=com" updateref ldap://ca1xc124.ijji.com access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Manager,dc=ijji,dc=com" write by * read access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * read # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM loglevel -1 Justin Choi Sr. Security Engineer NHN USA, Inc. 3353 Michelson Suite 250 Irvine, CA 92612 Mobile (408) 329-8554 MSN iD: counterhacker(a)live.com <mailto:amyoh79@hotmail.com> Office (949) 863-1292 ext 256 Fax (949) 863-9418

2 1

nss_initgroups_ignoreusers
by Lynn York 26 Oct '08

26 Oct '08

Hello, I seem to be having an issue with nss_initgroups_ignoreusers. I have the following line in my /etc/ldap.conf file but it still seems to search ldap for the users. Can anyone shed some light on this issue for me? Also, I am running nss_ldap version >= 2.53. I have supplied a snippet of the sldap log. [ /etc/ldap.conf ] nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,postm aster,anonymous,apache [end ] [ log snippet ] Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=140 fd=48 ACCEPT from IP=127.0.0.1:59736 (IP=0.0.0.0:389) Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SRCH base="ou=Internal,dc=mgmt,dc=test,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=postmaster))" Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 op=0 STARTTLS Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 op=0 RESULT oid= err=0 text= Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SEARCH RESULT tag=101 err=0 nentries=0 text= Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=28 SRCH base="ou=Internal,dc=mgmt, dc=test,dc=com " scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=postmaster))" Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=28 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 fd=62 TLS established tls_ssf=256 ssf=256 [ end snippet ] Thanks

1 0

active option crypt
by Kermito le kermit 26 Oct '08

26 Oct '08

hello all, i am to know how to activate option crypt in install of open ldap when i make this commande i see in the log crypt ..... no ./configure --enable-crypt

2 1

Upgrade from openldap 2.4.9 to 2.4.12
by Paul Lee 24 Oct '08

24 Oct '08

Dear all, I am currently having 4 LDAP servers running in 4-way masters mode, the current version is 2.4.9 and there are around 100k records. The db version is 4.2. If I want to upgrade to version 2.4.12, I should upgrade the db to 4.4 or above, right ? but if the db version is upgraded, how to preserve my existing 100k records, any formal procedure to convert the data to the new format ? Is my following procedure correct ? - upgrade the db version to 4.4 - upgrade openldap in 1 machine to 2.4.12 - delete all the files in /usr/local/var/openldap-data - stop 2 more openldap servers, leaving only 1 running version 2.4.9 - start the new server running version 2.4.12, then, records will be created in 2.4.12. - repeat for others servers. Is this correct ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

3 5

Security issue : userPassword is shown
by Paul Lee 23 Oct '08

23 Oct '08

Hi all, I use a 3rd party LDAP browser to browse the users that I created. I can see the userPassword clearly (plain text). Is there any way to avoid this ? When I use slapcat command to export to LDIF file, the userPassword field is encrypted, but why using 3rd party browser will show the password in plain text ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

6 7

Re: Upgrade from openldap 2.4.9 to 2.4.12
by Oliver Liebel 23 Oct '08

23 Oct '08

yes. absolutely correct: 2.4.12 needs 4.4+ http://www.openldap.org/software/release/readme.html Rein Tollevik schrieb: > Oliver Liebel skrev: >> keep it simple. >> first, theres no need of upgrading your bdb. >> 4.2.52 has the longest history to be stable. >> for bdb versions, see: >> http://www.openldap.org/lists/openldap-technical/200807/msg00138.html > > As of version 2.4.12, the bdb backend only support db versions 4.4 and > higher. See the README file. So the upgrade from 4.2 *is* required. > > Rein Tollevik > Basefarm AS > > ____________ Virus checked by G DATA AntiVirusKit Version: AVK 19.1180 from 23.10.2008 Virus news: www.antiviruslab.com

1 0

LDAP + SAMBA PDC
by Arun NAIR 23 Oct '08

23 Oct '08

Hey Guys, I have made an LDAP + Samba PDC and am able to add users to it as well. But when I try to login using ssh to the user name I get the error message Permission denied (publickey,gssapi-with-mic,password). I'm really reaching the deadlines now and have tried all the resources I could get my hands on it would be greatly appreciated if you guys can help me out with this. Regards, Arun Nair

3 2

Case sensitive uid attribute
by Martin Benson 23 Oct '08

23 Oct '08

Hi I am currently using Buchan Milne's OpenLDAP 2.3.43 rpm's on a RHEL 4.4 installation. I use the core, cosine, inetorgperson and NIS schema's and everything works great. I mainly use OpenLDAP as an authentication server and I have a problem where the uid is not case sensitive. If I create a user called "Martin" then it will also allow me to log in as "martin" and then fails as it cannot find my home directory. I have had a look at the schema files and in the core.schema and the core.ldif the uid entry is commented out. It contains an entry "EQUALITY caseIgnoreMatch" and I tried to change it to "EQUALITY caseExactMatch". Now I realise that I shouldn't be touching the core.schema but I don't know how else to do this without invalidating all the entries in the current database. No surprise but changing the attribute and uncommenting the uid entry did not work so any help would be appreciated. Sorry for not including all the usual files like slapd.conf but they are on the server at work and I am at home. Martin Benson

2 1

How to confirm syncrepl is working properly
by Mike Simonton 23 Oct '08

23 Oct '08

Hello everyone, I'm trying to learn how to use OpenLDAP and syncrepl, and I have two issues. First, how do I get past the following error, and second, how do I confirm that syncrepl is actually working?? Here's the slaptest error: # slaptest -f /usr/local/etc/openldap/slapd.conf bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=promptutech,dc=local". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable config file testing succeeded ...and here's my slapd.conf. Any ideas?? cat /usr/local/etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/promptu.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /opt/promptu/openldap/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to * by dn.base="cn=replica,dc=promptutech,dc=local" read by * break ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=promptutech,dc=local" rootdn "cn=Manager,dc=promptutech,dc=local" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=0 provider=ldap://ptsunray02 type=refreshOnly interval=00:00:05:00 searchbase="dc=promptutech,dc=local" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=replica,dc=promptutech,dc=local" credentials="secret" updateref ldap://localhost mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 Thanks for your help! Mike

2 2

How to disable or enable an ldap user account
by RamakrishnaDeepak Battu 22 Oct '08

22 Oct '08

Hello everyone, Can any one point me to how u can disable/enable an ldap user account.Thanks in advance. regards, deepak.

7 6

LDAP proxy for AD
by Lynn York 22 Oct '08

22 Oct '08

Hello, I have been attempting to use openldap as a proxy to AD with no success. I have attempted multiple different ways that I found online. I am able to get the proxy server to connect to AD, but I cannot get a client server to connect through the proxy to the AD server. Can anyone suggest anything? -Lynn

7 22

TLS not working (even though SSL does) -- logging trouble
by Kyle Barger 21 Oct '08

21 Oct '08

I have an OpenLDAP 2.3 server that is up and running. I have been trying to add SSL and TLS. SSL connections on port 636 work fine. However the TLS connection on 389 is not working. The only errors are "TLS accept failure" and "TLS negotiation failure." I've not been able to dig up any more information, even using the -d option, and I notice that people have posted log files with detailed TLS trace messages. How can I enable the TLS logging to find out what's going on? Thanks. -- Kyle Barger Director of Information Systems The Lutheran Theological Seminary at Philadelphia (For questions about your computer, network, or telephone service, email helpdesk(a)ltsp.edu)

2 1

Issue while implementing Password Policy
by daljeet.mehta＠wipro.com 21 Oct '08

21 Oct '08

Hi, I am trying to implement password policy in OpenLDAP. There are already similar postings on the same issue. But I tried all the possible solutions and now I am really tired after one week. Here are the details about my problem Operating System: Red Hat Linux ES 5.0 OpenLDAP Release: 2.3.39 During the addition of userPassword node I get the following error. ldapadd -f /root/openldap/openldap-2.3.39/servers/slapd/schema/paswd_policy1.ldif -D "cn=Manager,dc=xyz,dc=com" -w secret -x adding new entry "cn=default,ouname=ppolicy,oname=P_Policy,dc=xyz,dc=com" ldapadd: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax Then after reading some of the issues related to it, I tried every possible solution. I added overlay path in my slapd.conf and I got the following error. ./slapd -f /root/openldap/openldap-2.3.39/servers/slapd/slapd.conf -d 1 @(#) $OpenLDAP: slapd 2.3.39 (Aug 25 2008 11:38:51) $ root@localhost.localdomain:/root/openldap/openldap-2.3.39/servers/slapd <mailto:root@localhost.localdomain:/root/openldap/openldap-2.3.39/server s/slapd> daemon_init: listen on ldap:/// <ldap:///> daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:/// <ldap:///> ) daemon: listener initialized ldap:/// <ldap:///> daemon_init: 2 listeners opened slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) overlay "ppolicy" not found slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Following is my configuration file snapshot:- # This file should NOT be world readable. # include /root/openldap/openldap-2.3.39/servers/slapd/schema/core.schema include /root/openldap/openldap-2.3.39/servers/slapd/schema/local.schema include /root/openldap/openldap-2.3.39/servers/slapd/schema/java.schema include /root/openldap/openldap.3.39/servers/slapd/schema/inetorgperson.schema #include /root/openldap/openldap-2.3.39/servers/slapd/schema/ppolicy.schema include /etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org <ldap://root.openldap.org/> pidfile /var/run/slapd.pid argsfile /var/run/slapd.args # Load dynamic backend modules: modulepath /root/openldap/openldap-2.3.39 modulepath /servers/slapd/overlays modulepath /usr/sbin moduleload ppolicy.la moduleload back_hdb.la moduleload back_monitor.la #modulepath %MODULEDIR% # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la moduleload ppolicy.la moduleload /root/openldap/openldap-2.3.39/libraries/libldap overlay ppolicy ppolicy_default "cn=default,ouname=ppolicy,oname=P_POLICY,dc=xyz,dc=com" ppolicy_use_lockout #overlay ppolicy #overlay refint # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=xyz,dc=com" rootdn "cn=Manager,dc=xyz,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq Trust me I did R & D for 7 days. Even I did a free installation of same version and of newer version(2.4.11 release) also I got the same error. Can you please tell me the steps to make this working. Now it has become matter of life and death for me and I will do possibly anything resolve it. Thanks in advance for your help. Thanks & Regards, Daljeet Mehta Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

referral and replication
by jakjr 21 Oct '08

21 Oct '08

Hi all, I'm using slapd 2.3.30-5 on Debian Etch. I have 1 provider and 2 consumers using refreshAndPersist replication. The replication works fine, but when I add a referral object on provider, this object is not replicate to the consumers. Is normal not replicate referrals ?? Thanks João Alfredo.

1 1

How to implement Extended DNs for Samba4?
by Andrew Bartlett 21 Oct '08

21 Oct '08

At the CIFS plugfest it became clear that Samba3 requires that we complete the implementation of 'extended DN' replies in the Samba4 LDAP server. This means that a DN in things like memberOf are in the form: <GUID=0bc11d00-e431-40a0-8767-344a320142fa>;<SID=S-1-2-3-2345>;cn=abartlet,cn=users,dc=abartlet,dc=net (or so, I've just made this one up) If the magic 'extended DN' control is specificed, then we have to return this form to the client, and it would work really well to store it in that form on the backend, and if they do not specify the control, only then strip it back to the 'normal' DN. The problem is now particularly how to implement these locally - inside Samba4 it should be pretty easy to have the right triggers in the existing memberOf module, but how to implement this in OpenLDAP and (eventually) FedoraDS. Currently OpenLDAP uses the refint and memberOf modules, knowing that this attribute is simply a DN, nothing more. These modules (and probably the input validation) will no doubt be unable to cope with the 'extended' DN form. Is it reasonable to ask that OpenLDAP carry a module so Samba-specific in it's application (reading the objectSid and entryUUID and formatting the link that way)? Should we try to just fill this in with another search as part of the search entry callback? (at great performance cost). Any thoughts? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

3 8

LDAP + SSH + Key Auth
by openLDAP 17 Oct '08

17 Oct '08

I would like to use public keys on my OS X servers for my LDAP users to use SSH. All indications from the OSX list is that it is not possible. I was hoping someone on this list could confirm that LDAP/Key Pair/SSH is not possible or point me in the right direction to where someone has figured it out. I would like to centrally control SSH access and not have to have local accounts on all of my servers. Any help is appreciated.

3 3

What is the Difference between a LDAP client Prompting for Password as opposed ...
by Kumar, Amit H. 17 Oct '08

17 Oct '08

Hello All, Scenario: OpenLDAP Client Machine <-----talking------> OpenLDAP Server Machine. Both Client and Server are two different machines. What is the Difference between an OpenLDAP client Prompting for Password and then authenticating with the OpenLDAP server via TLS as opposed to : An OpenLDAP client redirecting the authentication request to an OpenLDAP server to prompt for the password and do the authentication. What kind of setup would we require if we want the OpenLDAP Server to prompt for the password and do the authentication for an end user to login onto the OpenLDAP client machine. Any thoughts will be of great help!!! Thank you, Amit

1 0

multiple suffix
by Kermito le kermit 15 Oct '08

15 Oct '08

hello all i want to know if is possible to have multiple suffix to same database ex: suffix dc=exemple,dc=org suffix dc=msn,dc=com any ideas

5 6

Complete list of APIs?
by Brad T Waldorf 14 Oct '08

14 Oct '08

Hi. Does a complete list of client APIs from ldap.h exist? The list provided in the "INDEX" section of the 'ldap' man page doesn't seem to contain all APIs. http://www.openldap.org/software/man.cgi?query=ldap&sektion=3&apropos=0&man… +2.4-Release Thanks

1 0

Help me clear in design
by Phan Dang Duy Thinh 14 Oct '08

14 Oct '08

Hi experts, I'm new member in LDAP. Although I've finished configured a Linux server qmail - ldap but I still have some points unclear, let's I explain: For example, I have a lap using some services require authenticate, ex: qmail, radius, ftp, ... I want to save the user information (username, password, ... ) in only one place, so I decided to using LDAP. (number of users are quite large) But after implement qmail-ldap (it now runs good), I don't know how to continue to implement radius service (or other services). Reason is I can't integrate the radius information into qmail database (although I included qmail.schema and radius.schema in slapd.conf). The question: is there a way to integrate data of one schema in to an existed schema? I want to design a structure like this: [qmail information] [radius information] [other service ....] \ | / \ | / \ | / \ | / [common user information] (username, password) Do I have to write my own schema for doing this? (Schema that include both [qmail service information] and [radius service information]) Please give me an advice how to solve this? Thanks, -- Phan Dang Duy Thinh

1 0

Solaris 10 native Client with TLS to OpenLDAP
by John Gee 13 Oct '08

13 Oct '08

Hello, i have a problem with connecting Solaris10 native LDAP Client to a openLDAP Server (slapd 2.4.11) with TLS. The replication from Server ldap01 to ldap02 works fine with TLS, so i think that the problem must be on client site (Solaris 10 native LDAP Client - latest Patchset). Without TLS it works. Maybe someone can give me a hint - -(slapd - debug)--- >>> slap_listener(ldaps:///) connection_get(11): got connid=207 connection_read(11): checking for input on id=207 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(11): got connid=207 connection_read(11): checking for input on id=207 TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1053 connection_read(11): TLS accept failure error=-1 id=207, closing connection_closing: readying conn=207 sd=11 for close connection_close: conn=207 sd=11 -( slapd.conf - tls part)--- TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCACertificateFile /opt/openldap/var/openldap-data/ca-cert.pem TLSCertificateFile /opt/openldap/var/openldap-data/ldap01.kleinfeld.ch.pem TLSCertificateKeyFile /opt/openldap/var/openldap-data/ldap01.kleinfeld.ch TLSVerifyClient never -( solaris 10 - client )---- # import the ca-cert certutil -N -d /var/ldap certutil -A -n "ca-cert" -i /tmp/ldap/ca-cert.pem -a -t CT -d /var/ldap/ # import ldap-server certs certutil -A -d /var/ldap/ -n "ldap01.kleinfeld.ch" -t C,, -i ldap01.kleinfeld.ch.pem certutil -A -d /var/ldap/ -n "ldap02.kleinfeld.ch" -t C,, -i ldap02.kleinfeld.ch.pem # list cert-db certutil -L -d /var/ldap ca-cert CT,, ldap02.kleinfeld.ch C,, ldap01.kleinfeld.ch C,, # initialize ldap-client ldapclient manual -v \ -a credentialLevel=proxy \ -a authenticationMethod=tls:simple \ -a serviceAuthenticationMethod=pam_ldap:tls:simple \ -a proxyDN=cn=proxyAgent,ou=profile,o=kleinfeld,c=ch \ -a proxyPassword=xxxxxxxxxxxx \ -a defaultsearchbase=ou=unix,o=kleinfeld,c=ch \ -a defaultServerList="ldap01.kleinfeld.ch ldap02.kleinfeld.ch" \ -a certificatePath=/var/ldap \ -a domainName=kleinfeld.ch \ -a attributeMap=passwd:gecos=cn \ -a objectClassMap=group:posixGroup=posixGroup \ -a objectClassMap=passwd:posixAccount=posixAccount \ -a objectClassMap=shadow:shadowAccount=shadowAccount \ -a serviceSearchDescriptor=passwd:ou=people,ou=unix,o=kleinfeld,c=ch?one \ -a serviceSearchDescriptor=group:ou=groups,ou=unix,o=kleinfeld,c=ch?one \ -a serviceSearchDescriptor=netgroup:ou=netgroup,ou=unix,o=kleinfeld,c=ch?one # output from ldapclient Parsing credentialLevel=proxy Parsing authenticationMethod=tls:simple Parsing serviceAuthenticationMethod=pam_ldap:tls:simple Parsing proxyDN=cn=proxyAgent,ou=profile,o=kleinfeld,c=ch Parsing proxyPassword=UnIXpRoXY Parsing defaultsearchbase=ou=unix,o=kleinfeld,c=ch Parsing defaultServerList=ldap01.kleinfeld.ch Parsing certificatePath=/var/ldap Parsing domainName=kleinfeld.ch Parsing attributeMap=passwd:gecos=cn Parsing objectClassMap=group:posixGroup=posixGroup Parsing objectClassMap=passwd:posixAccount=posixAccount Parsing objectClassMap=shadow:shadowAccount=shadowAccount Parsing serviceSearchDescriptor=passwd:ou=people,ou=unix,o=kleinfeld,c=ch?one Parsing serviceSearchDescriptor=group:ou=groups,ou=unix,o=kleinfeld,c=ch?one Parsing serviceSearchDescriptor=netgroup:ou=netgroup,ou=unix,o=kleinfeld,c=ch?one Arguments parsed: Handling manual option Proxy DN: cn=proxyAgent,ou=profile,o=kleinfeld,c=ch Proxy password: {NS1}xxxxxxxxxxxxxxxxxxxxx Credential level: 1 Authentication method: 3 About to modify this machines configuration by writing the files Stopping network services sendmail not running nscd not running autofs not running Stopping ldap stop: sleep 100000 microseconds stop: sleep 200000 microseconds stop: network/ldap/client:default... success nisd not running nis(yp) not running Removing existing restore directory file_backup: stat(/etc/nsswitch.conf)=0 file_backup: (/etc/nsswitch.conf -> /var/ldap/restore/nsswitch.conf) file_backup: stat(/etc/defaultdomain)=0 file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain) file_backup: stat(/var/nis/NIS_COLD_START)=-1 file_backup: No /var/nis/NIS_COLD_START file. file_backup: nis domain is "kleinfeld.ch" file_backup: stat(/var/yp/binding/kleinfeld.ch)=-1 file_backup: No /var/yp/binding/kleinfeld.ch directory. file_backup: stat(/var/ldap/ldap_client_file)=0 file_backup: (/var/ldap/ldap_client_file -> /var/ldap/restore/ldap_client_file) file_backup: (/var/ldap/ldap_client_cred -> /var/ldap/restore/ldap_client_cred) Starting network services start: /usr/bin/domainname kleinfeld.ch... success start: sleep 100000 microseconds start: network/ldap/client:default... success restart: sleep 100000 microseconds restart: milestone/name-services:default... success System successfully configured authenticationMethod: tls:simple serviceAuthenticationMethod: arg[0]: pam_ldap:tls:simple defaultSearchBase: ou=unix,o=kleinfeld,c=ch credentialLevel: proxy domainName: kleinfeld.ch proxyDN: cn=proxyAgent,ou=profile,o=kleinfeld,c=ch objectclassMap: arg[0]: group:posixGroup=posixGroup arg[1]: passwd:posixAccount=posixAccount arg[2]: shadow:shadowAccount=shadowAccount attributeMap: arg[0]: passwd:gecos=cn serviceSearchDescriptor: arg[0]: passwd:ou=people,ou=unix,o=kleinfeld,c=ch?one arg[1]: group:ou=groups,ou=unix,o=kleinfeld,c=ch?one arg[2]: netgroup:ou=netgroup,ou=unix,o=kleinfeld,c=ch?one proxyPassword: xxxxxxxxxxxxx defaultServerList: ldap01.kleinfeld.ch certificatePath: /var/ldap thanks in advance John

4 8

ldap_start_tls_s() usage related errors
by dhiraj.prasad＠tcs.com 12 Oct '08

12 Oct '08

Hello, I have configured LDAP server on linux with TLS support and was able to fetch data from it using the 'ldapsearch' utility. However, when i tried to do this searching via code i got following errors: Error at Server Side: slap_listener_activate(10): >>> slap_listener(ldaps://) connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(15): TLS accept failure error=-1 id=47, closing connection_closing: readying conn=47 sd=15 for close connection_close: conn=47 sd=15 Error at Client side: [root@localhost LDAP1]# ./ldapSearch ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost.localdomain:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 19, subject: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com, issuer: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Error in ldap_start_tls_s -1:Can't contact LDAP serverTest..1 ldap_bind_s ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request Test..2: -1 ldap_err2string Failure of LDAP bind -1-Can't contact LDAP server [root@localhost LDAP1]# Snippet of client code for TLS support used by Me: ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE, "/root/cacert.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_CERTFILE, "/usr/local/etc/openldap/ldap.client.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_KEYFILE, "/usr/local/etc/openldap/ldap.client.key.pem"); ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); status = ldap_start_tls_s(ld, NULL, NULL); Please let me know as to what is missing in my code that is triggering the above errors. Also if there are any sample TLS client code, please let me know where can i get it. Thanks, Dhiraj Kumar Prasad Tata Consultancy Services Mailto: dhiraj.prasad(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Outsourcing ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 1

How to make two attribute unique
by piyush joshi 10 Oct '08

10 Oct '08

Hello All, I wanna know is it possible to make 2 attributes unique Example -: mail and mailAlternateAddress , I mean to say if i have set abc(a)expmple.net in mail attribute as a value and if then I try to add same to the mailAlternateAddress attribute it will prevent me to do this and also vice versa. -- Regards Piyush Joshi 9415414376

2 3

CSN too old
by Paul Lee 10 Oct '08

10 Oct '08

Dear all, I am using openldap version 2.4.9, I am using 4 ldap servers with 4-way master configured. Data can be synronized initially, but when the records is getting more and more, now is around 100k records, I always find data is not synronized between the four ldap servers. I find that "CSN is too old, ignoring" in the LDAP log file. Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: cookie=rid=003,sid=001,csn=20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: rid=003 CSN too old, ignoring 20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: cookie=rid=002,sid=001,csn=20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: rid=002 CSN too old, ignoring 20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: cookie=rid=002,sid=001,csn=20080923200403.739461Z#000000#002#000000 Sep 24 04:04:03 disb01 slapd[28779]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Sep 24 04:04:03 disb01 slapd[28779]: syncrepl_entry: rid=002 be_search (0) Sep 24 04:04:03 disb01 slapd[28779]: syncrepl_entry: rid=002 cn=pwdfail,ou=SCIG,ou=Govt-Dept,o=HKSARG Any idea of this kind of error and how to fixed it ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

4 13

Large stack allocations
by Sean Burford 10 Oct '08

10 Oct '08

Hi, bdb_search() allocates space for 128k candidate IDs and 64k scope IDs on the stack (about 768k of memory). bdb_idl_fetch_key() also allocates a large buffer on the stack (262352 bytes). Most other functions allocate roughly 1kB. Using the stack rather than heap limits the size of these structures (idl.h observes: "IDL sizes - likely should be even bigger. limiting factors: sizeof(ID), thread stack size") Using the stack for large allocations also creates the possibility of these arrays straddling the guard page (possibly resulting in local variables ending up in neighboring memory regions). Would the performance cost of using the heap or thread local storage for these allocations outweigh the benefit of being able to use bigger arrays? If you're interested in some statistics about slapd's stack usage, the static analysis perl script on kegel.com matches what I'm seeing from real running slapds: http://www.kegel.com/stackcheck/ -- Thanks, Sean Burford

2 1

slapd.conf and 2 databases
by Kermito le kermit 09 Oct '08

09 Oct '08

hello all, I am new to openldap and i want to now how put 2 databases in slpad.conf, when i make this in my config , slpad start but i see this message : bdb(dc=example,dc=com): PANIC: fatal region error detected; run recovery help please

2 1

Re: AW: Re: AW: Re: AW: StartTLS is not working
by Dat Duong 09 Oct '08

09 Oct '08

Hi Hauke, I've followed the mini tutorial and got stuck at the path for the server certificates in your tutorial. The path is not correct for slapd. Can you verify? TLSCertificateFile /usr/lib/ssl/certs/<fqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/private/<fqdn>.key.pem thanks ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical <openldap-technical(a)openldap.org> Sent: Thursday, October 9, 2008 12:46:00 AM Subject: AW: Re: AW: Re: AW: StartTLS is not working Hi Dat, > I've added the below to /etc/openldap/ldap.conf on RHEL 5: > TLS_CACERT /etc/openldap/cacerts/ServerCA.chain.pem > TLS_REQCERT demand > > and still getting errors messages... below: > > TLS certificate verification: Error, self signed certificate The LDAP server does not send a server certificate but a self signed certificate. Are you sending the RootCA's certificate? Create a server certificate as described in the tutorial and let your LDAP server use this. I assume that you will have to read a bit more about certificates and openssl to understand all the steps of the mini tutorial. Rergards, Hauke ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: openldap-software <openldap-software(a)openldap.org> Cc: Dat Duong <datduong2000(a)yahoo.com> Sent: Wednesday, October 8, 2008 2:09:11 AM Subject: AW: Re: AW: StartTLS is not working Hi Dat, glad to see that the first problem has been solved now. As Dieter already pointed out, we need to know how the certificates have been created. As a rough overview, you will need to run through following steps: 0. Understand the basic idea: At the end of this MiniHowto, you will have three certification authorities: UserCA: For user certificates (usually password protected) ServerCA: For server certificates (usually NOT password protected) RootCA: The CA that everyone has to trust in the end. This CA only exists to create and verify the UserCA and ServerCA. For your LDAP server, you create a server certificate with your ServerCA. The LDAP clients will accept the LDAP certificate as long as they trust the ServerCA. They will trust the ServerCA because they trust the RootCA. To make them do so, you will need the certificates of the ServerCA AND the RootCA on each client. Just to make sure: We are not talking about copying the LDAP certificate to the client. Instead, you will copy the CA certificates to the client. 1. Create directory structure and files containing random numbers (need to be root for this): # Make sure uuencode is installed. On Debian based # systems, type # # apt-get install sharutils # cd /usr/lib/ssl/ for i in RootCA ServerCA UserCA; do mkdir -p $i/newcerts; mkdir $i/certs; mkdir $i/crl; mkdir $i/private; touch $i/index.txt; echo 01 > $i/serial; chmod -R g-rwx,o-rwx $i; done for i in `find /usr/lib/ssl/ -name private` do cat /dev/urandom | uuencode -m bla | head -19 | sed "s/begin.*//g" | tail -18 | xargs | sed "s/ //g" > $i/.rand chmod 770 $i/.rand ls -l $i/.rand done At the end of this step, you will have three subdirectories in /usr/lib/ssl: RootCA: Contains the root CA's self-signed certificate and private key as well as the certificates created by the root CA. ServerCA: Contains the CA which is used to create server certificates. Again, the directory contains of the server CA's certificate and key as well as the certificates created by the server CA. UserCA: Contains the CA which is used to create user certificates. 2. openssl.cnf Adapt your openssl.cnf (should be in /usr/lib/ssl, too) to have proper entries for each of the CAs: HOME = /usr/lib/ssl [ RootCA ] dir = /usr/lib/ssl/RootCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/RootCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/RootCA.key.pem RANDFILE = $dir/private/.rand policy = policy_match x509_extensions = ca_cert [ ServerCA ] dir = /usr/lib/ssl/ServerCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/ServerCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/ServerCA.key.pem RANDFILE = $dir/private/.rand x509_extensions = usr_cert (Same with [ UserCA ]) There are more options to be set, but they depend on your environment. Have a look at the default_days, default_md, ... parameters. 1. Create a self signed certificate (RootCA): cd /usr/lib/ssl/RootCA # Create the private key first # You will be asked for a new pasword here. Make it a good one and remember it ;-) openssl genrsa -aes256 -out /usr/lib/ssl/RootCA/private/RootCA.key.pem -rand /usr/lib/ssl/RootCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/RootCA/private/RootCA.key.pem # Now create a certification request. Because the cert is self-signed, this # directly creates the RootCA's certificate. You will be asked for the # password you just created. # # All in one line: openssl req -new -x509 -days 1827 -key /usr/lib/ssl/RootCA/private/RootCA.key.pem -out /usr/lib/ssl/RootCA/RootCA.cert.pem # Copy the certificate to the certs directory and create a link named like # the cert's hash value cp RootCA.cert.pem certs/00.pem cd certs ln -s /usr/lib/ssl/RootCA/certs/00.pem `openssl x509 -hash -noout -in 00.pem`.0 Now you should have the cert (00.pem) and something like 1a2783e8.0 pointing to /usr/lib/ssl/RootCA/00.pem 2. Create the ServerCA cd /usr/lib/ssl/ServerCA # Create the private key for the ServerCA # You will be asked for a new password here. Do not make it the same as the RootCA's # password, but still - make it a good one. # openssl genrsa -aes256 -out /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -rand /usr/lib/ssl/ServerCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/ServerCA/private/ServerCA.key.pem # Create the certification request. You will be asked for the # newly created password. # (All in one line) openssl req -new -days 1827 -key /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -out /usr/lib/ssl/ServerCA/ServerCA.req.pem # Let the RootCA sign the request and create the certificate. # You will need the RootCA's password for this. # openssl ca -name RootCA -in /usr/lib/ssl/ServerCA/ServerCA.req.pem -out /usr/lib/ssl/ServerCA/ServerCA.cert.pem # Copy and link the certificate. # mv /usr/lib/ssl/RootCA/newcerts/01.pem /usr/lib/ssl/RootCA/certs/ cd /usr/lib/ssl/RootCA/certs/ ln -s 01.pem `openssl x509 -in 01.pem -hash -noout`.0 # And copy the part neccessary for browser integration into # another file (this is the part between BEGIN CERTIFICATE and END CERTIFICATE) # cd /usr/lib/ssl/ServerCA sed -n '/-----BEGIN CERTIFICATE-----/,$p' ServerCA.cert.pem > ServerCA.crt # Create the CACerts file used on the client side to verify a server cert mkdir /usr/lib/ssl/cacerts/ cat /usr/lib/ssl/RootCA/RootCA.cert.pem /usr/lib/ssl/ServerCA/ServerCA.cert.pem > /usr/lib/ssl/cacerts/ServerCA.chain.pem # The newly created file (ServerCA.chain.pem) is the CACertsFile which has to be copied # to every client. Create a /usr/lib/ssl/cacerts/ directory on the client side and copy # the file to that location. 3. Do the same with the User CA 4. Create your LDAP server certificate. As for the name in your cert, use the fqdn of the machine you are running the server on. cd /usr/lib/ssl/ServerCA # You will NOT need a password here # openssl genrsa -out <fqdn-of-your-server>.key.pem -rand ./private/.rand 2048 openssl req -new -key <fqdn-of-your-server>.key.pem -out <fqdn-of-your-server>.req.pem # But here, you will be asked for the ServerCA's password openssl ca -name ServerCA -in <fqdn-of-your-server>.req.pem -out <fqdn-of-your-server>.cert.pem Move and link the new certificate (in newcerts) as above. 5. Configure LDAP server and clients Make sure that your ldap server can read its own private key. If your ldap server is running as user openldap, make sure that this user owns the private key in /usr/lib/ssl/ServerCA/private/ Normal users should never be allowed to read the key! This would break the whole security mechanism. In your slapd.conf, you will have TLSCertificateFile /usr/lib/ssl/certs/<fqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/private/<fqdn>.key.pem And on client side ldap.conf: TLS_CACERT /usr/lib/ssl/cacerts/ServerCA.chain.pem TLS_REQCERT demand Hope this helps, Hauke p.s.: The description is strongly influenced by Frank Steidl's tutorial as it can be found at http://fra.nksteidl.de/Erinnerungen/OpenSSL.php ----- Ursprüngliche Mail ----- Von: "Dieter Kluenter" < dieter(a)dkluenter.de > An: openldap-technical(a)openldap.org Gesendet: Dienstag, 7. Oktober 2008 22:34:14 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: StartTLS is not working Dat Duong < datduong2000(a)yahoo.com > writes: > Hi Hauke, > > I still can't get TLS to work. Here is the error message. > > TLS certificate verification: Error, self signed certificate > tls_write: want=7, written=7 > 0000: 15 03 01 00 02 02 30 ......0 > TLS trace: SSL3 alert write:fatal:unknown CA > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Please describe the parameters to create your certificate chain. I presume you have not signed your certificates with a known certificate authority. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------ -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

2 1

AW: Re: AW: Re: AW: StartTLS is not working
by Hauke Coltzau 09 Oct '08

09 Oct '08

Hi Dat, > I've added the below to /etc/openldap/ldap.conf on RHEL 5: > TLS_CACERT /etc/openldap/cacerts/ServerCA.chain.pem > TLS_REQCERT demand > > and still getting errors messages... below: > > TLS certificate verification: Error, self signed certificate The LDAP server does not send a server certificate but a self signed certificate. Are you sending the RootCA's certificate? Create a server certificate as described in the tutorial and let your LDAP server use this. I assume that you will have to read a bit more about certificates and openssl to understand all the steps of the mini tutorial. Rergards, Hauke ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: openldap-software <openldap-software(a)openldap.org> Cc: Dat Duong <datduong2000(a)yahoo.com> Sent: Wednesday, October 8, 2008 2:09:11 AM Subject: AW: Re: AW: StartTLS is not working Hi Dat, glad to see that the first problem has been solved now. As Dieter already pointed out, we need to know how the certificates have been created. As a rough overview, you will need to run through following steps: 0. Understand the basic idea: At the end of this MiniHowto, you will have three certification authorities: UserCA: For user certificates (usually password protected) ServerCA: For server certificates (usually NOT password protected) RootCA: The CA that everyone has to trust in the end. This CA only exists to create and verify the UserCA and ServerCA. For your LDAP server, you create a server certificate with your ServerCA. The LDAP clients will accept the LDAP certificate as long as they trust the ServerCA. They will trust the ServerCA because they trust the RootCA. To make them do so, you will need the certificates of the ServerCA AND the RootCA on each client. Just to make sure: We are not talking about copying the LDAP certificate to the client. Instead, you will copy the CA certificates to the client. 1. Create directory structure and files containing random numbers (need to be root for this): # Make sure uuencode is installed. On Debian based # systems, type # # apt-get install sharutils # cd /usr/lib/ssl/ for i in RootCA ServerCA UserCA; do mkdir -p $i/newcerts; mkdir $i/certs; mkdir $i/crl; mkdir $i/private; touch $i/index.txt; echo 01 > $i/serial; chmod -R g-rwx,o-rwx $i; done for i in `find /usr/lib/ssl/ -name private` do cat /dev/urandom | uuencode -m bla | head -19 | sed "s/begin.*//g" | tail -18 | xargs | sed "s/ //g" > $i/.rand chmod 770 $i/.rand ls -l $i/.rand done At the end of this step, you will have three subdirectories in /usr/lib/ssl: RootCA: Contains the root CA's self-signed certificate and private key as well as the certificates created by the root CA. ServerCA: Contains the CA which is used to create server certificates. Again, the directory contains of the server CA's certificate and key as well as the certificates created by the server CA. UserCA: Contains the CA which is used to create user certificates. 2. openssl.cnf Adapt your openssl.cnf (should be in /usr/lib/ssl, too) to have proper entries for each of the CAs: HOME = /usr/lib/ssl [ RootCA ] dir = /usr/lib/ssl/RootCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/RootCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/RootCA.key.pem RANDFILE = $dir/private/.rand policy = policy_match x509_extensions = ca_cert [ ServerCA ] dir = /usr/lib/ssl/ServerCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/ServerCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/ServerCA.key.pem RANDFILE = $dir/private/.rand x509_extensions = usr_cert (Same with [ UserCA ]) There are more options to be set, but they depend on your environment. Have a look at the default_days, default_md, ... parameters. 1. Create a self signed certificate (RootCA): cd /usr/lib/ssl/RootCA # Create the private key first # You will be asked for a new pasword here. Make it a good one and remember it ;-) openssl genrsa -aes256 -out /usr/lib/ssl/RootCA/private/RootCA.key.pem -rand /usr/lib/ssl/RootCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/RootCA/private/RootCA.key.pem # Now create a certification request. Because the cert is self-signed, this # directly creates the RootCA's certificate. You will be asked for the # password you just created. # # All in one line: openssl req -new -x509 -days 1827 -key /usr/lib/ssl/RootCA/private/RootCA.key.pem -out /usr/lib/ssl/RootCA/RootCA.cert.pem # Copy the certificate to the certs directory and create a link named like # the cert's hash value cp RootCA.cert.pem certs/00.pem cd certs ln -s /usr/lib/ssl/RootCA/certs/00.pem `openssl x509 -hash -noout -in 00.pem`.0 Now you should have the cert (00.pem) and something like 1a2783e8.0 pointing to /usr/lib/ssl/RootCA/00.pem 2. Create the ServerCA cd /usr/lib/ssl/ServerCA # Create the private key for the ServerCA # You will be asked for a new password here. Do not make it the same as the RootCA's # password, but still - make it a good one. # openssl genrsa -aes256 -out /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -rand /usr/lib/ssl/ServerCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/ServerCA/private/ServerCA.key.pem # Create the certification request. You will be asked for the # newly created password. # (All in one line) openssl req -new -days 1827 -key /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -out /usr/lib/ssl/ServerCA/ServerCA.req.pem # Let the RootCA sign the request and create the certificate. # You will need the RootCA's password for this. # openssl ca -name RootCA -in /usr/lib/ssl/ServerCA/ServerCA.req.pem -out /usr/lib/ssl/ServerCA/ServerCA.cert.pem # Copy and link the certificate. # mv /usr/lib/ssl/RootCA/newcerts/01.pem /usr/lib/ssl/RootCA/certs/ cd /usr/lib/ssl/RootCA/certs/ ln -s 01.pem `openssl x509 -in 01.pem -hash -noout`.0 # And copy the part neccessary for browser integration into # another file (this is the part between BEGIN CERTIFICATE and END CERTIFICATE) # cd /usr/lib/ssl/ServerCA sed -n '/-----BEGIN CERTIFICATE-----/,$p' ServerCA.cert.pem > ServerCA.crt # Create the CACerts file used on the client side to verify a server cert mkdir /usr/lib/ssl/cacerts/ cat /usr/lib/ssl/RootCA/RootCA.cert.pem /usr/lib/ssl/ServerCA/ServerCA.cert.pem > /usr/lib/ssl/cacerts/ServerCA.chain.pem # The newly created file (ServerCA.chain.pem) is the CACertsFile which has to be copied # to every client. Create a /usr/lib/ssl/cacerts/ directory on the client side and copy # the file to that location. 3. Do the same with the User CA 4. Create your LDAP server certificate. As for the name in your cert, use the fqdn of the machine you are running the server on. cd /usr/lib/ssl/ServerCA # You will NOT need a password here # openssl genrsa -out <fqdn-of-your-server>.key.pem -rand ./private/.rand 2048 openssl req -new -key <fqdn-of-your-server>.key.pem -out <fqdn-of-your-server>.req.pem # But here, you will be asked for the ServerCA's password openssl ca -name ServerCA -in <fqdn-of-your-server>.req.pem -out <fqdn-of-your-server>.cert.pem Move and link the new certificate (in newcerts) as above. 5. Configure LDAP server and clients Make sure that your ldap server can read its own private key. If your ldap server is running as user openldap, make sure that this user owns the private key in /usr/lib/ssl/ServerCA/private/ Normal users should never be allowed to read the key! This would break the whole security mechanism. In your slapd.conf, you will have TLSCertificateFile /usr/lib/ssl/certs/<fqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/private/<fqdn>.key.pem And on client side ldap.conf: TLS_CACERT /usr/lib/ssl/cacerts/ServerCA.chain.pem TLS_REQCERT demand Hope this helps, Hauke p.s.: The description is strongly influenced by Frank Steidl's tutorial as it can be found at http://fra.nksteidl.de/Erinnerungen/OpenSSL.php ----- Ursprüngliche Mail ----- Von: "Dieter Kluenter" < dieter(a)dkluenter.de > An: openldap-technical(a)openldap.org Gesendet: Dienstag, 7. Oktober 2008 22:34:14 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: StartTLS is not working Dat Duong < datduong2000(a)yahoo.com > writes: > Hi Hauke, > > I still can't get TLS to work. Here is the error message. > > TLS certificate verification: Error, self signed certificate > tls_write: want=7, written=7 > 0000: 15 03 01 00 02 02 30 ......0 > TLS trace: SSL3 alert write:fatal:unknown CA > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Please describe the parameters to create your certificate chain. I presume you have not signed your certificates with a known certificate authority. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------ -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

ldapadd error
by Kermito le kermit 08 Oct '08

08 Oct '08

hello all i am new to openldap and i have some problem to use, i follow the exemple in quick start guide to make my slpad.conf but when i what to populta my data base i have error in the log i see conn=0 op=0 BIND dn="cn=Manager,dc=example,dc=com" method=128 conn=0 op=0 BIND dn="cn=Manager,dc=example,dc=com" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 ADD dn="dc=example,dc=com" Erreur de segmentation i am to debian help me please

1 0

problem searching directory for a certificate
by drewgr 08 Oct '08

08 Oct '08

Folks, I have a Java based application using JNDI to connect with OpenLDAP. One of the functions requires searching the directory for a given certificate. No matter what I try, this will not work with OpenLDAP. I think that either OpenLDAP just is not able to search for binary data, or more likely there is something "special" about the "userCertificate;binary" attribute. I turned on full tracing in the LDAP log, and I see the following when the relevant search is executed. >>> serialNumberAndIssuerPretty: <various "graphics" characters > get_ava: illegal value for attributeType userCertificate end get_filter 0 end get_filter_list end get_filter 0 filter: (&(?=undefined)) => get_ctrls => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" attrs: The "filter: (&(?=undefined))" seems really fishy to me. When I do any other search, the line looks more like "(&(uid=GregD))" From the application side, it appears that the request succeeded, but it returns nothing. I know the certificate exists in the directory, as I can search on an ordinary attribute like uid and then get the userCertificate;binary attribute from the result. The data returned is a valid certificate. I have watched the packet stream back and forth, and the query is getting transmitted to the slapd correctly, but no matches are returned. Setting com.sun.jndi.ldap.trace.ber to System.out in the application gives trace data which indicates the same thing. To further validate my suspicions that this is an OpenLDAP issue, I set up a Sun Directory Server instance on the same server, and I am able to perform the search against that software. I've also started looking around the OpenLDAP source code, but so far have not found the smoking gun. Can anyone shed some light on this for me? The OS is CentOS 5.2, latest patches. The OpenLdap version is 2.3.27-8 as reported by rpm. Thanks Greg

2 1

Re: AW: StartTLS is not working
by Dat Duong 07 Oct '08

07 Oct '08

Hi Hauke, I still can't get TLS to work. Here is the error message. TLS certificate verification: Error, self signed certificate tls_write: want=7, written=7 0000: 15 03 01 00 02 02 30 ......0 TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed. ldap_err2string ldap_start_tls: Connect error (-11) Thanks ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical <openldap-technical(a)openldap.org> Sent: Tuesday, October 7, 2008 1:25:37 AM Subject: AW: StartTLS is not working Hi Dat, first of all: Please send your questions to the list so that other users with the same problem can find the solution, too. To your problem: Please make sure that you have a correct value for your ServerCA's private key in your openssl.cnf. It should read something like this: [ ServerCA ] # Where is the base directory for the ServerCA dir = /usr/lib/ssl/ServerCA # Where is the ServerCA's certificate certificate = $dir/ServerCA.cert.pem # and where is the ServerCA's private key private_key = $dir/private/ServerCA.key.pem Without the private key, the ServerCA will not be able to sign your LDAP certificate. You will find more configuration hints for openssl.cnf in the tutorial. Hope this helps, Hauke -- ----- Ursprüngliche Mail ----- Von: "Dat Duong" <datduong2000(a)yahoo.com> An: "hauke coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Dienstag, 7. Oktober 2008 09:06:07 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: StartTLS is not working Hi Hauke, I read your instruction on how to create Root CA ...I have a hard time understanding the step. I have a question on how to sign the ldap server certificated using Server CA? I get an error message: bash-3.00# openssl ca -name ServerCA -in afldap01.req.pem -out afldap01.cert.pem Using configuration from /usr/local/ssl/openssl.cnf variable lookup failed for ServerCA::private_key 18908:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=ServerCA name=private_key Thanks Dat -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

2 1

LVM snapshot as a backup method
by Pavlos Parissis 07 Oct '08

07 Oct '08

Hi, Has anyone used LVM snapshot as a backup method when downtime isn't allowed and slapcat takes hours to finish? I have to find a way to backup the LDAP without bring it down or set it in ReadOnly mode, thus I thought about the LVM snapshot. I can run LVM snapshot every day and then run db_recover -c for making the snapshot LDAP DB in a good state. Am I missing something in the above idea? Cheers, Pavlos

2 3

RE: JDBC-LDAP Bridge Driver and Tomcat Connection Pooling
by Hu, William 07 Oct '08

07 Oct '08

I got the following when try to use connection pooling from Tomcat. There maybe an issue with auto commit, read only and transaction isolation settings. Does your driver use these settings? Or are they not implemented? Thanks in advance com.jaspersoft.jasperserver.api.JSException: jsexception.error.creating.connection com.jaspersoft.jasperserver.api.JSException: jsexception.error.creating.connection at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:61) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.BaseJdbcDa taSource.setReportParameterValues(BaseJdbcDataSource.java:52) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.setReportParameterValues(JdbcDataSourceService.java:66) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:633) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:333) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.executeReport(EngineServiceImpl.java:765) at com.jaspersoft.jasperserver.api.engine.jasperreports.domain.impl.ReportUnitR equest.execute(ReportUnitRequest.java:60) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.execute(EngineServiceImpl.java:265) at com.jaspersoft.jasperserver.war.action.ViewReportAction.executeReport(ViewRe portAction.java:329) at com.jaspersoft.jasperserver.war.action.ViewReportAction.verifyData(ViewRepor tAction.java:222) at sun.reflect.GeneratedMethodAccessor376.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethod Invoker.java:103) at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:13 6) at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.jav a:203) at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.j ava:142) at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.jav a:61) at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:180) at org.springframework.webflow.engine.State.enter(State.java:200) at org.springframework.webflow.engine.Transition.execute(Transition.java:229) at org.springframework.webflow.engine.TransitionableState.onEvent(Transitionabl eState.java:112) at org.springframework.webflow.engine.Flow.onEvent(Flow.java:572) at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEven t(RequestControlContextImpl.java:207) at org.springframework.webflow.engine.impl.FlowExecutionImpl.signalEvent(FlowEx ecutionImpl.java:214) at org.springframework.webflow.executor.FlowExecutorImpl.resume(FlowExecutorImp l.java:238) at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopU tils.java:281) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint (ReflectiveMethodInvocation.java:187) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:154) at org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.inv oke(MethodSecurityInterceptor.java:66) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:176) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopPro xy.java:210) at $Proxy13.resume(Unknown Source) at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRe quest(FlowRequestHandler.java:115) at org.springframework.webflow.executor.mvc.FlowController.handleRequestInterna l(FlowController.java:170) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(Abstrac tController.java:153) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(Si mpleControllerHandlerAdapter.java:45) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl et.java:820) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle t.java:755) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer vlet.java:396) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java :350) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.common.UploadMultipartFilter.doFilter(Upload MultipartFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:264) at org.acegisecurity.ui.switchuser.SwitchUserProcessingFilter.doFilter(SwitchUs erProcessingFilter.java:335) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecur ityInterceptor.java:107) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSec urityInterceptor.java:72) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslatio nFilter.java:110) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(Ano nymousProcessingFilter.java:125) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.api.metadata.user.service.impl.MetadataAuthentic ationProcessingFilter.doFilter(MetadataAuthenticationProcessingFilter.java:1 41) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.util.RequestParameterAuthenticationFilter.do Filter(RequestParameterAuthenticationFilter.java:97) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessin gFilter.java:181) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFil ter.java:217) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpS essionContextIntegrationFilter.java:191) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148) at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.util.CharacterEncodingFilter.doFilter(Charac terEncodingFilter.java:70) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt erProxy.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.ja va:213) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.ja va:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126 ) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105 ) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java :107) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869) at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processC onnection(Http11BaseProtocol.java:664) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.jav a:527) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWo rkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.jav a:684) at java.lang.Thread.run(Thread.java:595) Caused by: org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool exhausted at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:103) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:58) ... 94 more Caused by: java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPoo l.java:806) at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:95) ... 95 more org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool exhausted org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool exhausted at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:103) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:58) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.BaseJdbcDa taSource.setReportParameterValues(BaseJdbcDataSource.java:52) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.setReportParameterValues(JdbcDataSourceService.java:66) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:633) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:333) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.executeReport(EngineServiceImpl.java:765) at com.jaspersoft.jasperserver.api.engine.jasperreports.domain.impl.ReportUnitR equest.execute(ReportUnitRequest.java:60) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.execute(EngineServiceImpl.java:265) at com.jaspersoft.jasperserver.war.action.ViewReportAction.executeReport(ViewRe portAction.java:329) at com.jaspersoft.jasperserver.war.action.ViewReportAction.verifyData(ViewRepor tAction.java:222) at sun.reflect.GeneratedMethodAccessor376.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethod Invoker.java:103) at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:13 6) at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.jav a:203) at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.j ava:142) at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.jav a:61) at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:180) at org.springframework.webflow.engine.State.enter(State.java:200) at org.springframework.webflow.engine.Transition.execute(Transition.java:229) at org.springframework.webflow.engine.TransitionableState.onEvent(Transitionabl eState.java:112) at org.springframework.webflow.engine.Flow.onEvent(Flow.java:572) at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEven t(RequestControlContextImpl.java:207) at org.springframework.webflow.engine.impl.FlowExecutionImpl.signalEvent(FlowEx ecutionImpl.java:214) at org.springframework.webflow.executor.FlowExecutorImpl.resume(FlowExecutorImp l.java:238) at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopU tils.java:281) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint (ReflectiveMethodInvocation.java:187) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:154) at org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.inv oke(MethodSecurityInterceptor.java:66) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:176) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopPro xy.java:210) at $Proxy13.resume(Unknown Source) at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRe quest(FlowRequestHandler.java:115) at org.springframework.webflow.executor.mvc.FlowController.handleRequestInterna l(FlowController.java:170) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(Abstrac tController.java:153) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(Si mpleControllerHandlerAdapter.java:45) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl et.java:820) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle t.java:755) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer vlet.java:396) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java :350) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.common.UploadMultipartFilter.doFilter(Upload MultipartFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:264) at org.acegisecurity.ui.switchuser.SwitchUserProcessingFilter.doFilter(SwitchUs erProcessingFilter.java:335) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecur ityInterceptor.java:107) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSec urityInterceptor.java:72) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslatio nFilter.java:110) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(Ano nymousProcessingFilter.java:125) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.api.metadata.user.service.impl.MetadataAuthentic ationProcessingFilter.doFilter(MetadataAuthenticationProcessingFilter.java:1 41) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.util.RequestParameterAuthenticationFilter.do Filter(RequestParameterAuthenticationFilter.java:97) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessin gFilter.java:181) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFil ter.java:217) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpS essionContextIntegrationFilter.java:191) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148) at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.util.CharacterEncodingFilter.doFilter(Charac terEncodingFilter.java:70) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt erProxy.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.ja va:213) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.ja va:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126 ) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105 ) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java :107) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869) at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processC onnection(Http11BaseProtocol.java:664) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.jav a:527) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWo rkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.jav a:684) at java.lang.Thread.run(Thread.java:595) Caused by: java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPoo l.java:806) at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:95) ... 95 more java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPoo l.java:806) at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:95) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:58) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.BaseJdbcDa taSource.setReportParameterValues(BaseJdbcDataSource.java:52) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.setReportParameterValues(JdbcDataSourceService.java:66) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:633) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:333) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.executeReport(EngineServiceImpl.java:765) at com.jaspersoft.jasperserver.api.engine.jasperreports.domain.impl.ReportUnitR equest.execute(ReportUnitRequest.java:60) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.execute(EngineServiceImpl.java:265) at com.jaspersoft.jasperserver.war.action.ViewReportAction.executeReport(ViewRe portAction.java:329) at com.jaspersoft.jasperserver.war.action.ViewReportAction.verifyData(ViewRepor tAction.java:222) at sun.reflect.GeneratedMethodAccessor376.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethod Invoker.java:103) at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:13 6) at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.jav a:203) at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.j ava:142) at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.jav a:61) at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:180) at org.springframework.webflow.engine.State.enter(State.java:200) at org.springframework.webflow.engine.Transition.execute(Transition.java:229) at org.springframework.webflow.engine.TransitionableState.onEvent(Transitionabl eState.java:112) at org.springframework.webflow.engine.Flow.onEvent(Flow.java:572) at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEven t(RequestControlContextImpl.java:207) at org.springframework.webflow.engine.impl.FlowExecutionImpl.signalEvent(FlowEx ecutionImpl.java:214) at org.springframework.webflow.executor.FlowExecutorImpl.resume(FlowExecutorImp l.java:238) at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopU tils.java:281) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint (ReflectiveMethodInvocation.java:187) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:154) at org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.inv oke(MethodSecurityInterceptor.java:66) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:176) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopPro xy.java:210) at $Proxy13.resume(Unknown Source) at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRe quest(FlowRequestHandler.java:115) at org.springframework.webflow.executor.mvc.FlowController.handleRequestInterna l(FlowController.java:170) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(Abstrac tController.java:153) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(Si mpleControllerHandlerAdapter.java:45) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl et.java:820) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle t.java:755) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer vlet.java:396) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java :350) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.common.UploadMultipartFilter.doFilter(Upload MultipartFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:264) at org.acegisecurity.ui.switchuser.SwitchUserProcessingFilter.doFilter(SwitchUs erProcessingFilter.java:335) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecur ityInterceptor.java:107) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSec urityInterceptor.java:72) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslatio nFilter.java:110) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(Ano nymousProcessingFilter.java:125) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.api.metadata.user.service.impl.MetadataAuthentic ationProcessingFilter.doFilter(MetadataAuthenticationProcessingFilter.java:1 41) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.util.RequestParameterAuthenticationFilter.do Filter(RequestParameterAuthenticationFilter.java:97) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessin gFilter.java:181) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFil ter.java:217) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpS essionContextIntegrationFilter.java:191) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148) at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.util.CharacterEncodingFilter.doFilter(Charac terEncodingFilter.java:70) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt erProxy.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.ja va:213) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.ja va:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126 ) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105 ) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java :107) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869) at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processC onnection(Http11BaseProtocol.java:664) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.jav a:527) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWo rkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.jav a:684) at java.lang.Thread.run(Thread.java:595)

1 0

question regarding ACLs
by Kick, Claus 07 Oct '08

07 Oct '08

Hello all, Since there is some time, I figured I rectify our openldap configuration and use proper ACLs. We are using the following version on Solaris 10: [xxxx:/opt/csw/libexec]$ ./slapd -V @(#) $OpenLDAP: slapd 2.3.39 (Feb 22 2008 18:51:52) $ asmoore@ra Our user subtree is organized as shown below: o=suffix ou=people,o=suffix uid=kdz,ou=people,o=suffix uid=hyc,ou=people,o=suffix ou=removed_accounts,ou=people,o=suffix uid=abcd,ou=removed_accounts,ou=people,o=suffix uid=efgh,ou=removed_accounts,ou=people,o=suffix Basically, I want a getent passwd not to list entries below ou=removed_accounts,ou=people,o=suffix, for a client application still considers the removed accounts as users (it probably searches the whole subtree). I read the documentation for 2.3: http://www.openldap.org/doc/admin23/slapdconfig.html#Access%20Control <http://www.openldap.org/doc/admin23/slapdconfig.html> And found this: The scope can be either base, one, subtree, or children. Where base matches only the entry with provided DN, one matches the entries whose parent is the provided DN, subtree matches all entries in the subtree whose root is the provided DN, and children matches all entries under the DN (but not the entry named by the DN). So, I figured that an ACL (no global ACLs any longer) like this access to dn.one="ou=People,o=suffix" by * write Should hide the removed accounts and only show the active ones. But it does not, it still contains all the children of ou=removed_accounts,ou=people,o=suffix And of ou=people,o=suffix Using dn.base="ou=People,o=suffix" by * write Works as expected and getent passwd not return any ldap users, solely the /etc/passwd users. The client system in question is a Solaris 10 machine, I have kept the client configuration unchanged for the tests so far: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 127.0.0.1 NS_LDAP_SEARCH_BASEDN= o=suffix NS_LDAP_SEARCH_TIME= 90 NS_LDAP_CACHETTL= 0 There are only two other ACLs in place: 1. access to dn.one="ou=Group,o=siemensmedical.com" by * write This one works fine, getent group returns all the groups it should return and the changes can be done as well. 2. access to dn.subtree="ou=Roles,o=siemensmedical.com" by * write This one works fine as well, it returns the role structure as requested and changes work as well. Where am I making a mistake? Best regards, Claus

2 3

openLDAP TLS APIs usage issue
by dhiraj.prasad＠tcs.com 07 Oct '08

07 Oct '08

Hello, I have configured LDAP server on linux with TLS support and was able to fetch data from it using the ldapsearch utility. However, when i tried to do this searching via code i got following errors: Error at Server Side: slap_listener_activate(10): >>> slap_listener(ldaps://) connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(15): TLS accept failure error=-1 id=47, closing connection_closing: readying conn=47 sd=15 for close connection_close: conn=47 sd=15 Error at Client side: [root@localhost LDAP1]# ./ldapSearch ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost.localdomain:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 19, subject: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com, issuer: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Error in ldap_start_tls_s -1:Can't contact LDAP serverTest..1 ldap_bind_s ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request Test..2: -1 ldap_err2string Failure of LDAP bind -1-Can't contact LDAP server [root@localhost LDAP1]# Snippet of client code for TLS support used by Me: ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE, "/root/cacert.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_CERTFILE, "/usr/local/etc/openldap/ldap.client.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_KEYFILE, "/usr/local/etc/openldap/ldap.client.key.pem"); ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); status = ldap_start_tls_s(ld, NULL, NULL); Please let me know as to what is missing in my code that is triggering the above errors. Also if there are any sample TLS client code, please let me know where can i get it. Thanks, Dhiraj Kumar Prasad Tata Consultancy Services Mailto: dhiraj.prasad(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Outsourcing ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

loglevel and logfile
by Ashraf Mohamed 07 Oct '08

07 Oct '08

hi, I am trying to turn on debugging for slapd and direct the debug output to a specific file on OpenLDAP 2.4.11 on linux without using syslog. I tried using slapd.conf; configured logfile and loglevel. And the only way I could get it working is by passing in the -d option to slapd. It does not seem to use the loglevel/logfile values if I don't pass in the -d option. I also tried using slapd.d. I am able to set olcLogLevel but I can't set olcLogFile. It won't even let me add it to the config. Ideas? Thanks much. Ashraf

2 1

AW: StartTLS is not working
by Hauke Coltzau 07 Oct '08

07 Oct '08

Hi Dat, first of all: Please send your questions to the list so that other users with the same problem can find the solution, too. To your problem: Please make sure that you have a correct value for your ServerCA's private key in your openssl.cnf. It should read something like this: [ ServerCA ] # Where is the base directory for the ServerCA dir = /usr/lib/ssl/ServerCA # Where is the ServerCA's certificate certificate = $dir/ServerCA.cert.pem # and where is the ServerCA's private key private_key = $dir/private/ServerCA.key.pem Without the private key, the ServerCA will not be able to sign your LDAP certificate. You will find more configuration hints for openssl.cnf in the tutorial. Hope this helps, Hauke -- ----- Ursprüngliche Mail ----- Von: "Dat Duong" <datduong2000(a)yahoo.com> An: "hauke coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Dienstag, 7. Oktober 2008 09:06:07 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: StartTLS is not working Hi Hauke, I read your instruction on how to create Root CA ...I have a hard time understanding the step. I have a question on how to sign the ldap server certificated using Server CA? I get an error message: bash-3.00# openssl ca -name ServerCA -in afldap01.req.pem -out afldap01.cert.pem Using configuration from /usr/local/ssl/openssl.cnf variable lookup failed for ServerCA::private_key 18908:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=ServerCA name=private_key Thanks Dat -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

Problem with usage of suffixmassage and meta database
by Padgett,Phil 07 Oct '08

07 Oct '08

I am attempting to use "database meta" to direct queries to either one of two backend databases. The queries come in in the form "cn=user1,dc=alpha,dc=ufl,dc=edu" or "cn=user2,dc=beta,dc=ufl,dc=edu". I have multible local databases alpha, beta, and prod. There are some accounts which have info in those databases and others which should be redirected to a campus active directory server. If I send in the requests as "cn=user1,dc=ufl,dc=edu", etc then both the local databases and the remote active directory one can service them. This works well. I would like to call them with the alpha, beta, or prod in the dn so that the appropriate local database is consulted but if there is no match then the active directory server is queried. I seem to be having problems with the suffixmassage directive since this does not seem to be working. Any help would be appreciated. Below is the relevent section of my slapd.conf file. Thanks. Phil database meta suffix "dc=ufl,dc=edu" uri "ldap://localhost:390/dc=alpha,dc=ufl,dc=edu" uri "ldap://localhost:390/dc=beta,dc=ufl,dc=edu" uri ldap://localhost:390/dc=prod,dc=ufl,dc=edu uri "ldap://ldap.ad.ufl.edu/dc=alpha,dc=ufl,dc=edu" acl-authcDN "cn=SVC-LDAP,OU=Service Accounts,OU=Departments,OU=UF,DC=ad,DC=ufl,DC=edu" acl-passwd 'ssssssssss' rewriteEngine on suffixmassage "dc=alpha,dc=ufl,dc=edu" "dc=ad,dc=ufl,dc=edu" lastmod off

1 0

Re: Incorrect snippet in delta-syncrepl example in admin guide?
by Brad T Waldorf 06 Oct '08

06 Oct '08

My own thoughts, for what they're worth... A "complete working examples" section would be invaluable. The most useful part of the man pages for the command line & admin tools was the example section... it ties everything together. Same for the examples in the admin guide... a complete example to compliment the conceptual words is priceless. Funny you mention it, but i was also disappointed in the N-Way configuration example (17.4.3)... but because it was in the "new" config file format, which i wasn't using. Anyway, I understand you want readers to read thoroughly and try creating their own configuration from scratch... but i've found it's rare that a user will spend the time to "properly" understand something before they actually try making it work. Rather, they try something, research/fix the error, try again, research/fix, etc... whatever it takes to get it working as quick as possible. In my experience, syntax diagrams and working examples are the most important, time-saving (and sanity-saving) pieces of documentation. Having working example configurations that are commented thoroughly ("see section ____ for more info on configuration specifics for this", "modify the following statements with your own specific values", etc.) might be the best solution. Thanks again for all your help

1 0

Re: Incorrect snippet in delta-syncrepl example in admin guide?
by Pierangelo Masarati 06 Oct '08

06 Oct '08

Gavin Henry wrote: > ----- "Pierangelo Masarati" <ando(a)sys-net.it> wrote: > >> Brad T Waldorf wrote: >>> I would >>> definitely recommend replacing "may need to" with "must" in the >> following >>> statement, as you suggested. "This ACL may need to be merged with >> other >>> ACL statements." >> Probably, that whole example should be removed, as it belongs to >> access >> control rather than to replication. > > It's hard to present complete examples that way. I've other external feedback in various forums > whereby users complain that N-Way is hard to understand, but they merely need to read the whole guide. I0'm not speaking in general, but specifically related to that case. access to * by <canreadall> read by * break is: 1) generic, not necessarily specific to replication 2) incomplete, since it needs to integrate with other access rules 3) should be per-database, rather than global, IMHO. So like it's now it creates more trouble than it helps solving. > I'm tempted to move complete working examples to the follow existing empty section: > > http://www.openldap.org/doc/admin24/appendix-deployments.html Sounds good. > This would however promoted copy-and-paste configurations. That's inevitable, I fear, no matter what. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

rfc4523
by Gavin Henry 06 Oct '08

06 Oct '08

Hi All, How can slapd take advantage of rfc4523 for example? test21 only shows search/add/delete to a users entry, so I'm trying to understand the bigger picture from the server and clients point of view. Is it intended to be used just as a data store for 3rd party application to retrieve all the X.509 information? Thanks, Gavin.

2 1

Using ACIs in our opensource project
by Faraz Khan 06 Oct '08

06 Oct '08

Dear All, We are developing a webbased opensource identity management solution which includes a graphical frontend to manage openldap ACLs. Previously we were using Cn=config and 'standard' ACLs to manage our tree but we later moved on to OpenLdap ACIs for in-tree ACLs. Gavin Henry suggested that I take this discussion to the list since ACIs are not being actively maintained and its advisable to move to the 'normal' openldap ACLs. My problem with that model is that management through a graphical interface becomes VERY ugly (parsing and rendering text acls, maintaining priority, managing referential integrity if a dn is deleted, etc). I have found OpenLdapACIs extremely handy to use for my task. We are willing to provide resources/dev time in the future for the support of OpenLDAP ACIs since its crucial to our project. I wanted to know if support/interest is the ONLY problem or are there fundamental flaws in the way ACIs work? Thank you. -- Faraz R Khan Zivios::Open Source Enterprise Management www.zivios.org

1 0

Incorrect snippet in delta-syncrepl example in admin guide?
by Brad T Waldorf 05 Oct '08

05 Oct '08

Hi. I used the Delta-syncrepl configuration example from the admin guide (http://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl) to create configuration files for a basic 1 Master, 1 Slave configuration. With a populated & functional master, i started the slave and hit this error... slap_client_connect: URI=ldap://9.57.13.249:389 DN="cn=user.replicator,ou=people ,dc=exampleb,dc=com" ldap_sasl_bind_s failed (49)+ (The replicator DN couldn't bind.) In fact, i couldn't execute a basic ldapsearch while binding as the replicator DN... kept getting "ldap_bind: Invalid credentials (49)". Long story short, the fix was to comment out the following ACL statements in the master config file ... i could then bind as the replicator DN and delta-syncrepl worked... # Give the replica DN unlimited read access. access to * by dn.base="cn=user.replicator,ou=People,dc=exampleb,dc=com" read by * break I might be missing something... but based on my results, it seems like those ACL statements aren't needed and actually prevented me from delta-syncrepl'ing successfully. Wanted to pass along this info incase i'm actually on to something... so you can fix the documentation if need be. Thanks! Master slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Give the replica DN unlimited read access. #access to * # by dn.base="cn=user.replicator,ou=People,dc=exampleb,dc=com" read # by * break # Accesslog database definitions database hdb suffix cn=accesslog directory /usr/local/var/openldap-data/db/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=user.replicator,ou=People,dc=exampleb,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database hdb suffix "dc=exampleb,dc=com" rootdn "cn=kingb,dc=exampleb,dc=com" rootpw pappie directory /usr/local/var/openldap-data index objectclass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="cn=user.replicator,ou=People,dc=exampleb,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Slave slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database hdb suffix "dc=exampleb,dc=com" rootdn "cn=kingb,dc=exampleb,dc=com" rootpw pappie directory /usr/local/var/openldap-data index entryUUID eq # syncrepl directives syncrepl rid=0 provider=ldap://(my_ip_address):389 bindmethod=simple binddn="cn=user.replicator,ou=People,dc=exampleb,dc=com" credentials=metsrbad searchbase="dc=exampleb,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://(my_ip_address):389

2 3

AW: Re: AW: openldap and TLS certificates
by Hauke Coltzau 03 Oct '08

03 Oct '08

Hi Nick, just to make sure: Your CA certificate is not the same as your ldap server certificate, is it? If so, then there will be the problem. To get a proper server certificate, you will have to do the following steps: 1. Create a root CA (that means, create a self signed certificate) 2. Using your root CA, create a CA for your server certificate generation and, if needed, a user CA for your user certificate generation Now you have two certificates, already. A root CA cert and a server CA cert. Still, those are not your ldap server certificates. 3. With your server CA (NOT the root ca), create a server certificate for ldap. 4. Copy the server CA certificate and the root CA certificate into one file and call it something like serverca.chain.pem. This is NOT your ldap server certificate but the certification authority, your client will trust. 5. The serverca.chain.pem is to be copied to your ldap client and will be used as CACertFile. So if the client receives the ldap server cert, it can check that it came from a trusted CA and therefore can be accpeted. There is a very good tutorial for the CA creation available at http://fra.nksteidl.de/Erinnerungen/OpenSSL.php, but it is in German. I used that tutorial and it worked out perfectly. Hope, it helps, Hauke ----- Ursprüngliche Mail ----- Von: "Nick Kasparidis" <nick.kasparidis(a)toumaz.com> An: "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> CC: "openldap-technical" <openldap-technical(a)openldap.org> Gesendet: Donnerstag, 2. Oktober 2008 12:04:43 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: openldap and TLS certificates Hello again, I followed your instructions, and I keep getting the same errors. I have also tried to remove the entries before the actual certificate and still no change. There was another suggestion on generating the certificates. I will try that and hope for the best. Thanks for the help Nick On Tue, 2008-09-30 at 02:10 +0200, Hauke Coltzau wrote: > Hi Nick, > > it took me some time to set up TLS successfully, so I'm with > you in this journey ;-) > > >From my own experience, I would suggest to start verfifying > the server first. Let the client simply have the > > TLS_CACERT /<path>/<to>/<cachain>/cacert.chain.pem > TLS_REQCERT demand > > options set and not send any certificate at all. > On the server's side, only set > > TLSCertificateFile /your/cert.pem > TLSCertificateKeyFile /your/private/key.pem > > You will not need a CACert file on the server for now. > > Make sure that the client will not send any certificate, so > check your current users .ldaprc, because the client certificate > depends on the user that runs the ldapsearch command. > > If you can set up TLS this way, you can be sure that the > server is valid. To validate your client, you will need > a .ldaprc in the current user's home directory which points > to the user's cert and key. The server must be able to > verify the user's cert. > > Hope, this helps, > > Hauke > > > ----- Ursprüngliche Mail ----- > Von: "Nick Kasparidis" <nick.kasparidis(a)toumaz.com> > An: openldap-technical(a)openldap.org > Gesendet: Montag, 29. September 2008 17:11:10 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien > Betreff: openldap and TLS certificates > > Hello everyone, > I seem to have a problem with setting up secure connections with my > LDAP server. I believe the problem has mainly to do with my certificates > rather than anything else. I used the tutorial provided by the openLDAP > admin guide to generate my certificates > http://damncoolpics.blogspot.com/2008/09/oktoberfest-2008-in-munich.html > > My slapd.conf files has the following entries > > #SSL/TLS Options > TLSCipherSuite HIGH:MEDIUM > TLSCACertificateFile /usr/local/etc/slapd-cacert.pem > TLSCertificateFile /usr/local/etc/slapd-cert.pem > TLSCertificateKeyFile /usr/local/etc/slapd-key.pem > > and my ldap.conf > TLS_CACERTDIR /etc/openldap/cacerts > TLS_CACERT /etc/openldap/cacerts/slapd-cert.pem > > slapd-cacert.pem is the certificate of the CA > slapd-cert.pem is the server certificate (same copy on client and > server) > slapd-key.pem is the server key (I manually removed the certificate > request that was generated by the process on the link above) > > I start the server using /usr/local/libexec/slapd -h ldap:/// ( also > tried the -d 9 flag for debugging), and when I use ldapsearch I get the > following errors > > (from the client) > ldapsearch -x -ZZ (I have most of the settings in my ldap.conf) > > ldap_start_tls: Connect error (-11) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > (from the server with the -d 9 flag) > I get load of stuff, but the important seems to be the following > > TLS trace: SSL3 alert read:fatal:unknown CA > TLS trace: SSL_accept:failed in SSLv3 read client certificate A > TLS: can't accept. > TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca > s3_pkt.c:1053 > connection_read(12): TLS accept failure error=-1 id=0, closing > > When I try a search without the -ZZ flag everything works fine. When I > created the certificates I tried different common names. I tried the ip > address, fully qualified name (as shown below), the short name, even my > name, but no luck. I have read the proper RFC but could not get > anyusefull information. By the way I have a local DNS server and the > domain name should match the correct IP address (and the reverse). > > Truth is I do not know much about SSL and certificates, so I might be > missing something. Just for your information, The certificate authority > is the same with the LDAP server. I will provide the certificate below, > with email and addresses altered. Also the hashes have been altered so > key and cert will not match. I merely provide them just in case you see > something wrong in the syntax. > > The server certificate > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: 1 (0x1) > Signature Algorithm: sha1WithRSAEncryption > Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Validity > Not Before: Sep 29 09:49:07 2008 GMT > Not After : Sep 29 09:49:07 2009 GMT > Subject: C=GB, ST=Oxfordshire, L=Abingdon, O=Company,, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > RSA Public Key: (2048 bit) > Modulus (2048 bit): > 00:c4:4d:49:ce:35:a6:80:67:d5:c5:ea:2e:5a:b0: > 0f:96:a2:de:28:c3:97:fc:5d:9d:05:57:ae:a8:db: > d4:cd:8c:bb:1d:4d:2c:41:51:45:0e:c9:17:8f:a0: > 5b:bb:a0:5e:d3:d7:5d:a4:64:dd:23:9a:64:ad:dc: > 7b:49:5a:92:68:65:32:6c:0c:50:84:8a:75:26:da: > 76:7f:65:13:14:0a:05:eb:5e:d3:f7:1e:89:7f:a2: > d8:1b:4a:46:28:ee:98:5f:f9:bd:21:88:df:76:5c: > b9:8e:7e:5b:09:29:65:e7:6b:a7:5b:5f:4a:99:77: > 7d:6c:d1:44:7e:7a:77:05:fe:1c:b9:6d:2b:e2:57: > 63:63:29:b3:cb:c6:68:35:b5:81:fa:ef:ee:ba:c0: > 54:3e:d8:70:0a:f6:c9:39:74:21:f8:75:b9:08:89: > 6a:5e:e3:fe:1e:5e:37:b0:29:2d:13:35:b4:7c:aa: > 55:3e:c3:c4:59:cd:08:e1:ef:21:43:29:0f:82:8f: > 84:7d:f2:65:b5:79:2e:fc:87:7c:7d:ca:fb:7a:ef: > 54:c4:33:20:ed:f5:8a:64:de:60:18:60:07:ee:f9: > ea:0f:97:bf:af:63:e1:e4:e8:b2:15:1b:5f:95:fd: > ad:c7:83:8c:94:f3:e4:ef:95:63:f0:d4:a8:f8:49: > 13:05 > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Basic Constraints: > CA:FALSE > Netscape Comment: > OpenSSL Generated Certificate > X509v3 Subject Key Identifier: > > 1F:9F:4E:5A:C8:61:53:4B:5F:50:28:84:F8:D7:45:54:C0:C9:7E:67 > X509v3 Authority Key Identifier: > > keyid:7C:5A:92:7E:5C:6B:3E:9B:0E:87:46:7C:FB:27:8F:34:AD:42:3B:27 > > Signature Algorithm: sha1WithRSAEncryption > 04:3d:f9:64:e9:c1:13:8c:98:e6:b6:33:a9:e0:8b:8e:b0:68: > 2f:70:8e:8e:b4:b2:6f:61:7c:bd:63:f2:cb:20:b8:6e:4f:0a: > 53:5f:ba:ed:32:20:c7:31:24:0c:c3:e8:d6:42:1c:a8:3e:7b: > 32:b4:87:94:71:d6:8b:ca:c9:57:f5:9f:fc:8d:89:77:e2:3e: > ac:49:cd:c8:c7:01:83:41:41:a6:05:7c:df:c6:37:0e:15:d8: > d2:51:3f:a5:92:b7:bf:3f:65:4e:68:71:b7:4e:3e:26:f6:15: > fe:38:72:e1:f9:b7:60:29:e8:ff:78:3c:aa:34:be:e8:46:f1: > 5f:87:8b:a1:60:8b:82:31:ca:5e:a1:31:83:e7:b7:90:be:a5: > 2f:ac:f7:1c:fe:af:89:15:02:af:c7:4f:2f:97:87:2b:0b:83: > 5c:07:83:f9:f9:c7:63:00:69:fa:c9:d0:fc:fb:7a:ef:7a:41: > 1c:e0:99:e4:01:73:7f:94:fa:2c:12:0f:8e:3f:8f:b4:9b:b6: > 85:42:90:1a:aa:d6:11:9b:49:db:83:f9:19:1e:dd:8b:0a:c7: > b5:c0:5c:06:78:ca:f1:75:f9:8b:eb:c0:94:b0:3f:96:fc:b8: > 88:7c:52:46:ad:ab:bb:22:52:c1:31:dc:87:a7:c9:bd:de:98: > bd:76:45:2b > -----BEGIN CERTIFICATE----- > MIIESTCCAzGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix > FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYdVQQKExlUb3VtYXogVGVjaG5vbG9n > eSBMaW8pdGVkMQswCQYDVQQLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt > YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv > bTAeFw0wODA5MjkwOTQ5MDdaFw0wOTA5MjkwOTQ5MDdaMIGyMQswCQYDVQQGEwJH > QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxETAPBgNVBAcTCEFiaW5nZG9uMSIwIAYD > VQQKExlUb3VtYXogVGVjaG5vbG9neSBMaW1pdGVkMQswCQYDVQQLEwJJVDEeMBwG > A1UEAxMVbWFnZ2llLmVuZy50b3VtYXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNr > Lmthc3BhcmlkaXNAdG91bWF6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC > AQoCggEBAMRNSc41poBn1cXqLlqwD5ai3ijDl&xdnQVXrqjb1M2cux1NLEFRRQ7J > F4+gW7ugXtPXXaRk3SOaZK3ce0lakmhlMmwMUISKdSbadn9lExQKBete0/ceiX+i > 2BtKRijumF/5vSGI33ZcuY5+WwkpZedrp1tfSpl3fWzRRH56dwX+3LltK+JXY2Mp > s8vGaDW1gfrv7rrAVD7YcAr2yTl0Ifh1uQiJal7j/h5eN7ApLRM1tHyqVT7DxFnN > COHvIUMpD4KPhH3yZbV5LvgHfH3K+3rvVMQzIO31imTeYBdgB+756g+Xv69j4eTo > shUbX5X9rceCjJTz5O+VY/DUqPhJEwUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglg > hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O > BBYEFB+fXlrIYVNLX1AphPjXRVTAyX9nMB8GA1UdIwQYMBaAFHxakn5cWz6bDodG > fPsnjzSuQjsnMA0GCSqGSIb3DQEBBQUAA4IBAQAEPflk6cETjJjmtjOp4IuOsGgv > cI6OtLNvYXy9Y/LLILhuTwpTX7rtMiDGMCQMw+jWQhyoPnsytIeUcdaLyslX9Z/8 > jYl34j6sSc3IxwGDQUGmBXzPxjcOFdjSUT+lkre/P2VOaHG3Tj4m9hX+OHLh+bdg > Kej/eDyqNL7oRvFfh4uhYIuCMcpeoTGD57eQvQUvrPcc/q+JFQKvx08vl4crC4NM > B4P5+cdjAGn6ydD8+3rvekEc4JnkAXN/lPosEg+OP4+0m7aFQpAaqtYRmknbg/kZ > Ht2LCse1wFwGeMrxdfmL68CUsD+W/LiIfFJGrau7IlLBMdyHp8m93pi9dkUr > -----END CERTIFICATE----- > > > The CA certificate > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: 0 (0x0) > Signature Algorithm: sha1WithRSAEncryption > Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Validity > Not Before: Sep 29 09:48:17 2008 GMT > Not After : Sep 29 09:48:17 2011 GMT > Subject: C=GB, ST=Oxfordshire, O=Company, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > RSA Public Key: (2048 bit) > Modulus (2048 bit): > 00:a6:6e:3b:1f:87:e9:1a:c9:e9:5c:3a:b8:96:19: > af:c9:e7:41:87:72:76:55:a8:fc:db:3c:05:55:9c: > 25:8f:83:5b:35:05:9f:cb:7b:4e:9b:3a:84:98:60: > 46:d5:79:be:c1:4c:b5:ea:cd:79:2b:c2:33:86:05: > 67:98:e4:62:77:d7:cf:98:c3:52:93:6c:ba:1c:fc: > a3:f9:81:26:ea:d8:a1:56:cd:74:f5:47:fe:0f:8d: > 95:7a:b7:8b:14:25:e7:9d:e2:e7:46:a2:d6:90:4c: > 25:94:16:20:51:78:6a:68:da:e0:06:2c:45:4e:27: > c4:2b:8b:bc:a9:e2:fb:c5:c1:8b:9d:33:5f:e3:be: > d1:f5:53:9d:2b:0c:bf:2a:95:e6:57:29:5e:ef:ab: > 3a:e9:33:09:00:c3:7d:94:aa:a9:b4:3c:08:9d:e8: > e6:92:f2:60:03:ed:12:1d:df:81:9f:a7:d2:81:7f: > 3e:8b:fa:a4:01:ba:c1:49:1c:51:02:c6:54:3c:48: > 9a:3f:18:54:04:35:c4:e1:c7:12:f6:7a:26:7e:47: > 04:e6:f8:fc:ed:8c:2e:17:05:62:b6:73:9a:4e:52: > 10:17:92:52:38:3a:4d:2d:32:ab:76:c8:61:ab:36: > cd:52:f9:95:bb:87:63:ad:5d:d3:d0:f9:6f:06:a6: > 29:6f > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Basic Constraints: > CA:FALSE > Netscape Comment: > OpenSSL Generated Certificate > X509v3 Subject Key Identifier: > > 7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 > X509v3 Authority Key Identifier: > > keyid:7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 > > Signature Algorithm: sha1WithRSAEncryption > 2b:b9:65:09:2d:ff:c0:80:dd:e0:f4:d0:01:9a:87:b9:da:54: > d2:f1:e4:0a:56:0b:cf:31:55:97:9f:93:62:df:59:3d:11:5b: > 06:6c:e7:f9:56:9b:c8:e8:e0:77:54:12:5b:ca:98:f9:c7:fa: > c6:41:45:6d:14:31:2d:d6:19:a8:41:ba:89:55:5a:7f:5c:79: > 1b:05:36:d7:e4:00:7b:e7:ae:5e:56:74:12:f9:fa:ab:63:0f: > f6:8e:97:cc:53:d3:91:7e:4b:48:6e:15:27:bc:73:4a:68:1f: > ff:36:67:b2:fa:6b:38:40:0c:f2:99:5f:75:2a:4f:27:21:a8: > fb:b5:9a:c3:7a:05:a5:45:03:3f:cf:85:21:eb:42:69:23:af: > d5:b8:32:17:4e:a5:52:c2:3e:01:bd:1f:f2:1a:b6:f0:f8:8f: > d9:d0:70:30:08:39:37:42:84:42:67:27:74:16:be:e7:2d:0f: > 54:e8:3d:8b:6f:6c:76:a6:39:d9:df:e4:b9:33:9a:92:5b:3e: > b2:6a:8a:8f:2e:9c:3a:01:54:c7:3e:0e:f4:45:9c:bd:f6:39: > e9:8c:9d:95:60:e7:2a:10:f6:ac:4a:a2:b7:16:bf:06:44:76: > 4b:5d:51:5a:0b:82:b0:53:f6:4a:d7:04:f0:85:7e:34:c6:fc: > 50:1a:c4:b3 > -----BEGIN CERTIFICATE----- > MIIENjCCAx6gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix > FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYDVQQKExlUb3VtYXogVGVjaG5vbG9n > eSBMaW1pdGVkMQswCQYDV1QLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt > YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv > bTAeFw0wODA5MjkwOTQ4MTdaFw0xMTA5MjkwOTQ4MTdaMIGfMQswCQYDVQQGEwJH > QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxIjAgBgNVBAoTGVRvdW1heiBUZWNobm9s > b2d5IExpbWl0ZWQxCzAJBgNVBAsTAklUMR4wHAYDVQQDExVtYWdnaWUuZW5nLnRv > dW1hei5jb20xKTAnBgkqhki39w0BCQEWGm5pY2sua2Fz5GFyaWRpc0B0b3VtYXou > Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApm47H4fpGsnpXDq4 > lhmvyedAh3J2Vaj82zwFVZwlj4NbNQWfy3tOmzqEmGBG1Xm+wUy16s15K8IzhgVn > mORid9fPmMNSk2y6HPyj+YEm6tihVs109Uf+D42VereLFCHnneLnRqLWkEwllBYg > UXhqaNrgBixFTifEK4u8qeL7xUGLnTNf477R9VOdKwy/KpXmVyle76s66TMJAMN9 > lKqptDwInejmkvJgA+0SHd+Bn6fSgX8+i/qkAbrBSRxRAsZUPEia3xhUBDXE4ccS > 9nomfkcE5vj87YwuFwVitnOZTlIQF5JSODpNLTKrdsHhqzbNUvmVu4djrV3T0Plv > BqYpbwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM > IEdlbmVyYXRlZC5DZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUfFqSflxbPpsOh0Z8+yeP > NK5COycwHwYDVR0jBBgwFoAUfFqSflxbPpsOh0Z8+yePNK5COycwDQYJKoZIhvcN > AQEFBQADggEBACu5ZQkt/8CA3eD00AGah7naVNLx5ApWC88xVZefk2LfWT0RWwZs > H/lWm8jo4HdUElvKmPnH+sZBRW0UMS3WGahBuolVWn9ceRsFNtfkAHvnrl5WdBL5 > +qtjD4aOl8xT05F+S0huFSe8c0poH/82Z7L6azhADPKZ73UqTychTPu1msN6BaVF > Az/PhSHrQmkj39W4MhdOpFLCPgG9H/IatvD4j9nQcDAIOTdChEJnJ3QWvuctD1To > PYtvbHamOdnf5LkzmpJbPrJiio8unDoBVMc+DvRFnL32OemMnzVg5yoQ9qxKorcW > vwZEdktdUVoLgrBT9krXBPCFfjTG/FAaxLM= > -----END CERTIFICATE----- > > and finally the server key, which I modified slightly be removing a > certificate request entry > > -----BEGIN RSA PRIVATE KEY----- > MIIEowIBAAKCAQEAxE1JzjWmgGfVxeouWrAPlqLeKMOX/F2dBVeuqNvUzZy7HU0s > QVFFDskXj6B9u6Be09ddpGTdI5pkrdx7SVqSaGUybAxQhIp1Jtp2f2UTFAoF617T > 9x6Jf6LYG0pGKO6YX/m9IYjfdly5jn5bCSll52unW19KmXd9bNFEfnp3Bf7cuW0r > 4ldjYymzy8ZoNbWB+u/uusBUPthwCvbJOXQh+HW5CIlqXuP+Hl43bCktEzW0fKpV > PsPEWc0I4e8hQykPgo+EffJltXku/Id8fcr7eu9UxDMg7fWKZN5gF2AH7vnqD5e/ > r2Ph5OiyFRtflf2tx4KMlPPk75Vj8NSo+EkTBQIDAQABAoIBAFkajAniKHXYrBxu > NCRODoVd4GG4huCyzXeDWXCkeG/sWLLwOMpdTW9ssBktvPXp0aFu/L6GWiqzBkg0 > 8HFXf2WLqduJq3K+NncwauFgy8wo0I8KOETPw7IABQA+MqKZyuilv8fdDTH43PFl > QYVjGTJ2lzzOgFow9unSA7k1dZluTeMyE+RzpVYwE/WSgsOFa7qYQnCXy0hlx85u > /SNU5383/v1cvrSghDCbZ2WrllHAerjUep1FNDounGkhiWj+JWUfddL7zYM+KVdJ > AKRaxeYo+UTAVa9rd9D8qgZo5oIJ6l53bvobkwcrVnAoYPxtzAjhcBhgtQjXSXrJ > YrHhKQECgYEAavUIAaT/XfHDXuXYMHnSf/ZgAqipOv36OPPnXnpg0yZbyLs/dgN6 > GYVBtvd3ugfQ3ZEUfOwYw2wVq6hItq6+lQRjL+G5IsoeyKJXGIpBdlr7Yhhes1gv > 4R5nGB97+F9kBVEmDephg0K++EeKRZMpzUgn1cBvBXrcfJsUc8OAFbUCgYEAy31q > k8HXBltJz7QQxmXLZogFkb0dxxXUrax202e6XsqroUpmUWx1n75TVnnP4QNH0Tqx > 8EQTDMZzQRHgFidwLAzhpI16Ex1fLfSw/lMQij7ojxtGp8LbC057dGpseBxwTPjP > I5dpdIl2Mt8HeH5qMiizRls1EcSu1RK9cPhOWhECgjEAtU+pFSwCoQKDIgU1+EE4 > nuJQEyOpO7qEH5RS5jaLJ/sdn/551TcwSdRgLuj5agea/VEq7ZyZgcC1GFZxLE6X > dejGubzLpBMpDrzBnS7EaRTbQ2YJATtfy7n6juduqSe/03eErOrLtQcoFjjP98zX > //Nd671gxXEyt/lTxrpeK5ECgYBFbIFq7awFkCmLgjxi46HUVj3ILgQ1wt3vbrKP > h4kPBAgwG+jyiJVMratTCnYAp5Td7i988EyrhB0YKxgPlt7vOGnXMSlf0hqB3ERy > UDaJY9MF1+FwJMuEfP8jhZeCFvm9WPmag/LHfoVj6rFqy35BpJ8dNsrRSA/5w837 > 98sLcQKBgBBfNJdPOGjgLZxLM5hXI88UkYFc3ppVh83SHSikKULO5d7wrWeQDR9V > u3t+sx8bl067E2dILPzTa9qLt3RO+GPCwOQMQUywNBh7jQ1BjaOg/4ctlJkjAdKo > x4hAG2dU5Z7iEob5AWpfv3+A5taS8P9RjI1O2jUwnTR84vqJtNx7 > -----END RSA PRIVATE KEY----- > > Any ideas would be welcome > > Best Regards > Nick > >

2 1

Questions about OpenLDAP for account authentication
by Phill Edwards 03 Oct '08

03 Oct '08

I have a linux server which provides a number of services such as samba, firewall, DNS, postfix, spam filtering etc to PCs on a small LAN. The client PCs on the LAN are Windows XP. I find it a pain when someone needs to change a password that you have to do it first on the PC, then make sure it's the same on the corresponding linux account and also for Samba. I thought I might use OpenLDAP so that there's only 1 password to change and was hoping I could use it to manage accounts. I've read a lot of HOWTOs but still have some questions. - Can I use an OpenLDAP frontend (eg JXplorer) and OpenLDAP to create new accounts on a linux machine, specify the group and have it create a new home dir etc (like when you run useradd)? - Does openldap replace the need to have the accounts in /etc/passwd? Once I've copied the existing linux accounts from /etc/passwd, should I delete them from /etc/passwd using userdel so that I don't have the account in two places? - I also want to use OpenLDAP to provide a common address book which will be used mainly by Outlook. I know that Outlook can query the LDAP address book, but can it also update it? It seems that there are lots of apps to query OpenLDAP but updating the entries is a little arcane. Regards, Phill

2 1

OpenLDAP 2.4.10 Import Errors
by Lydon, Mark 03 Oct '08

03 Oct '08

Hello, perhaps someone can help me with this issue, as I am an LDAP novice. I am migrating from an IBM Tivoli LDAP server to OpenLDAP 2.4.10 running under Solaris 10. I have the new service up and running, and am trying to export entries from old to new ldap servers using an LDAP Browser/Editor. There are additional schema entries to be considered, and these have been configured with a line in the slapd.conf file as follows; include /usr/local/etc/openldap/schema/npr.schema And npr.schema contains; objectClass ( 1.3.6.1.4.1.4203.1.4.6 NAME 'openbookmarks' DESC 'NPR GMIS Report Bookmark' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.5 NAME 'vpnbookmarks' DESC 'NPR MDNS Report Bookmark' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.4 NAME 'openscheduledreports' DESC 'NPR GMIS Scheduled Report' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.3 NAME 'vpnscheduledreports' DESC 'NPR MDNS Scheduled Report' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.2 NAME 'usergruas' DESC 'NPR User GRUAs' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.7 NAME 'useraccounts' DESC 'NPR User Accounts' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.0 NAME 'newaccntlist' DESC 'NPR User Account Lists' MAY displayName AUXILIARY ) attributetype ( 1.3.6.1.4.1.4203.1.4.0 NAME ( 'newaccntlist' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.7 NAME ( 'useraccounts' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.2 NAME ( 'usergruas' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.3 NAME ( 'vpnscheduledreports' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.4 NAME ( 'openscheduledreports' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.5 NAME ( 'vpnbookmarks' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.6 NAME ( 'openbookmarks' ) SUP name ) But when I run the import approx 1000 out of the 4000 entries are discarded with errors such as; Root error: [LDAP: error code 21 - vpnscheduledreports: value #0 invalid per syntax] 05:21:23 PM: Failed to synchronize entries Root error: [LDAP: error code 21 - vpnbookmarks: value #0 invalid per syntax] 05:21:24 PM: Failed to synchronize entries Root error: [LDAP: error code 21 - useraccounts: value #0 invalid per syntax] It is obviously complaining about the entries that use the additional scheme attributes, but I have no idea why. Any help is greatly appreciated.

2 4

Re: Shared Addressbook using LDAP
by Tarak Ranjan 03 Oct '08

03 Oct '08

--- Tarak Ranjan <contacttrm(a)yahoo.co.in> wrote: > > --- Tarak Ranjan <contacttrm(a)yahoo.co.in> wrote: > > > > > > > > Message: 3 > > > Date: Wed, 01 Oct 2008 09:49:53 +0200 > > > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > > > Subject: Re: Shared Addressbook using LDAP > > > To: openldap-technical(a)openldap.org > > > Message-ID: <87y718hhzy.fsf(a)magenta.l4b.de> > > > Content-Type: text/plain; charset=iso-8859-1 > > > > > > Tarak Ranjan <contacttrm(a)yahoo.co.in> writes: > > > > > > > Hi List, > > > > I am configuring a shared addressbook for > > > > squirrelmail. > > > > but the problem is it's showing the only > single > > > email > > > > address of the user, using that email id i'm > > login > > > > into the webmail. > > > > > > > > here is my slapd.conf. > > > > > > > > include > /etc/openldap/schema/core.schema > > > > include > > /etc/openldap/schema/cosine.schema > > > > include > > > > /etc/openldap/schema/inetorgperson.schema > > > > allow bind_v2 > > > > pidfile /var/run/openldap/slapd.pid > > > > argsfile /var/run/openldap/slapd.args > > > > loglevel 256 > > > > access to * > > > > by self write > > > > by anonymous auth > > > > by users read > > > > access to > > > > > > > > > > dn.children="ou=addressbook,dc=mail,dc=example,dc=com" > > > > by self write > > > > by anonymous read > > > > by users read > > > [...] > > > > > > I presume that the access rules for > > > dn.children=ou=addressbook.. are > > > not taken by cut and paste from your slapd.conf > > > file, otherwise this > > > rules are not honored, as the rules have to be > > > written in a folded line. > > > With regard to your question, change the rule > > > dn.children=ou=addressbook... to > > > dn.subtree=ou=addressbook.. > > > If you want to protect the base entry > > > ou=addressbook, define something > > > like > > > access to > > > dn.base=ou=addressbook... > > > attrs=entry,children by ... > > > access to dn.children=ou=addressbook... by... > > > > > === message truncated === > > > > Hi List, > > after changing the dn.children=ou=addressbook... > to > > dn.subtree=ou=addressbook.. , i'm getting the same > > result. > > > > Only single address i'm getting, using the ID i'm > > logging in . > > > > /\ > > Tarak > > > > > please submit an example of your searchstring. > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://www.dpunkt.de/buecher/2104.html > GPG Key ID:8EF7B6C6 > 53°08'09,95"N > 10°08'02,42"E > > > Hi List, > > [root@mail ~]# ldapsearch -x -b > 'ou=addressbook,dc=mail,dc=example,dc=com' > '(objectclass=*)' > # extended LDIF > # > # LDAPv3 > # base <ou=addressbook,dc=mail,dc=example,dc=com> > with > scope subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # addressbook, mail.example.com > dn: ou=addressbook,dc=mail,dc=example,dc=com > ou: addressbook > objectClass: top > objectClass: organizationalUnit > > # Tarak, addressbook, mail.example.com > dn: > cn=Tarak,ou=addressbook,dc=mail,dc=example,dc=com > cn: Tarak > givenName: Tarak Ranjan > sn: Mukherjee > mail: tarak.ranjan(a)example.com > objectClass: top > objectClass: inetOrgPerson > > # Amit, addressbook, mail.example.com > dn: cn=Amit,ou=addressbook,dc=mail,dc=example,dc=com > cn: Amit > givenName: Amit > sn: Sharda > mail: amit(a)example.com > objectClass: top > objectClass: inetOrgPerson > > # Anand, addressbook, mail.example.com > dn: > cn=Anand,ou=addressbook,dc=mail,dc=example,dc=com > cn: Anand > givenName: Anand > sn: Adkoli > mail: anand(a)example.com > objectClass: top > objectClass: inetOrgPerson > > /\ > Tarak > > Hi List, The problem is that , when i'm deleting the particular entry in LDAP, & after that when i logging in Webmail i m getting other addressbook entries. but when i'm creating entry like cn=John,cn=Tarak,ou=addressbook,dc=mail,dc=example,dc=com the entry is coming twice, i have 33 entry & if i make sub entry for those 33 entries , it's horrible it showing 66 times the same entry.. pleas guide where i m wrong Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

autogroup error
by nooroon 03 Oct '08

03 Oct '08

hi, i'd like to use the autogroup module found in the contrib tree of the openldap sources. So I took sources from openldap.org and rebuilt openldap 2.4.11. I've also built manually autogroup.so, thanks to its makefile, and copied it with other ldap modules. Then I've followed the quick start user guide from openldap.org, to build the dc=example,dc=com tree. It's working fine with this simple configuration. In order to test the autogroup module, I have followed the README of this module, an dmodified my slapd.conf and my dyngroup.schema. Then my slapd starts correctly, but every request generates an error. Here is the error that can be seen in debug logs : ... ldap_read: want=8 error=Resource temporarily unavailable conn=0 op=1 do_search ... send_ldap_result: err=53 matched="" text="operation not supported within namingContext" seoverlay autogroupnd_ldap_response: msgid=2 tag=101 err=53 ... If i remove "overlay autogroup" and "autogroup-attrset groupOfURLs memberURL member" from slapd.conf, everythings works perfectly!! Does someone can help me to get autogroup work? thanks!

1 0

samba: Active Directory support requires ldap_initialize
by Wayne Rasmussen 02 Oct '08

02 Oct '08

Having a problem with openldap-2.4.11 for use with Samba-3.2.4 and am looking for help fixing the issue. system info: uname -m = sun4u uname -r = 5.9 uname -s = SunOS uname -v = Generic_118558-25 #building openldap CC=gcc #echo $CC #exit CPPFLAGS="-I/usr/local/include -I/usr/local/ssl/include -I/usr/local/BerkeleyDB.4.2/include -I/usr/local/include/sasl" LDFLAGS="-L/usr/local/lib -L/usr/local/ssl/lib -L/usr/local/BerkeleyDB.4.2/lib" export CC CPPFLAGS LDFLAGS # CFLAGS='-D_AVL_H' export CFLAGS # ./configure --enable-bdb make depend make install #end building openldap #build samba make clean ./configure --with-ldap --with-acl-support --with-ads --with-pam --with-winbind --with-krb5=/usr/local #####make #####make install #end build samba The configure script fails with the following: checking for LDAP support... yes checking ldap.h usability... yes checking ldap.h presence... yes checking for ldap.h... yes checking lber.h usability... yes checking lber.h presence... yes checking for lber.h... yes checking for ber_tag_t... yes checking for ber_scanf in -llber... yes checking for ber_sockbuf_add_io... yes checking for LDAP_OPT_SOCKBUF... yes checking for LBER_OPT_LOG_PRINT_FN... yes checking for ldap_init in -lldap... yes checking for ldap_set_rebind_proc... yes checking whether ldap_set_rebind_proc takes 3 arguments... 3 checking for ldap_initialize... no checking whether LDAP support is used... yes checking for Active Directory and krb5 support... yes checking for ldap_initialize... (cached) no configure: error: Active Directory support requires ldap_initialize

2 1

Conditionals in LDAP
by Tom Cooper 02 Oct '08

02 Oct '08

Hi all, I am fairly new to OpenLDAP and I was requested to set up the following: We have ADSL users to authenticate on freeradius which reads the user info via an OpenLDAP server. Now when the user has used a certain amount of data he must be flagged as blocked. His connection is disconnected and upon reconnection he is assigned a different IP address with restricted connectivity untile he tops up his account. I can see that his information needs to be changed in LDAP to maybe assign him to a different uid, something like this: uid=xxxxxx,dc=radius,dc=example,dc=com (Original) changed to uid=xxxxxx,dc=blocked,dc=radius,dc=example,dc=com. My question is now how do I accomplish this, because on the client side he will still try to authenticate as uid=xxxxxx,dc=radius,dc=example,dc=com and I can not control what credentials are sent? Is it maybe better accomplished from freeradius than from LDAP? The record needs to be changed in LDAP for our admin portal to make use of this to check the client's status. Regards, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 1

OpenLDAP back-sql ldap_add error:53
by Arun NAIR 02 Oct '08

02 Oct '08

Hey Guys, When I try to add the base ldif file i get the error mentioned below. Please help me out with this. its really urgent. Regards, Arun Nair *This is my base domain ldif file:* dn: dc=abc,dc=corp ou: rootobject description: LDAP Admin objectClass: top objectClass: dcObject objectClass: organizationalUnit dc: abc description: ABC Corp dn: ou=People,dc=abc,dc=corp ou: People description: users of abc corp objectClass: organizationalUnit *Complete debug log of ldapadd:* [root@centserver mysql]# ldapadd -x -D "cn=root,dc=abc,dc=corp" -W -f /tmp/abc.corp.ldif -d 1 ldap_create Enter LDAP Password: ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP centserver.abc.corp:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush: 46 bytes to sd 4 ldap_result ld 0x99156e8 msgid 1 ldap_chkResponseList ld 0x99156e8 msgid 1 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL wait4msg ld 0x99156e8 msgid 1 (infinite timeout) wait4msg continue ld 0x99156e8 msgid 1 all 1 ** ld 0x99156e8 Connections: * host: centserver.abc.corp port: 389 (default) refcnt: 2 status: Connected last used: Thu Oct 2 20:34:46 2008 ** ld 0x99156e8 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x99156e8 Response Queue: Empty ldap_chkResponseList ld 0x99156e8 msgid 1 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL ldap_int_select read1msg: ld 0x99156e8 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x99156e8 msgid 1 message type bind ber_scanf fmt ({eaa) ber: read1msg: ld 0x99156e8 0 new referrals read1msg: mark request completed, ld 0x99156e8 msgid 1 request done: ld 0x99156e8 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree adding new entry "dc=abc,dc=corp" ldap_add_ext ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 151 bytes to sd 4 ldap_result ld 0x99156e8 msgid 2 ldap_chkResponseList ld 0x99156e8 msgid 2 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL wait4msg ld 0x99156e8 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x99156e8 msgid 2 all 1 ** ld 0x99156e8 Connections: * host: centserver.abc.corp port: 389 (default) refcnt: 2 status: Connected last used: Thu Oct 2 20:34:46 2008 ** ld 0x99156e8 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 0x99156e8 Response Queue: Empty ldap_chkResponseList ld 0x99156e8 msgid 2 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL ldap_int_select read1msg: ld 0x99156e8 msgid 2 all 1 ber_get_next ber_get_next: tag 0x30 len 56 contents: read1msg: ld 0x99156e8 msgid 2 message type add ber_scanf fmt ({eaa) ber: read1msg: ld 0x99156e8 0 new referrals read1msg: mark request completed, ld 0x99156e8 msgid 2 request done: ld 0x99156e8 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_perror ldap_add: Server is unwilling to perform (53) additional info: operation not permitted within namingContext ldap_free_connection 1 1 ldap_send_unbind ber_flush: 7 bytes to sd 4 ldap_free_connection: actually freed

1 0

AW: openldap and TLS certificates
by Hauke Coltzau 02 Oct '08

02 Oct '08

Hi Nick, it took me some time to set up TLS successfully, so I'm with you in this journey ;-) >From my own experience, I would suggest to start verfifying the server first. Let the client simply have the TLS_CACERT /<path>/<to>/<cachain>/cacert.chain.pem TLS_REQCERT demand options set and not send any certificate at all. On the server's side, only set TLSCertificateFile /your/cert.pem TLSCertificateKeyFile /your/private/key.pem You will not need a CACert file on the server for now. Make sure that the client will not send any certificate, so check your current users .ldaprc, because the client certificate depends on the user that runs the ldapsearch command. If you can set up TLS this way, you can be sure that the server is valid. To validate your client, you will need a .ldaprc in the current user's home directory which points to the user's cert and key. The server must be able to verify the user's cert. Hope, this helps, Hauke ----- Ursprüngliche Mail ----- Von: "Nick Kasparidis" <nick.kasparidis(a)toumaz.com> An: openldap-technical(a)openldap.org Gesendet: Montag, 29. September 2008 17:11:10 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: openldap and TLS certificates Hello everyone, I seem to have a problem with setting up secure connections with my LDAP server. I believe the problem has mainly to do with my certificates rather than anything else. I used the tutorial provided by the openLDAP admin guide to generate my certificates http://damncoolpics.blogspot.com/2008/09/oktoberfest-2008-in-munich.html My slapd.conf files has the following entries #SSL/TLS Options TLSCipherSuite HIGH:MEDIUM TLSCACertificateFile /usr/local/etc/slapd-cacert.pem TLSCertificateFile /usr/local/etc/slapd-cert.pem TLSCertificateKeyFile /usr/local/etc/slapd-key.pem and my ldap.conf TLS_CACERTDIR /etc/openldap/cacerts TLS_CACERT /etc/openldap/cacerts/slapd-cert.pem slapd-cacert.pem is the certificate of the CA slapd-cert.pem is the server certificate (same copy on client and server) slapd-key.pem is the server key (I manually removed the certificate request that was generated by the process on the link above) I start the server using /usr/local/libexec/slapd -h ldap:/// ( also tried the -d 9 flag for debugging), and when I use ldapsearch I get the following errors (from the client) ldapsearch -x -ZZ (I have most of the settings in my ldap.conf) ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (from the server with the -d 9 flag) I get load of stuff, but the important seems to be the following TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(12): TLS accept failure error=-1 id=0, closing When I try a search without the -ZZ flag everything works fine. When I created the certificates I tried different common names. I tried the ip address, fully qualified name (as shown below), the short name, even my name, but no luck. I have read the proper RFC but could not get anyusefull information. By the way I have a local DNS server and the domain name should match the correct IP address (and the reverse). Truth is I do not know much about SSL and certificates, so I might be missing something. Just for your information, The certificate authority is the same with the LDAP server. I will provide the certificate below, with email and addresses altered. Also the hashes have been altered so key and cert will not match. I merely provide them just in case you see something wrong in the syntax. The server certificate Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Validity Not Before: Sep 29 09:49:07 2008 GMT Not After : Sep 29 09:49:07 2009 GMT Subject: C=GB, ST=Oxfordshire, L=Abingdon, O=Company,, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:c4:4d:49:ce:35:a6:80:67:d5:c5:ea:2e:5a:b0: 0f:96:a2:de:28:c3:97:fc:5d:9d:05:57:ae:a8:db: d4:cd:8c:bb:1d:4d:2c:41:51:45:0e:c9:17:8f:a0: 5b:bb:a0:5e:d3:d7:5d:a4:64:dd:23:9a:64:ad:dc: 7b:49:5a:92:68:65:32:6c:0c:50:84:8a:75:26:da: 76:7f:65:13:14:0a:05:eb:5e:d3:f7:1e:89:7f:a2: d8:1b:4a:46:28:ee:98:5f:f9:bd:21:88:df:76:5c: b9:8e:7e:5b:09:29:65:e7:6b:a7:5b:5f:4a:99:77: 7d:6c:d1:44:7e:7a:77:05:fe:1c:b9:6d:2b:e2:57: 63:63:29:b3:cb:c6:68:35:b5:81:fa:ef:ee:ba:c0: 54:3e:d8:70:0a:f6:c9:39:74:21:f8:75:b9:08:89: 6a:5e:e3:fe:1e:5e:37:b0:29:2d:13:35:b4:7c:aa: 55:3e:c3:c4:59:cd:08:e1:ef:21:43:29:0f:82:8f: 84:7d:f2:65:b5:79:2e:fc:87:7c:7d:ca:fb:7a:ef: 54:c4:33:20:ed:f5:8a:64:de:60:18:60:07:ee:f9: ea:0f:97:bf:af:63:e1:e4:e8:b2:15:1b:5f:95:fd: ad:c7:83:8c:94:f3:e4:ef:95:63:f0:d4:a8:f8:49: 13:05 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 1F:9F:4E:5A:C8:61:53:4B:5F:50:28:84:F8:D7:45:54:C0:C9:7E:67 X509v3 Authority Key Identifier: keyid:7C:5A:92:7E:5C:6B:3E:9B:0E:87:46:7C:FB:27:8F:34:AD:42:3B:27 Signature Algorithm: sha1WithRSAEncryption 04:3d:f9:64:e9:c1:13:8c:98:e6:b6:33:a9:e0:8b:8e:b0:68: 2f:70:8e:8e:b4:b2:6f:61:7c:bd:63:f2:cb:20:b8:6e:4f:0a: 53:5f:ba:ed:32:20:c7:31:24:0c:c3:e8:d6:42:1c:a8:3e:7b: 32:b4:87:94:71:d6:8b:ca:c9:57:f5:9f:fc:8d:89:77:e2:3e: ac:49:cd:c8:c7:01:83:41:41:a6:05:7c:df:c6:37:0e:15:d8: d2:51:3f:a5:92:b7:bf:3f:65:4e:68:71:b7:4e:3e:26:f6:15: fe:38:72:e1:f9:b7:60:29:e8:ff:78:3c:aa:34:be:e8:46:f1: 5f:87:8b:a1:60:8b:82:31:ca:5e:a1:31:83:e7:b7:90:be:a5: 2f:ac:f7:1c:fe:af:89:15:02:af:c7:4f:2f:97:87:2b:0b:83: 5c:07:83:f9:f9:c7:63:00:69:fa:c9:d0:fc:fb:7a:ef:7a:41: 1c:e0:99:e4:01:73:7f:94:fa:2c:12:0f:8e:3f:8f:b4:9b:b6: 85:42:90:1a:aa:d6:11:9b:49:db:83:f9:19:1e:dd:8b:0a:c7: b5:c0:5c:06:78:ca:f1:75:f9:8b:eb:c0:94:b0:3f:96:fc:b8: 88:7c:52:46:ad:ab:bb:22:52:c1:31:dc:87:a7:c9:bd:de:98: bd:76:45:2b -----BEGIN CERTIFICATE----- MIIESTCCAzGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYdVQQKExlUb3VtYXogVGVjaG5vbG9n eSBMaW8pdGVkMQswCQYDVQQLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv bTAeFw0wODA5MjkwOTQ5MDdaFw0wOTA5MjkwOTQ5MDdaMIGyMQswCQYDVQQGEwJH QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxETAPBgNVBAcTCEFiaW5nZG9uMSIwIAYD VQQKExlUb3VtYXogVGVjaG5vbG9neSBMaW1pdGVkMQswCQYDVQQLEwJJVDEeMBwG A1UEAxMVbWFnZ2llLmVuZy50b3VtYXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNr Lmthc3BhcmlkaXNAdG91bWF6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAMRNSc41poBn1cXqLlqwD5ai3ijDl&xdnQVXrqjb1M2cux1NLEFRRQ7J F4+gW7ugXtPXXaRk3SOaZK3ce0lakmhlMmwMUISKdSbadn9lExQKBete0/ceiX+i 2BtKRijumF/5vSGI33ZcuY5+WwkpZedrp1tfSpl3fWzRRH56dwX+3LltK+JXY2Mp s8vGaDW1gfrv7rrAVD7YcAr2yTl0Ifh1uQiJal7j/h5eN7ApLRM1tHyqVT7DxFnN COHvIUMpD4KPhH3yZbV5LvgHfH3K+3rvVMQzIO31imTeYBdgB+756g+Xv69j4eTo shUbX5X9rceCjJTz5O+VY/DUqPhJEwUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglg hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O BBYEFB+fXlrIYVNLX1AphPjXRVTAyX9nMB8GA1UdIwQYMBaAFHxakn5cWz6bDodG fPsnjzSuQjsnMA0GCSqGSIb3DQEBBQUAA4IBAQAEPflk6cETjJjmtjOp4IuOsGgv cI6OtLNvYXy9Y/LLILhuTwpTX7rtMiDGMCQMw+jWQhyoPnsytIeUcdaLyslX9Z/8 jYl34j6sSc3IxwGDQUGmBXzPxjcOFdjSUT+lkre/P2VOaHG3Tj4m9hX+OHLh+bdg Kej/eDyqNL7oRvFfh4uhYIuCMcpeoTGD57eQvQUvrPcc/q+JFQKvx08vl4crC4NM B4P5+cdjAGn6ydD8+3rvekEc4JnkAXN/lPosEg+OP4+0m7aFQpAaqtYRmknbg/kZ Ht2LCse1wFwGeMrxdfmL68CUsD+W/LiIfFJGrau7IlLBMdyHp8m93pi9dkUr -----END CERTIFICATE----- The CA certificate Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Validity Not Before: Sep 29 09:48:17 2008 GMT Not After : Sep 29 09:48:17 2011 GMT Subject: C=GB, ST=Oxfordshire, O=Company, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:a6:6e:3b:1f:87:e9:1a:c9:e9:5c:3a:b8:96:19: af:c9:e7:41:87:72:76:55:a8:fc:db:3c:05:55:9c: 25:8f:83:5b:35:05:9f:cb:7b:4e:9b:3a:84:98:60: 46:d5:79:be:c1:4c:b5:ea:cd:79:2b:c2:33:86:05: 67:98:e4:62:77:d7:cf:98:c3:52:93:6c:ba:1c:fc: a3:f9:81:26:ea:d8:a1:56:cd:74:f5:47:fe:0f:8d: 95:7a:b7:8b:14:25:e7:9d:e2:e7:46:a2:d6:90:4c: 25:94:16:20:51:78:6a:68:da:e0:06:2c:45:4e:27: c4:2b:8b:bc:a9:e2:fb:c5:c1:8b:9d:33:5f:e3:be: d1:f5:53:9d:2b:0c:bf:2a:95:e6:57:29:5e:ef:ab: 3a:e9:33:09:00:c3:7d:94:aa:a9:b4:3c:08:9d:e8: e6:92:f2:60:03:ed:12:1d:df:81:9f:a7:d2:81:7f: 3e:8b:fa:a4:01:ba:c1:49:1c:51:02:c6:54:3c:48: 9a:3f:18:54:04:35:c4:e1:c7:12:f6:7a:26:7e:47: 04:e6:f8:fc:ed:8c:2e:17:05:62:b6:73:9a:4e:52: 10:17:92:52:38:3a:4d:2d:32:ab:76:c8:61:ab:36: cd:52:f9:95:bb:87:63:ad:5d:d3:d0:f9:6f:06:a6: 29:6f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 X509v3 Authority Key Identifier: keyid:7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 Signature Algorithm: sha1WithRSAEncryption 2b:b9:65:09:2d:ff:c0:80:dd:e0:f4:d0:01:9a:87:b9:da:54: d2:f1:e4:0a:56:0b:cf:31:55:97:9f:93:62:df:59:3d:11:5b: 06:6c:e7:f9:56:9b:c8:e8:e0:77:54:12:5b:ca:98:f9:c7:fa: c6:41:45:6d:14:31:2d:d6:19:a8:41:ba:89:55:5a:7f:5c:79: 1b:05:36:d7:e4:00:7b:e7:ae:5e:56:74:12:f9:fa:ab:63:0f: f6:8e:97:cc:53:d3:91:7e:4b:48:6e:15:27:bc:73:4a:68:1f: ff:36:67:b2:fa:6b:38:40:0c:f2:99:5f:75:2a:4f:27:21:a8: fb:b5:9a:c3:7a:05:a5:45:03:3f:cf:85:21:eb:42:69:23:af: d5:b8:32:17:4e:a5:52:c2:3e:01:bd:1f:f2:1a:b6:f0:f8:8f: d9:d0:70:30:08:39:37:42:84:42:67:27:74:16:be:e7:2d:0f: 54:e8:3d:8b:6f:6c:76:a6:39:d9:df:e4:b9:33:9a:92:5b:3e: b2:6a:8a:8f:2e:9c:3a:01:54:c7:3e:0e:f4:45:9c:bd:f6:39: e9:8c:9d:95:60:e7:2a:10:f6:ac:4a:a2:b7:16:bf:06:44:76: 4b:5d:51:5a:0b:82:b0:53:f6:4a:d7:04:f0:85:7e:34:c6:fc: 50:1a:c4:b3 -----BEGIN CERTIFICATE----- MIIENjCCAx6gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYDVQQKExlUb3VtYXogVGVjaG5vbG9n eSBMaW1pdGVkMQswCQYDV1QLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv bTAeFw0wODA5MjkwOTQ4MTdaFw0xMTA5MjkwOTQ4MTdaMIGfMQswCQYDVQQGEwJH QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxIjAgBgNVBAoTGVRvdW1heiBUZWNobm9s b2d5IExpbWl0ZWQxCzAJBgNVBAsTAklUMR4wHAYDVQQDExVtYWdnaWUuZW5nLnRv dW1hei5jb20xKTAnBgkqhki39w0BCQEWGm5pY2sua2Fz5GFyaWRpc0B0b3VtYXou Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApm47H4fpGsnpXDq4 lhmvyedAh3J2Vaj82zwFVZwlj4NbNQWfy3tOmzqEmGBG1Xm+wUy16s15K8IzhgVn mORid9fPmMNSk2y6HPyj+YEm6tihVs109Uf+D42VereLFCHnneLnRqLWkEwllBYg UXhqaNrgBixFTifEK4u8qeL7xUGLnTNf477R9VOdKwy/KpXmVyle76s66TMJAMN9 lKqptDwInejmkvJgA+0SHd+Bn6fSgX8+i/qkAbrBSRxRAsZUPEia3xhUBDXE4ccS 9nomfkcE5vj87YwuFwVitnOZTlIQF5JSODpNLTKrdsHhqzbNUvmVu4djrV3T0Plv BqYpbwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM IEdlbmVyYXRlZC5DZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUfFqSflxbPpsOh0Z8+yeP NK5COycwHwYDVR0jBBgwFoAUfFqSflxbPpsOh0Z8+yePNK5COycwDQYJKoZIhvcN AQEFBQADggEBACu5ZQkt/8CA3eD00AGah7naVNLx5ApWC88xVZefk2LfWT0RWwZs H/lWm8jo4HdUElvKmPnH+sZBRW0UMS3WGahBuolVWn9ceRsFNtfkAHvnrl5WdBL5 +qtjD4aOl8xT05F+S0huFSe8c0poH/82Z7L6azhADPKZ73UqTychTPu1msN6BaVF Az/PhSHrQmkj39W4MhdOpFLCPgG9H/IatvD4j9nQcDAIOTdChEJnJ3QWvuctD1To PYtvbHamOdnf5LkzmpJbPrJiio8unDoBVMc+DvRFnL32OemMnzVg5yoQ9qxKorcW vwZEdktdUVoLgrBT9krXBPCFfjTG/FAaxLM= -----END CERTIFICATE----- and finally the server key, which I modified slightly be removing a certificate request entry -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAxE1JzjWmgGfVxeouWrAPlqLeKMOX/F2dBVeuqNvUzZy7HU0s QVFFDskXj6B9u6Be09ddpGTdI5pkrdx7SVqSaGUybAxQhIp1Jtp2f2UTFAoF617T 9x6Jf6LYG0pGKO6YX/m9IYjfdly5jn5bCSll52unW19KmXd9bNFEfnp3Bf7cuW0r 4ldjYymzy8ZoNbWB+u/uusBUPthwCvbJOXQh+HW5CIlqXuP+Hl43bCktEzW0fKpV PsPEWc0I4e8hQykPgo+EffJltXku/Id8fcr7eu9UxDMg7fWKZN5gF2AH7vnqD5e/ r2Ph5OiyFRtflf2tx4KMlPPk75Vj8NSo+EkTBQIDAQABAoIBAFkajAniKHXYrBxu NCRODoVd4GG4huCyzXeDWXCkeG/sWLLwOMpdTW9ssBktvPXp0aFu/L6GWiqzBkg0 8HFXf2WLqduJq3K+NncwauFgy8wo0I8KOETPw7IABQA+MqKZyuilv8fdDTH43PFl QYVjGTJ2lzzOgFow9unSA7k1dZluTeMyE+RzpVYwE/WSgsOFa7qYQnCXy0hlx85u /SNU5383/v1cvrSghDCbZ2WrllHAerjUep1FNDounGkhiWj+JWUfddL7zYM+KVdJ AKRaxeYo+UTAVa9rd9D8qgZo5oIJ6l53bvobkwcrVnAoYPxtzAjhcBhgtQjXSXrJ YrHhKQECgYEAavUIAaT/XfHDXuXYMHnSf/ZgAqipOv36OPPnXnpg0yZbyLs/dgN6 GYVBtvd3ugfQ3ZEUfOwYw2wVq6hItq6+lQRjL+G5IsoeyKJXGIpBdlr7Yhhes1gv 4R5nGB97+F9kBVEmDephg0K++EeKRZMpzUgn1cBvBXrcfJsUc8OAFbUCgYEAy31q k8HXBltJz7QQxmXLZogFkb0dxxXUrax202e6XsqroUpmUWx1n75TVnnP4QNH0Tqx 8EQTDMZzQRHgFidwLAzhpI16Ex1fLfSw/lMQij7ojxtGp8LbC057dGpseBxwTPjP I5dpdIl2Mt8HeH5qMiizRls1EcSu1RK9cPhOWhECgjEAtU+pFSwCoQKDIgU1+EE4 nuJQEyOpO7qEH5RS5jaLJ/sdn/551TcwSdRgLuj5agea/VEq7ZyZgcC1GFZxLE6X dejGubzLpBMpDrzBnS7EaRTbQ2YJATtfy7n6juduqSe/03eErOrLtQcoFjjP98zX //Nd671gxXEyt/lTxrpeK5ECgYBFbIFq7awFkCmLgjxi46HUVj3ILgQ1wt3vbrKP h4kPBAgwG+jyiJVMratTCnYAp5Td7i988EyrhB0YKxgPlt7vOGnXMSlf0hqB3ERy UDaJY9MF1+FwJMuEfP8jhZeCFvm9WPmag/LHfoVj6rFqy35BpJ8dNsrRSA/5w837 98sLcQKBgBBfNJdPOGjgLZxLM5hXI88UkYFc3ppVh83SHSikKULO5d7wrWeQDR9V u3t+sx8bl067E2dILPzTa9qLt3RO+GPCwOQMQUywNBh7jQ1BjaOg/4ctlJkjAdKo x4hAG2dU5Z7iEob5AWpfv3+A5taS8P9RjI1O2jUwnTR84vqJtNx7 -----END RSA PRIVATE KEY----- Any ideas would be welcome Best Regards Nick -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

2 1

Re: Shared Addressbook using LDAP
by Tarak Ranjan 01 Oct '08

01 Oct '08

--- Tarak Ranjan <contacttrm(a)yahoo.co.in> wrote: > > > > Message: 3 > > Date: Wed, 01 Oct 2008 09:49:53 +0200 > > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > > Subject: Re: Shared Addressbook using LDAP > > To: openldap-technical(a)openldap.org > > Message-ID: <87y718hhzy.fsf(a)magenta.l4b.de> > > Content-Type: text/plain; charset=iso-8859-1 > > > > Tarak Ranjan <contacttrm(a)yahoo.co.in> writes: > > > > > Hi List, > > > I am configuring a shared addressbook for > > > squirrelmail. > > > but the problem is it's showing the only single > > email > > > address of the user, using that email id i'm > login > > > into the webmail. > > > > > > here is my slapd.conf. > > > > > > include /etc/openldap/schema/core.schema > > > include > /etc/openldap/schema/cosine.schema > > > include > > > /etc/openldap/schema/inetorgperson.schema > > > allow bind_v2 > > > pidfile /var/run/openldap/slapd.pid > > > argsfile /var/run/openldap/slapd.args > > > loglevel 256 > > > access to * > > > by self write > > > by anonymous auth > > > by users read > > > access to > > > > > > dn.children="ou=addressbook,dc=mail,dc=example,dc=com" > > > by self write > > > by anonymous read > > > by users read > > [...] > > > > I presume that the access rules for > > dn.children=ou=addressbook.. are > > not taken by cut and paste from your slapd.conf > > file, otherwise this > > rules are not honored, as the rules have to be > > written in a folded line. > > With regard to your question, change the rule > > dn.children=ou=addressbook... to > > dn.subtree=ou=addressbook.. > > If you want to protect the base entry > > ou=addressbook, define something > > like > > access to > > dn.base=ou=addressbook... > > attrs=entry,children by ... > > access to dn.children=ou=addressbook... by... > > > === message truncated === > > Hi List, > after changing the dn.children=ou=addressbook... to > dn.subtree=ou=addressbook.. , i'm getting the same > result. > > Only single address i'm getting, using the ID i'm > logging in . > > /\ > Tarak > > please submit an example of your searchstring. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E Hi List, [root@mail ~]# ldapsearch -x -b 'ou=addressbook,dc=mail,dc=example,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <ou=addressbook,dc=mail,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # addressbook, mail.example.com dn: ou=addressbook,dc=mail,dc=example,dc=com ou: addressbook objectClass: top objectClass: organizationalUnit # Tarak, addressbook, mail.example.com dn: cn=Tarak,ou=addressbook,dc=mail,dc=example,dc=com cn: Tarak givenName: Tarak Ranjan sn: Mukherjee mail: tarak.ranjan(a)example.com objectClass: top objectClass: inetOrgPerson # Amit, addressbook, mail.example.com dn: cn=Amit,ou=addressbook,dc=mail,dc=example,dc=com cn: Amit givenName: Amit sn: Sharda mail: amit(a)example.com objectClass: top objectClass: inetOrgPerson # Anand, addressbook, mail.example.com dn: cn=Anand,ou=addressbook,dc=mail,dc=example,dc=com cn: Anand givenName: Anand sn: Adkoli mail: anand(a)example.com objectClass: top objectClass: inetOrgPerson /\ Tarak Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

1 0

Re: Shared Addressbook using LDAP
by Tarak Ranjan 01 Oct '08

01 Oct '08

> Message: 3 > Date: Wed, 01 Oct 2008 09:49:53 +0200 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > Subject: Re: Shared Addressbook using LDAP > To: openldap-technical(a)openldap.org > Message-ID: <87y718hhzy.fsf(a)magenta.l4b.de> > Content-Type: text/plain; charset=iso-8859-1 > > Tarak Ranjan <contacttrm(a)yahoo.co.in> writes: > > > Hi List, > > I am configuring a shared addressbook for > > squirrelmail. > > but the problem is it's showing the only single > email > > address of the user, using that email id i'm login > > into the webmail. > > > > here is my slapd.conf. > > > > include /etc/openldap/schema/core.schema > > include /etc/openldap/schema/cosine.schema > > include > > /etc/openldap/schema/inetorgperson.schema > > allow bind_v2 > > pidfile /var/run/openldap/slapd.pid > > argsfile /var/run/openldap/slapd.args > > loglevel 256 > > access to * > > by self write > > by anonymous auth > > by users read > > access to > > > dn.children="ou=addressbook,dc=mail,dc=example,dc=com" > > by self write > > by anonymous read > > by users read > [...] > > I presume that the access rules for > dn.children=ou=addressbook.. are > not taken by cut and paste from your slapd.conf > file, otherwise this > rules are not honored, as the rules have to be > written in a folded line. > With regard to your question, change the rule > dn.children=ou=addressbook... to > dn.subtree=ou=addressbook.. > If you want to protect the base entry > ou=addressbook, define something > like > access to > dn.base=ou=addressbook... > attrs=entry,children by ... > access to dn.children=ou=addressbook... by... > === message truncated === Hi List, after changing the dn.children=ou=addressbook... to dn.subtree=ou=addressbook.. , i'm getting the same result. Only single address i'm getting, using the ID i'm logging in . /\ Tarak Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

Shared Addressbook using LDAP
by Tarak Ranjan 01 Oct '08

01 Oct '08

Hi List, I am configuring a shared addressbook for squirrelmail. but the problem is it's showing the only single email address of the user, using that email id i'm login into the webmail. here is my slapd.conf. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 access to * by self write by anonymous auth by users read access to dn.children="ou=addressbook,dc=mail,dc=example,dc=com" by self write by anonymous read by users read database bdb suffix "dc=mail,dc=example,dc=com" rootdn "cn=Manager,dc=mail,dc=example,dc=com" rootpw {SSHA}WtGEFDMu4JYHmuGNngBNib80Nwka9o20 directory /var/lib/ldap index objectClass eq,pres dbconfig set_cachesize 0 10485760 0 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 , /\ Tarak Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

2 1

OpenLDAP 2.4 replication to a write-only LDAP server
by Brouwer, Onno - Acision 01 Oct '08

01 Oct '08

Hi List, I am trying to set up replication from an OpenLDAP 2.4 master to a write-only LDAP slave. This slave is not really an LDAP slave, but has an LDAP interface to have changes replicated to it. In earlier OpenLDAP releases I could use slurpd for this, but since this has been deprecated I am trying to get it working using syncrepl. Based on what I found in the online manual I am trying to achieve this with an additional OpenLDAP 2.4 proxy which replicates changes it learns from the master through syncrepl to the slave through the LDAP backend. Is there some way I can get this to work? If the slave is a real LDAP server, then the proxy works, but it stores the contextCSN on the slave, and not on the proxy. If I have some form of storing this contextCSN elsewhere then I might try to start the proxy (in case it dies) with this contextCSN value specified on the command line. Also, when I try to ban searches on the slave (since it is a write-only slave), the proxy thinks none of the master entries exist on the slave and then happily tries to add them to the slave, resulting in duplicate errors. Any help would be greatly appreciated! Regards, Onno This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

bindpw and SSHA
by Nick Kasparidis 29 Sep '08

29 Sep '08

Hello everyone, I have a small problem setting up my ldap client. The issue comes from trying to force authenticated queries. So I have set the following lines in my slapd.conf disallow bind_anon require authc on the client side I have added the following lines to my ldap.conf binddn cn=manager,dc=domain,dc=com bindpw {SSHA}<the hash> Using this approach I cannot get a connection to the ldap server. I checked through wireshark, and I get a packet bindResponse(1) invalidCredentials () If on the other hand I when use the cleartext password, instead of SSHA then everything works fine. I am not sure if it is important but the 'bindRequest(1) simple' packet contains the text {SSHA}<hash> exactly as it appears in the ldap.conf file. Should it be processed on the client end? I have created the SSHA hash using slappasswd on the server machine, and then I copied and pasted the text across to my ldap.conf file. The hashes used by the server and client are identical. Have I done something wrong, should I encrypt the password using another way? Also if there is another way to initiate an authenticated query without using plaintext passwords, please let me know. By the way my server is openldap 2.4.10 on solaris 10 (sparc) and the client I experiment with openldap 2.2.13-12 on RHEL4.7 (i386) Thank you Nick

2 3

Error with OpenLDAP
by Arun NAIR 28 Sep '08

28 Sep '08

Hey Guys, My configuration I'm not sure doesn't seems to be working too well, it was working this morning now its not. If you could analyze it for me and tell me how I can achieve 100% success with this would be great. Thanks in advance for all the time extended Regards, Arun Nair The current error that I'm getting is * [root@centserver ~]# service ldap start Checking configuration files for slapd: WARNING: No dynamic config support for database sql. backend_startup_one: bi_db_open failed! (1) slap_startup failed (test would succeed using the -u switch) [FAILED] * *My slapd.conf file is as under: * # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema loglevel -1 # Define global ACLs to disable default read access. defaultaccess read access to * by * read access to * by self write # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap moduleload back_sql.la ####################################################################### # sql database definitions ####################################################################### database sql suffix dc=abc,dc=corp rootdn cn=Manager,dc=abc,dc=corp rootpw {CRYPT}2aFSZAS2uxw.. dbname ldap dbuser ldap dbpasswd password subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_query "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no TLSCertificateFile /etc/openldap/ldap.cert TLSCertificateKeyFile /etc/openldap/ldap.key *My odbc.ini configuration is as under: * *[ODBC Data Sources] *myodbc5 = MyODBC 5.1.5 Driver DSN *[myodbc5] *Driver = /usr/lib/libmyodbc5.so Description = LDAP Connector SERVER = localhost PORT = USER = ldap Password = password Database = ldap SOCKET = /var/lib/mysql/mysql.sock

1 0

index_param failed
by Denis BUCHER 27 Sep '08

27 Sep '08

Hello ! I have cyrus (IMAP mailserver) working perfectly based on openldap, BUT I have some strange messages in the logs that I would like to understand/correct : * bdb_equality_candidates: (accountStatus) index_param failed (18) * bdb_equality_candidates: (virtualdomain) index_param failed (18) * bdb_equality_candidates: (description) index_param failed (18) This is exactly ONE session where one of our users (description=dbucher(a)ourcompany.ch) is sending a mail to the outside world (dbucher(a)destdomain.ch). If someone would be nice enough to explain me exactly what it means, and how to solve this problem, it would be very nice... I already searched a lot to find help on this topic, without success, I found some possible solutions but I don't know exactly how to test them : 1. define the approriate indexes in slapd.conf, reindex and restart 2. Check the actual index files to make sure they're correct permissions, etc, and then try a db_recover. In slapd.conf I have : index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub I tryed to add : index accountStatus,description eq but : # slapindex bdb_db_open: database already in use backend_startup_one: bi_db_open failed! (-1) slap_startup failed Thanks a lot in advance for your help Denis Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND anonymous mech=implicit ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(|(&(objectClass=CourierMailAccount)(mail=dbucher@ourcompany.ch)(accountStatus=active))(&(cn=mailadmin)(description=dbucher@ourcompany.ch)))" Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SRCH attr=dn Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (accountStatus) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (description) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND anonymous mech=implicit ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND dn="cn=dbucher,ou=users,ou=ourcompany.ch,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND dn="cn=dbucher,ou=users,ou=ourcompany.ch,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=dbucher(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=dbucher(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 fd=20 ACCEPT from IP=127.0.0.1:41775 (IP=0.0.0.0:389) Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierDomainAlias)(virtualdomain=destdomain.ch))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SRCH attr=virtualdomain Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (virtualdomain) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:35 mailhost slapd[2099]: conn=24038 fd=20 closed (connection lost)

2 4

DB_KEYEXIST: Key/data pair already exists
by Stelios A. 26 Sep '08

26 Sep '08

Hello all, I have 2 users with identical Full Name and their ldif change on mail, uid, username and home directory in order to avoid ldap constraints. However, even though I have no other constraints apart from unique_attributes uid mail uidNumber homeDirectory I'm getting the following error and cannot add the 2nd user. root@masterldap:~# slapadd -l debug.ldif -f /etc/ldap/slapd.conf => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="cn=Full Name,ou=Users,dc=mydomain,dc=com" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) root@masterldap:~# Any ideas how I can see which attribute is causing the problem? -- Stelios A

3 4

RFT0001 : Request For Thoughts
by Christopher Barry 24 Sep '08

24 Sep '08

Hi everyone, If this post here is in poor taste, please pardon my interruption. It's just that I figured those here would have a high probability of trying to do as I am trying to do. Background: I'm a debian-head from the early 90's, but I'm new to OpenLDAP, and this is my first post here. I'm about halfway done with Mastering OpenLDAP, and I've been lurking here for a month or so, trying to understand how things work, and looking for questions like mine. I also just read Kerberos, the definitive guide as a primer into understanding how my team can make everyone 'Just Get Along(tm)' in a multi-platform global enterprise, while leveraging open source projects. Rough Goals: * We're exploring ways in which we can have a single user/group database for everything, everywhere in our domain. * Additionally, we want as 'SSO' an environment as possible. * We also want to keep, and even extend all the other NIS functionality we use today - only without the NIS limitations. * We also need to be able to phase it in, or even have it overlap with our current situation for a period, so it's not an all-or-nothing kind of change. The Parts Bin: There's a bunch of parts around, and they all kind of fit together, but to my current understanding anyway, seem to create a few different incomplete solutions, such as: * Samba/Winbind/Kerberos (possibly backed by OpenLDAP) * OpenLDAP/Kerberos with trusts to AD * AD using 2003R2 and possibly custom schema modifications if required. My question really is what are others doing to solve this type of problem? Architecturally, what is the best approach given the above desired outcome? Thanks to all for your thoughts and insight on this, Regards, Christopher Barry Systems Engineer QLogic

2 3

Re: Configuring MirrorMode via cn=config
by p_pavlos＠freemail.gr 24 Sep '08

24 Sep '08

> > ----- "Pavlos Parissis" <p_pavlos(a)freemail.gr> wrote: > > > Hello all, > > > > I am writing to ask for a confirmation on the steps that I followed > > to > > configure MirrorMode replication via cn=config > > > > The step is the typical, 2 nodes where m1 is the first node and m2 is > > the second one. > > > > 1) start m1 > > 2) create dit > > 3) add mirrormode_user > > OK. > > > 4) slaptest -f slapd.conf -F slapd.d > > chown -R ds-ldap.ds-ldap slapd.d > > Why do this? Why not start m1 from a basic slapd.d and then add all > above on the fly via cn=config? Because I don't have a basic slapd.d, the dir is empty. The replica configuration are added via cn=config when I have converted my basic slapd.conf to slapd.d on both servers. I don't think that I do something wrong here or stupid, what do you think? > > 5) stop m1 ;start m1 > > 6) enable sync log > > 7) start m2 > > 8) slaptest -f slapd.conf -F slapd.d > > chown -R ds-ldap.ds-ldap slapd.d > > 9) stop m2;start m2 > > 10) enable sync log > > 11) add replication configuration on m1 [1] > > 12) add replication configuration on m2 [2] > > See above. Cheers, Pavlos

1 0

accesslog misses out on entries during slapd failure
by Sean Burford 23 Sep '08

23 Sep '08

Hi, An add operation was underway on my HDB backend. Around one second later, a large group modification ran slapd out of memory. Slapd was then unresponsive until a watchdog killed and restarted it two minutes later. The add operation successfully modified the database but never appeared in the audit log nor the syncrepl access log, so it was never replicated to the replicas. Is it by design that modifications hit the database before being recorded in the audit and access logs? This is with OpenLDAP 2.3.39, BDB 4.4. Logs: Sep 22 09:15:16 host slapd[27404]: conn=102591 op=5 ADD dn="uid=username,ou=people,dc=example,dc=com" ... Sep 22 09:15:17 host slapd[27404]: conn=99395 op=131974 MOD dn="cn=biggroup,ou=groups,dc=example,dc=com" Sep 22 09:15:17 host slapd[27404]: conn=99395 op=131974 MOD attr=member memberuid Sep 22 09:15:17 host slapd[27404]: ch_malloc of 242464 bytes failed Sep 22 09:15:17 host slapd[27404]: conn=102732 op=2 UNBIND Sep 22 09:15:17 host slapd[27404]: conn=102732 fd=124 closed Sep 22 09:17:33 host slapd: allocation failed: 0 Sep 22 09:17:33 host slapd: allocation failed: 12 Config snippet: database hdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw ... directory /var/lib/ldap cachesize 25000 idlcachesize 75000 checkpoint 512 1 lastmod on ... indexes ... ... ACLs ... overlay auditlog auditlog /var/lib/ldif/auditlog/example.com.ldif overlay syncprov syncprov-sessionlog 1000 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 02+23:46 01+23:46 -- Thanks, Sean Burford

2 1

slapd stops accepting connections - OpenSolaris
by Josh Rivel 23 Sep '08

23 Sep '08

Hello. I am running OpenLDAP 2.4.11 on OpenSolaris snv_91 on a Sun X2200. After a few minutes, the box stops accepting connections on port 389, even though the slapd process is still running, and the machine still shows itself listening on port 389. I am attaching my slapd.conf, ldap.conf, and DB_CONFIG files. I had the same behaviour with the Blastwave package which was version 2.3.39, so I figured "OK Let me upgrade to 2.4.11" but same behaviour. I have roughly 800 OpenSolaris clients that need to connect to the box, and I currently see roughly 300 established connections to the server on port 389. Thanks, Josh

1 0

Pls help : how to make mail id as unique attribute
by Somnath Pal 22 Sep '08

22 Sep '08

Hi list, We have an openldap server 2.4 on redhat enterprise linux 4 update 7. We import users from Windows Active Directory(AD) running Windows Server 2003. We are mapping the mail attribute from the source (AD) to the destination (openldap) & want the mail id to be unique accross the ldap directory so that no two email ids will be same while replicating from different Source . How to achive that ? Do we have to modify our schema ? We are using the following schema in our slapd.conf - include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema Can you pls help ? Thanks & Regards, Somnath Pal Server Management Unit International Computing Centre (ICC) E-mail: pal(a)unicc.org

2 2

Configuring MirrorMode via cn=config
by Pavlos Parissis 21 Sep '08

21 Sep '08

Hello all, I am writing to ask for a confirmation on the steps that I followed to configure MirrorMode replication via cn=config The step is the typical, 2 nodes where m1 is the first node and m2 is the second one. 1) start m1 2) create dit 3) add mirrormode_user 4) slaptest -f slapd.conf -F slapd.d chown -R ds-ldap.ds-ldap slapd.d 5) stop m1 ;start m1 6) enable sync log 7) start m2 8) slaptest -f slapd.conf -F slapd.d chown -R ds-ldap.ds-ldap slapd.d 9) stop m2;start m2 10) enable sync log 11) add replication configuration on m1 [1] 12) add replication configuration on m2 [2] I did testing on the replication and it worked. But, I noticed that when I configured the syncpro overlay after the replicas both servers stopped responding. I will try to reproduce that issue and get some debug messages, may be I didn't something wrong or it is a bug. Cheers, Pavlos [1] Replication configuration for node m1 dn: cn=config changetype: modify add: olcServerID olcServerID: 1 dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcLimits olcLimits: {0}dn.base="cn=mirrormode_user,o=solution.acision.com" size.soft=un limited size.hard=unlimited time.soft=unlimited time.hard=unlimited - add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://m2 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://m1 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcMirrorMode olcMirrorMode: TRUE - add: olcDbIndex olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq ############################### [2] replication configuration for node m2 dn: cn=config changetype: modify add: olcServerID olcServerID: 2 dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcLimits olcLimits: {0}dn.base="cn=mirrormode_user,o=solution.acision.com" size.soft=un limited size.hard=unlimited time.soft=unlimited time.hard=unlimited - add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://m2 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://m1 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcMirrorMode olcMirrorMode: TRUE - add: olcDbIndex olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq

1 0

Auth issues with openldap proxy to AD
by Lynn York 20 Sep '08

20 Sep '08

Hello, I am having some issues with authentication with an openldap proxy to AD. When I query the user I am able to get back the userPassword attribute and everything looks to be correct. I can "su username" and it works properly, but when I attempt to "ssh user@localhost" it will not accept the password. The password is stored as {crypt}. I am trying to pin point whether this is a PAM issue or an ldap issue. Any help or suggestions would be greatly appreciated. Thanks, Lynn

2 1

Re: Differences between MirrorMode and 2-way mulit-master
by ghenry＠OpenLDAP.org 19 Sep '08

19 Sep '08

----- "Almir Karic" <redduck666(a)gmail.com> wrote: > On Fri, Sep 19, 2008 at 11:44 AM, Pavlos Parissis > <p_pavlos(a)freemail.gr> wrote: > > Well I must admit I can't read very so I will guess that > > the reason is to guarantee consistency in the database. > > > > How do you guarantee consistency in the database on N-way > Multi-Master > > replication where any member can accept write operations? > > AFAIK openldap can't do "true" write anywhere. the configuration is > one "true" master on which writes are happening, the remaining N-1 > masters just issue the referrals to the "true" master which can > optionally be server side followed with slapo-chain making writes on > the N-1 "non-true" masters transparent to the clients. You need to check what you know then ;-) Who told you above or did you make it up? http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master%2… Multi-Master means just that. Write to *any* master and replication is handled by Syncrepl not slapo-chain. It wouldn't be Multi-master is there was one "true" master, as that's not multi-master! slapo-chain can be used to "chain" writes back to a Master from a slave. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

Re: Differences between MirrorMode and 2-way mulit-master
by ghenry＠OpenLDAP.org 19 Sep '08

19 Sep '08

Please also cc the list. > http://www.openldap.org/doc/admin24/replication.html#MirrorMode%20replicati… > > If I understood it correctly, on N-way Multi-Master replication any > member can > accept write operations while on MirrorMode only must|should accept > write > operations. Correct. > I had a MirrorMode configured and I was able to send writes on > both servers and each server was replicating the changes without > problems. > The test which I did was very simple, first add/remove an entry on the > first > and then add/remove an entry on the second. > > So, the above test made to wonder about the differences between > MirrorMode and > 2-way mulit-master. > > what is the reason on a MirrorMode replication to force all write > operations to > one of the members of the replication? Did you read the above link? It doesn't look like you did. > BTW, what about the syncpro overlay settings which are not part of > the > MirrorMode configuration example? Again, please read the docs: http://www.openldap.org/doc/admin24/replication.html#MirrorMode It specifically says: "17.4.4.1. Mirror Node Configuration This is the same as the Set up the provider slapd section." where it links to the section that show the syncprov overlay config. Please read the docs. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

3 3

Regarding LDAP Replication(Repost)
by ashish mahamuni 19 Sep '08

19 Sep '08

Hello Everybody, I've one query regarding LDAP master/slave configuration. When we set replication,We put same root DN on master as well as on slave. Also If my organization have any unique OID that will also get replicated on slave. But as per my knowledge, ideally we should not use existing OID's and root DN(not sure about root DN) because it could cause inconsistency. How this replication works indeed? Regards, Ash Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

Fw: Re: Differences between MirrorMode and 2-way mulit-master
by Pavlos Parissis 18 Sep '08

18 Sep '08

By mistake I replied to Gavin Henry and not the list, I am sorry for this. On Thu, 18 Sep 2008 20:40:17 +0100 (BST) Gavin Henry <ghenry(a)OpenLDAP.org> wrote: > > ----- "Pavlos Parissis" <p_pavlos(a)freemail.gr> wrote: > > > Hi all, > > > > I am experimenting with different replication configurations and I may > > have a rather silly question. > > > > Are any differences between a MirrorMode and 2 node Multi-Master > > replication? > > >From configuration point of view they look like the same, but are > > they? > > > > Reading the Admin guide I see that on the MirrorMode configuration > > example there are no syncpro overlay settings, shouldn't be? > > This explains it: > > http://www.openldap.org/doc/admin24/replication.html#MirrorMode%20replicati… If I understood it correctly, on N-way Multi-Master replication any member can accept write operations while on MirrorMode only must|should accept write operations. I had a MirrorMode configured and I was able to send writes on both servers and each server was replicating the changes without problems. The test which I did was very simple, first add/remove an entry on the first and then add/remove an entry on the second. So, the above test made to wonder about the differences between MirrorMode and 2-way mulit-master. what is the reason on a MirrorMode replication to force all write operations to one of the members of the replication? BTW, what about the syncpro overlay settings which are not part of the MirrorMode configuration example? Thanks, Pavlos

1 0

Differences between MirrorMode and 2-way mulit-master
by p_pavlos＠freemail.gr 18 Sep '08

18 Sep '08

Hi all, I am experimenting with different replication configurations and I may have a rather silly question. Are any differences between a MirrorMode and 2 node Multi-Master replication? >From configuration point of view they look like the same, but are they? Reading the Admin guide I see that on the MirrorMode configuration example there are no syncpro overlay settings, shouldn't be? Cheers, Pavlos

1 0

Ldap and root access on workstations
by Nick Rathke 18 Sep '08

18 Sep '08

HI, I have what I hope is an easy question ( and I hope this is the right place to post this ). I have a situation where we are using openldap and a large number of users who also have local root level access to their own workstations. Is there a way in ldap to allow root access without letting them su to another user ? Is there some ACL that I can put into place that would prevent this ? -Nick

5 6

Re: custom bind attribute
by Stefano Zanmarchi 16 Sep '08

16 Sep '08

Hi, what I am trying to achieve is to have both a Shibboleth IdP and an Imap server (that's why different IPs) authenticate against openldap, with different credentials. My aim is to let Openldap handle this difference and let the Imap and IdP server unaware of this, they'd just need to do a simple bind. Thanks again, Stefano

2 1

Regarding LDAP Replication
by ashish mahamuni 16 Sep '08

16 Sep '08

Hello Everybody, I've one query regarding LDAP master/slave configuration. When we set replication,We put same base DN on master as well as on slave. Also If my organization have any unique OID that will also get replicated on slave. But as per my knowledge, ideally we should not use existing OID's and base DN's(not sure about base DN's) because it could cause inconsistency. How this replication works indeed? Regards, Ash Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

Re: pwd* Attributes and replication
by Eyal Marantenboim 15 Sep '08

15 Sep '08

Hi, here are the configs: Thanks! MASTER: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/openldap-2.4.11/etc/openldap/schema/core.schema include /opt/openldap-2.4.11/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.11/etc/openldap/schema/inetorgperson.schema include /opt/openldap-2.4.11/etc/openldap/schema/dnszone.schema include /opt/openldap-2.4.11/etc/openldap/schema/nis.schema include /opt/openldap-2.4.11/etc/openldap/schema/sudo.schema include /opt/openldap-2.4.11/etc/openldap/schema/DUAConfigProfile.schema include /opt/openldap-2.4.11/etc/openldap/schema/solaris.schema include /opt/openldap-2.4.11/etc/openldap/schema/ppolicy.schema include /opt/openldap-2.4.11/etc/openldap/schema/autofs.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/openldap-2.4.11/var/run/slapd.pid argsfile /opt/openldap-2.4.11/var/run/slapd.args allow bind_v2 password-hash {MD5} database monitor # TLS configuration TLSCipherSuite HIGH:MEDIUM:TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/ca-ldap.crt TLSCertificateFile /etc/openldap/ldap1.crt TLSCertificateKeyFile /etc/openldap/ldap1.key ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=empresa,dc=com" rootdn "cn=root,dc=empresa,dc=com" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/openldap-2.4.11/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Database access list access to attrs=userPassword by self write by anonymous auth access to attrs=shadowLastChange by self write by * read access to * by * read # Replication overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Password policies overlay ppolicy ppolicy_default "cn=Password,ou=Policies,dc=empresa,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout # Access Logging overlay accesslog logdb cn=log logops bind logsuccess TRUE # Access DB database bdb suffix "cn=log" directory /opt/openldap-2.4.11/var/openldap-accesslog rootdn "cn=log" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart, eq,pres # Syncrepl overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE SLAVE: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/openldap-2.4.11/etc/openldap/schema/core.schema include /opt/openldap-2.4.11/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.11/etc/openldap/schema/inetorgperson.schema include /opt/openldap-2.4.11/etc/openldap/schema/dnszone.schema include /opt/openldap-2.4.11/etc/openldap/schema/nis.schema include /opt/openldap-2.4.11/etc/openldap/schema/sudo.schema include /opt/openldap-2.4.11/etc/openldap/schema/DUAConfigProfile.schema include /opt/openldap-2.4.11/etc/openldap/schema/solaris.schema include /opt/openldap-2.4.11/etc/openldap/schema/ppolicy.schema include /opt/openldap-2.4.11/etc/openldap/schema/autofs.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/openldap-2.4.11/var/run/slapd.pid argsfile /opt/openldap-2.4.11/var/run/slapd.args allow bind_v2 password-hash {MD5} database monitor # TLS configuration TLSCACertificateFile /etc/openldap/cacerts/ca-ldap.crt TLSCertificateFile /etc/openldap/ldap2.crt TLSCertificateKeyFile /etc/openldap/ldap2.key ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=empresa,dc=com" rootdn "cn=root,dc=empresa,dc=com" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/openldap-2.4.11/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Database Access list access to * attrs=userPassword by self write by anonymous auth access to * attrs=shadowLastChange by self write by * read access to * by * read # Replication # Transparently proxy updates to master overlay chain chain-uri "ldap://ldap1.empresa.com" chain-idassert-bind bindmethod="simple" binddn="cn=root,dc=empresa,dc=com" credentials="password" mode="self" chain-tls start chain-return-error TRUE # Replication agent syncrepl rid=123 provider=ldaps://ldap1.empresa.com type=refreshOnly interval=00:00:01:00 searchbase="dc=empresa,dc=com" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=on retry="60 10 300 3" bindmethod=simple binddn="cn=root,dc=empresa,dc=com" credentials=password # Refer updates to master updateref ldap://ldap1.empresa.com/ # Password policies overlay ppolicy ppolicy_default "cn=Password,ou=Policies,dc=empresa,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout # Access Logging overlay accesslog logdb cn=log logops bind logsuccess TRUE # Access DB database bdb suffix "cn=log" directory /opt/openldap-2.4.11/var/openldap-accesslog rootdn "cn=log" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart, eq,pres syncrepl rid=124 provider=ldaps://ldap1.empresa.com bindmethod=simple binddn="cn=root,dc=empresa,dc=com" credentials=password type=refreshOnly interval=00:00:01:00 filter="(objectClass=*)" retry="5 +" searchbase="cn=log" logbase="cn=log" syncdata=accesslog # type=refreshAndPersist # schemachecking=on updateref ldap://ldap1.empresa.com/ ----- Original Message ---- From: Gavin Henry <ghenry(a)OpenLDAP.org> To: Eyal Marantenboim <eyalmdiveo(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Monday, September 15, 2008 12:46:15 PM Subject: Re: pwd* Attributes and replication Eyal Marantenboim wrote: > Hi, > > We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. > When a user tries to bind with incorrect credential, the master server > gets populated with pwdFailureTime attribute. > After 4 times of entering wrong credentials, pwdAccountLockedTime is > added to that user. > > Our problem is that the secondary server (using syncrepl) is not > replicating the pwd* values. > I've noticed that neither entryCSN nor contextCSN are being updated (on > the master) when pwdFailureTime is added to the user (I'm not sure if it > should actually change). > But, when we change any other attribute (userPassword, etc) on the > master, that does change entryCSN, and all pwd* attributes do get > updated in the seconday server. > > appreciate your help. > Thanks! > Config? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

custom bind attribute
by Stefano Zanmarchi 15 Sep '08

15 Sep '08

Hi all, I'd like to let users bind against an attribute other than "userPassword". Is it possible or is userPassword hardcoded? Moreover I'd like to serve bind requests from one IP against "userPassword" and bind requests from another IP against another (custom) attribute. Is this possible by any chance? Thank you very much for your help, Stefano

2 1

Migrating AD Users/Groups to samba-ldap server
by janskey 15 Sep '08

15 Sep '08

Hi All, I need advice on how i can pull down AD users/groups (password of each users) to samba-ldap server. I already configured my server using the howto: * http://www.howtoforge.com/openldap-samba-domain-controller-ubuntu7.10 * http://ubuntuforums.org/showthread.php?t=640760 I tried also ldifde to create ldif files and tried to populate in smbldap-tools. But it has an error, some sort of compatibility of ldif syntax. Our objective is to phase out or Win2003 AD server and user samba+ldap authentication scheme. cheers, janskey

2 1

Active directory change notification using open ldap library: errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece
by susant sahani 15 Sep '08

15 Sep '08

Hi , I am trying to syncing up with Active directory. When ever there is a change in active directory it should send the information. But It's keep on sending me this error message . errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece LDAP_SERVER_NOTIFICATION_OID_W "1.2.840.113556.1.4.528" char* base="dc=ad,dc=hello123,dc=com"; char* filter="(objectClass=*)"; controls[0] = create_psearch_control (LDAP_SERVER_NOTIFICATION_OID_W, 1, 1); controls[1] = 0; ret = ldap_search_ext (ld, base, LDAP_SCOPE_SUBTREE, filter, 0, /* attrs */ 0, /* attrsonly */ controls, 0, /* clientctrls */ 0, /* timeout */ LDAP_NO_LIMIT, &msgid); while ((ret = ldap_result (ld, msgid, LDAP_MSG_RECEIVED, &timeout, &entries)) >= 0) { LDAPMessage *entry; LDAPControl **ec_controls; if (!ret) { printf ("Timed out\n"); continue; } } Please let me know what I am doing wrong. -- Thanks, Susant

1 0

Syncrepl missing cn,sn and givenName
by Stelios A. 14 Sep '08

14 Sep '08

Hello all, I'm going mad with a problem during syncrepl. I have one master and one slave. When I add one entry to the master the record is replicated to the slave without a problem but without all fields and this is causing me problems as from a shell cannot resolve the user using for example the command 'id username'. That gives me an error, no such a user and cause further problems with existin email setup. Under master ldap everything works/resolves fine. If I manually add the whole tree of the master including the 'username' entry then it works fine. Master entry is like: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Kostas sn: Somelastname cn: Kostas Somelastname uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com and slave when replicated has: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com If you check the fields that missing from slave are: cn, sn and givenName My slave slapd.conf has: syncrepl rid=001 provider=ldap://192.168.1.110 type=refreshOnly interval=00:00:05:00 retry="30 10 600 20" searchbase="dc=mydomain,dc=com" attrs="*" scope=sub binddn="uid=syncrepl,ou=System,dc=mydomain,dc=com" credentials=smypassword updateref ldap://192.168.1.110 Any help is much appreciated. Thanks a lot

2 1

Chage for LDAP
by Gustavo Mendes de Carvalho 13 Sep '08

13 Sep '08

Hi All, Is there any tool for LDAP that works like chage, to inform when I changed my password, when will expire, and so on. I am using Openldap 2.3.39 with ppolicy. Thanks --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

Re: Help: Slow LDAP search with high %iowait
by Victor 12 Sep '08

12 Sep '08

Would you folks mind sharing some thoughts/ideas on this? Thanks a lot! --- On Mon, 9/8/08, Victor <victorfuman(a)yahoo.com> wrote: > From: Victor <victorfuman(a)yahoo.com> > Subject: Help: Slow LDAP search with high %iowait > To: openldap-technical(a)openldap.org > Date: Monday, September 8, 2008, 5:35 PM > Hi , > > I did quite a bit reading and research before I send email > to this list for help. If I have missed some basic concepts > here, please execuse my ignorance. Thanks for your help and > time in advance. > > 1. Summary > The initial search in my prototyping with OpenLDAP (slapd + > BDB) seemed to be slow. What is the reason and How could I > fix it? > > 2. Configuration > 2.1 Environment > Linux CentOS, 1 hard disk (therefore unfortunately the BDB > transaction logs and database files are written to the same > disk), 120GB disk space (80% unused), 1GB RAM, reserved for > this prototyping, OpenLDAP 2.3.39 with default BDB > installation > > 2.2 slapd.conf (modified trivially for discussion > purpose) > # global configuration > loglevel 0 > > # BDB > database bdb > suffix "dc=test,dc=dummy,dc=com" > rootdn > "cn=Manager,dc=test,dc=dummy,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for > details. > # Use of strong authentication encouraged. > rootpw secret > # The database directory MUST exist prior to running slapd > AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > directory /usr/local/var/openldap-data > #Other DB configuration > idlcachesize 60000 > cachesize 20000 > # Indices to maintain > # the indexes are to support search in first name, last > name and email for both exact match and wild cards in the > end > index objectClass eq > index gn pres,eq,sub > index sn pres,eq,sub > index mail pres,eq,sub > > 2.3 DB_CONFIG (for BDB) > set_cachesize 0 52428800 1 > set_lg_bsize 2097512 > set_flags DB_LOG_AUTOREMOVE > set_lg_regionmax 262144 > > 2.4 Data setup > 2 million records (users with gn, sn, email, mobile, street > address, etc. in the BDB; all records are indexed using the > index in the above slapd.conf; grouped by the first > character of lastName. For example, > dn: ou=Z,dc=test,dc=dummy,dc=com > objectclass: organizationalUnit > ou: Z > > Sample LDIF entry: > #Directory Entry > dn: > uid=ABCDEFGHIJKLMNOPQRSTUVWXYZ123459,ou=F,dc=test,dc=dummy,dc=com > objectclass: top > objectclass: person > objectclass: organizationalPerson > objectclass: inetOrgPerson > uid: ABCDEFGHIJKLMNOPQRSTUVWXYZ123459 > ...... (details omitted) > > 3. Symptom/Problem > > It was very slow in the first (fresh) search if I searched > by wildcard firstname only like "Larry*" (which > returned 478 entries/users). The response time was generally > higher than 5 seconds Depending the count of records found, > the response time might exceed 20 or even 50 seconds. During > the search, the "iostat" result showed +95% > %iowait, await was much higher that svctm, the device %util > was over 96%. Here is the "iostat" output: > > Time: 10:51:34 AM > avg-cpu: %user %nice %sys %iowait %idle > 3.10 0.00 1.40 95.50 0.00 > > Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s > rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util > hda 0.00 2.90 64.94 65.33 1322.68 580.22 > 661.34 290.11 14.61 51.99 343.51 7.44 96.92 > dm-0 0.00 0.00 64.94 72.53 1322.68 580.22 > 661.34 290.11 13.84 55.44 330.62 7.06 96.99 > dm-1 0.00 0.00 0.00 0.00 0.00 0.00 > 0.00 0.00 0.00 0.00 0.00 0.00 0.00 > > > However, The subsequent search (using the exact search > criteria) is much faster (within 200ms). I believe it is > because of the cache. > > I did a "db_stat -m" check and saw +90% cache hit > rate (I guess it is normal?). The detailed output is in the > attachment. > > 4. Questions > The "iostat" output showed obvious I/O > bottleneck. Assuming I can't upgrade my hardware (for > example, adding another disk specifically for writing > transaction logs to), assuming I won't set a limit to > the max number of entried returned, is there anything else I > can do (typically BDB/slapd tuning or configuration) to make > the fresh/first search much faster (say within 2 seconds for > the worst case)? Did I do anything wrong? Please advise. > > Thanks a lot! > > Vic

3 5

CREATE LDAP REPLICA
by LITLE TUX 12 Sep '08

12 Sep '08

Hi i install openldap in servers and create replica but is not runin perfectly My entry in ldap server: MASTER SERVER: replogfile /var/log/replica/replica.log replica host=hostname_slave.domain.com:389 binddn="cn=Administrator,dc=domain,dc=com" bindmethod=simple credentials=123456 tls=none ################################################## ###################### SLAVE SERVER: updatedn "cn=Administrator,dc=domain,dc=com" updateref ldap://hostname_master.domain.com In my /etc/hosts configure any hostnames... The file replica.log is empty and not create replica. I execute normaly /etc/init.d/slurpd start only master server. Is necessary running slurod daemon is slave server? Exist other configuration to slapd.conf? My slapd.conf is same in master and slave except lines reference the replica. Thanks for your helps..... Best

1 0

pwd* Attributes and replication
by Eyal Marantenboim 12 Sep '08

12 Sep '08

Hi, We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. When a user tries to bind with incorrect credential, the master server gets populated with pwdFailureTime attribute. After 4 times of entering wrong credentials, pwdAccountLockedTime is added to that user. Our problem is that the secondary server (using syncrepl) is not replicating the pwd* values. I've noticed that neither entryCSN nor contextCSN are being updated (on the master) when pwdFailureTime is added to the user (I'm not sure if it should actually change). But, when we change any other attribute (userPassword, etc) on the master, that does change entryCSN, and all pwd* attributes do get updated in the seconday server. appreciate your help. Thanks!

1 0

Re: Reentrant library question.
by William Jojo 12 Sep '08

12 Sep '08

---- Original message ---- >Date: Thu, 11 Sep 2008 14:55:14 +0100 >From: Duncan Gibb <Duncan.Gibb(a)SiriusIT.co.uk> >Subject: Re: Reentrant library question. >To: William Jojo <w.jojo(a)hvcc.edu> >Cc: openldap-technical(a)openldap.org > >William Jojo wrote: > >WJ> I manage a set of packages [..] for AIX 5.3 and 6.1. > >WJ> Is it safe to [..] > >WJ> libldap.so -> libldap_r.so > >Disclaimer: I do not speak AIX. > That's ok, I do. :-) :-) >The Debian Linux OpenLDAP packages have been doing this since 2.4.7. >We've deployed these and not come across any serious problems (said he, >about to roll out a 2.4.11 backport...). > Sounds wonderful! Thanks a bunch! Cheers, Bill > >Cheers > > >Duncan > >-- >Duncan Gibb, Technical Architect >Sirius Corporation - The Open Source Experts >http://www.siriusit.co.uk/ >Tel: +44 870 608 0063 || +44 7977 441 515

1 0

Reentrant library question.
by William Jojo 11 Sep '08

11 Sep '08

I manage a set of packages under the name pWare for AIX 5.3 and 6.1. I am upgrading the core OpenLDAP from 2.3.38 to 2.4.11 and wanted to do something IBM does with libc. They link libc.a -> libc_r.a Is it safe to do the same in OpenLDAP such that: libldap.so -> libldap_r.so ? Then I rebuild any packages that depended on 2.3 for 2.4. Cheers, Bill

3 3

LDAP log analysis
by Praveen Kumar 11 Sep '08

11 Sep '08

Hi, I am using LDAP server for authentication, where i am successful in making an user to log in into a machine after authentication from ldap server. Now i want to see at the server side at what time the user asked for authentication and was successfully authenticated. In other words how can the log about any authentication request and successful reply to that can be seen for each request made to the server. Regards

2 1

[Solved] AW: Re: AW: Re: AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable))
by Hauke Coltzau 11 Sep '08

11 Sep '08

Hi all, Wow, it seems to be done ;-) To put it in a nutshell: - apt-get purge MIT-Kerberos* - apt-get install Heimdal* - tried and failed, tried and failed, ... - apt-get purge heimdal*, cyrus*, openldap* - apt-get libssl-dev and libdb dev packages - got cyrus, openldap and heimdal tarballs - configured, compiled, tested, failed, configured, compiled, tested, failed, conf.......... ...... ...... ... --- ... ... --- ... configured, compiled, succeeded! - Followed well known configuration instructions Voila! ldapsearch -Y GSSAPI works ldaps works (without client verification, did not solve that yet, server verification works fine) login with kerberos authentication works (with proxy ticket for the machine, this way I avoid having PLAIN username/password send to slapd) su, id, etc. works Seems, as if doing it by hand is still the best way ;-) Thanks again for your help, Hauke ----- Ursprüngliche Mail ----- Von: "Quanah Gibson-Mount" <quanah(a)zimbra.com> An: "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> CC: openldap-software(a)openldap.org Gesendet: Montag, 8. September 2008 21:44:16 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: Re: AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable)) --On Monday, September 08, 2008 9:26 PM +0200 Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> wrote: > ii libsasl2-modules-gssapi-mit 2.1.22.dfsg1-18ubuntu2 \\ > Cyrus SASL - pluggable authentication module I would highly recommend using Heimdal on the master side. But that's up to you. ;) > - In the first approach, the user already has a TGT and asks the KDC for > a "ldap/fqdn@REALM-ticket"? This is done by ldapsearch, not by slapd? > Hence, slapd "only" needs access to its keytab to be able to decrypt the > clients messages? I believe that is correct, yes. At Stanford, I had to point slapd at the keytab in a shell script, but I believe that was because I was using SASL/GSSAPI to do replication as well. It's been a while. ;) > - And in the second one, the user provides username and password (plain), > slapd converts the username into a principle (user@REALM) and forwards > this to saslauthd? So this should be secured via TLS? You can try securing it via startTLS, but nothing blocks a user from still doing it in the clear, unfortunately (i.e., you can reject the non-secured bind, but they'll have already sent their credentials, so anyone sniffing would be able to get them). > There used to be a well-known howto for all this at > http://www.bayour.com/LDAPv3-HOWTO.html but the site is offline for some > days now. This howto is completely wrong, and the various folks have asked the author to take it down for years. I'm glad to hear it is not accessible. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration --

2 1

syncrepl - Base DN is not within the database naming context.
by Brad T Waldorf 11 Sep '08

11 Sep '08

Sorry in advance if i'm missed something obvious (which is what the text of this error makes me think), but i've spent 2 days on this and could use another set of eyes. I hit the error in the subject when trying to set up basic refreshAndPersist replication with 2 separate BDB databases defined and populated. The error happens on only 1 of the databases (replication works fine on the other.) (slapd.conf for Master....) include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=exampleb1,dc=com" rootdn "cn=kingb1,dc=exampleb1,dc=com" rootpw password directory /usr/local/var/openldap-data/bdb1 index objectClass,sn,mail,street,pager eq database bdb suffix "o=baseballs" rootdn "cn=admin,o=baseballs" rootpw password directory /usr/local/var/openldap-data/bdb2 index objectClass,sn,mail,street,pager eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 database monitor (slapd.conf for Slave...) include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=exampleb1,dc=com" rootdn "cn=kingb1,dc=exampleb1,dc=com" rootpw password directory /usr/local/var/openldap-data/bdb1 index objectClass,sn,mail,street,pager eq database bdb suffix "o=baseballs" rootdn "cn=admin,o=baseballs" rootpw password directory /usr/local/var/openldap-data/bdb2 index objectClass,sn,mail,street,pager eq syncrepl rid=492 provider=ldap://9.00.00.000:389 type=refreshAndPersist retry="120 +" searchbase="dc=exampleb1,dc=com" bindmethod=simple binddn="cn=kingb1,dc=exampleb1,dc=com" credentials=password database monitor I get the Master up and populated before starting the Slave. When i start the Slave, i get the error. Here's the output with -d 256... (line 38 is the end of the syncrepl chunk... the "credentials=password" line) OpenLDAP 2.4.6 Standalone LDAP Server (slapd)/test/slapd_multibackendsS.conf: li ne 38: Base DN "dc=exampleb1,dc=com" is not within the database naming context.+ CSMP0097I 22.50.28 CPU-C SS-BSS SSU-HPN IS-01 failed to add syncinfo+ CSMP0097I 22.50.28 CPU-C SS-BSS SSU-HPN IS-01 slapd stopped.+ CSMP0097I 22.50.28 CPU-C SS-BSS SSU-HPN IS-01 connections_destroy: nothing to destroy.+ If i modify the syncrepl statement in the slave to replicate the other database, replication of "o=baseballs" works... syncrepl rid=493 provider=ldap://9.00.00.000:389 type=refreshAndPersist retry="120 +" searchbase="o=baseballs" bindmethod=simple binddn="cn=admin,o=baseballs" credentials=password The data in "dc=exampleb1,dc=com" is straight from the output of the MakeLDIF utility. I've added/searched/modified it a bunch before trying this particular replication scenario. So... how stupid am i?? Do you see anything i'm missing? Thanks for your help...

3 4

Openldap force replication
by Govind c 10 Sep '08

10 Sep '08

Hi, Is there a way to force the replication between Master and the slave?. The number of objects and entries are the same in both master and slave,however the some fields don`t have the same content (eg : last login time)Wondering if there is way to keep both in sync in terms of content and objects/entries. Cheers CG

3 6

Check errors from Jexplore!
by Nguyen Quang Huy 10 Sep '08

10 Sep '08

Hi all! Im Setup Openldapv2.x, Im setup following guide: http://www.linuxmail.info/openldap-setup-howto/ Im connect from Jexplore to Openldap --> OK, I can open no-ip..vv, but I open org --> error appear: Im dont know check location.. Help me! ************************************************* Nguyen Quang Huy Add: Tang 4 - Trung Tâm Tin Hoc So 8 Le Thai To - Hoan Kiem - Ha Noi Mob: 0914-257-830 Tel: 04-9288858 ext 425 Fax: + 84 4 928 9213 Email: <mailto:quanghuy@vpb.com.vn> quanghuy(a)vpb.com.vn LinQ: <mailto:kquanghuy@web.vpb.com.vn> quanghuy(a)web.vpb.com.vn

2 1

Problem With postfix
by LITLE TUX 09 Sep '08

09 Sep '08

Hi peoples .... i'm tryng configure openldap with postfix but qhen try add the below entry i receive next error: gheorghe:~/difs # ldapadd -f base.ldif -x -D cn=Administrator,dc=domain,dc=com-w 123456 adding new entry "relativeDomainName=@, ou=dns,dc=domain,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax My ldif file: dn: relativeDomainName=@, ou=dns,dc=domain,dc=com objectClass: dNSZone relativeDomainName: @ zoneName: domain.com dNSTTL: 3600 dNSClass: IN sOARecord: ns3.domain.com. administrator.domain.com. 2001030201 3600 1800 604800 86400 nSRecord: ns3.domain.com. mXRecord: 30 mail.domain.com. My include schemas: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba3.schema include /etc/openldap/schema/dnszone.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/qmail.schema include /etc/openldap/schema/postfix.schema Any help is welcome...!!!! Best Regards!

3 2

Help: Slow LDAP search with high %iowait
by Victor 08 Sep '08

08 Sep '08

Hi , I did quite a bit reading and research before I send email to this list for help. If I have missed some basic concepts here, please execuse my ignorance. Thanks for your help and time in advance. 1. Summary The initial search in my prototyping with OpenLDAP (slapd + BDB) seemed to be slow. What is the reason and How could I fix it? 2. Configuration 2.1 Environment Linux CentOS, 1 hard disk (therefore unfortunately the BDB transaction logs and database files are written to the same disk), 120GB disk space (80% unused), 1GB RAM, reserved for this prototyping, OpenLDAP 2.3.39 with default BDB installation 2.2 slapd.conf (modified trivially for discussion purpose) # global configuration loglevel 0 # BDB database bdb suffix "dc=test,dc=dummy,dc=com" rootdn "cn=Manager,dc=test,dc=dummy,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data #Other DB configuration idlcachesize 60000 cachesize 20000 # Indices to maintain # the indexes are to support search in first name, last name and email for both exact match and wild cards in the end index objectClass eq index gn pres,eq,sub index sn pres,eq,sub index mail pres,eq,sub 2.3 DB_CONFIG (for BDB) set_cachesize 0 52428800 1 set_lg_bsize 2097512 set_flags DB_LOG_AUTOREMOVE set_lg_regionmax 262144 2.4 Data setup 2 million records (users with gn, sn, email, mobile, street address, etc. in the BDB; all records are indexed using the index in the above slapd.conf; grouped by the first character of lastName. For example, dn: ou=Z,dc=test,dc=dummy,dc=com objectclass: organizationalUnit ou: Z Sample LDIF entry: #Directory Entry dn: uid=ABCDEFGHIJKLMNOPQRSTUVWXYZ123459,ou=F,dc=test,dc=dummy,dc=com objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson uid: ABCDEFGHIJKLMNOPQRSTUVWXYZ123459 ...... (details omitted) 3. Symptom/Problem It was very slow in the first (fresh) search if I searched by wildcard firstname only like "Larry*" (which returned 478 entries/users). The response time was generally higher than 5 seconds Depending the count of records found, the response time might exceed 20 or even 50 seconds. During the search, the "iostat" result showed +95% %iowait, await was much higher that svctm, the device %util was over 96%. Here is the "iostat" output: Time: 10:51:34 AM avg-cpu: %user %nice %sys %iowait %idle 3.10 0.00 1.40 95.50 0.00 Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util hda 0.00 2.90 64.94 65.33 1322.68 580.22 661.34 290.11 14.61 51.99 343.51 7.44 96.92 dm-0 0.00 0.00 64.94 72.53 1322.68 580.22 661.34 290.11 13.84 55.44 330.62 7.06 96.99 dm-1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 However, The subsequent search (using the exact search criteria) is much faster (within 200ms). I believe it is because of the cache. I did a "db_stat -m" check and saw +90% cache hit rate (I guess it is normal?). The detailed output is in the attachment. 4. Questions The "iostat" output showed obvious I/O bottleneck. Assuming I can't upgrade my hardware (for example, adding another disk specifically for writing transaction logs to), assuming I won't set a limit to the max number of entried returned, is there anything else I can do (typically BDB/slapd tuning or configuration) to make the fresh/first search much faster (say within 2 seconds for the worst case)? Did I do anything wrong? Please advise. Thanks a lot! Vic

1 0

AW: Re: AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable))
by Hauke Coltzau 08 Sep '08

08 Sep '08

Hi Quanah, thanks again for your answer. > Did you make sure the GSSAPI module was installed with Cyrus-SASL? IIRC, > it's a separate package under Ubuntu. > > p libgssapi2-heimdal > - Heimdal Kerberos - GSSAPI support library > p libsasl2-modules-gssapi-heimdal > - Pluggable Authentication Modules for SASL (GSSAPI) > p libsasl2-modules-gssapi-mit > - Cyrus SASL - pluggable authentication modules (GSSAPI) ii libsasl2-modules-gssapi-mit 2.1.22.dfsg1-18ubuntu2 \\ Cyrus SASL - pluggable authentication module > > (b) saslauthd and SASL/GSSAPI are unrelated. I.e., you don't need to be > > running saslauthd for SASL/GSSAPI to work. > > Now I'm confused. I always understood the way to use > > Kerberos authentication for accessing the ldap directory > > to be: > > > > LDAP->SASL->Kerberos > > > > and that I have to fill the SASL part with something real, > > like saslauthd. What did I miss here? > > SASL/GSSAPI uses the existing Kerberos ticket to auth a user to LDAP > > When using saslauthd, you do a simple bind to the LDAP server, which then > connects to the KDC, gets a ticket, and auths the user. > > Two very different things. I.e., the first, the user already has authed to > the KDC. In the second, they haven't. I see the difference, but still have some questions: - In the first approach, the user already has a TGT and asks the KDC for a "ldap/fqdn@REALM-ticket"? This is done by ldapsearch, not by slapd? Hence, slapd "only" needs access to its keytab to be able to decrypt the clients messages? - And in the second one, the user provides username and password (plain), slapd converts the username into a principle (user@REALM) and forwards this to saslauthd? So this should be secured via TLS? I'm just looking for a setup that restricts access to LDAP to authenticated users (except, of course, information neccessary for authentication purposes). I need to use Kerberos for authentication, because I want to use NFSv4. There used to be a well-known howto for all this at http://www.bayour.com/LDAPv3-HOWTO.html but the site is offline for some days now. Thanks again for your help, Hauke --

1 0

AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable))
by Hauke Coltzau 08 Sep '08

08 Sep '08

Hi Quanah, thank you for your immediate reply. (a) Which Kerberos implementation are you using? MIT Kerberos 5 as shipped with Hardy (1.6.dfsg.3~beta1-2ubuntu1) (b) saslauthd and SASL/GSSAPI are unrelated. I.e., you don't need to be running saslauthd for SASL/GSSAPI to work. Now I'm confused. I always understood the way to use Kerberos authentication for accessing the ldap directory to be: LDAP->SASL->Kerberos and that I have to fill the SASL part with something real, like saslauthd. What did I miss here? Thanks again, Hauke p.s.: ZCS fan here ;-) --

2 1

Simple binds with SASL/GSSAPI (Resource temporarily unavailable)
by Hauke Coltzau 08 Sep '08

08 Sep '08

Hi all, I have a problem to make simple binds with authentication done by kerberos5. I use OpenLDAP to store all user account information and have everything set up so far that users can login: $ su - testuser Password: $ klist Ticket cache: FILE:/tmp/krb5cc_2000_yukVIJ Default principal: testuser@REALM Valid starting Expires Service principal 09/08/08 16:54:16 09/09/08 02:54:16 krbtgt/REALM@REALM renew until 09/09/08 16:54:16 Kerberos 4 ticket cache: /tmp/tkt2000 klist: You have no tickets cached $ id uid=2000(testuser) gid=2000(dusers) groups=2000(dusers) uid, gid,etc. have been successfully taken from the LDAP directory. But then, ldapsearch fails: $ ldapsearch SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) $ Details: ======== Currently, the KDC and the LDAP-Server reside on the same host, running Ubuntu 8.04 x64_64. I made sure that principals exist for <fqdn>@REALM ldap/<fqdn>@REALM host/<fqdn>@REALM and exported them to /etc/krb5.keytab as well as /etc/ldap/ldap.keytab, which is now owned by the openldap user. # ktutil ktutil: rkt /etc/krb5.keytab ktutil: l slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 ldap/<fqdn>@REALM 2 6 ldap/<fqdn>@REALM 3 4 host/<fqdn>@REALM 4 4 host/<fqdn>@REALM 5 4 <fqdn>@REALM 6 4 <fqdn>@REALM ktutil: ktutil: clear ktutil: rkt /etc/ldap/ldap.keytab ktutil: l slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 ldap/<fqdn>@REALM 2 6 ldap/<fqdn>@REALM 3 4 host/<fqdn>@REALM 4 4 host/<fqdn>@REALM 5 4 <fqdn>@REALM 6 4 <fqdn>@REALM # ll /etc/ldap/ldap.keytab -rw------- 1 openldap openldap 512 2008-09-08 15:23 /etc/ldap/ldap.keytab (Even tried 666, but that didn't change anything. If I move this file, slapd complains, so I'm pretty sure it's actually been used) Next, I set START=yes and MECHANISMS="kerberos5" in /etc/default/saslauthd, started saslauthd and tested: # testsaslauthd -u testuser -p <secret> 0: OK "Success." As recommended, I used sasl-sample-server and /-client to test the configuration SASSL/GSSAPI <-> Kerberos: # sasl-sample-client -s ldap -m GSSAPI -n <fqdn> (partial output) service=ldap Waiting for mechanism list from server... Forcing use of mechanism GSSAPI Choosing best mechanism from: GSSAPI Using mechanism GSSAPI Preparing initial. Sending initial response... C: .... ... Username: testuser@REALM SSF: 56 Waiting for encoded message... recieved decoded message 'srv message 1' sending encrypted message 'client message 1' On the sample-server side, it's the same, 'client message 1' was successfully decoded. Next thing I did was to add following lines to /etc/ldap/slapd.conf sasl-secprops noplain,noactive,noanonymous sasl-regexp uid=(.*),cn=<domain>,cn=gssapi,cn=auth ldap:///dc=...??sub?uid=$1 sasl-regexp uid=(.*),cn=<domain>,cn=gssapi,cn=auth uid=$1,dc=... and created /usr/lib/sasl2/slapd.conf mech_list: gssapi digest-md5 cram-md5 external pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux keytab: /etc/ldap/ldap.keytab Then I chgrouped /var/run/saslauthd to openldap and gave g=rwx permissions to the directory: # ls -al /var/run/saslauthd/ total 0 drwxrwxr-x 2 root openldap 100 2008-09-08 16:36 . drwxr-xr-x 15 root root 580 2008-09-08 12:13 .. srwxrwxrwx 1 root root 0 2008-09-08 16:36 mux -rw------- 1 root root 0 2008-09-08 16:36 mux.accept -rw------- 1 root root 0 2008-09-08 16:36 saslauthd.pid.lock But now, when trying ldapsearch on the same machine, it fails: $ klist Ticket cache: FILE:/tmp/krb5cc_2000_tA7220 Default principal: testuser@REALM Valid starting Expires Service principal 09/08/08 16:33:05 09/09/08 02:33:05 krbtgt/REALM@REALM renew until 09/09/08 16:33:05 09/08/08 16:33:46 09/09/08 02:33:05 ldap/<fqdn>@REALM renew until 09/09/08 16:33:05 Kerberos 4 ticket cache: /tmp/tkt2000 klist: You have no tickets cached $ ldapsearch SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) $ And on the server side: # echo $KRB5_KTNAME /etc/ldap/ldap.keytab # slapd -d127 -h "ldap:///" -u openldap -g openldap ... >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=GSSAPI datalen=583 SASL [conn=0] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Resource temporarily unavailable) send_ldap_result: conn=0 op=1 p=3 send_ldap_result: err=80 matched="" text="SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Resource temporarily unavailable)" send_ldap_response: msgid=2 tag=97 err=80 ber_flush2: 158 bytes to sd 13 ... and saslauthd is not contacted at all: # saslauthd -d -a kerberos5 saslauthd[7243] :main : num_procs : 5 saslauthd[7243] :main : mech_option: NULL saslauthd[7243] :main : run_path : /var/run/saslauthd saslauthd[7243] :main : auth_mech : kerberos5 saslauthd[7243] :ipc_init : using accept lock file: /var/run/saslauthd/mux.accept saslauthd[7243] :detach_tty : master pid is: 0 saslauthd[7243] :ipc_init : listening on socket: /var/run/saslauthd/mux saslauthd[7243] :main : using process model saslauthd[7244] :get_accept_lock : acquired accept lock saslauthd[7243] :have_baby : forked child: 7244 saslauthd[7243] :have_baby : forked child: 7245 saslauthd[7243] :have_baby : forked child: 7246 saslauthd[7243] :have_baby : forked child: 7247 <no more output> What did I do wrong this time ;-) ? Best regards, Hauke --

2 2

ldapadd of LDIF files with attribute 'apple-generateduid' not allowed [Resolved]
by Alexander Hartner 07 Sep '08

07 Sep '08

At it turns out the problem was with the objectClasses. I should have used : objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: extensibleObject Instead of objectClass: top objectClass: person objectClass: inetOrgPerson Adding the extra attributes to the objectClass resolved this problem. Thanks for all your help. Regards Alex On 21 Feb 2008, at 11:56, Alexander Hartner wrote: > I am trying to import a simple LDIF file into OpenDirectory on OS X > 10.5.2 Leopard Server. > > However when I issue the following ldapadd command I get an error : > > ldapadd -D [rootdn] -x -w [secretPassword] -f Import.ldif > > Error : 65 Object class violation" > attribute 'apple-generateduid' not allowed > > > I would have thought that I had specified apple-generateduid, but I > didn't. > > This is my import file > -----------BEGIN----------- > # Alexander Hartner > dn: cn=Alexander Hartner2,cn=people,dc=macbook-znet,dc=local > objectClass: top > objectClass: person > objectClass: inetOrgPerson > displayName: Alexander Hartner2 > cn: Alexander Hartner2 > givenName: Alexander > sn: Hartner > mail: alex(a)j2anywhere.com > initials: A > o: j2anywhere.com > -----------END----------- > > I know this might not be the best forum for OS X support, but I am a > bit stuck on this. > Thanks in advance. > Alex > > >

2 2

anish_patil wants to keep up with you on Twitter
by anish_patil 07 Sep '08

07 Sep '08

To find out more about Twitter, visit the link below: http://twitter.com/i/6de68cfefa92375374ca938a55b8e865fa2162ab Thanks, -The Twitter Team About Twitter Twitter is a unique approach to communication and networking based on the simple concept of status. What are you doing? What are your friends doing—right now? With Twitter, you may answer this question over SMS, IM, or the Web and the responses are shared between contacts. This message was sent by a Twitter user who entered your email address. If you'd prefer not to receive emails when other people invite you to Twitter, click here: http://twitter.com/i/optout/dd31dad00025fa765c3307138c272038991bea18

1 0

Re: RHEL 5 will not do TLS/SSL authentication
by Dat Duong 06 Sep '08

06 Sep '08

Does anyone have the answer to my problem? thanks ----- Original Message ---- From: Dat Duong <datduong2000(a)yahoo.com> To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Cc: openldap-technical(a)openldap.org Sent: Wednesday, September 3, 2008 7:45:45 AM Subject: Re: RHEL 5 will not do TLS/SSL authentication The slapd.conf is on Solaris 10 machine. This is how I compiled from the source for Openssl and Openldap. #cd openssl.0.98h # ./config shared # make clean # make # make install # cd openldap-2.4.11 # env LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/local/ssl/lib" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.4.2/lib -L/usr/local/ssl/lib -R/usr/local/lib -R/usr/local/BerkeleyDB.4.2/lib -R/usr/local/ssl/lib" CPPFLAGS="-I/usr/local/include -I/usr/local/BerkeleyDB.4.2/include -I/usr/local/ssl/include" ./configure --enable-bdb --enable-crypt --with-tls --without-cyrus-sasl # make depend # make clean ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, September 3, 2008 5:17:14 AM Subject: Re: RHEL 5 will not do TLS/SSL authentication On Wednesday 03 September 2008 09:49:54 Dat Duong wrote: > I'm thinking, if the gnutls which installed by default, was causing the > problem?? It doesn't matter if gnutls is installed, what matters is what OpenLDAP was compiled against. Now, you stated that you are using RHEL 5, and gave no other details of what software you installed, so it would be logical to assume you are using only the RHEL 5 packages. On RHEL 5, OpenLDAP 2.3.27 is compiled against openssl 0.9.8b. But, since you have some weird paths reflected in your slapd.conf etc., maybe you have built your own software. If you have, you need to supply the details thereof, or we are all wasting our time. Regards, Buchan

1 0

Re: Help needed to set up N-way multimaster replication
by piyush joshi 05 Sep '08

05 Sep '08

I have added serverid 1 to first server and serverid 2 to secondserver and rid=001 with syncrepl on both the server also added mirrormode true on both node but now when i make changes to one server that is not reflected to another one while before adding mirrormode true whenever i was trying to make changes in dir it gives me error [ Sep 4 10:18:39 mail slapd[20141]: conn=5 op=1 RESULT tag=103 err=53 text=shadow context; no update referral ] So now no idea where I am wrong. Please help me ... On Wed, Sep 3, 2008 at 6:25 PM, Miguel Jinez <miguel.jinez(a)gmail.com> wrote: > Hello, maybe try with a mirrormode line, look the comments in red > > Migue > > 2008/9/3 piyush joshi <joy.piyush(a)gmail.com> > > >> *Dear All,* >> *I am using openldap-2.4.11 version and trying to use >> N-way multimaster replication so that changes made to first server reflects >> to second and* *vice versa but with my current set up if i use syncprov >> overlay and syncrepl on both server then it doesn't allow me to make changes >> in any ldap server but if i configure syncprov overlay on one server and >> configure syncrepl on another server it allow me to make changes and as well >> reflect the changes to another however still i can't make changes to second >> ldap server my both server configuration is as follows. please let me know >> what is wrong with this configuration or what all changes to be made >> to running it.* >> >> Configuration on First LDAP Server >> >> allow bind_v2 >> include /usr/local/openldap/etc/openldap/schema/core.schema >> include /usr/local/openldap/etc/openldap/schema/corba.schema >> include /usr/local/openldap/etc/openldap/schema/cosine.schema >> include /usr/local/openldap/etc/openldap/schema/nis.schema >> include >> /usr/local/openldap/etc/openldap/schema/inetorgperson.schema >> pidfile /usr/local/openldap/var/run/slapd.pid >> argsfile /usr/local/openldap/var/run/slapd.args >> modulepath /usr/local/openldap/libexec/openldap >> moduleload syncprov >> password-hash {SSHA} >> database hdb >> suffix "dc=***,dc=com" >> rootdn "cn=root,dc=***,dc=com" >> rootpw {SSHA}yZkqhHmELfmUTsaQyfxgXBqq95gugTA4 >> directory /usr/local/openldap/var/openldap-data >> index uid pres,eq >> index cn,sn pres,eq,approx,sub >> index objectClass eq >> index entryCSN,entryUUID eq >> syncrepl rid=001 >> provider=ldap://192.168.1.12 >> type=refreshAndPersist >> retry="5 5 300 +" >> searchbase="dc=***,dc=com" >> attrs=* >> binddn="cn=root,dc=***,dc=com" >> credentials=secret >> > mirrormode true > > >> overlay syncprov >> syncprov-checkpoint 50 10 >> database monitor >> loglevel 256 >> >> >> Configuration on Second LDAP Server >> >> allow bind_v2 >> include /usr/local/openldap/etc/openldap/schema/core.schema >> include /usr/local/openldap/etc/openldap/schema/corba.schema >> include /usr/local/openldap/etc/openldap/schema/cosine.schema >> include /usr/local/openldap/etc/openldap/schema/nis.schema >> include >> /usr/local/openldap/etc/openldap/schema/inetorgperson.schema >> pidfile /usr/local/openldap/var/run/slapd.pid >> argsfile /usr/local/openldap/var/run/slapd.args >> >> modulepath /usr/local/openldap/libexec/openldap >> moduleload syncprov >> password-hash {SSHA} >> >> database hdb >> suffix "dc=***,dc=com" >> rootdn "cn=root,dc=***,dc=com" >> rootpw {SSHA}9nbNE9l1rTvPCoU95zgo6vVoL3nMRzMI >> directory /usr/local/openldap/var/openldap-data >> index uid pres,eq >> index cn,sn pres,eq,approx,sub >> index objectClass eq >> index entryCSN,entryUUID eq >> syncrepl rid=001 >> provider=ldap://192.168.1.8 >> type=refreshAndPersist >> retry="5 5 300 +" >> searchbase="dc=***,dc=com" >> attrs=* >> binddn="cn=root,dc=***,dc=com" >> credentials=secret >> mirrormode true >> > > >> overlay syncprov >> syncprov-checkpoint 50 10 >> database monitor >> loglevel 256 >> >> >> Thanks Regards >> >> Piyush Joshi >> 9415414376 >> >> >> >> >> >> > > -- Regards Piyush Joshi 9415414376

3 4

objectclass sambaSamAccount
by Laurence Mayer 03 Sep '08

03 Sep '08

Hi, OS: Linux Redhat x86_64 OpenLdap 2.3.27 I am trying to add an objectclass sambaSamAccount to my ou=People. My goal would be to have both samba and posix account for each user. I have included the samba schema to the slapd.conf file. I tried adding this to a file and running ldapadd: dn: uid=laurence, ou=People,dc=istraresearch,dc=com sambaLogonTime: 0 displayName: Laurence Mayer sambaLMPassword: xxxxx sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201 objectClass: sambaSamAccount sambaAcctFlags: [UX ] gidNumber: 100 sambaKickoffTime: 2147483647 sambaPwdLastSet: 1010179230 sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 sambaNTPassword: xxxx However I received the error: adding new entry "uid=laurence, ou=People,dc=istraresearch,dc=com" ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute Please can you tell me what I need to do to achieve this. Thanks in advance Laurence

4 10

Re: RHEL 5 will not do TLS/SSL authentication
by Dat Duong 03 Sep '08

03 Sep '08

The slapd.conf is on Solaris 10 machine. This is how I compiled from the source for Openssl and Openldap. #cd openssl.0.98h # ./config shared # make clean # make # make install # cd openldap-2.4.11 # env LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/local/ssl/lib" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.4.2/lib -L/usr/local/ssl/lib -R/usr/local/lib -R/usr/local/BerkeleyDB.4.2/lib -R/usr/local/ssl/lib" CPPFLAGS="-I/usr/local/include -I/usr/local/BerkeleyDB.4.2/include -I/usr/local/ssl/include" ./configure --enable-bdb --enable-crypt --with-tls --without-cyrus-sasl # make depend # make clean ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, September 3, 2008 5:17:14 AM Subject: Re: RHEL 5 will not do TLS/SSL authentication On Wednesday 03 September 2008 09:49:54 Dat Duong wrote: > I'm thinking, if the gnutls which installed by default, was causing the > problem?? It doesn't matter if gnutls is installed, what matters is what OpenLDAP was compiled against. Now, you stated that you are using RHEL 5, and gave no other details of what software you installed, so it would be logical to assume you are using only the RHEL 5 packages. On RHEL 5, OpenLDAP 2.3.27 is compiled against openssl 0.9.8b. But, since you have some weird paths reflected in your slapd.conf etc., maybe you have built your own software. If you have, you need to supply the details thereof, or we are all wasting our time. Regards, Buchan

1 0

Re: RHEL 5 will not do TLS/SSL authentication
by Buchan Milne 03 Sep '08

03 Sep '08

On Wednesday 03 September 2008 09:49:54 Dat Duong wrote: > I'm thinking, if the gnutls which installed by default, was causing the > problem?? It doesn't matter if gnutls is installed, what matters is what OpenLDAP was compiled against. Now, you stated that you are using RHEL 5, and gave no other details of what software you installed, so it would be logical to assume you are using only the RHEL 5 packages. On RHEL 5, OpenLDAP 2.3.27 is compiled against openssl 0.9.8b. But, since you have some weird paths reflected in your slapd.conf etc., maybe you have built your own software. If you have, you need to supply the details thereof, or we are all wasting our time. Regards, Buchan

1 0

Help needed to set up N-way multimaster replication
by piyush joshi 03 Sep '08

03 Sep '08

*Dear All,* *I am using openldap-2.4.11 version and trying to use N-way multimaster replication so that changes made to first server reflects to second and* *vice versa but with my current set up if i use syncprov overlay and syncrepl on both server then it doesn't allow me to make changes in any ldap server but if i configure syncprov overlay on one server and configure syncrepl on another server it allow me to make changes and as well reflect the changes to another however still i can't make changes to second ldap server my both server configuration is as follows. please let me know what is wrong with this configuration or what all changes to be made to running it.* Configuration on First LDAP Server allow bind_v2 include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/corba.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/local/openldap/libexec/openldap moduleload syncprov password-hash {SSHA} database hdb suffix "dc=***,dc=com" rootdn "cn=root,dc=***,dc=com" rootpw {SSHA}yZkqhHmELfmUTsaQyfxgXBqq95gugTA4 directory /usr/local/openldap/var/openldap-data index uid pres,eq index cn,sn pres,eq,approx,sub index objectClass eq index entryCSN,entryUUID eq syncrepl rid=001 provider=ldap://192.168.1.12 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=***,dc=com" attrs=* binddn="cn=root,dc=***,dc=com" credentials=secret overlay syncprov syncprov-checkpoint 50 10 database monitor loglevel 256 Configuration on Second LDAP Server allow bind_v2 include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/corba.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/local/openldap/libexec/openldap moduleload syncprov password-hash {SSHA} database hdb suffix "dc=***,dc=com" rootdn "cn=root,dc=***,dc=com" rootpw {SSHA}9nbNE9l1rTvPCoU95zgo6vVoL3nMRzMI directory /usr/local/openldap/var/openldap-data index uid pres,eq index cn,sn pres,eq,approx,sub index objectClass eq index entryCSN,entryUUID eq syncrepl rid=001 provider=ldap://192.168.1.8 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=***,dc=com" attrs=* binddn="cn=root,dc=***,dc=com" credentials=secret overlay syncprov syncprov-checkpoint 50 10 database monitor loglevel 256 Thanks Regards Piyush Joshi 9415414376

2 1

Re: RHEL 5 will not do TLS/SSL authentication
by Buchan Milne 03 Sep '08

03 Sep '08

On Tuesday 02 September 2008 21:26:10 Dat Duong wrote: > Also I did the certs test on the client RHEL5: And it failed for some reason, meaning this isn't an OpenLDAP problem, but an OpenSSL problem. > > # openssl s_client -connect xxx.xxx.xxx.xxx:636 -showcerts -state -CAfile > /etc/openldap/cacerts/cacert.pem > > > CONNECTED(00000003) > SSL_connect:before/connect initialization > SSL_connect:SSLv2/v3 write client hello A > SSL_connect:SSLv3 read server hello A > depth=1 > /C=US/ST=California/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo. >com verify return:1 > depth=0 /C=US/ST=California/L=Mountain > View/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo.com verify > return:1 > SSL_connect:SSLv3 read server certificate A > SSL_connect:SSLv3 read server done A > SSL_connect:SSLv3 write client key exchange A > SSL_connect:SSLv3 write change cipher spec A > SSL_connect:SSLv3 write finished A > SSL_connect:SSLv3 flush data At this point, I get: SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=ZA .... > SSL3 alert read:fatal:bad record mac > SSL_connect:failed in SSLv3 read finished A > 29751:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record > mac:s3_pkt.c:1057:SSL alert number 20 29751:error:140790E5:SSL > routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: > So it looks like a problem with the certificate. > > > ----- Original Message ---- > From: Dat Duong <datduong2000(a)yahoo.com> > To: Buchan Milne <bgmilne(a)staff.telkomsa.net>; > openldap-technical(a)openldap.org Sent: Tuesday, September 2, 2008 12:14:12 > PM > Subject: Re: RHEL 5 will not do TLS/SSL authentication > > > I'm using ldapsearch from openldap-2.4.xx on Solaris 10. I can do the > ldapsearch with -ZZ option and I can get the result back just fine. > However, on my RHEL 5 using the native ldapsearch with -ZZ and a -d1 > options for debug, will give some errors below. I can do a ldapsearch > without the -ZZ and it just run fine. > > ERROR: > > TLS trace: SSL_connect:before/connect initialization > TLS trace: SSL_connect:SSLv2/v3 write client hello A > TLS trace: SSL_connect:SSLv3 read server hello A > TLS certificate verification: depth: 1, err: 19, subject: > /C=US/ST=California/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo. >com, issuer: > /C=US/ST=California/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo. >com TLS certificate verification: Error, self signed certificate in > certificate chain TLS trace: SSL3 alert write:fatal:unknown CA > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect. > ldap_perror > ldap_start_tls: Connect error (-11) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > **** Here is how I setup the TLS: > > On the Client side, I copied over the cacert.pem from the server to > /etc/openldap/cacerts/cacert.pem. A look at the cacert.pem show: > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: > b1:fe:10:70:c6:7e:fe:24 > Signature Algorithm: sha1WithRSAEncryption > Issuer: C=US, ST=California, O=, OU=ODIN, > CN=ldap01.example.com/emailAddress=dduong@yahoo.com Validity > Not Before: Sep 2 17:31:55 2008 GMT > Not After : Sep 2 17:31:55 2011 GMT > Subject: C=US, ST=California, O=, OU=, > CN=ldap01.example.com/emailAddress=dduong@yahoo.com Subject Public Key > Info: > Public Key Algorithm: rsaEncryption > RSA Public Key: (1024 bit) > Modulus (1024 bit): > 00:bf:eb:3e:89:2b:aa:4f:2f:31:0e:45:8f:7e:1b: > c6:3f:49:ae:62:ea:1b:fe:4a:71:60:38:b9:a8:02: > eb:7e:e4:3b:a6:cb:bb:9c:bb:23:b7:86:11:87:b4: > 2d:59:99:33:20:f4:90:dd:90:52:b0:59:1d:e4:e4: > 68:03:7f:d2:7f:0b:9d:e7:10:81:9d:d0:ef:d8:98: > dc:49:a0:2b:c1:71:5d:2c:63:34:e5:38:7c:13:11: > f4:cf:bd:0b:4a:2b:2c:03:23:9a:e1:67:6d:d9:ae: > c6:60:ac:85:41:98:43:03:28:fa:e1:e6:76:3e:69: > 8f:66:de:ca:56:ff:de:33:4d > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Subject Key Identifier: > 7C:49:79:29:08:EE:77:8D:C0:93:9B:44:62:63:F6:3F:FD:26:1E:E9 > X509v3 Authority Key Identifier: > > keyid:7C:49:79:29:08:EE:77:8D:C0:93:9B:44:62:63:F6:3F:FD:26:1E:E9 > DirName:/C=US/ST=California/O=/OU=ODIN/CN=ldap01.example.com/emailAddress=d >duong(a)yahoo.com serial:B1:FE:10:70:C6:7E:FE:24 > > X509v3 Basic Constraints: > CA:TRUE > Signature Algorithm: sha1WithRSAEncryption > 4f:c5:42:62:d2:75:38:0f:cd:8c:18:a3:6f:d5:9b:92:23:4b: > a6:74:f9:e1:fd:9a:2f:43:ee:25:d6:f4:33:cb:2c:e1:f9:f2: > 1c:13:87:f4:cf:1c:68:ef:99:a3:5e:8c:4c:73:bd:e1:43:80: > 14:bb:dc:96:12:bf:93:4c:03:f3:f5:0d:bb:2f:92:26:fb:ae: > 54:62:de:cc:0a:d5:f1:cf:9a:b0:61:53:eb:6c:76:a4:f5:f2: > 9a:90:a6:a8:cc:db:f6:ba:aa:8c:ad:f5:4d:63:d2:3a:4b:e9: > 45:41:73:ac:5b:a8:ab:7f:8f:41:07:5d:02:73:a2:b9:9d:27: > 87:67 > -----BEGIN CERTIFICATE----- > . > . > . > . > . > -----END CERTIFICATE----- > > > *****On the client RHEL5, /etc/openldap/ldap.conf look like this: > > # > # LDAP Defaults > # > > # See ldap.conf(5) for details > # This file should be world readable but not world writable. > > #BASE dc=example, dc=com > #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 > > #SIZELIMIT 12 > #TIMELIMIT 15 > #DEREF never > URI ldap://xxx.xxx.xxx.xxx/ > BASE dc=foobar,dc=example,dc=com > TLS_CACERTDIR /etc/openldap/cacerts If you use this directive (and not TLS_CACERT), then you must have created the hashes in /etc/openldap/cacerts, using c_rehash (on RHEL, you must install openssl-perl to get this), e.g. c_rehash /etc/openldap/cacerts > > > ***** On Client RHEL5, the ldap.conf located at /etc/ldap.conf look like > this: I've removed the useless lines of commented defaults .... > base dc=example,dc=com > > timelimit 120 > > bind_timelimit 120 > > idle_timelimit 3600 > > nss_base_passwd ou=People,dc=foobar,dc=example,dc=com?one > nss_base_shadow ou=People,dc=foobar,dc=example,dc=com?one > nss_base_group ou=Group,dc=foobar,dc=example,dc=com?one > nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon > ssl start_tls > tls_checkpeer yes > tls_cacertfile /etc/openldap/cacerts/cacert.pem > > uri ldap://ldap01.example.com/ > #ssl no > tls_cacertdir /etc/openldap/cacerts > pam_password crypt This should work, if your certificate wasn't broken. > On the LDAP server, This is how I create CA and certificates: > > #openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout > server.pem -days 365 I'm wondering if some files left over by the order in which you did things caused a problem. > ## create self signed certs > > ## generate root signing cert: > /usr/share/ssl/misc/CA.pl -newca Did you really give your CA the subject: C=US, ST=California, O=, OU=,CN=ldap01.example.com/emailAddress=dduong@yahoo.com ? Why did you make it so close to that of the LDAP server's certificate ? > > ## create a signing req for the server > openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem > > ## sign it with root CA > # /usr/local/ssl/misc/CA.sh -sign > > ## call the cert/key something useful > mv newcert.pem ldap01-cert.pem > mv newreq.pem ldap01-key.pem > > Copy ldap01-cert.pem and ldap01-key.pem and the root CA (in > demoCA/cacert.pem) to server:/opt/openldap/keys > > chmod 400 * > > Add these config params: > > TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv3 > TLSCACertificateFile /usr/local/etc/openldap/keys/cacert.pem > TLSCertificateFile /opt/openldap/keys/ldap01-cert.pem > TLSCertificateKeyFile /opt/openldap/keys/ldap01-key.pem > TLSVerifyClient never Can you verify the certificate on the server? E.g.: # openssl verify -CAfile /usr/local/etc/openldap/keys/cacert.pem /opt/openldap/keys/ldap01-cert.pem Regards, Buchan

1 0

Re: objectclass sambaSamAccount
by Michael Ströder 02 Sep '08

02 Sep '08

Laurence, please stay on the mailing list. Laurence Mayer wrote: > > I got this working and now I can add sambaSamAccounts. > > When I add passdb backend = ldapsam:ldap://ldap.example.com to my > smb.conf with all the other needed options the smb does not come up. You should provide more information. At first I'd recommend to have a closer look at the logs of OpenLDAP and Samba. Ciao, Michael.

1 0

RHEL 5 will not do TLS/SSL authentication
by Dat Duong 02 Sep '08

02 Sep '08

Hi, I can't find anywhere on how to fix my RHEL 5 to use TLS/SSL authentication. I will work when I comment out the ssl startTLS and SSL. On my Solaris 10, I can do ldapsearch with the -ZZ option Here is what I did with the debug on for ldapsearch. Please help me solve this problem...THANKS!! TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

2 1

Fw: RHEL 5 will not do TLS/SSL authentication
by Dat Duong 01 Sep '08

01 Sep '08

Hi, I can't find anywhere on how to fix my RHEL 5 to use TLS/SSL authentication. I will work when I comment out the ssl startTLS and SSL. On my Solaris 10, I can do ldapsearch with the -ZZ option Here is what I did with the debug on for ldapsearch. Please help me solve this problem...THANKS!! TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

1 0

ldapsearch - Active Directory proxyaddresses:smtp
by Chris Henderson 31 Aug '08

31 Aug '08

I am trying to filter proxyaddress:smtp email addresses querying Active Directory. I need to use this for sendmail address lookup. I tried the following queries but they give a lot of extraneous information I don't need. Any help would be much appreciated. Thanks. - ldapsearch -x -h 192.168.25.16 -p 3268 -b "DC=company,DC=com" "(&(proxyAddresses=SMTP:*))" - ldapsearch -x -h 192.168.25.16 -p 3268 -b "DC=company,DC=com" -P2 -s sub "objectclass=*" SMTP - ldapsearch -x -h 192.168.25.16 -p 3268 -b "DC=company,DC=com" -P2 -s sub "proxyAddresses=*" Normally the address comes in this exact format while querying Active Directory: "proxyAddresses: SMTP:firstname.lastname@company.com" Thanks.

4 3

Mistake in the doc ?
by Vincent Panel 30 Aug '08

30 Aug '08

Hi, Maybe I don't understand but, I'm looking at § 8.2.4.1 in this document : http://www.openldap.org/doc/admin22/schema.html The goal is to create an attributetype called "myUniqueName" which is unique. With the last definition of this attributetype : attributetype ( 1.1.2.1.1 NAME 'myUniqueName' DESC 'unique name with my organization' SUP name ) How can openldap guess that we cant a unique attributetype ? Isn't there a SINGLE-VALUE missing at the end of the description ? Thanks for your answers, Vincent

3 3

More info: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 30 Aug '08

30 Aug '08

Hi again, when I make sudo /etc/init.d/ssh restart after reboot, the network users can login, even when the tls_cert and tls_key options in /etc/ldap.conf have been disabled. After rebooting the machine, the login fails and I have to login as local user to restart the sshd. <some user>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Permission denied, please try again. <network_user>@<client>'s password: <some user>@<some host>:~> ssh <local_user>@<client> <local_user>@<client>'s password: Last login: Sat Aug 30 10:25:56 2008 from <some host> <local_user>@<client>:~$ sudo /etc/init.d/ssh restart [sudo] password for <local user>: * Restarting OpenBSD Secure Shell server sshd [ OK ] <local_user>@<client>:~$ logout <some user>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Sat Aug 30 10:23:40 2008 from <some host> <network_user>@<client>:~$ I'm very confused now! Best regards, Hauke ----- Ursprüngliche Mail ----- Von: "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> An: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> CC: openldap-technical(a)openldap.org Gesendet: Freitag, 29. August 2008 21:33:08 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: AW: Re: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server) Hi Buchan, summary first: the su - <network_user> problem is solved thanks to your question. ssh <network_user>@<client> works only under certain circumstances (see below). > > I want to use TLS-communication between my ldap server and > > the clients. > > [...] > > > Next, I activated TLSVerifyClient on the server side > > Why ? You don't need this to address your single remaining problem, > unless you haven't stated it in full. Sorry, I did not point out that I want only valid users/services to be able to get information from the ldap server at all. A valid service or user shall be identified by a certificate that is signed by a valid CA of mine. All other connection attempts shall be rejected. That is how I understood the combination of TLS_REQCRT (to verify the server) and TLSVerifyClient (to verify the client). Am I wrong here? > Since I use the ldap server for network user authentication, I can (as > local user) make a su - <network_user>, enter the password and get > authenticated, but have a look at the shell: > > <local user>@<client>:~$ su - <network_user> > Password: <network user password here> > id: cannot find name for group ID <network_user group> > I have no name!@<client>:~$ > > Does 'strace -e open id' tell you anything interesting (specifically about > the key/cert)? Wow, one single question of yours gave me several hours of work and the solution for my first problem. Thanks ;-) I ensured that the requested files are readable by the user (they already were, but I checked it again, even made a chmod -R 777 on the directory). This was not the problem. But after creating a new certificate for that network user with the CN set to the users username (instead of the surname/name before), the problem with su - <network_user> disappeared. Now I can su from a certified local user to my network user. <local user>@<client>:~$ su - <network user> Password: <network user>@<client>:~$ That's cool! > > In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for > > lib(pam|nss)_ldap.conf), > > Actually, Ubuntu reverts back to the upstream location, lib(pam|nss)_ldap.conf > is a Debian-ism. Thanks for the info, did not know that. > > I set the values for > > > > tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem > > tls_key /usr/lib/ssl/private/<client>.ldap.key.pem > > You didn't indicate any of the other /etc/ldap.conf settings, such as > tls_cacertfile, tls_check_peer. Additionally, you don't specify if you are > using nscd, or whether the logged in user (below) can read the tls_cert and > tls_key files. Since the verification of the server certificate works out fine, I only provided the client-verification specific values. Here are the missing values: base dc=... uri ldaps://<fqdn of my server>/ ldap_version 3 bind_policy soft pam_password md5 tls_check_peer yes tls_cacertfile /usr/lib/ssl/cacerts/<serverca>.chain.pem tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem nss_initgroups_ignoreusers backup,bin,daemon,dhcp,fetchmail,games,gnats,irc,klog,libuuid,list,lp,mail,man, \ messagebus,news,postfix,proxy,root,sshd,statd,sync,sys,syslog,uucp,www-data,zimbra The nss_initgroups_ignoreusers entry is automatically created when executing /etc/init.d/libnss-ldap restart or when booting the system. I disabled the nscd caches for passwd and group before starting to deal with TLS just to make sure that the ldap server is always contacted. ==== /etc/nscd.conf ==== ... enable-cache passwd no ... enable-cache group no ... == END /etc/nscd.conf == After tideous testing I found out something new: I wanted to strace the sshd, too and therefore stopped the running instance with /etc/init.d/ssh stop and started a new instance manually <local user>@<client> sudo -s root@<client># /usr/sbin/sshd -D Doing so, the login via SSH works sout perfectly. I assumed that this is because sshd would read the .ldaprc of <local user>, which has a valid cert/key entry (see above), so I straced the above command. But: root@<client>:/etc/init.d# strace -e open /usr/sbin/sshd -D 2>&1 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libwrap.so.0", O_RDONLY) = 3 open("/lib/libpam.so.0", O_RDONLY) = 3 open("/lib/libdl.so.2", O_RDONLY) = 3 open("/lib/libselinux.so.1", O_RDONLY) = 3 open("/usr/lib/libck-connector.so.0", O_RDONLY) = 3 open("/usr/lib/libdbus-1.so.3", O_RDONLY) = 3 open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 3 open("/lib/libutil.so.1", O_RDONLY) = 3 open("/usr/lib/libz.so.1", O_RDONLY) = 3 open("/lib/libnsl.so.1", O_RDONLY) = 3 open("/lib/libcrypt.so.1", O_RDONLY) = 3 open("/lib/libresolv.so.2", O_RDONLY) = 3 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 open("/lib/libcom_err.so.2", O_RDONLY) = 3 open("/lib/libc.so.6", O_RDONLY) = 3 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 open("/lib/libkeyutils.so.1", O_RDONLY) = 3 open("/etc/selinux/config", O_RDONLY) = -1 ENOENT (No such file or directory) open("/proc/mounts", O_RDONLY) = 3 open("/dev/null", O_RDWR) = 3 open("/proc/14556/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|0x80000) = 3 open("/etc/ssh/sshd_config", O_RDONLY) = 3 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3 open("/etc/gai.conf", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY) = 3 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY|0x80000 /* O_??? */) = 3 open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.RSA-2048", O_RDONLY) = 3 open("/etc/ssh/ssh_host_dsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.DSA-1024", O_RDONLY) = 3 open("/etc/localtime", O_RDONLY) = 4 open("/var/run/sshd.pid", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4 Now if I do ssh <network_user>@<client> from any machine in the net, everything works out perfectly: <some id>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Fri Aug 29 21:23:06 2008 from <fqdn of some host> <network user>@<client>:~$ But not a single ldap or libnss/libpam config file is stat'ed or read by the above sshd at all. The only thing that can be seen is that after logging out, the above sshd command echos --- SIGCHLD (Child exited) @ 0 (0) --- and that's it. When I kill the above sshd and do /etc/init.d/ssh start again, the login still works out. But after restarting the sytem, the login fails as always. As far as I can see, /etc/init.d/ssh starts sshd as root, obviously not chrooted or something similar. Do you have any idea, what this is all about? Kind regards, Hauke --

1 0

Re: SSHD doesn't start
by Jordi Espasa Clofent 29 Aug '08

29 Aug '08

> This is more of a sys-admin question, but change when sshd starts up so > ldap comes up first. Ok Gavin, I'd thought that the present 'openldap-technical' mail-list was the correct place to ask this kind of questions. ¿Can you point to me what is the correct list? -- Thanks, Jordi Espasa Clofent

1 0

AW: Re: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 29 Aug '08

29 Aug '08

Hi Buchan, summary first: the su - <network_user> problem is solved thanks to your question. ssh <network_user>@<client> works only under certain circumstances (see below). > > I want to use TLS-communication between my ldap server and > > the clients. > > [...] > > > Next, I activated TLSVerifyClient on the server side > > Why ? You don't need this to address your single remaining problem, > unless you haven't stated it in full. Sorry, I did not point out that I want only valid users/services to be able to get information from the ldap server at all. A valid service or user shall be identified by a certificate that is signed by a valid CA of mine. All other connection attempts shall be rejected. That is how I understood the combination of TLS_REQCRT (to verify the server) and TLSVerifyClient (to verify the client). Am I wrong here? > Since I use the ldap server for network user authentication, I can (as > local user) make a su - <network_user>, enter the password and get > authenticated, but have a look at the shell: > > <local user>@<client>:~$ su - <network_user> > Password: <network user password here> > id: cannot find name for group ID <network_user group> > I have no name!@<client>:~$ > > Does 'strace -e open id' tell you anything interesting (specifically about > the key/cert)? Wow, one single question of yours gave me several hours of work and the solution for my first problem. Thanks ;-) I ensured that the requested files are readable by the user (they already were, but I checked it again, even made a chmod -R 777 on the directory). This was not the problem. But after creating a new certificate for that network user with the CN set to the users username (instead of the surname/name before), the problem with su - <network_user> disappeared. Now I can su from a certified local user to my network user. <local user>@<client>:~$ su - <network user> Password: <network user>@<client>:~$ That's cool! > > In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for > > lib(pam|nss)_ldap.conf), > > Actually, Ubuntu reverts back to the upstream location, lib(pam|nss)_ldap.conf > is a Debian-ism. Thanks for the info, did not know that. > > I set the values for > > > > tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem > > tls_key /usr/lib/ssl/private/<client>.ldap.key.pem > > You didn't indicate any of the other /etc/ldap.conf settings, such as > tls_cacertfile, tls_check_peer. Additionally, you don't specify if you are > using nscd, or whether the logged in user (below) can read the tls_cert and > tls_key files. Since the verification of the server certificate works out fine, I only provided the client-verification specific values. Here are the missing values: base dc=... uri ldaps://<fqdn of my server>/ ldap_version 3 bind_policy soft pam_password md5 tls_check_peer yes tls_cacertfile /usr/lib/ssl/cacerts/<serverca>.chain.pem tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem nss_initgroups_ignoreusers backup,bin,daemon,dhcp,fetchmail,games,gnats,irc,klog,libuuid,list,lp,mail,man, \ messagebus,news,postfix,proxy,root,sshd,statd,sync,sys,syslog,uucp,www-data,zimbra The nss_initgroups_ignoreusers entry is automatically created when executing /etc/init.d/libnss-ldap restart or when booting the system. I disabled the nscd caches for passwd and group before starting to deal with TLS just to make sure that the ldap server is always contacted. ==== /etc/nscd.conf ==== ... enable-cache passwd no ... enable-cache group no ... == END /etc/nscd.conf == After tideous testing I found out something new: I wanted to strace the sshd, too and therefore stopped the running instance with /etc/init.d/ssh stop and started a new instance manually <local user>@<client> sudo -s root@<client># /usr/sbin/sshd -D Doing so, the login via SSH works sout perfectly. I assumed that this is because sshd would read the .ldaprc of <local user>, which has a valid cert/key entry (see above), so I straced the above command. But: root@<client>:/etc/init.d# strace -e open /usr/sbin/sshd -D 2>&1 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libwrap.so.0", O_RDONLY) = 3 open("/lib/libpam.so.0", O_RDONLY) = 3 open("/lib/libdl.so.2", O_RDONLY) = 3 open("/lib/libselinux.so.1", O_RDONLY) = 3 open("/usr/lib/libck-connector.so.0", O_RDONLY) = 3 open("/usr/lib/libdbus-1.so.3", O_RDONLY) = 3 open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 3 open("/lib/libutil.so.1", O_RDONLY) = 3 open("/usr/lib/libz.so.1", O_RDONLY) = 3 open("/lib/libnsl.so.1", O_RDONLY) = 3 open("/lib/libcrypt.so.1", O_RDONLY) = 3 open("/lib/libresolv.so.2", O_RDONLY) = 3 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 open("/lib/libcom_err.so.2", O_RDONLY) = 3 open("/lib/libc.so.6", O_RDONLY) = 3 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 open("/lib/libkeyutils.so.1", O_RDONLY) = 3 open("/etc/selinux/config", O_RDONLY) = -1 ENOENT (No such file or directory) open("/proc/mounts", O_RDONLY) = 3 open("/dev/null", O_RDWR) = 3 open("/proc/14556/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|0x80000) = 3 open("/etc/ssh/sshd_config", O_RDONLY) = 3 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3 open("/etc/gai.conf", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY) = 3 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY|0x80000 /* O_??? */) = 3 open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.RSA-2048", O_RDONLY) = 3 open("/etc/ssh/ssh_host_dsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.DSA-1024", O_RDONLY) = 3 open("/etc/localtime", O_RDONLY) = 4 open("/var/run/sshd.pid", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4 Now if I do ssh <network_user>@<client> from any machine in the net, everything works out perfectly: <some id>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Fri Aug 29 21:23:06 2008 from <fqdn of some host> <network user>@<client>:~$ But not a single ldap or libnss/libpam config file is stat'ed or read by the above sshd at all. The only thing that can be seen is that after logging out, the above sshd command echos --- SIGCHLD (Child exited) @ 0 (0) --- and that's it. When I kill the above sshd and do /etc/init.d/ssh start again, the login still works out. But after restarting the sytem, the login fails as always. As far as I can see, /etc/init.d/ssh starts sshd as root, obviously not chrooted or something similar. Do you have any idea, what this is all about? Kind regards, Hauke --

1 0

Re: Mistake in the doc ?
by Gavin Henry 29 Aug '08

29 Aug '08

----- "Vincent Panel" <yohonet(a)gmail.com> wrote: > Hi, > > Maybe I don't understand but, I'm looking at § 8.2.4.1 in this > document : http://www.openldap.org/doc/admin22/schema.html > > The goal is to create an attributetype called "myUniqueName" which is > unique. With the last definition of this attributetype : > > attributetype ( 1.1.2.1.1 NAME 'myUniqueName' > DESC 'unique name with my organization' > SUP name ) > > How can openldap guess that we cant a unique attributetype ? > > Isn't there a SINGLE-VALUE missing at the end of the description ? It's just talking about the name of the attribute, not the attribute value. SINGLE-VALUE means attributes of this type are restricted to a single value, nothing about uniqueness. Please have a read of doc/rfc/rfc4512.txt at your leisure. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 29 Aug '08

29 Aug '08

Hi everybody, hope, this is still the right group for my question, might also be a lib{pam|nss}_ldap problem. I am very happy to say that I have an almost completely running installation now. But one single problem still remains: I want to use TLS-communication between my ldap server and the clients. I started up with an own RootCA, created 2 SubCAs (one for server certs, one for user certs) and generated a certificate for my server, signed by the ServerCA. On client side, I have set ==== /etc/ldap/ldap.conf ==== BASE dc=... URI ldaps://<fqdn>/ # Require valid cert from server TLS_REQCERT yes # CA for trusted server certs TLS_CACERT /usr/lib/ssl/cacerts/<serverca>.chain.pem == END /etc/ldap/ldap.conf == This works out perfectly, as I can see using a paket sniffer. The client only communicates with the server using TLSv1 and only if the server's certificate is valid. Next, I activated TLSVerifyClient on the server side ==== /etc/ldap/slapd.conf ==== ... # The CA chain for valid client certs TLSCACertificateFile /usr/lib/ssl/cacerts/<userca>.chain.pem # The server's cert TLSCertificateFile /usr/lib/ssl/certs/<server>.cert.pem # The server's key TLSCertificateKeyFile /usr/lib/ssl/private/<server>.key.pem # Verify clients always TLSVerifyClient demand == END /etc/ldap/slapd.conf == and created a client cert without password for my local client user, signed by the UserCA. This cert and the according key are referenced in the (local) users .ldaprc on the client machine: ==== /home/<user>/.ldaprc ==== TLS_CERT /home/<user>/openldap/<user>.ldap.cert.pem TLS_KEY /home/<user>/openldap/<user>.ldap.key.pem == END /home/<user>/.ldaprc == So, when I start ldapsearch -x as local user, I get a positive result as long as the above mentioned certificate is valid. If the user's certificate is not valid, ldapsearch fails. Wonderful, that's exactly what I wanted. But now to my problem: Since I use the ldap server for network user authentication, I can (as local user) make a su - <network_user>, enter the password and get authenticated, but have a look at the shell: <local user>@<client>:~$ su - <network_user> Password: <network user password here> id: cannot find name for group ID <network_user group> I have no name!@<client>:~$ Without TLSVerifyClient, this works out fine: <local user>@<client>:~$ su - <network_user> Password: <network user password here> <network_user>@<client>:~$ Secondly: How do I make it possible that when connecting via ssh to the client machine (from any other machine), I can login as <network_user>? Here are the details: In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for lib(pam|nss)_ldap.conf), I set the values for tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem The certificate has been signed by the same CA as the above user certificate. The CN is the name of the host (not fqdn, that is, just the hostname). But when I try to login via ssh, quits the connection saying slapd -d127 -h "ldaps:///" -u openldap -g openldap ... TLS: can't accept: The peer did not send any certificate.. connection_read(12): TLS accept failure error=-1 id=0, closing ... Whithout TLSVerifyClient, I can login. I assume that both problems have the same background, but I just don't get it. Hope, this time I didn't miss reading a manual again ;-) Best regards, Hauke --

2 1

Proxy to Active Directory
by Nazeeruddin Mohammad 29 Aug '08

29 Aug '08

Hi Everyone, Like many organizations, we have two authentication systems here. I am trying to figure out a way of synchronizing LDAP passwords with AD passwords; or proxying the requests to AD. Management wants to keep LDAP intact, while enjoying the flexibility of single password. I have unsuccessfully tried to use proxy functionally of LDAP to get user information from AD. First of all, AD needs a user name and password to retrieve information. Is there a way of specifying username/password? Even the following ldapsearch FAILS on openldap server, but the same query works fine for AD server. ldapsearch -LLL -x -h localhost -b 'cn=users,dc=internal,dc=phg,dc=com,dc=au' -D "ldapauth(a)internal.phg.com.au" -W -x ldapsearch -LLL -x -h localhost -b 'dc=internal,dc=phg,dc=com,dc=au' -D "CN=Ldap Authentication,OU=Linux,OU=InformationTechnology,OU=Portland House,OU=Sites,DC=internal,DC=phg,DC=com,DC=au" -W -x Here is the relevant sladp.conf snippet. database ldap suffix "cn=users,dc=internal,dc=phg,dc=com,dc=au" subordinate rebind-as-user uri "ldap://192.168.100.100/" chase-referrals yes Any help is appreciated. Thank you very much. Cheers Nazeer *************************************************************************** CAUTION: This email message and accompanying data may contain information that is confidential and/or subject to legal privilege. If you are not the intended recipient, you are notified that any use, dissemination, distribution or copying of this message or data is prohibited. If you have received this email message in error, please notify us immediately and erase all copies of this message and attachments. Thank you. ***************************************************************************

5 6

Changing the structural objectclass within the same hierarchy
by Vincent Panel 29 Aug '08

29 Aug '08

On Wed, Jul 30, 2008 at 4:55 PM, Vincent Panel <yohonet(a)gmail.com> wrote: > Hi, > > It seems that openldap didn't allow changing the structural > objectclass of an object, even if both classes are in the same > "branch", back in 2006 : > http://www.openldap.org/lists/openldap-software/200602/msg00459.html > > I now have a similar problem : is it still planned to be solved ? > > Specififaclly, my object is from class "inetOrgPerson" and I want to > change it to "myClass" which SUP is inetOrgPerson. > > Thanks, > > Vincent > About this problem, I've seen this FAQ entry : http://www.openldap.org/faq/data/cache/1341.html Quote : "In 2.4, support for a new control will (hopefully) be introduced to allow the (authorized) user to request this (and various other model restrictions) be temporarily relaxed." Has this really been introduced ? Actually, I'm using openldap 2.3, but it's definitely an argument for me to upgrade to 2.4... In particular, am I allowed to change the object class from "fruit" to "pear" (I refer the FAQ) ?

1 0

LDAP + PAM, authentication of users in certain group
by Peter V 29 Aug '08

29 Aug '08

Hi, I have got users and groups in LDAP and I use it for authentication from several servers. I need users to be able to log into the servers only if they are in "admin" group. I use pam_ldap.so module for the authentication. I added these lines into /etc/pam_ldap.conf pam_groupdn cn=admins,ou=Groups,dc=domain,dc=com pam_member_attribute memberUid And the following line into /etc/pam.d/ssh: account required pam_ldap.so Basically, this works alright, BUT I have got root account in local databse /etc/passwd and I need root to be able to log in even if he is not in the "admin" group and also if the LDAP server is off. This does not work, because with this setting, the PAM module requires also root to be in the "admin" group and when the LDAP server is off, there is no admin group. Does anyone know how to set this up? Thanks, Peter

2 1

Create EntryDN
by LITLE TUX 29 Aug '08

29 Aug '08

Hi all ..... Would Like know as create entry DN in my ldap server???? Thanks

1 0

Problem allow bind_v3
by LITLE TUX 29 Aug '08

29 Aug '08

Hi list.... would like know to lieve version OpenLdap in can use option "allow bind_v3" ? Thanks!

1 0

OpenLDAP Client + IBM Directory Server + TLS
by Klaus Heinrich Kiwi 29 Aug '08

29 Aug '08

Hi, has anyone ever managed to set-up an TLS connection between an OpenLDAP client and an IBM LDAP Server (more specifically, ITDS 6.1, linux platform)? I can submit queries in the standard way, but using TLS seems to be a bit of a problem. I have the server certificate specified as TLS_CACERT in my client config since it's self-signed. The query result goes like this: ------ klausk@klausk:~/sandbox/Kerberos_work$ ldapsearch -D cn=root -W -H ldap://fqdn -s sub -x -ZZ -d 9 objectclass=* ldap_url_parse_ext(ldap://fqdn) ldap_create ldap_url_parse_ext(ldap://fqdn:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP fqdn:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 2.2.2.222:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x8059240 msgid 1 wait4msg ld 0x8059240 msgid 1 (infinite timeout) wait4msg continue ld 0x8059240 msgid 1 all 1 ** ld 0x8059240 Connections: * host: fqdn port: 389 (default) refcnt: 2 status: Connected last used: Thu Aug 28 13:43:57 2008 ** ld 0x8059240 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x8059240 request count 1 (abandoned 0) ** ld 0x8059240 Response Queue: Empty ld 0x8059240 response count 0 ldap_chkResponseList ld 0x8059240 msgid 1 all 1 ldap_chkResponseList returns ld 0x8059240 NULL ldap_int_select read1msg: ld 0x8059240 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 38 contents: read1msg: ld 0x8059240 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x8059240 0 new referrals read1msg: mark request completed, ld 0x8059240 msgid 1 request done: ld 0x8059240 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ber_scanf fmt (O) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: can't connect: Decryption has failed.. ldap_err2string ldap_start_tls: Connect error (-11) klausk@klausk:~/sandbox/Kerberos_work$ ------ Note: the server is configured to accept TLS in the standard port (389), after a START_TLS extended LDAP operation. It works fine using the IBM Client. After sniffing the packets I could see that the OpenLDAP Client sends a "Client Hello" message advertising TLS 1.1 support (0x0302), whereas the IBM Client asks for TLS 1.0 (0x0301). In both cases the server replies with a TLS 1.0 "Server Hello" message, with the certificate and TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite. The following client messages are TLS 1.0, indicating that the OpenLDAP correctly fell back the version. But with the OpenLDAP Client, after Change Cipher Spec and Encrypted Handshake, the server sends an "Encrypted Alert" message and the connection is dropped, with the output above. I'm using a certificate generated using GSKIT in the server box, and exported the .PEM key, which OpenSSL appears to recognize fine. Is there anything more I can do to debug this error? I'm particularly interested in further debugging the TLS connection. Maybe there is an environment variable that will enable debugging output from OpenSSL? Any pointers are helpful. Thanks, -Klaus K. -- Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com> Linux Security Development, IBM Linux Technology Center

1 0

OpenLdap + Postfix
by LITLE TUX 29 Aug '08

29 Aug '08

Hello list.... look to me another .... after resolve problem witch ldap and squid ... i have a new problem.... now with POSTFIX Scenaries: server 01: openLdap + SambaPDC server 02: postfix + squi I trying make integration between systems OPEN LDAP and POSTFIX but all time that configure the server 02 to authentication in server 01 receving bellow error: Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_search Aug 29 08:30:19 gheorghe slapd[7485]: bdb_dn2entry("ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: => send_search_entry: conn 31 dn="ou=DNS,dc=meudominio,dc=com,dc=br" Aug 29 08:30:19 gheorghe slapd[7485]: <= send_search_entry: conn 31 exit. Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=7 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=8 tag=101 err=0 Aug 29 08:30:19 gheorghe slapd[7485]: connection_get(31): got connid=31 Aug 29 08:30:19 gheorghe slapd[7485]: connection_read(31): checking for input on id=31 Aug 29 08:30:19 gheorghe slapd[7485]: do_search Aug 29 08:30:19 gheorghe slapd[7485]: >>> dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: <<< dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br>, <zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_search Aug 29 08:30:19 gheorghe slapd[7485]: bdb_dn2entry("zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_dn2id("zoneName= meudominio.com.br.br,ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=8 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=9 tag=101 err=32 Aug 29 08:30:19 gheorghe slapd[7485]: connection_get(31): got connid=31 Aug 29 08:30:19 gheorghe slapd[7485]: connection_read(31): checking for input on id=31 Aug 29 08:30:19 gheorghe slapd[7485]: do_add Aug 29 08:30:19 gheorghe slapd[7485]: >>> dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: <<< dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br>, <zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=9 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=10 tag=105 err=21 I tray all... our almost all ... rs ...but i don't resolver error..... Thanks for any help to me resolve this problem.

1 0

SSHD doesn't start
by Jordi Espasa Clofent 29 Aug '08

29 Aug '08

Hi all, I'm just learning about wonderful OpenLDAP. I want to build a AAAA server (with OpenLDAP, of course) that allows SSH. At present I've the next testing scenario: * OpenLDAP server (FreeBSD 7.0) * OpenLDAP client (FreeBSD 7.0 also) When server it's running, I can always perform ssh logins on client. Perfect. The problem is when I shutdown the server and after I reboot the client, the client systems completely hangs up when it tries to run up the sshd service. ?¿?¿?¿? If I restart the server, the client runs fine again. I'm not understand the real reason of that behavior, but one thing is clear: SSH deamon requires OpenLDAP server runs. So I thing the problem is focused probably in pam.d module conf. Useful info: ldapclient# more /etc/pam.d/sshd # # $FreeBSD: src/etc/pam.d/sshd,v 1.16 2007/06/10 18:57:20 yar Exp $ # # PAM configuration for the "sshd" service # # auth auth sufficient pam_opie.so no_warn no_fake_prompts #auth requisite pam_opieaccess.so no_warn allow_local #auth sufficient pam_krb5.so no_warn try_first_pass auth sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass auth sufficient pam_ssh.so no_warn try_first_pass auth required pam_unix.so no_warn try_first_pass # account account required pam_nologin.so #account required pam_krb5.so account required pam_login_access.so account sufficient /usr/local/lib/pam_ldap.so account required pam_unix.so # session #session optional pam_ssh.so session required /usr/local/lib/pam_mkhomedir.so debug #session required pam_permit.so # password #password sufficient pam_krb5.so no_warn try_first_pass password sufficient /usr/local/lib/pam_ldap.so use_authok password required pam_unix.so no_warn try_first_pass ldapclient# more /etc/nsswitch.conf # # nsswitch.conf(5) - name service switch configuration file # $FreeBSD: src/etc/nsswitch.conf,v 1.1 2006/05/03 15:14:47 ume Exp $ # group: ldap files passwd: ldap files #group: compat #group_compat: nis hosts: files dns #networks: files #passwd: compat #passwd_compat: nis shells: files #services: compat #services_compat: nis protocols: files rpc: files -- Thanks, Jordi Espasa Clofent

1 0

ldap query on imail
by Li Wen Bin 29 Aug '08

29 Aug '08

Hi all, We have a mail server known as imail which is a product of Ipswitch. It is using openldap database. We are now in the process of creating a web application for our office users which will authenticate using the openldap database in imail server. Below is the code that my programmer is trying to query to imail. However we got the error "The specified domain either does not exist or could not be contacted". Is the code below "LDAP://o=smtp2.mentormedia.com.sg" correct? Pls advise. Thks in advance. //****Connecting to LDAP active directory domainAndUsername = "LDAP://o=smtp2.mentormedia.com.sg"; userName = "USER1"; passWord = "testpass"; at= AuthenticationTypes.ReadonlyServer; //Create the object necessary to read the info from the LDAP directory DirectoryEntry entry = new DirectoryEntry(domainAndUsername,userName,passWord,at);

1 0

AW: Re: [SOLVED] Re: SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read
by Hauke Coltzau 28 Aug '08

28 Aug '08

Hi again, man, I mixed up a lot of things ... Hope, I finally understand what I did wrong: Ubuntu 8.04 creates a huge /etc/ldap.conf as a substitute for libnss_ldap.conf and libpam_ldap.conf. I misunderstood this file to be the LDAP client configuration, which it is obviously not. Instead, it's the configuration for libnss-ldap and libpam-ldap. In some wiki article, I read that it would be o.k. to softlink /etc/ldap/ldap.conf to /etc/ldap.conf to have a fewer number of configuration files. I did that and forgot to mention in my first mail. That's why I used keywords like tls_cacertfile and others, because that's just the way those parameters are called in that file. I hope to be smarter next time ;-) So, what I did now: I created a new /etc/ldap/ldap.conf with only a few entries: ===== /etc/ldap/ldap.conf ===== BASE dc=... URI ldaps://<fqdn>/ TLS_REQCERT yes TLS_CACERT /usr/lib/ssl/cacerts/<ca>.chain.crt === END /etc/ldap/ldap.conf === after that, ldapsearch -x was successful. Then I re-installed libnss/libpam-ldap and set the neccessary nss/pam values in the auto-generated /etc/ldap.conf. Finally, I adapted common-* in /etc/pam.d/ and getent passwd, id <user> and su worked the way I wanted them to. I still have a problem with TLSVerifyClient demand, but that's something for another thread and only after some more reading and testing ;-) Thanks again for your help, I learned a lot :-) Best regards, Hauke ----- Ursprüngliche Mail ----- Von: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> An: openldap-technical(a)openldap.org CC: hyc(a)symas.com, "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Donnerstag, 28. August 2008 13:31:58 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: [SOLVED] Re: SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read On Thursday 28 August 2008 12:28:25 Hauke Coltzau wrote: > Hi everybody, > > thank you all for your immediate replies. > > As you correctly pointed out, the options I used were wrong. > With following ldap.conf, everything works out fine. > > base dc=... > URI ldaps://<fqdn of ldap server>/ > ldap_version 3 > rootbinddn cn=... > bind_policy soft > pam_password md5 > > TLS_REQCERT yes > TLS_CACERT /usr/lib/ssl/certs/<ca>.chain.crt > > The ldap.conf I used before has been created by dpkg-reconfigure > and I simply changed the default values there. That was a mistake ;-) > Creating a new ldap.conf from scratch with a man-page at hand > obviously did the trick. You still seem to be confused between different ldap.conf files, bind_policy, pam_password etc. are not valid in the OpenLDAP ldap.conf file, most likely one belongs in /etc/libnss_ldap.conf and the the other in /etc/libpam_ldap.conf (on Debian-based systems, or /etc/ldap.conf on distros that use the default config file location for nss_ldap/pam_ldap as shipped upstream). While you may have a working configuration, it may be more by luck than good judgement. Regards, Buchan -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

Re: ldap_bind: Can't contact LDAP server (-1)
by Michael Ströder 28 Aug '08

28 Aug '08

Kristen, please stay on the mailing list you started the thread. Don't e-mail me solely personally. Kristen Walker wrote: > Thanks for your help. I can't seem to be able to start the server with the > -d flag. Here is what I tried: > > su root -c /usr/local/libexec/slapd -d 65535 > > I also tried: > > su root -d 65535 -c /usr/local/libexec/slapd > > And it complains in both cases that -d is an invalid option. Using -d works for me. Which version of OpenLDAP is this? Can you post any output it produces? Ciao, Michael.

4 6

SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read
by Hauke Coltzau 28 Aug '08

28 Aug '08

Hello everybody, I'm just trying to set up a LDAPS server using my own certification authority, but the ldap server does not accept/understand my client certificate. Instead, the server sais: TLS: can't accept: The peer did not send any certificate.. What I did: 1.) I set up LDAP without SSL/TLS to make sure that it is configured properly. This worked out fine so far, I can use ldapsearch, ldapadd, phpldapadmin ... 2.) I created a self signed certificate for my RootCA, used it to sign my ServerCA and used the ServerCA to sign the certificates for my ldap server and client. The certificates of RootCA and ServerCA have been concatenated into one file <name of ca>.chain.crt 3.) Changed ldap.conf and slapd.conf as described below 4.) Tried to do an ldapsearch on the client -> failed 5.) Tried openssl client -> success Here are the details: Client: ======= # ldapsearch -x -LLL -ZZ -d 1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP <serverip>:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying <serverip>:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string ldap_start_tls: Can't contact LDAP server (-1) Server: ======== # slapd -VV @(#) $OpenLDAP: slapd 2.4.9 (Aug 1 2008 01:09:46) $ buildd@king:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd # slapd -h "ldaps://<ip>/" -u openldap -g openldap -d 127 ... ... connection_get(13): got connid=32 connection_read(13): checking for input on id=32 tls_read: want=5, got=5 0000: 16 03 02 00 07 ..... tls_read: want=7, got=7 0000: 0b 00 00 03 00 00 00 ....... TLS: can't accept: The peer did not send any certificate.. connection_read(13): TLS accept failure error=-1 id=32, closing connection_closing: readying conn=32 sd=13 for close connection_close: conn=32 sd=13 daemon: removing 13 But if I use openssl s_client, I get a differnet result: Client: ======= openssl s_client -showcerts -connect <serverfqdn>:636 \ -CAfile cacerts/<ca>.chain.crt -cert certs/<clientfqdn>.cert.pem \ -key private/<clientfqdn>.key.pem CONNECTED(00000003) depth=2 /C=... verify return:1 depth=1 /C=... verify return:1 depth=0 /C=... verify return:1 --- Certificate chain 0 s:/C=... i:/C=... -----BEGIN CERTIFICATE----- <Certificate data> -----END CERTIFICATE----- --- Server certificate subject=/C=... issuer=/C=... --- Acceptable client certificate CA names /C=... /C=... --- SSL handshake has read 1806 bytes and written 4358 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: F63D4DB4A918CC3BC8F8617AD49F6C6EFCB316203466EC91DBCF0C2E3700DE1E Session-ID-ctx: Master-Key: <master key> Key-Arg : None Start Time: 1219848938 Timeout : 300 (sec) Verify return code: 0 (ok) --- And on server side, everything seems to be o.k. There is no error and the last lines of output are: => ldap_dn2bv(16) <= ldap_dn2bv(cn=<cn of client>,ou=<ou>,o=<o>,st=<st>,c=<c>)=0 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ldap.conf (partially) --------------------- uri ldaps://132.176.4.6/ ssl yes tls_cacertfile /usr/lib/ssl/cacartes/<ca>.chain.crt tls_ciphers TLSv1 tls_cert /usr/lib/ssl/certs/<clientfqdn>.cert.pem tls_key /usr/lib/ssl/private/<clientfqdn>.key.pem ldap.conf (partially) --------------------- TLSCACertificateFile /usr/lib/ssl/certs/<ca>.chain.crt TLSCertificateFile /usr/lib/ssl/openldap/<serverfqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/openldap/private/<serverfqdn>.key.pem TLSVerifyClient demand What did I do wrong? Best regards, Hauke Coltzau --

3 3

How to restrict the simultaneous login
by Praveen Kumar 28 Aug '08

28 Aug '08

Hi, I using the LDAP server for authentication and log into a machine. Now i want the user should not be allowed log into any machine, if it is already logged into one machine using that LDAP server for the login and authentication. Means that there should not be any simultaneous login for the same user. Is this possible using the LDAP or Not. Waiting for the reply. Thanks in advance. Regards.

3 2

Re: How to generate access logs
by Gavin Henry 27 Aug '08

27 Aug '08

----- "Luciano Andre Baramarchi" <luciano_mt(a)terra.com.br> wrote: > Hi, > > I'm using OpenLDAP with HP-UX and LDAP-UX (HP product) to integrate > users and passwords with NSS. The integration works fine but, > sometimes the system lost the username when I run "id" command. In > contact with HP support, they suspect that the problem is in OpenLDAP > > server. I need to generate a log of the all access to LDAP server to > > validate if the problem occurs because the server don't respond or the For search operation logging set your loglevel to 256 or stats. See "man slapd.conf" and: http://www.openldap.org/faq/index.cgi?_highlightWords=syslog&file=358 http://www.openldap.org/faq/index.cgi?_highlightWords=syslog&file=907 http://www.openldap.org/faq/index.cgi?_highlightWords=syslog&file=80 -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

How to generate access logs
by Luciano Andre Baramarchi 27 Aug '08

27 Aug '08

Hi, I'm using OpenLDAP with HP-UX and LDAP-UX (HP product) to integrate users and passwords with NSS. The integration works fine but, sometimes the system lost the username when I run "id" command. In contact with HP support, they suspect that the problem is in OpenLDAP server. I need to generate a log of the all access to LDAP server to validate if the problem occurs because the server don't respond or the client don't query the server Is possible to generate this log? How? Thanks a lot. PS.: Sorry ... I'm brasilian and my english needs to improve ... --------------------------------------------- Luciano A. Baramarchi Multitask Consultoria luciano(a)multitasknet.com.br 47 9911 4484 ---------------------------------------------

1 0

How to import xml file
by İlker Aktuna (Koç.net) 27 Aug '08

27 Aug '08

Hi, I am a new OpenLDAP user. I wonder if there is an easy way of importing an XML file to OpenLDAP server. I've read on some forums that importing LDIF is possible but XML is not. If an XML importer is not available I am also willing to convert my XML file to LDIF but I don't know of a free XML to LDIF converter. Could you please help me ? Thanks, ilker _____________________________________________________________________________________________________________________________________________ Bu e-posta mesaji kisiye ozel olup, gizli bilgiler iceriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, icerigini hic bir sekilde kullanmayiniz ve ekli dosyalari acmayiniz. Bu durumda lutfen e-posta mesajini kullaniciya hemen geri gonderiniz ve tum kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hic bir sekilde, herhangi bir amac icin cogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji viruslere karsi anti-virus sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virus koruma sistemleri ile kontrol ediliyor olsa bile - virus icermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hicbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed , and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence. _____________________________________________________________________________________________________________________________________________

2 1

Help Regarding Multi master replication
by piyush joshi 27 Aug '08

27 Aug '08

Dear All, I am configuring OpenLDAP with multi master replication. I have configured both server's slapd.conf file and as well as loaded syncprov module and following is the syncrepl configuration First LDAP Server IP - 192.168.1.8 Second LDAP Server IP - 192.168.1.12 On first server syncrepl rid=001 provider=ldap://192.168.1.12 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=***,dc=com" attrs=* bindmethod=simple binddn="cn=root,dc=***,dc=com" credentials=*** overlay syncprov syncprov-checkpoint 50 10 and on second server syncrepl rid=001 provider=ldap://192.168.1.8 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=***,dc=com" attrs=* bindmethod=simple binddn="cn=root,dc=***,dc=com" credentials=*** overlay syncprov syncprov-checkpoint 50 10 But Now I am unable to modify, add or delete any record so what is the proper solution to make it work . I need your support to make it work. Thanks Regards Piyush Joshi 9415414376

2 1

Re: RHEL 5 cannot authenticate thru ldap
by Santosh Balan 27 Aug '08

27 Aug '08

Hi, If you are using pam.d for authentication then i beleive that the below site is a very good reference material for installation. http://coewww.rutgers.edu/www1/linuxclass2003/lessons/lecture8.html I have referred to the above site and done for authentication and automounting a partition. Kindly refer and revert if it was of any support to you. Thanks and regards Santosh Balan +91-9819419509 (Open Source is the technology for future) > ----- Original Message ----- > From: "Dat Duong" <datduong2000(a)yahoo.com> > To: "Santosh Balan" <santosh.balan(a)linuxmail.org>, openldap-technical(a)openldap.org > Subject: Re: RHEL 5 cannot authenticate thru ldap > Date: Tue, 26 Aug 2008 07:55:03 -0700 (PDT) > > > Hi, > > Thanks for a quick respond. I did use the GUI within GNOME called > "Athentication". I think I'm using pam.d I haven't try to copy > anything yet. Also, I can't do the ldapsearch using -ZZ for TLS on > RHEL 5. However, I get some errors. I was able to do the ldapsearch > for -ZZ on Solaris. > > > thanks again, > > > > ----- Original Message ---- > From: Santosh Balan <santosh.balan(a)linuxmail.org> > To: Dat Duong <datduong2000(a)yahoo.com>; openldap-technical(a)openldap.org > Sent: Monday, August 25, 2008 10:05:01 PM > Subject: Re: RHEL 5 cannot authenticate thru ldap > > Hi, > > > From where r u taking data for authentication. Is it using pamd > > or creating a new ldap bdb or ldbm. > > Have u configured your client machine to connect to the ldap server > for authentication using system-config-authentication. > > In case you are using the pamd authentication module then you need > to copy the following files from /usr/share/doc/nss_ldap-253/pam.d/ > directory namely login, passwd, su, ssh to /etc/pam.d . > > Then u need to try to authenticate. > > Try googling through for the other method of authentication i.e. > using ldbm or bdb database. As scripts needs to be executed to load > your users data. > > Kindly check and revert. > > Thanks and Regards > Santosh Balan > +91-9819419509. > > > > > ----- Original Message ----- > > From: "Dat Duong" <datduong2000(a)yahoo.com> > > To: openldap-technical(a)openldap.org > > Subject: RHEL 5 cannot authenticate thru ldap > > Date: Mon, 25 Aug 2008 11:01:16 -0700 (PDT) > > > > > > Hi, > > > > I don't know what is the reason why i can't authenticate thru the > > ldap server from RHEL 5. I can do ldapsearch -x -LLL and it > > listed the data. Any help who be appreciated...thanks > > > > > > > > > > > > > > = > > > -- > Powered by Outblaze > > > > > = -- Powered by Outblaze

1 0

Re: RHEL 5 cannot authenticate thru ldap
by Dat Duong 26 Aug '08

26 Aug '08

Hi, Thanks for a quick respond. I did use the GUI within GNOME called "Athentication". I think I'm using pam.d I haven't try to copy anything yet. Also, I can't do the ldapsearch using -ZZ for TLS on RHEL 5. However, I get some errors. I was able to do the ldapsearch for -ZZ on Solaris. thanks again, ----- Original Message ---- From: Santosh Balan <santosh.balan(a)linuxmail.org> To: Dat Duong <datduong2000(a)yahoo.com>; openldap-technical(a)openldap.org Sent: Monday, August 25, 2008 10:05:01 PM Subject: Re: RHEL 5 cannot authenticate thru ldap Hi, >From where r u taking data for authentication. Is it using pamd or creating a new ldap bdb or ldbm. Have u configured your client machine to connect to the ldap server for authentication using system-config-authentication. In case you are using the pamd authentication module then you need to copy the following files from /usr/share/doc/nss_ldap-253/pam.d/ directory namely login, passwd, su, ssh to /etc/pam.d . Then u need to try to authenticate. Try googling through for the other method of authentication i.e. using ldbm or bdb database. As scripts needs to be executed to load your users data. Kindly check and revert. Thanks and Regards Santosh Balan +91-9819419509. > ----- Original Message ----- > From: "Dat Duong" <datduong2000(a)yahoo.com> > To: openldap-technical(a)openldap.org > Subject: RHEL 5 cannot authenticate thru ldap > Date: Mon, 25 Aug 2008 11:01:16 -0700 (PDT) > > > Hi, > > I don't know what is the reason why i can't authenticate thru the > ldap server from RHEL 5. I can do ldapsearch -x -LLL and it listed > the data. Any help who be appreciated...thanks > > > > > = -- Powered by Outblaze

1 0

RHEL 5 cannot authenticate thru ldap
by Dat Duong 26 Aug '08

26 Aug '08

Hi, I don't know what is the reason why i can't authenticate thru the ldap server from RHEL 5. I can do ldapsearch -x -LLL and it listed the data. Any help who be appreciated...thanks

2 1

Re: RHEL 5 cannot authenticate thru ldap
by Santosh Balan 26 Aug '08

26 Aug '08

Hi, >From where r u taking data for authentication. Is it using pamd or creating a new ldap bdb or ldbm. Have u configured your client machine to connect to the ldap server for authentication using system-config-authentication. In case you are using the pamd authentication module then you need to copy the following files from /usr/share/doc/nss_ldap-253/pam.d/ directory namely login, passwd, su, ssh to /etc/pam.d . Then u need to try to authenticate. Try googling through for the other method of authentication i.e. using ldbm or bdb database. As scripts needs to be executed to load your users data. Kindly check and revert. Thanks and Regards Santosh Balan +91-9819419509. > ----- Original Message ----- > From: "Dat Duong" <datduong2000(a)yahoo.com> > To: openldap-technical(a)openldap.org > Subject: RHEL 5 cannot authenticate thru ldap > Date: Mon, 25 Aug 2008 11:01:16 -0700 (PDT) > > > Hi, > > I don't know what is the reason why i can't authenticate thru the > ldap server from RHEL 5. I can do ldapsearch -x -LLL and it listed > the data. Any help who be appreciated...thanks > > > > > = -- Powered by Outblaze

1 0

Create new user via a user belonging to a specific group
by Stelios A. 24 Aug '08

24 Aug '08

Hello all, An example user in my LDAP structure is like: dn: cn=Full Name,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Full sn: Name cn: Full Name uid: fname userPassword: {MD5}HNtFsPRLE3okNNjVm6lmpw== uidNumber: 1004 gidNumber: 100 homeDirectory: /home/fname loginShell: /bin/bash mail: fname(a)mydomain.com This user is under group of IT where I want to give him access to add new entry into the OpenLDAP. I'm connecting to LDAP server via his details and phpldapadmin and trying to create a new user but I'm getting the following error: Error number: 0x13 (LDAP_CONSTRAINT_VIOLATION) Description: Some constraint would be violated by performing the action. This can happen when you try to add a second value to a single-valued attribute, for example. My ACL's in the master ldap server are: access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=com" write by dn="uid=syncrepl,ou=system,dc=mydomain,dc=com" write by group/groupOfUniqueNames/uniqueMember="cn=IT,ou=Groups,dc=mydomain,dc=com" write by dn="uid=authenticate,ou=system,dc=mydomain,dc=com" read by anonymous auth by self write by * none access to attrs=givenName,sn,cn by group/groupOfUniqueNames/uniqueMember="cn=IT,ou=Groups,dc=mydomain,dc=com" write by self write by users auth by anonymous auth access to dn.base="" by * read access to * by dn="cn=admin,dc=mydomain,dc=com" write by group/groupOfUniqueNames/uniqueMember="cn=LDAP Admins,ou=Groups,dc=mydomain,dc=com" write by * read I'm also using in this file the overlay unique for attributes uid,mail and uidNumber in case that this has anything to do. Any help is much appreciated. Thanks

2 3

some attributes forbidden in a schema
by nicolas＠gibelin.fr 23 Aug '08

23 Aug '08

Hello, I have some troubles in the creation of a ldap schema. I would like something like that: attributetype ( eloOrganizationalUnitAttribute:7.30.2008.1.22 NAME 'street' DESC 'Cinema street' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} SINGLE-VALUE ) attributetype ( eloOrganizationalUnitAttribute:7.30.2008.1.23 NAME 'postalCode' DESC 'Cinema Zip code' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} SINGLE-VALUE ) When I restart slapd, I have an error (but no output was produced) ans there is nothing niteresting in syslog. If I change the attributes' names (street -> cstreet, postalCode -> cpostalCode for instance), all works fine. I could keep my schema like that but it's not very beautiful. Do you know what's happen ? I have seen some schema over the net which use 'street' and 'postalCode' and without problems. I'm a bit jalous :) Thank you !

2 2

Re: Windows AD --> Linux/OpenLDAP
by Gustavo Mendes de Carvalho 23 Aug '08

23 Aug '08

Hi Janskey, You can try it using ldifde command, like this ldifde -f exportuserfile.ldif -s ServerName -d "dc=foo,dc=com " \ -r " (&(objectCategory=Person)(objectClass=User)(givenName=*)) " \ -l " CN,givenName,objectClass,sAMAccountName " If you have any doubt, try ldifde /? Regards > Date: Thu, 21 Aug 2008 06:32:58 -0700 (PDT) > From: janskey <janskey_boy(a)yahoo.com> > Subject: Windows AD --> Linux/OpenLDAP > To: openldap-technical(a)openldap.org > Message-ID: <543692.93491.qm(a)web51701.mail.re2.yahoo.com> > Content-Type: text/plain; charset="us-ascii" > > Hi All, > > I need advice on how I can migrate my AD to linux/OpenLDAP? > Currently we're using Windows 2003 evaluation and its going to expire. > > cheers, > > janskey --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

Windows AD --> Linux/OpenLDAP
by janskey 22 Aug '08

22 Aug '08

Hi All, I need advice on how I can migrate my AD to linux/OpenLDAP? Currently we're using Windows 2003 evaluation and its going to expire. cheers, janskey

3 2

Can't bind to server even though everything is running and seems normal
by Kristen Walker 21 Aug '08

21 Aug '08

Hello, I am sorry to bug this list about another problem with LDAP. This morning I logged in to LDAP via phpldapadmin and added users and everything seemed find. Now, a few hours later, I cannot seem to bind to the server to add users via the web interface or command line. Here is the output from the command line: sudo ldapadd -x -D "cn=Manager,dc=sbceoportal,dc=org" -W -f /home/upadmin/ldap/new_users.ldif Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) I started openLDAP in debugging mode, and nothing seems out of the ordinary: su root -c "/usr/local/libexec/slapd -d 65535" @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ root@porthole:/etc/openldap/openldap-2.3.39/servers/slapd daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened slapd init: initiated server. bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) reading config file /usr/local/etc/openldap/slapd.conf line 5 (include /usr/local/etc/openldap/schema/core.schema) reading config file /usr/local/etc/openldap/schema/core.schema line 77 (attributetype ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )) line 86 (attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name )) line 92 (attributetype ( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial number of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} )) line 96 (attributetype ( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC2256: ISO-3166 country 2-letter code' SUP name SINGLE-VALUE )) line 100 (attributetype ( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: locality which this object resides in' SUP name )) line 104 (attributetype ( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2256: state or province which this object resides in' SUP name )) line 110 (attributetype ( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC2256: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )) line 114 (attributetype ( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256: organization this object belongs to' SUP name )) line 118 (attributetype ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC 'RFC2256: organizational unit this object belongs to' SUP name )) line 122 (attributetype ( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name )) line 134 (attributetype ( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search guide, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 )) line 140 (attributetype ( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: business category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )) line 146 (attributetype ( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )) line 152 (attributetype ( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} )) line 158 (attributetype ( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Office Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} )) line 164 (attributetype ( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )) line 170 (attributetype ( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Telephone Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} )) line 174 (attributetype ( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Number' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 )) line 178 (attributetype ( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC2256: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 )) line 182 (attributetype ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.121.1.22 )) line 188 (attributetype ( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Address' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{15} )) line 194 (attributetype ( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256: international ISDN number' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} )) line 199 (attributetype ( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: registered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )) line 205 (attributetype ( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: destination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} )) line 210 (attributetype ( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC2256: preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE-VALUE )) line 216 (attributetype ( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: presentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.43 SINGLE-VALUE )) line 221 (attributetype ( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'RFC2256: supported application context' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )) line 225 (attributetype ( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a group' SUP distinguishedName )) line 229 (attributetype ( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the object)' SUP distinguishedName )) line 233 (attributetype ( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupant of role' SUP distinguishedName )) line 251 (attributetype ( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.509 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )) line 258 (attributetype ( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )) line 263 (attributetype ( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC2256: X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )) line 268 (attributetype ( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC2256: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )) line 273 (attributetype ( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X.509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 )) line 283 (attributetype ( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) for which the entity is known by' SUP name )) line 287 (attributetype ( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of some or all of names, but not the surname(s).' SUP name )) line 291 (attributetype ( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: name qualifier indicating a generation' SUP name )) line 296 (attributetype ( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X.500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )) line 303 (attributetype ( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN qualifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 )) line 307 (attributetype ( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: enhanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 )) line 312 (attributetype ( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: protocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.42 )) line 322 (attributetype ( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique member of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )) line 328 (attributetype ( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: house identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )) line 333 (attributetype ( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: supported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 )) line 338 (attributetype ( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: delta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )) line 342 (attributetype ( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' SUP name )) line 346 (attributetype ( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudonym for the object' SUP name )) line 366 (objectclass ( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP top STRUCTURAL MUST c MAY ( searchGuide $ description ) )) line 371 (objectclass ( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SUP top STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ description ) )) line 382 (objectclass ( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organization' SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )) line 393 (objectclass ( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an organizational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )) line 399 (objectclass ( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP top STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) )) line 408 (objectclass ( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an organizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l ) )) line 419 (objectclass ( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an organizational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l $ description ) )) line 425 (objectclass ( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )) line 436 (objectclass ( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an residential person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ preferredDeliveryMethod $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) )) line 442 (objectclass ( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an application process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ description ) )) line 449 (objectclass ( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an application entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MAY ( supportedApplicationContext $ seeAlso $ ou $ o $ l $ description ) )) line 454 (objectclass ( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory system agent (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformation )) line 460 (objectclass ( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP top STRUCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ description ) )) line 465 (objectclass ( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC2256: a strong authentication user' SUP top AUXILIARY MUST userCertificate )) line 471 (objectclass ( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256: a certificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ certificateRevocationList $ cACertificate ) MAY crossCertificatePair )) line 477 (objectclass ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uniqueMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )) line 482 (objectclass ( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC2256: a user security information' SUP top AUXILIARY MAY ( supportedAlgorithms ) )) line 486 (objectclass ( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP certificationAuthority AUXILIARY MAY ( deltaRevocationList ) )) line 492 (objectclass ( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTURAL MUST ( cn ) MAY ( certificateRevocationList $ authorityRevocationList $ deltaRevocationList ) )) line 502 (objectclass ( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST ( dmdName ) MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )) line 510 (objectclass ( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' SUP top AUXILIARY MAY userCertificate )) line 516 (objectclass ( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate authority' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRevocationList $ cACertificate $ crossCertificatePair ) )) line 521 (objectclass ( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SUP top AUXILIARY MAY deltaRevocationList )) line 534 (objectclass ( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'RFC2079: object that contains the URI attribute type' SUP top AUXILIARY MAY ( labeledURI ) )) line 551 (attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )) line 556 (objectclass ( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject' DESC 'RFC1274: simple security object' SUP top AUXILIARY MUST userPassword )) line 564 (attributetype ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainComponent' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )) line 569 (objectclass ( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: domain component object' SUP top AUXILIARY MUST dc )) line 574 (objectclass ( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid object' SUP top AUXILIARY MUST uid )) line 582 (attributetype ( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DESC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 590 (attributetype ( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'pkcs9email' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )) line 6 (include /usr/local/etc/openldap/schema/cosine.schema) reading config file /usr/local/etc/openldap/schema/cosine.schema line 130 (attributetype ( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 168 (attributetype ( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: general information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} )) line 187 (attributetype ( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDrink' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 205 (attributetype ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 227 (attributetype ( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} )) line 248 (attributetype ( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC1274: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 264 (attributetype ( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: host computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 279 (attributetype ( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC1274: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 296 (attributetype ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' DESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 312 (attributetype ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC 'RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 329 (attributetype ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DESC 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 344 (attributetype ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 361 (attributetype ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DESC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 380 (attributetype ( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTelephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )) line 395 (attributetype ( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 411 (attributetype ( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 )) line 480 (attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 486 (attributetype ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 501 (attributetype ( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 516 (attributetype ( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 531 (attributetype ( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 546 (attributetype ( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 581 (attributetype ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 599 (attributetype ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' DESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )) line 616 (attributetype ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 635 (attributetype ( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTelephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )) line 653 (attributetype ( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelephoneNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )) line 671 (attributetype ( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCountryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 691 (attributetype ( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DESC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 713 (attributetype ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 734 (attributetype ( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC 'RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )) line 764 (attributetype ( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )) line 781 (attributetype ( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC 'RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 796 (attributetype ( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RFC1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE )) line 811 (attributetype ( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE )) line 827 (attributetype ( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQuality' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE )) line 843 (attributetype ( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQuality' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE )) line 865 (attributetype ( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' DESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23 )) line 884 (attributetype ( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'RFC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 900 (attributetype ( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274: audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} )) line 916 (attributetype ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' DESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 1084 (objectclass ( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilotPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ homePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ businessCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelephoneNumber $ organizationalStatus $ mailPreferenceOption $ personalSignature ) )) line 1110 (objectclass ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ host ) )) line 1142 (objectclass ( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUCTURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ documentTitle $ documentVersion $ documentAuthor $ documentLocation $ documentPublisher ) )) line 1165 (objectclass ( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURAL MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) )) line 1191 (objectclass ( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ localityName $ organizationName $ organizationalUnitName ) )) line 1222 (objectclass ( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCTURAL MUST domainComponent MAY ( associatedName $ organizationName $ description $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $ stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) )) line 1252 (objectclass ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP domain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telephoneNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) )) line 1275 (objectclass ( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord ) )) line 1293 (objectclass ( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' DESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associatedDomain )) line 1311 (objectclass ( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP country STRUCTURAL MUST friendlyCountryName )) line 1345 (objectclass ( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SUP ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName )) line 1361 (objectclass ( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STRUCTURAL MAY dSAQuality )) line 1382 (objectclass ( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximumQuality ) )) line 7 (include /usr/local/etc/openldap/schema/inetorgperson.schema) reading config file /usr/local/etc/openldap/schema/inetorgperson.schema line 36 (attributetype ( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC2798: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 46 (attributetype ( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC 'RFC2798: identifies a department within an organization' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 59 (attributetype ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )) line 70 (attributetype ( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RFC2798: numerically identifies an employee within an organization' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )) line 81 (attributetype ( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 92 (attributetype ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 )) line 107 (attributetype ( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )) line 123 (attributetype ( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' DESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )) line 135 (attributetype ( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )) line 155 (objectclass ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) )) line 16 (pidfile /usr/local/var/run/slapd.pid) line 17 (argsfile /usr/local/var/run/slapd.args) line 58 (database bdb) bdb_db_init: Initializing BDB database line 59 (suffix "dc=sbceoportal,dc=org") >>> dnPrettyNormal: <dc=sbceoportal,dc=org> => ldap_bv2dn(dc=sbceoportal,dc=org,0) <= ldap_bv2dn(dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=sbceoportal,dc=org)=0 <<< dnPrettyNormal: <dc=sbceoportal,dc=org>, <dc=sbceoportal,dc=org> line 60 (rootdn "cn=Manager,dc=sbceoportal,dc=org") >>> dnPrettyNormal: <cn=Manager,dc=sbceoportal,dc=org> => ldap_bv2dn(cn=Manager,dc=sbceoportal,dc=org,0) <= ldap_bv2dn(cn=Manager,dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Manager,dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,dc=sbceoportal,dc=org)=0 <<< dnPrettyNormal: <cn=Manager,dc=sbceoportal,dc=org>, <cn=manager,dc=sbceoportal,dc=org> line 64 (rootpw ***) line 68 (directory /usr/local/var/openldap-data) line 70 (index objectClass eq) index objectClass 0x0004 >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox ) ) 2.5.13.35 (certificateMatch): matchingRuleUse: ( 2.5.13.35 NAME 'certificateMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES userPassword ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcGentleHUP $ olcLastMod $ olcReadOnly $ olcReverseLookup $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcSpNoPresent $ olcSpReloadHint ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcSpCheckpoint $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcSpCheckpoint $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ namingContexts $ aliasedObjectName $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=include{0}" config_build_entry: "cn=include{1}" config_build_entry: "cn=include{2}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}inetorgperson" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=sbceoportal,dc=org" bdb_db_open: dc=sbceoportal,dc=org bdb_db_open: dbenv_open(/usr/local/var/openldap-data) slapd starting daemon: added 4r listener=(nil) daemon: added 7r listener=0x81b5290 daemon: added 8r listener=0x81b5350 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL And this is the output in the log file: Aug 21 11:12:37 porthole slapd[32498]: daemon: shutdown requested and initiated. Aug 21 11:12:37 porthole slapd[32498]: slapd shutdown: waiting for 0 threads to terminate Aug 21 11:12:37 porthole slapd[32498]: slapd stopped. Aug 21 11:12:50 porthole slapd[32513]: @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ ^Iroot@porthole:/etc/openldap/openldap-2.3.39/servers/slapd Aug 21 11:12:50 porthole slapd[32514]: slapd starting Aug 21 11:13:51 porthole slapd[32514]: daemon: shutdown requested and initiated. Aug 21 11:13:51 porthole slapd[32514]: slapd shutdown: waiting for 0 threads to terminate Aug 21 11:13:51 porthole slapd[32514]: slapd stopped. Aug 21 11:14:02 porthole slapd[32522]: @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ ^Iroot@porthole:/etc/openldap/openldap-2.3.39/servers/slapd Aug 21 11:14:02 porthole slapd[32523]: slapd starting Aug 21 11:14:09 porthole slapd[32523]: daemon: shutdown requested and initiated. Aug 21 11:14:09 porthole slapd[32523]: slapd shutdown: waiting for 0 threads to terminate Aug 21 11:14:09 porthole slapd[32523]: slapd stopped. Aug 21 11:14:15 porthole slapd[32528]: @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ ^Iroot@porthole:/etc/openldap/openldap-2.3.39/servers/slapd Aug 21 11:14:15 porthole slapd[32528]: slapd starting Any help is much appreciated! Thanks, Kristen -- Kristen Walker Digital Media Resources Developer Instructional Media Services Santa Barbara County Education Office 4400 Cathedral Oaks Road P.O. Box 6307 Santa Barbara, CA 93160-6307 (805)964-4711 ext. 5244/FAX (805)683-3597 kwalker(a)sbceo.org http://www.sbceoportal.org

1 1

Prooblem loading dynamic module
by Ricardo Moreira 21 Aug '08

21 Aug '08

Hello, I am new to openldap so any help is wellcome! I am trying to build dynamic modules and I have got this error when trying to load them: lt_dlopenext failed: (back_monitor.la) /usr/local/libexec/openldap/back_monitor-2.3.so.0: undefined symbol: slapd_rq /etc/openldap/slapd.conf: line 23: failed to load or initialize module back_monitor.la Could someone help me with this issue? Here are some extra information: - Source package: openldap-2.3.39.tgz - Configure options: configure --libdir=/usr/lib --libexecdir=/usr/local/libexec/openldap --enable-dynamic --enable-modules --enable-monitor=mod --enable-shell=mod - Ldd output: ldd /usr/local/libexec/openldap/back_monitor.so libldap_r-2.3.so.0 => /home/ricardo/openldap-work/libraries/libldap_r/.libs/libldap_r-2.3.so.0 (0x00aa2000) liblber-2.3.so.0 => /home/ricardo/openldap-work/libraries/liblber/.libs/liblber-2.3.so.0 (0x00bc6000) libc.so.6 => /lib/tls/libc.so.6 (0x0056b000) libresolv.so.2 => /lib/libresolv.so.2 (0x00111000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x00124000) libssl.so.4 => /lib/libssl.so.4 (0x008cc000) libcrypto.so.4 => /lib/libcrypto.so.4 (0x00780000) /lib/ld-linux.so.2 (0x002f0000) libdl.so.2 => /lib/libdl.so.2 (0x00138000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00362000) libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x0013c000) libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x006a6000) libcom_err.so.2 => /lib/libcom_err.so.2 (0x00b9c000) libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x001c2000) libz.so.1 => /usr/lib/libz.so.1 (0x00f85000) - Slapd.conf: modulepath /usr/local/libexec/openldap moduleload back_monitor.la -- :: Ricardo Moreira

1 0

ACL: user who can just create but not delete entries
by Stefano Zanmarchi 21 Aug '08

21 Aug '08

Hi, I'd like to create a special user ("cn=useradmin,dc=myorg,dc=com") whose task would be creating new entries under "ou=people,dc=myorg,dc=com". My problem is that useradmin will be used by a not completely trusted application. Can I prevent useradmin from deleting or modifying entries under "ou=people,dc=myorg,dc=com"? Thank you very much for your help, Stefano

2 1

LDAP lookup problem
by Stelios A. 21 Aug '08

21 Aug '08

Hello all, I have a master and a slave Openldap server on an Ubuntu 8.0.4 server with 2.4.9 version of Openldap. I'm sing syncrepl to sync data between 2 servers. Data are transfered from master to the slave without a problem and I'm able to query the slave ldap via phpldapadmin without a problem. Having said that, as soon as I add a new user to the master ldap that is been replicated fine (I can see the user details on the slave server) but when I run from bash 'id user1' I'm getting an 'id: user1: No such user. This is happening no matter if I stop and start nscd or ldap. The sync part of the slave server is pasted below: syncrepl rid=001 provider=ldap://192.168.1.0 type=refreshOnly interval=00:00:01:00 searchbase="dc=mydomain,dc=edu,dc=com" binddn="uid=syncrepl,ou=System,dc=mydomain,dc=edu,dc=com" bindmethod=simple credentials=mypassword updateref ldap://192.168.1.0 and the ACL's into slave are: access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=edu,dc=com" write by dn="uid=syncrepl,ou=System,dc=mydomain,dc=edu,dc=com" write by dn="uid=authenticate,ou=System,dc=mydomain,dc=edu,dc=com" read by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=mydomain,dc=edu,dc=com" write by dn="uid=syncrepl,ou=System,dc=mydomain,dc=edu,dc=com" write by * read On master slave I can query any user fine. It just doesn't work on slave. nsswitch.conf is same as master: passwd: files ldap group: files ldap shadow: files ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis ldap I have no clue how to troubleshoot this problem. Any help is much appreciated. Thanks a lot

2 4

DN question
by Kós Tamás 21 Aug '08

21 Aug '08

Hi List! I got a little bit off topic problem, but I hope you can help me about it. We got an LDAP directory, with many names. We got some same CNs for instance: John Smiths. The only difference is between the 2 names is the e-mail address. How can I modify one of them? ldapmodify request DN, but our enviroment DN seems to be DN: CN=John Smiths. How can I include the e-mail address to the DN? Any help appreciated. Yours, K.T. -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life."

4 17

Re: translucent overlay with local-only entries
by Sven Ulland 20 Aug '08

20 Aug '08

Gavin Henry wrote: [...] >> Are they really correct? With local-only entries working well (as >> they should, with my recent version of openldap), I would assume >> that local-only would return local-only entries, and that >> local-and-remote would return both remote and local entries. > > So are you getting local entries at all? I see local *modifications*, yes. Example: A remote entry with uid=andrew is edited on the translucent extension with a new description. When searching, I see the locally changed description without problems. On the other hand, when I create *entries* that only exist on the translucent extension, I never see any sign of them when searching. I do see them when running slapcat, so they are indeed present in the local database. This should be fixed with Howard's 2.4.8 patch some time ago, so I can only assume there's something strange with my config or the 2.4.10 Debian build. I will try to build a vanilla OpenLDAP from source as soon as I have time. sven

2 2

How To (correctly) reference an LDAP entry
by Christian Marg 20 Aug '08

20 Aug '08

Hello, I have some entries in my own OpenLDAP server (Server A, Base: dc=tu-clausthal,dc=de) and would like to link each of them to entries stored on a foreign LDAP Server (Server B, Base: ou=X,o=Y,c=Z). I have added the "seeAlso"-attribute containing the DNs I want to link my LDAP-entries to, but since they are in another name space and on a foreign Server, they point to "nil". Do I have to rebuild the foreign namespace to just add a reference to the other server? How would I do that most cleverly on OpenLDAP? Or is there another way to create (correct) external references? Am I even using the "seeAlso" attribute correctly? bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Rechenzentrum TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2626 Germany jabber: ifcma(a)jabber.tu-clausthal.de

2 3

Re: translucent overlay with local-only entries
by Sven Ulland 20 Aug '08

20 Aug '08

Gavin Henry wrote: > ----- "Sven Ulland" <sveniu(a)ifi.uio.no> wrote: > >> Gavin Henry wrote: >> [...] >>>> Are they really correct? With local-only entries working well (as >>>> they should, with my recent version of openldap), I would assume >>>> that local-only would return local-only entries, and that >>>> local-and-remote would return both remote and local entries. >>> So are you getting local entries at all? >> I see local *modifications*, yes. Example: A remote entry with >> uid=andrew is edited on the translucent extension with a new >> description. When searching, I see the locally changed description >> without problems. >> >> On the other hand, when I create *entries* that only exist on the >> translucent extension, I never see any sign of them when searching. >> I do see them when running slapcat, so they are indeed present in >> the local database. >> >> This should be fixed with Howard's 2.4.8 patch some time ago, so I >> can only assume there's something strange with my config or the >> 2.4.10 Debian build. I will try to build a vanilla OpenLDAP from >> source as soon as I have time. > > OK, thanks. Does a slapcat of the local db show the new entries > you've added to existing remote ones? I assume you mean new and/or modified attributes. Yes, those are shown as well, with all the needed glue records in place. So as far as I can see, writing new entries/attributes works perfectly fine, but the searching does not. I'll send an update after trying the vanilla distr. sven

1 0

Re: Help with authz-regexp mapping kerberos
by Chavez, James R. 20 Aug '08

20 Aug '08

Rahul, Sorry I am not clear in my explanations. What I am trying to achieve is to login to my linux and solaris boxes from the console or through a remote ssh session using Active directory or kerberos credentials and have that effectively map to my users that exist in the LDAP directory. And this works with a catch.. If the username in LDAP (joe_montana) matches the kerberos principal name (joe_montana) I have no issue.. I login using the kerberos username and password and the uid, gid, for that user in LDAP is correct when issuing the id command. So effectively it uses the kerberos credentials and logs me in as that ldap user. Pam-krb is used for authentication and things seem beautiful. However in this case, I have user's with the 8 character unix naming convention(migrated from NIS). I am trying to find the correct way to map that username to the kerberos username. There has got to be a way!! Actually reading over the openldap Admin guide, I see that it mentions using passthrough authentication to an Active directory server. Seems this is done by modifying the userPassword attribute of the ldap dn. As I understand from reading the guide, for my user jmontana the entry should look something like this.. dn: cn=jmontana,ou-People,dc=example,dc=com userPassword: {SASL}joe_montana(a)EXAMPLE.COM However all the userPassword attributes for the users are encrypted. I delete the dn's userPassword attribute first off. But when I attempt to add the userPassword attribute with the ldif below I still get an encrypted password in the userPassword attribute. How can I get the entry to show {SASL}joe_montana(a)EXAMPLE.COM? Is there something in slapd.conf or ldap.conf I need to modify? I may be barking up the wrong tree but it sounds like what I need. dn: uid=jmontana,ou=People,dc=example,dc=com changetype: modify add: userPassword userPassword: {SASL}joe_montana(a)EXAMPLE.COM Also the Openldap Admin guide mentions that "the server must be built with the --enable-spasswd configuration option to enable pass-through authentication." I am not sure how to check if this is the case. This is a RHEL5 box with openldap-servers-2.3.27-8 rpm. I did not install from source, I used Red Hat's precompiled RPM. Having to install from source is a whole other can of worms. But I will do what I have to. Thank you much James 1. Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL (Rahul Amaram) ---------------------------------------------------------------------- Message: 1 Date: Sun, 17 Aug 2008 11:30:25 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL To: openldap-technical(a)openldap.org Message-ID: <48A7BE79.2080704(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed This is the flow of events. 1. First GSSAPI (Kerberos) authentication takes place using the id "joe_montana". 2. Then LDAP gives this the DN "uid=joe_montana,cn=REALM,cn=gssapi,cn=auth". 3. Using authz-regexp, we can map this to another DN such as "uid=jomontana,ou=People,dc=company,dc=com" which I believe makes sense only to LDAP. Getting back to your query, could you precisely define what is it that you are trying to achieve? If you could give a clear step-to-step example of the workflow, then I might be able to be of some assistance. Regards, Rahul. Chavez, James R. wrote: > > Rahul, > Thank you again..I will try this expression you have provided. > Am I going about this in the correct way? What I want is to login > through ssh or even the local box and be authenticated by the kerberos > credentials. But I want the effective uid or account to be that of the > ldap user in the openldap directory. > I want my kerberos credentials to authorize my ldap login even though > the account names do not match. Is it possible with this authz-regexp? > Or is this simply for services. > Sorry for all the questions. > > Thanks > James > > > > Message: 1 > Date: Wed, 13 Aug 2008 15:08:43 +0530 > From: Rahul Amaram <rahul(a)synovel.com> > Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos > identity to dn --RAHUL > Cc: openldap-technical(a)openldap.org > Message-ID: <48A2ABA3.9090900(a)synovel.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Chavez, > Try this expression. It should work. > > authz-regexp uid=(.).*_([^,]*),cn=company.com,cn=gssapi,cn=auth > uid=$1$2,ou=People,dc=company,dc=com > > > The "sasl-realm" parameter is set in /etc/slapd/slapd.conf (main > slapd.conf file). You might also be interested in sasl-host (for > hard-coding the host sasl fqdn name to be used while fetching > ldap/<fqdn>@<REALM> password from the keytab file) and sasl-secprops > parameters. > > Regards, > Rahul. > > Chavez, James R. wrote: > >> >> Rahul, >> My friend finally a response. >> Thank you for the input I had also read that link you provided, it >> was >> > > >> somewhat helpful. If the usernames were identical that would work >> great I believe. However the source name is coming in as joe_montana >> and I need it to map to jmontana. >> So I need only the first character of the first name and everything >> after the underscore (last name). I am looking for the expression >> that >> > > >> would give me that. I am not too familiar with the expressions syntax >> or how to manipulate them. I see there is an option to search ldap >> using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I >> should look into that. Do you have any suggestions or source for >> reading on authz-regexp? I have been looking. If it was shell >> scripting I could manage another way. >> >> When you say the SASL Realm would that go in the main slapd.conf or >> the /usr/lib/sasl2/slapd.conf? >> >> I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting >> close,just gotta get past this. :) >> >> Thank you again. >> James >> >> >> >> >> ------------------------------ >> CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

Cannot find 2 particular users
by Stelios A. 20 Aug '08

20 Aug '08

Hello all, I'm going mad with this problem. Suddenly and without doing any modification 2 particular users cannot bind on slave ldap. Example: root@slaveldap:~# id user1 id: psamara: No such user root@slaveldap:~# id user2 id: idanias: No such user root@slaveldap:~# id stelios uid=1000(stelios) gid=100(users) groups=100(users) root@slaveldap:~# The above commands run fine on the master ldap server. Doing a search on slaveldap finds both user1 and user2. Because of the above lookup problem I cannot send emails to those 2 users as I'm getting the following error from the email server which is running on the same machine. Requested action not taken: mailbox unavailable 550 5.1.1 <user1(a)mydomain.com>: Recipient address rejected: User unknown in local recipient table I have no clue what is going on and how to solve it. I also try to delete and re-create the users but with same results. Any ideas? Thanks a lot

3 3

Re: translucent overlay with local-only entries
by Sven Ulland 19 Aug '08

19 Aug '08

Gavin Henry wrote: > ----- "Sven Ulland" <sveniu(a)ifi.uio.no> wrote: >> Gavin Henry wrote: >>> Did you read the man page? man slapo-translucent >> I did, but the significance of translucent_local and _remote didn't >> strike me. Unfortunately it seems that enabling local+remote >> searching doesn't change the result. I must have a silly bug in my >> configuration, but I cannot figure out where. >> >> Various combinations of translucent_local and _remote give different, >> but consistent, results: >> >> neither local nor remote: only remote entries returned >> local only: no entries returned >> remote only: only remote entries returned >> local and remote: only remote entries returned > > These are corrent results and are documented in the slapo-translucent man page. Are they really correct? With local-only entries working well (as they should, with my recent version of openldap), I would assume that local-only would return local-only entries, and that local-and-remote would return both remote and local entries. >> I use the following in my slapd.conf[1]: >> >> translucent_remote uid >> translucent_local uid > > Do you have uid indexed? Yes, and I have tried rebuilding the index (and set proper file ownership afterwards) several times. 'uid' is indexed on the main ldap and on the translucent one, using 'index uid eq,sub'. No effect. I search using equality with ldapsearch. I tried switching between bdb and hdb, also without any effect. It seems I have to dive into the code to resolve this one. sven

1 0

slapadd error when I add ldif file which export from Windows AD
by 绍庚曾 19 Aug '08

19 Aug '08

Hello ,all! First, I'm sorry for my poor english. In windowsXP, I export whole Windows AD as a ldif file by a tool called "Softerra LDAP Browser 2.6". But in my CentOS4.6, when I import this ldif file, It occured an error message: slapadd: could not parse entry (line=56) I find this ldif file contains some private objectclass, so I try to search the corresponding schema files in Windows AD server, but I find nothing.Whether the is a way to directly import the ldif file to OpenLDAP which export from a Windows AD server? By the way ,my OpenLDAP version is 2.2.13. Any help will be really appreciated. With Best regards!

1 0

Re: Proxying data for syncrepl
by ghenry＠OpenLDAP.org 18 Aug '08

18 Aug '08

----- "Gavin Henry" <ghenry(a)suretecsystems.com> wrote: > Yes, and that it is "proxying" data. Openldap as the remove has what > is needed, domino does not. Bonnie, that meant to say, "as the remote". For example, the OpenLDAP remote side might have an entry like so: # gavin.henry(a)suretecsystems.com, MailAliases, suretecsystems.com dn: cn=gavin.henry(a)suretecsystems.com,ou=MailAliases,dc=suretecsystems,dc=com structuralObjectClass: suretecMailAlias entryUUID: fdbf98ca-3118-102c-9eee-c3b0278f5eab creatorsName: cn=admin,dc=suretecsystems,dc=com createTimestamp: 20071127094345Z entryCSN: 20071127130047.357178Z#000000#000#000000 modifiersName: cn=admin,dc=suretecsystems,dc=com modifyTimestamp: 20071127130047Z entryDN: cn=gavin.henry(a)suretecsystems.com,ou=MailAliases,dc=suretecsystems,dc =com subschemaSubentry: cn=Subschema hasSubordinates: FALSE Note the entryCSN and entryUUID as per: RFC 4533 LDAP Content Synchronization Operation June 2006 [Page 28] Appendix A. CSN-based Implementation Considerations ...the server not only maintains a CSN for each directory entry (the entry CSN) but also maintains a value that we will call the context CSN. The context CSN is the greatest committed entry CSN that is not greater than any outstanding (uncommitted) entry CSNs for all entries in a directory context. The values of context CSN are used in syncCookie values as synchronization state indicators. These are what Syncrepl needs, and because the remote side you are proxying has them, all is well. Now take an entry from Active Directory on Windows Server 2008: dn: CN=Administrator,CN=Users,DC=ad,DC=suretecsystems,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Administrator description: Built-in account for administering the computer/domain distinguishedName: CN=Administrator,CN=Users,DC=ad,DC=suretecsystems,DC=com instanceType: 4 whenCreated: 20080818193354.0Z whenChanged: 20080818195251.0Z uSNCreated: 8194 memberOf: CN=Group Policy Creator Owners,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Domain Admins,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Enterprise Admins,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Schema Admins,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Administrators,CN=Builtin,DC=ad,DC=suretecsystems,DC=com uSNChanged: 12715 name: Administrator objectGUID:: vuyXNovZB06PgC486y0UjA== userAccountControl: 512 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 128635631238177500 lastLogoff: 0 lastLogon: 128635645180075000 logonHours:: //////////////////////////// pwdLastSet: 128635613297241250 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAA4IX8iXHsQkLUe6ZE9AEAAA== adminCount: 1 accountExpires: 0 logonCount: 13 sAMAccountName: Administrator sAMAccountType: 805306368 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=ad,DC=suretecsystems,DC=com isCriticalSystemObject: TRUE dSCorePropagationData: 20080818193742.0Z dSCorePropagationData: 16010101000005.0Z lastLogonTimestamp: 128635619492443750 There is no entryCSN or entryUUID. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: Re: Proxying data for syncrepl
by Gavin Henry 18 Aug '08

18 Aug '08

Yes, and that it is "proxying" data. Openldap as the remove has what is needed, domino does not. ---- Original Message ---- From: Luca <luca.scamoni(a)sys-net.it> To: Bonnie <Bonnie.Oostenbrug(a)indaal.de>, Cc: openldap-technical <openldap-technical(a)openldap.org>, Sent: Mon, 18 Aug 2008 19:07 (GMT +0100) GMT+01:00 Subject: Re: Proxying data for syncrepl Because syncrepl depends heavily on entryUUID and entryCSN that are not provided by domino?

1 0

Proxying data for syncrepl
by Bonnie.Oostenbrug＠indaal.de 18 Aug '08

18 Aug '08

Hi, I am trying to set up the following configuration. Unfortunately, without much luck so far. 1. A Directory Server capable of LDAP e.g. LotusDomino, OpenLDAP, AD, etc.... (This Server isn't/can't be specially configured for replication. I can only ensure that the schema is correct. That is the whole point of my undertaking - because Lotus Domino/AD support it. 2. OpenLDAP configured as Proxy with a database of type LDAP with overlay syncprov configured and a uri that points to my Directory Server 3. A Consumer with a database of type BDB configured for syncrepl with my proxy as provider The whole idea is to be able to use this setup to incorporate information from diverse legacy directory servers and get it into a manageable standard OpenLDAP Directory. Without exports etc. I need to have the data replicated down local to my consumer due to Network restrictions. I want to be able to point my Proxy at 3 different Directory Servers and replicate this content down to a single consumer. If I set up the configuration using an OpenLDAP Server as my Directory Server it works. (more or less*) But when I change the proxy to point to e.g. Lotus Domino as my Directory Server I get the error "got empty SyncUUID with LDAP_SYNC_ADD" and the content doesn't replicate down from the Directory Server. Although I see activity on my proxy - he queries my Directory Server. Did I bite off to much for a newbie or am I missing something obvious?? Thanks for ideas in which direction I need to be looking! Bonnie (* the more or less refers to the fact that changes made to the Directory Server content don't replicate down unless I restart the Proxy. Then the changes are immediately replicated to the consumer..... I'm still working on that one??)

3 3

Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL
by Chavez, James R. 17 Aug '08

17 Aug '08

Rahul, Thank you again..I will try this expression you have provided. Am I going about this in the correct way? What I want is to login through ssh or even the local box and be authenticated by the kerberos credentials. But I want the effective uid or account to be that of the ldap user in the openldap directory. I want my kerberos credentials to authorize my ldap login even though the account names do not match. Is it possible with this authz-regexp? Or is this simply for services. Sorry for all the questions. Thanks James Message: 1 Date: Wed, 13 Aug 2008 15:08:43 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL Cc: openldap-technical(a)openldap.org Message-ID: <48A2ABA3.9090900(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Chavez, Try this expression. It should work. authz-regexp uid=(.).*_([^,]*),cn=company.com,cn=gssapi,cn=auth uid=$1$2,ou=People,dc=company,dc=com The "sasl-realm" parameter is set in /etc/slapd/slapd.conf (main slapd.conf file). You might also be interested in sasl-host (for hard-coding the host sasl fqdn name to be used while fetching ldap/<fqdn>@<REALM> password from the keytab file) and sasl-secprops parameters. Regards, Rahul. Chavez, James R. wrote: > > Rahul, > My friend finally a response. > Thank you for the input I had also read that link you provided, it was > somewhat helpful. If the usernames were identical that would work > great I believe. However the source name is coming in as joe_montana > and I need it to map to jmontana. > So I need only the first character of the first name and everything > after the underscore (last name). I am looking for the expression that > would give me that. I am not too familiar with the expressions syntax > or how to manipulate them. I see there is an option to search ldap > using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I > should look into that. Do you have any suggestions or source for > reading on authz-regexp? I have been looking. If it was shell > scripting I could manage another way. > > When you say the SASL Realm would that go in the main slapd.conf or > the /usr/lib/sasl2/slapd.conf? > > I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting > close,just gotta get past this. :) > > Thank you again. > James > > > > > ------------------------------ > > Message: 2 > Date: Mon, 11 Aug 2008 17:54:02 +0530 > From: Rahul Amaram <rahul(a)synovel.com> > Subject: Re: Help with authz-regexp mapping kerberos identity to dn > ....SASL > To: openldap-technical(a)openldap.org > Message-ID: <48A02F62.1000305(a)synovel.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Chavez, > This is the authz-regexp string I have used in slapd.conf: > > authz-regexp uid=([^,]*),cn=synovel.com,cn=gssapi,cn=auth > uid=$1,ou=People,dc=synovel,dc=com > > This works if the SASL auth mechanism is gssapi. I have also > hard-coded the SASL Realm with the below config option: > > sasl-realm SYNOVEL.COM > > If it uses the default realm (i.e. sasl-realm option is missing) then > the string would probably be: > > authz-regexp uid=([^,]*),cn=gssapi,cn=auth > uid=$1,ou=People,dc=synovel,dc=com > > > Hope this is of some assistance. For furthur information, kindly read > http://www.openldap.org/doc/admin24/sasl.html#Mapping%20Authentication > %2 > 0Identities > . > > Regards, > Rahul. > > Chavez, James R. wrote: > >> Hello all, >> My plan is to use Kerberos and LDAP as a replacement for NIS. >> My issue is that I need my kerberos credentials to map to a user in >> > LDAP > >> so I can avoid permission issues when logging in with kerberos creds. >> All the perms are based on the UNIX/LDAP users and groups. Thing is >> > the > >> user id's are different between kerberos and LDAP. >> The kerberos names consist of firstname_lastname@REALM. The ldap >> > entries > >> are in the format of standard Unix user names or first letter of >> first name and up to 7 characters of the last name (jmontana). I >> migrated >> > the > >> LDAP entries from my existing NIS maps. >> Now I understand that I can use SASL and authz-regexp in slapd.conf >> to map these id's. Please correct me if I am wrong. >> >> I added all the corresponding "krbName: first_last@REALM" to the >> > users > >> when I added them to the LDAP directory. >> For example for user Joe Montana..His ldap dn is "dn: >> uid=jmontana,ou=People,dc=test,dc=example,dc=com" >> His uid is "uid: jmontana >> And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" >> >> I think all the data is there to get a mapping I just am unsure of >> the auth-regexp strings I need to add to the slapd.conf file. >> Does anyone out there have any experience with this and better yet >> provide the string or example of what strings I can use? >> I have searched the net on how to authenticate with kerberos and >> effictively login with a local id but have been unsuccessful in my >> search. >> Appreciate any help. >> >> Thank You >> James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

How to build custom backend database?
by Ricardo Moreira 15 Aug '08

15 Aug '08

Hi, I am trying to create a custom backend database. I have read http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/12.html<http://www.umich.edu/%7Edirsvcs/ldap/doc/guides/slapd/12.html>and just created my custom API as indicated but I don't know how to make "configure" create the makefile for my custom backend? Do I have to edit "configure.in" and see how the other backends are configured to create my custom code? Regards, -- :: Ricardo Moreira

2 2

DN question
by Kós Tamás 15 Aug '08

15 Aug '08

2008/8/15 Andrew Findlay <andrew.findlay(a)skills-1st.co.uk>: > On Fri, Aug 15, 2008 at 10:41:54AM +0200, Kós Tamás wrote: > >> >> I got a little bit off topic problem, but I hope you can help me about >> >> it. We got an LDAP directory, with many names. We got some same CNs >> >> for instance: John Smiths. The only difference is between the 2 names >> >> is the e-mail address. How can I modify one of them? ldapmodify >> >> request DN, but our enviroment DN seems to be DN: CN=John Smiths. >> >> How can I include the e-mail address to the DN? > >> Thank for your help. I tried to search with this command: >> ldapsearch -xv -h host.somewhere.net -D "CN=jsmiths,O=ACME" -w >> password mail=jsmiths(a)moewhere.net+CN=John\ Smiths >> Nothing found... > > Ah - we have some confusion here. Michael and I both replied to your > first message assuming that you wanted to add new entries for two > people with the same name. I now think that you are trying to > find and modify an existing entry. Yes, we want to modify existing entries, which could be same CN, the unique is the mail attribute. > If you already have two people in the directory who have the same name > then they must have different DNs. It does not matter what those DNs > are - we just need to find them. It looks as if the mail address is > the best way to select the one you want so the search should look > something like this: > > ldapsearch -x -h host.somewhere.net -D "CN=jsmiths,O=ACME" \ > -w password -b O=ACME mail=jsmiths(a)moewhere.net > In this directory where are the two John Smiths don't have Organization, because it has been synchronised from an other directory. The unique attribute is the mail address... The Acme organization needs for only the authentication. I could write admin, not jsmiths. Sorry. > Note that I am assuming that there really is a user with DN > "CN=jsmiths,O=ACME". If not, you will get an "Invalid credentials" > error. In many directories you do not need to specify the DN and > password as they allow anonymous users to search and read. > > Note also that I have supplied a base for the search with the -b > flag. If you do not do this you will get a "No such object" error. > The base object must exist. > >> This persons don't have O or DC attributes. >> Can I ask you to give me some examples for searches and to modify >> people by mail and CN attributes. > > Get the search working first, to find the DN of the entry. > To modify the entry using command-line tools you will need to write > a small LDIF file. Let us assume that you want to add a phone > number to CN=jsmiths,O=ACME: > > dn: CN=jsmiths,O=ACME > changetype: modify > add: telephonenumber > telephonenumber: +1 234 567 890 > > (the file should end with a blank line). > > Now the command will be: > > ldapmodify -x -h host.somewhere.net -D "CN=jsmiths,O=ACME" \ > -w password -f FILENAME > > This assumes that the user "CN=jsmiths,O=ACME" is allowed > to modify their own entry. > > Why not try jXplorer? I will try it, thanks for the idea. > > Andrew > -- > ----------------------------------------------------------------------- > | From Andrew Findlay, Skills 1st Ltd | > | Consultant in large-scale systems, networks, and directory services | > | http://www.skills-1st.co.uk/ +44 1628 782565 | > ----------------------------------------------------------------------- > -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life." -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life."

1 0

Re: ldap_bind: Can't contact LDAP server (-1)
by Michael Ströder 15 Aug '08

15 Aug '08

Kristen Walker wrote: > >> Kristen, please stay on the mailing list you started the thread. Don't >> e-mail me solely personally. > > Sorry about that. Again: Please, use your "Reply to all" button! >> Kristen Walker wrote: >>> Thanks for your help. I can't seem to be able to start the server with the >>> -d flag. Here is what I tried: >>> >>> su root -c /usr/local/libexec/slapd -d 65535 >>> >>> I also tried: >>> >>> su root -d 65535 -c /usr/local/libexec/slapd >>> >>> And it complains in both cases that -d is an invalid option. >> Using -d works for me. Which version of OpenLDAP is this? >> >> Can you post any output it produces? > > I am using openldap-2.3.39 on Ubuntu. > > Here is the output: > > su root -d 65535 -c /usr/local/libexec/slapd > su: invalid option -- d > Usage: su [options] [LOGIN] Obviously this is wrong since you use option -d for the su command. How about doing "su -" just to get root and then use /usr/local/libexec/slapd -d 65535 [..other needed args..] You also have to check your syslog and which user is running slapd normally. Ciao, Michael.

1 0

Re: allow admin group to write excluding specific users
by Gavin Henry 14 Aug '08

14 Aug '08

----- "Stelios A." <stelios.a(a)gmail.com> wrote: > No, i have seperated Groups like: > > dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr > cn: IT > objectClass: groupOfUniqueNames > uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com > uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com > > and all users under ou=Users,dc=mydomain,dc=edu,dc=com OK, just grant one group write and not the other. Remember, ACLs are accessed from top down. There are plenty of examples on the FAQ: http://www.openldap.org/faq/data/cache/52.html Again, also read the man page. Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: allow admin group to write excluding specific users
by Stelios A. 14 Aug '08

14 Aug '08

No, i have seperated Groups like: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com and all users under ou=Users,dc=mydomain,dc=edu,dc=com Thanks 2008/8/14 Gavin Henry <ghenry(a)openldap.org>: > Stelios A. wrote: >> >> Hello, >> >> I have a group called IT and another one called LDAP Admins. There are >> 5 users under IT and 2 under LDAP Admins. >> I'm looking for an acl where members of IT (groupOfUniqueNames) can >> modify/write anywhere under ou=Users.... apart from those users under >> the LDAP Admins group. >> Can anyone give me a help about this please. >> >> I've found only how to give access to IT group but not how to exclude >> LDAP Admins (2 in total) where those 2 exist also under IT group. >> >> Any ideas? > > Your DIT sounds a bit messy. Do you have groups under ou=Users? > > What is your design? > > BTW, man slapd.access > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > -- Stelios A

1 0

Drupal/OpenLDAP integration
by Jeff Sussna 14 Aug '08

14 Aug '08

Anyone have success integrating Drupal with OpenLDAP via the ldapauth module? I've been thrashing all day. Have read Drupal posts that imply others have thrashed as well. Details of my pain are at http://drupal.org/node/295029 . Thx, Jeff

2 1

Re: Drupal/OpenLDAP integration
by Jeff Sussna 14 Aug '08

14 Aug '08

Never mind. I am a blithering idiot. When I changed user passwords in JXplorer, I clicked OK in the password dialog, but then forgot to click Submit in the main window, so the changes never took effect. Tried againd and did it right this time, and everything works just fine. Good news is that I can attest that integrating Drupal with OpenLDAP is trivial, as long as you have a few brain cells left to spare :-).

1 0

NewBi: Trying to setup a custom project.
by Flip Vernooij 13 Aug '08

13 Aug '08

Hi all, For a project at work I need to setup a LDAP server and make it possible to authenticate allot of (yet unwriten) applications. I have been reading for the past 2 days on the internet about this issue but I have the feeling I do not have enough knowledge to provide a correct setup. The idea is that there are a few different ou¹s holding several users. These users all hold login-profiles for the applications we are developping right now. Alldue this sounds kinda logic, I do not exactly understand how the authentication should take place. Lets say: Dn=domain,dn=com ou=test -user name=me pass=secret --app_1 username=appuser password=appSecret ap_related_opt=variable --app_2 username=app2user password=app2secret other_ap_related_opt=variable --app_3 username=app3user password=app3secret other_ap_related_opt=variable -user /// Next user holding the same structure. Now I wrote a master_app that should handle the authentication using LDAP. It received the ³me² username with corresponding password and must fetch a list of profiles used for the requested applications (say app_1 and app_2) I¹m still in doubt about the app username and password, as without a matching profile, application access would be denied anyways so I could store some acl values to (is that right?) Am I on the right track here, any ideas sugestions links or examples? Thanks for reading! Flip Vernooij

1 0

allow admin group to write excluding specific users
by Stelios A. 13 Aug '08

13 Aug '08

Hello, I have a group called IT and another one called LDAP Admins. There are 5 users under IT and 2 under LDAP Admins. I'm looking for an acl where members of IT (groupOfUniqueNames) can modify/write anywhere under ou=Users.... apart from those users under the LDAP Admins group. Can anyone give me a help about this please. I've found only how to give access to IT group but not how to exclude LDAP Admins (2 in total) where those 2 exist also under IT. Thanks

1 0

Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL
by Chavez, James R. 13 Aug '08

13 Aug '08

Rahul, My friend finally a response. Thank you for the input I had also read that link you provided, it was somewhat helpful. If the usernames were identical that would work great I believe. However the source name is coming in as joe_montana and I need it to map to jmontana. So I need only the first character of the first name and everything after the underscore (last name). I am looking for the expression that would give me that. I am not too familiar with the expressions syntax or how to manipulate them. I see there is an option to search ldap using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I should look into that. Do you have any suggestions or source for reading on authz-regexp? I have been looking. If it was shell scripting I could manage another way. When you say the SASL Realm would that go in the main slapd.conf or the /usr/lib/sasl2/slapd.conf? I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting close,just gotta get past this. :) Thank you again. James ------------------------------ Message: 2 Date: Mon, 11 Aug 2008 17:54:02 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Help with authz-regexp mapping kerberos identity to dn ....SASL To: openldap-technical(a)openldap.org Message-ID: <48A02F62.1000305(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Chavez, This is the authz-regexp string I have used in slapd.conf: authz-regexp uid=([^,]*),cn=synovel.com,cn=gssapi,cn=auth uid=$1,ou=People,dc=synovel,dc=com This works if the SASL auth mechanism is gssapi. I have also hard-coded the SASL Realm with the below config option: sasl-realm SYNOVEL.COM If it uses the default realm (i.e. sasl-realm option is missing) then the string would probably be: authz-regexp uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=People,dc=synovel,dc=com Hope this is of some assistance. For furthur information, kindly read http://www.openldap.org/doc/admin24/sasl.html#Mapping%20Authentication%2 0Identities . Regards, Rahul. Chavez, James R. wrote: > Hello all, > My plan is to use Kerberos and LDAP as a replacement for NIS. > My issue is that I need my kerberos credentials to map to a user in LDAP > so I can avoid permission issues when logging in with kerberos creds. > All the perms are based on the UNIX/LDAP users and groups. Thing is the > user id's are different between kerberos and LDAP. > The kerberos names consist of firstname_lastname@REALM. The ldap entries > are in the format of standard Unix user names or first letter of first > name and up to 7 characters of the last name (jmontana). I migrated the > LDAP entries from my existing NIS maps. > Now I understand that I can use SASL and authz-regexp in slapd.conf to > map these id's. Please correct me if I am wrong. > > I added all the corresponding "krbName: first_last@REALM" to the users > when I added them to the LDAP directory. > For example for user Joe Montana..His ldap dn is "dn: > uid=jmontana,ou=People,dc=test,dc=example,dc=com" > His uid is "uid: jmontana > And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" > > I think all the data is there to get a mapping I just am unsure of the > auth-regexp strings I need to add to the slapd.conf file. > Does anyone out there have any experience with this and better yet > provide the string or example of what strings I can use? > I have searched the net on how to authenticate with kerberos and > effictively login with a local id but have been unsuccessful in my > search. > Appreciate any help. > > Thank You > James > > CONFIDENTIALITY > This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. > ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity. > > CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

implicit context attribute in add request
by Wolfgang Bergbauer 12 Aug '08

12 Aug '08

Hi all, I have a problem with the standard JNDI LDAP bind request and wanted to know if OpenLdap behaves differently: e.g. when creating and object with a LDAP addRequest with a context of umObjectGUID=0, OU=People, DC=avaya then I will automatically get a attribute: umObjectGUID with value "0". So this is implicit, I do not specify this attribute. Unfortunately the ldap server then responds that this attribute is readOnly. Can anyone tell me if OpenLdap also add this implicit context attribute, or perhaps what other options do I have here? Thanks a lot, Wolfgang

1 0

ACL's for admin users
by Aravind Arjunan 12 Aug '08

12 Aug '08

hi, In my openldap i created a OU called india under this ou there are many users and one administrator as admin. I want this admin user to add and modify the users details only in this ou. for that i need to set the access control list. Can any one plz help me how to set acl's for this case. Remaining users have only read only permissions. eg: ou=india cn=admin---administrator cn=sachin cn=rahul cn=saurav cn=anil

2 1

allow admin group to write excluding specific users
by Stelios A. 12 Aug '08

12 Aug '08

Hello, I have a group called IT and another one called LDAP Admins. There are 5 users under IT and 2 under LDAP Admins. I'm looking for an acl where members of IT (groupOfUniqueNames) can modify/write anywhere under ou=Users.... apart from those users under the LDAP Admins group. Can anyone give me a help about this please. I've found only how to give access to IT group but not how to exclude LDAP Admins (2 in total) where those 2 exist also under IT group. Any ideas? Thanks

1 0

Re: mail Routing thorugh openldap attribute
by Santosh Balan 12 Aug '08

12 Aug '08

Hi, Create an MX record in your DNS server with the IP of the server, to which you need to divert your mails to and then give the host's name in mailHost attribute of LDAP. Regards Santosh Balan > ----- Original Message ----- > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Subject: Re: mail Routing thorugh openldap attribute > Date: Thu, 07 Aug 2008 14:18:31 +0200 > > > "Aravind Arjunan" <aravind.arjunan(a)gmail.com> writes: > > > hi, > > > > I had configured mailserver in postfix and integrated openldap with postfix. > > All my users information is in openldap. > > > > Now i need to route my mail for particular user to his respective mail box. > > eg: > [...] > > > > So when i send mail to user1 , it will first check the mail > > address is correct or not from ldap entries > > and check mailHost for the particular user and must go the > > particular SMTP server where i had mentioned > > in mailHost attribute in ldap. > > > > But for me it is checking the mailHost attribute and i had > > mentioned the IP of the SMTP server in my LDAP > > for mailHost attribute.So for me it checks the mailHost attribute > > and delivering the mail in the same > > SMTP server by creating the IP as the username and droping the mail > > > > Any body plz guide me home to route the mail to the particular user > > . > > http://www.postfix.org/LDAP_README.html > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://www.dkluenter.de > GPG Key ID:8EF7B6C6 > 53°08'09,95"N > 10°08'02,42"E > = -- Powered by Outblaze

1 0

Help with authz-regexp mapping kerberos identity to dn ....SASL
by Chavez, James R. 11 Aug '08

11 Aug '08

Hello all, My plan is to use Kerberos and LDAP as a replacement for NIS. My issue is that I need my kerberos credentials to map to a user in LDAP so I can avoid permission issues when logging in with kerberos creds. All the perms are based on the UNIX/LDAP users and groups. Thing is the user id's are different between kerberos and LDAP. The kerberos names consist of firstname_lastname@REALM. The ldap entries are in the format of standard Unix user names or first letter of first name and up to 7 characters of the last name (jmontana). I migrated the LDAP entries from my existing NIS maps. Now I understand that I can use SASL and authz-regexp in slapd.conf to map these id's. Please correct me if I am wrong. I added all the corresponding "krbName: first_last@REALM" to the users when I added them to the LDAP directory. For example for user Joe Montana..His ldap dn is "dn: uid=jmontana,ou=People,dc=test,dc=example,dc=com" His uid is "uid: jmontana And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" I think all the data is there to get a mapping I just am unsure of the auth-regexp strings I need to add to the slapd.conf file. Does anyone out there have any experience with this and better yet provide the string or example of what strings I can use? I have searched the net on how to authenticate with kerberos and effictively login with a local id but have been unsuccessful in my search. Appreciate any help. Thank You James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

Updating password in slave ldap server
by Gustavo Mendes de Carvalho 11 Aug '08

11 Aug '08

Hi All, I have 2 LDAP Servers (1 master and 1 slave) and I synchronize bdb database by slurp daemon. So, when somebody needs to update his/her password or other information, everything is done in master server and then slave server receives this updates. This 2 servers are in the same physical place. Now I am planning to put another LDAP slave in other geographical place (far from this 2 servers) and because of that I am planning to put some slave server receiving all updates from master server, but in all ldap client machines in this new location I would like to configure this new slave server (Slave server 2) as URI host in ldap.conf files. I mean Location 1: Master server 1 and slave server 1 Location 2: Slave server 2 Is there any way to do: 1. ldap client machines in location 2 to authenticate using Slave server 2 ? 2. when client machines needs to change some ldap information (like password or personal information), to force this update to occurs in slave server 2 and then master server 1 receives this uodate ? Do I have to use 2 Master servers (1 in each location) ? If yes, can I synchronize both BDB databases ? How ? Any other suggestions ? Thanks in advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 4

using query filter with dynlist attributes
by Rahul Amaram 09 Aug '08

09 Aug '08

Hi, I would like to know if it is possible to use the dynamic attributes (obtained by dynlist overlay), in a ldapsearch query filter. I have tried using it but it does not seem to be working. Is there any fix for this or is there any other overlay which will allow me to perform an operation similar to sql join across different DN? Thanks and Regards, Rahul.

2 1

RE: LDAP Group Membership Scalability
by Jeff Sussna 09 Aug '08

09 Aug '08

Fantastic! What I was hoping/expecting to hear :-). ________________________________________ From: Gavin Henry [ghenry(a)OpenLDAP.org] Sent: Friday, August 08, 2008 4:57 PM To: Jeff Sussna Cc: openldap-technical(a)openldap.org Subject: Re: LDAP Group Membership Scalability Jeff Sussna wrote: > I am looking into using OpenLDAP to manage users and groups for my > system. A single group may contain up to 50,000 users. Does the LDAP > group membership mechanism suffer any scalability problems at that size? > > --------------------------------------------------------------- > Jeff Sussna > No. Some fortune 50s have every employee in an OpenLDAP Dynamic Group. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

LDAP Group Membership Scalability
by Jeff Sussna 09 Aug '08

09 Aug '08

I am looking into using OpenLDAP to manage users and groups for my system. A single group may contain up to 50,000 users. Does the LDAP group membership mechanism suffer any scalability problems at that size? --------------------------------------------------------------- Jeff Sussna

3 2

Using logical operators in LDAP queries.....
by ashish mahamuni 08 Aug '08

08 Aug '08

Hello everybody... I've my own objectClass called 'Agency'. It has fields called 'radius' and 'agencyName'. I want to find out all 'agencyNames' such that 'radius' is less than 400. How can I achieve this? Regards Ashish Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

3 4

Basic Master/Slave replication, take slave down, slave hangs
by Brad T Waldorf 07 Aug '08

07 Aug '08

This may be problem that's been fixed from 2.4.6 to 2.4.11. I'm hoping someone recognizes it and can confirm it's been fixed. (We committed to 2.4.6 for the short term future.) We've got basic refreshAndPersist replication working fine. Replication declarations from the master slapd.conf... overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Replication declarations from the slave slapd.conf.... syncrepl rid=123 provider=ldap://<masterIP>:389 type=refreshAndPersist retry="120 +" searchbase="o=replDB" bindmethod=simple binddn="cn=replman,o=replDB" credentials=password When we shut down the slave, the slave hangs. Here's the debug log... daemon: closing 12582954+ slapd shutdown: waiting for 1 threads to terminate+ =.do_syncrepl rid=123+ connection_get(12582955)+ connection_get(12582955): got connid=0+ daemon: removing 12582955r+ ldap_free_request (origid 2, msgid 2)+ ldap_free_connection 1 1+ ldap_send_unbind+ ber_flush2: 7 bytes to sd 12582955+ 0000: 30 05 02 01 03 42 00 0....B. + ldap_write: want=7, written=7+ 0000: 30 05 02 01 03 42 00 0....B. + ldap_free_connection: actually freed+ We think the problem is with the following code in tpool.c. Specifically, ltp_open_count has a value of 1, so we're stuck in a loop. If we set ltp_open_count to 0, the server comes down properly. At that point we can restart it again. while (pool->ltp_open_count) { if (!pool->ltp_pause) ldap_pvt_thread_cond_broadcast(&pool->ltp_cond); ldap_pvt_thread_cond_wait(&pool->ltp_cond, &pool-> ltp_mutex); } Does this problem look familiar to anyone? Once again, we apologize for being on a backlevel release... but we committed to 2.4.6 for the first release, which is coming up shortly. We'll be upgrading for future releases... and we're hoping this problem (if it is a real problem) has been fixed. Thanks in advance...

2 1

RE : [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 07 Aug '08

07 Aug '08

Hi All I found my error about this problem. I correct the right of certificate ssl files. Regards for all Karim Bourenane 112 Av. Charles de Gaules 92520 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com <http://www.equant.com/> ********************************* This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender. ********************************

1 0

mail Routing thorugh openldap attribute
by Aravind Arjunan 07 Aug '08

07 Aug '08

hi, I had configured mailserver in postfix and integrated openldap with postfix. All my users information is in openldap. Now i need to route my mail for particular user to his respective mail box. eg: user1(a)afnet.com to machine1 user2(a)afnet.com to machine2 So in openldap i had added attribute like for user1 mail: user1(a)afnet.com mailHost: machine1(IP) or Hostname mailRoutingAddress: user1(a)afnet.com for user2 mail: user2(a)afnet.com mailHost: machine2(IP) or Hostname mailRoutingAddress: user2(a)afnet.com In /etc/postfix/main.cf queryfilter = (mail=%s) resultattribute = mailRoutingAddress So when i send mail to user1 , it will first check the mail address is correct or not from ldap entries and check mailHost for the particular user and must go the particular SMTP server where i had mentioned in mailHost attribute in ldap. But for me it is checking the mailHost attribute and i had mentioned the IP of the SMTP server in my LDAP for mailHost attribute.So for me it checks the mailHost attribute and delivering the mail in the same SMTP server by creating the IP as the username and droping the mail Any body plz guide me home to route the mail to the particular user .

2 1

VMware and mirror/multimaster
by Dave Horsfall 06 Aug '08

06 Aug '08

Has anyone tried mirroring or multimaster under VMware i.e. are the virtual clocks stable enough? We're starting to use VMware to cut down on the number of physical hosts, but I'd like to use the latest 2.4 features as well. -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

5 11

TLS Configuration - "unable to get TLS client DN, error=49"
by Brad T Waldorf 05 Aug '08

05 Aug '08

Hi. We're trying to configure a basic SSL (TLS) connection through OpenLDAP version 2.4.6. We're using Linux, Debian Version 4.0 ('etch') INTEL. The pertinent info... slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel -1 logfile /usr/local/var/openldap-data/logb TLSCACertificateFile /home/bwaldorf/certs/1024pcert.pem TLSCertificateFile /home/bwaldorf/certs/1024pcert.pem TLSCertificateKeyFile /home/bwaldorf/certs/1024pkey.pem TLSCipherSuite DES-CBC-SHA TLSVerifyClient never #TLSRandFile #TLSEphemeralDHParamFile ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=replDB" rootdn "cn=replman,o=replDB" rootpw password timelimit 1 idletimeout 4 access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by * read directory /usr/local/var/openldap-data index sn,mail,uid,title eq ldap.conf TLS_CACERT /home/bwaldorf/certs/1024pcert.pem TLS_CERT /home/bwaldorf/certs/1024pcert.pem TLS_KEY /home/bwaldorf/certs/1024pkey.pem So we try the following search (-ZZ to force the command to be successful)... ldapsearch -x -D "cn=replman,o=replDB" -w password -b "o=replDB1" -ZZ And we get the following output (below) with -d -1... (sorry for the excessive messages). Looks like the problem is... "connection_read(13): unable to get TLS client DN, error=49 id=5" I did some googling for this error, but never found a thread with a cause/solution. Thanks in advance for your time and help! daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: listen=8, new connection on 13 daemon: activity on:daemon: added 13r (active) listener=(nil) conn=5 fd=13 ACCEPT from IP=127.0.0.1:32933 (IP=0.0.0.0:389)) daemon: epoll: listen=7 active_threads=1 tvp=zero. daemon: epoll: listen=8 active_threads=1 tvp=zero. daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero. connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero. connection_get(13): got connid=5 connection_read(13): checking for input on id=5 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0xa0c11fc8 ptr=0xa0c11fc8 end=0xa0c11fe5 len=29. 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=5 op=0 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0xa0c11fc8 ptr=0xa0c11fcb end=0xa0c11fe5 len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 conn=5 op=0 EXT oid=1.3.6.1.4.1.1466.20037 do_extended: oid=1.3.6.1.4.1.1466.20037 daemon: activity on 1 descriptor conn=5 op=0 STARTTLS daemon: activity on:send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 daemon: epoll: listen=7 active_threads=1 tvp=zero ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ conn=5 op=0 RESULT oid= err=0 text= daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 80 74 01 03 01 00 4b 00 00 00 20 .t....K....... tls_read: want=107, got=107 0000: 00 00 39 00 00 38 00 00 35 00 00 16 00 00 13 00 ..9..8..5....... 0010: 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f 03 00 .......3..2../.. 0020: 80 00 00 05 00 00 04 01 00 80 00 00 15 00 00 12 ................ 0030: 00 00 09 06 00 40 00 00 14 00 00 11 00 00 08 00 .....@.......... 0040: 00 06 04 00 80 00 00 03 02 00 80 15 2d dd 5d 9a ............-.]. 0050: f5 29 55 3b 15 f2 e5 47 18 9c 22 f2 7d 07 51 72 .)U;...G..".}.Qr 0060: 60 1f 38 61 8d 9a e7 67 2a 5e 9e `.8a...g*^..}. TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=985, written=985 0000: 16 03 01 00 4a 02 00 00 46 03 01 48 92 1d e7 69 ....J...F..H...i 0010: f3 a0 ea 95 0f 3b 21 71 a5 b0 11 34 27 91 b8 0b .....;!q...4'... 0020: d1 25 4f ca d5 56 fd 55 d2 0f 33 20 a7 fe 44 07 .%O..V.U..3 ..D. 0030: 8a 33 a1 ec 46 61 01 94 2a 05 9a 59 9e 95 02 ec .3..Fa..*..Y.... 0040: 99 82 42 77 1d f6 bf 6e b4 0f 05 23 00 09 00 16 ..Bw...n...#.... 0050: 03 01 03 7c 0b 00 03 78 00 03 75 00 03 72 30 82 ...|...x..u..r0. 0060: 03 6e 30 82 02 d7 a0 03 02 01 02 02 01 00 30 0d .n0...........0. 0070: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 81 87 ..*.H........0.. 0080: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 1.0...U....US1.0 0090: 0f 06 03 55 04 08 13 08 4e 65 77 20 59 6f 72 6b ...U....New York 00a0: 31 15 30 13 06 03 55 04 07 13 0c 50 6f 75 67 68 1.0...U....Pough 00b0: 6b 65 65 70 73 69 65 31 0c 30 0a 06 03 55 04 0a keepsie1.0...U.. 00c0: 13 03 49 42 4d 31 0c 30 0a 06 03 55 04 0b 13 03 ..IBM1.0...U.... 00d0: 54 50 46 31 0e 30 0c 06 03 55 04 03 13 05 44 61 TPF1.0...U....Da 00e0: 76 69 64 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 vid1"0 ..*.H.... 00f0: 09 01 16 13 6d 6f 7a 65 73 68 74 61 40 75 73 2e ....mozeshta@us. 0100: 69 62 6d 2e 63 6f 6d 30 1e 17 0d 30 38 30 33 31 ibm.com0...08031 0110: 31 30 31 31 36 31 31 5a 17 0d 31 30 31 32 30 37 1011611Z..101207 0120: 30 31 31 36 31 31 5a 30 81 87 31 0b 30 09 06 03 011611Z0..1.0... 0130: 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 U....US1.0...U.. 0140: 13 08 4e 65 77 20 59 6f 72 6b 31 15 30 13 06 03 ..New York1.0... 0150: 55 04 07 13 0c 50 6f 75 67 68 6b 65 65 70 73 69 U....Poughkeepsi 0160: 65 31 0c 30 0a 06 03 55 04 0a 13 03 49 42 4d 31 e1.0...U....IBM1 0170: 0c 30 0a 06 03 55 04 0b 13 03 54 50 46 31 0e 30 .0...U....TPF1.0 0180: 0c 06 03 55 04 03 13 05 44 61 76 69 64 31 22 30 ...U....David1"0 0190: 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 6d 6f ..*.H........mo 01a0: 7a 65 73 68 74 61 40 75 73 2e 69 62 6d 2e 63 6f zeshta(a)us.ibm.co 01b0: 6d 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 m0..0...*.H..... 01c0: 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ac ee .......0........ 01d0: f9 a7 40 cc 73 af 67 a0 ea 46 08 45 a5 fd 44 71 ..@.s.g..F.E..Dq 01e0: a4 04 3e 51 f7 39 51 82 3d 7e 9b 99 ae 1d c1 22 ..>Q.9Q.=~....." 01f0: 67 10 e7 15 d1 a9 65 75 e9 3e 0f 77 64 d1 14 4d g.....eu.>.wd..M 0200: 28 f0 8c ba d3 ed 87 e9 b1 5b 11 c1 3f 11 ed 1a (........[..?... 0210: 96 9a 3f b3 4b f3 db bd 84 41 11 aa ea 37 6d ab ..?.K....A...7m. 0220: c5 fb a9 bb ab 9d 87 66 b2 31 7a c8 35 06 06 ec .......f.1z.5... 0230: fb 07 f1 29 f5 f3 fd 29 f4 df 33 bf 40 de 84 6f ...)...)..3.@..o 0240: 9d 66 ea 57 42 ab 0f 13 a0 07 71 d5 e0 6d 02 03 .f.WB.....q..m.. 0250: 01 00 01 a3 81 e7 30 81 e4 30 1d 06 03 55 1d 0e ......0..0...U.. 0260: 04 16 04 14 11 76 af b1 5a bd 99 53 a5 de 02 35 .....v..Z..S...5 0270: 06 51 c4 01 74 71 2c c6 30 81 b4 06 03 55 1d 23 .Q..tq,.0....U.# 0280: 04 81 ac 30 81 a9 80 14 11 76 af b1 5a bd 99 53 ...0.....v..Z..S 0290: a5 de 02 35 06 51 c4 01 74 71 2c c6 a1 81 8d a4 ...5.Q..tq,..... 02a0: 81 8a 30 81 87 31 0b 30 09 06 03 55 04 06 13 02 ..0..1.0...U.... 02b0: 55 53 31 11 30 0f 06 03 55 04 08 13 08 4e 65 77 US1.0...U....New 02c0: 20 59 6f 72 6b 31 15 30 13 06 03 55 04 07 13 0c York1.0...U.... 02d0: 50 6f 75 67 68 6b 65 65 70 73 69 65 31 0c 30 0a Poughkeepsie1.0. 02e0: 06 03 55 04 0a 13 03 49 42 4d 31 0c 30 0a 06 03 ..U....IBM1.0... 02f0: 55 04 0b 13 03 54 50 46 31 0e 30 0c 06 03 55 04 U....TPF1.0...U. 0300: 03 13 05 44 61 76 69 64 31 22 30 20 06 09 2a 86 ...David1"0 ..*. 0310: 48 86 f7 0d 01 09 01 16 13 6d 6f 7a 65 73 68 74 H........mozesht 0320: 61 40 75 73 2e 69 62 6d 2e 63 6f 6d 82 01 00 30 a@us.ibm.com...0 0330: 0c 06 03 55 1d 13 04 05 30 03 01 01 ff 30 0d 06 ...U....0....0.. 0340: 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 00 .*.H............ 0350: a8 39 22 f9 88 b2 c1 e6 95 5e af 4d ae f6 89 e5 .9"......^.M.... 0360: 64 82 37 42 f6 5b 00 56 22 d0 c6 b9 5f 70 36 2f d.7B.[.V"..._p6/ 0370: 8f 10 bb 5a d1 18 33 2a 37 8a a0 f2 c3 53 21 12 ...Z..3*7....S!. 0380: 2c 28 8a 62 a9 e0 b5 5a 70 4c 77 f1 5c 33 d2 a3 ,(.b...ZpLw.\3.. 0390: 6d 77 e8 6e e8 7e 5b 74 d9 3a 70 24 38 89 ce 11 mw.n.~[t.:p $8... 03a0: 4c ec 64 51 f2 be 61 4c 18 09 25 13 48 e2 5b 13 L.dQ..aL..%.H.[. 03b0: d9 fa 8c 0c b7 a2 dd 09 dd e8 da 01 c7 29 2b 9a .............)+. 03c0: 22 51 6f 19 54 e7 02 90 75 0e a9 3a 4b e0 d1 a4 "Qo.T...u..:K... 03d0: 16 03 01 00 04 0e 00 00 00 ...........: TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A.........: TLS trace: SSL_accept:error in SSLv3 read client certificate A.........: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=1 tvp=zero daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 tls_read: want=5, got=5 0000: 16 03 01 00 86 ...........: tls_read: want=134, got=134 0000: 10 00 00 82 00 80 91 6b 72 70 d5 4e 89 66 4e 5f .......krp.N.fN_ 0010: f2 d6 d6 41 e7 3a 85 1e 8e ce 85 4d 90 ac 4a ec ...A.:.....M..J. 0020: 81 f6 4d 2c 1d 94 85 e8 78 cf c9 68 11 77 b3 4e ..M,....x..h.w.N 0030: 13 97 62 43 e2 e8 12 44 42 46 c6 bc c3 74 c7 ad ..bC...DBF...t.. 0040: f7 46 22 2b ac 8c 8e 59 5d de f4 fd f9 73 3f 76 .F"+...Y]....s?v 0050: 1b 58 1f da 5c 95 49 a6 73 ec 75 37 fc 38 fa 53 .X..\.I.s.u7.8.S 0060: 6d 3c a9 fd 2a 7d c3 f7 b9 79 e7 3f 8f da df 04 m<..*}...y.?.... 0070: cb 06 e2 67 75 3c 57 cf 8e 60 6e e4 27 fa 23 a3 ...gu<W..`n.'.#. 0080: b8 fb c6 5b 14 7e ...[.~ TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 0000: 14 03 01 00 01 ..... tls_read: want=1, got=1 0000: 01 ..... tls_read: want=5, got=5 0000: 16 03 01 00 28 ....( tls_read: want=40, got=40 0000: 77 34 09 6c 45 e9 f1 f0 a2 e6 cb 2d e4 49 27 42 w4.lE......-.I'B 0010: 45 a5 84 74 bb bd 0f 6e 24 70 e1 b0 0f 19 83 4a E..t...n $p.....J 0020: 7a 41 c3 b3 ca fe 80 68 zA.....h TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=51, written=51 0000: 14 03 01 00 01 01 16 03 01 00 28 97 a6 bb b1 8c ..........(..... 0010: 50 d4 6f 60 2c fb c7 d1 10 a6 a6 37 ff ea 0b e8 P.o`,......7.... 0020: 60 d0 f1 6b 34 d7 26 7b a9 c8 c0 45 72 33 7c 67 `..k4.&{...Er3| g 0030: b4 07 93 ... TLS trace: SSL_accept:SSLv3 flush data connection_read(13): unable to get TLS client DN, error=49 id=5 conn=5 fd=13 TLS established tls_ssf=56 ssf=56 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=1 tvp=zero daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 ber_get_next tls_read: want=5, got=0 ldap_read: want=8, got=0 ber_get_next on fd 13 failed errno=0 (Success) connection_read(13): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=13 for close connection_close: conn=5 sd=13 daemon: removing 13 daemon: activity on 1 descriptor tls_write: want=29, written=29 0000: 15 03 01 00 18 73 41 45 4f f9 51 03 05 e6 66 c2 .....sAEO.Q...f. 0010: f5 65 d2 a9 ab 03 aa 8d d1 79 ef 18 8c .e.......y.... TLS trace: SSL3 alert write:warning:close notify conn=5 fd=13 closed (connection lost) daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL

4 4

updateref difficulty
by John Oliver 05 Aug '08

05 Aug '08

I added an updateref statement to my slave/consumer server, referring back to the master/producer: updateref ldap://test1.mydomain.com In the logs on the slave, I can see that it does look like it refers the client to the master... Aug 5 09:21:19 unix-services2 slapd[29985]: daemon: select: listen=7 active_threads=0 tvp=zero Aug 5 09:21:19 unix-services2 slapd[29985]: daemon: select: listen=8 active_threads=0 tvp=zero Aug 5 09:21:19 unix-services2 slapd[29985]: do_modify Aug 5 09:21:19 unix-services2 slapd[29985]: do_modify: dn (uid=joliver,ou=People,dc=mydomain,dc=com) Aug 5 09:21:19 unix-services2 slapd[29985]: >>> dnPrettyNormal: <uid=joliver,ou=People,dc=mydomain,dc=com> Aug 5 09:21:19 unix-services2 slapd[29985]: <<< dnPrettyNormal: <uid=joliver,ou=People,dc=mydomain,dc=com>, <uid=joliver,ou=people,dc=mydomain,dc=com> Aug 5 09:21:19 unix-services2 slapd[29985]: modifications: Aug 5 09:21:19 unix-services2 slapd[29985]: replace: userPassword Aug 5 09:21:19 unix-services2 slapd[29985]: one value, length 41 Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 MOD dn="uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 MOD attr=userPassword Aug 5 09:21:19 unix-services2 slapd[29985]: bdb_dn2entry("uid=joliver,ou=people,dc=mydomain,dc=com") Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: conn=22 op=5 p=3 Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: err=10 matched="" text="" Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: referral="ldap://test1.mydomain.com/uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_response: msgid=6 tag=103 err=10 Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_response: ref="ldap://test1.mydomain.com/uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 RESULT tag=103 err=10 text= Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: activity on 1 descriptor Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: activity on: Aug 5 09:21:22 unix-services2 slapd[29985]: 28r Aug 5 09:21:22 unix-services2 slapd[29985]: Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: read active on 28 Aug 5 09:21:22 unix-services2 slapd[29985]: connection_get(28) Aug 5 09:21:22 unix-services2 slapd[29985]: connection_get(28): got connid=22 Aug 5 09:21:22 unix-services2 slapd[29985]: connection_read(28): checking for input on id=22 Aug 5 09:21:22 unix-services2 slapd[29985]: do_unbind Aug 5 09:21:22 unix-services2 slapd[29985]: ber_get_next on fd 28 failed errno=0 (Success) Aug 5 09:21:22 unix-services2 slapd[29985]: conn=22 op=6 UNBIND Aug 5 09:21:22 unix-services2 slapd[29985]: connection_read(28): input error=-2 id=22, closing. Aug 5 09:21:22 unix-services2 slapd[29985]: connection_closing: readying conn=22 sd=28 for close Aug 5 09:21:22 unix-services2 slapd[29985]: connection_close: deferring conn=22 sd=28 Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: select: listen=7 active_threads=0 tvp=zero Aug 5 09:21:22 unix-services2 slapd[29985]: connection_resched: attempting closing conn=22 sd=28 Howver, nothing is logged on the master, and the client bombs out with: LDAP password information update failed: Can't contact LDAP server The client can authenticate against test1 (the master server) with the appropriate change to /etc/ldap.conf -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 2

Multiple email addresses +Postfix
by Stelios A. 05 Aug '08

05 Aug '08

Hello all, I have a master/slave Openldap 2.4.9 running on ubuntu server along with Postfix and dovecot. At the moment email server is able to server email for domain1.com with Maildir support for Dovecot at /home/username/ for each user. There is a need to add a 2nd domain let's say domain2.com. My question is where that domain will store the emails as the user home dir is already setup in ldap at /home/username Is there a way to define a new attribute like alternative email and have the same user with same auth details authenticate to both domains like user1(a)domain1.com and with same pass on user1(a)domain2.com? I'm not sure if I'm explain enough the situation, please ask for any clarification if you want to. -- Stelios A

2 1

Creating a "big" database... large LDIF file. automated procedure?
by Brad T Waldorf 05 Aug '08

05 Aug '08

Hi again. Thanks again for your responses to my prior posts. So far, all of my experience with OpenLDAP has been with databases with a minimal number of entries... 200 at the most. I'd like to do some performance experiments with a much larger database, say 10,000 database entries or so. What would you recommend for creating such a database? (Entries don't have to have real, sensible data... maybe the distinguished name is an integer that increases by 1?) Is there an automated way for creating such a database? Thanks,

2 2

Organizational Unit Listing
by Emre Yilmaz 04 Aug '08

04 Aug '08

hi list, We need list to all of organizational unit's in Active Directory with members. Its very important for me. Is there any idea? _________________________________________________________________ Windows Live Spaces – hayatınız, Alanınız. Daha fazlasını öğrenmek için buraya tıklayın. http://get.live.com/spaces/overview

5 5

Newbi question.
by Narsi Bala 03 Aug '08

03 Aug '08

I have just started to dig into openLDAP and I am against a roadblock right now...I am sure the issue i am having is straightforward for those LDAP experts out there, so bear with my ignorance. My slapd.conf file is listed below # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path ./ucdata include ./schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap:/root.openldap.org pidfile ./run/slapd.pid argsfile ./run/slapd.args # Load dynamic backend modules: # modulepath ./libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq I am connecting to the server just fine, and I am looking at the database through eclipse apache DS studio plugin. Notice how I have the rootDN set to "cn=Manager,dc=my-domain,dc=com" and the suffix set to "dc=my-domain,dc=com", but I dont see this root entry in my editor. all I see is Root DSE(1). I expand that tree and there is nothing underneath it. I assume that by starting the server with the above slapd.conf, I should be able to create the rootDN, if not how does one go about creating a rootDN ? Thanks Narsi

4 4

Replicating between Active Directory and Openldap
by Greg McConnel 01 Aug '08

01 Aug '08

Can anyone refer me to documentation or a site that describes how to replicate user and password information between Active Directory and Openldap. I have found a number of sites but most are a few years old and none seem to provide the necessary instructions and tools. Thanks!

2 1

Re: Understanding TLS SSF
by J Davis 31 Jul '08

31 Jul '08

That was it. I'm using 2.4.11 now compiled against openssl and it's working. Thanks! -Jake On Wed, Jul 30, 2008 at 7:36 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > I doubt that's the SSL that OpenLDAP is compiled against. It looks to me > like it is compiled against GnuTLS, and likely affected by ITS#5585, which > was fixed in OpenLDAP 2.4.11. If that's correct, then the real TLS value > is 256. Have you actually run ldd on slapd to see what libraries it is > linked against for SSL? > > --Quanah > > > --On Wednesday, July 30, 2008 1:16 PM -0400 J Davis <mrsalty0(a)gmail.com> > wrote: > > >> Openssl 0.9.8g-4ubuntu3.3 >> >> Thanks, >> -Jake >> >> >> On Wed, Jul 30, 2008 at 12:02 PM, Buchan Milne >> <bgmilne(a)staff.telkomsa.net> wrote: >> >> >> >> >> On Wednesday 30 July 2008 15:59:52 J Davis wrote: >> >>> Greetings, >>> >>> I'm testing an installation of openldap 2.4.9. I want to enforce TLS for >>> all access to the directory. >>> My problem is that I cannot get the client to meet the ssf restictions I >>> have in place. The documentation I've seen on ssf and tls_ssf is very >>> sparse so I don't really understand what it does. >>> >>> I'm using self signed cert created using the openssl CA.sh script. >>> >>> Relevant portions of the slapd.conf... >>> >>> TLSCACertificateFile /etc/ldap/ssl/cacert.pem >>> TLSCertificateFile /etc/ldap/ssl/servercrt.pem >>> TLSCertificateKeyFile /etc/ldap/ssl/serverkey.pem >>> ... >>> access to * >>> by tls_ssf=128 ssf=128 anonymous auth >>> by tls_ssf=128 ssf=128 self write >>> >>> Relevant portions of the lapd.conf... >>> >>> TLS_CACERT /etc/ldap/ssl/cacert.pem >>> >>> With those ACLs in place I get the following error: >>> >>> $ ldapsearch -x -ZZ -D "uid=jake,ou=people,dc=example,dc=com" -W -b >>> "uid=jake,ou=people,dc=example,dc=com" >>> ldap_bind: Invalid credentials (49) >>> >>> And slapd in debug mode shows me that I didn't meet the ssf >>> requirments... >>> >>> connection_read(15): unable to get TLS client DN, error=49 id=0 >>> conn=0 fd=15 TLS established tls_ssf=32 ssf=32 >>> ... >>> <= check a_authz.sai_tls_ssf: ACL 128 > OP 32 >>> >> >> What ssl implementation is your slapd using ? >> >> >> >> > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: translucent overlay with local-only entries
by Sven Ulland 31 Jul '08

31 Jul '08

Gavin Henry wrote: > Did you read the man page? man slapo-translucent I did, but the significance of translucent_local and _remote didn't strike me. Unfortunately it seems that enabling local+remote searching doesn't change the result. I must have a silly bug in my configuration, but I cannot figure out where. Various combinations of translucent_local and _remote give different, but consistent, results: neither local nor remote: only remote entries returned local only: no entries returned remote only: only remote entries returned local and remote: only remote entries returned I use the following in my slapd.conf[1]: translucent_remote uid translucent_local uid The databases on each host seem fine. The main ldap directory contains an ou with a single uid[2]; the branch extension directory contains one attribute modification and one local-only entry[3]. I ran a full debug with 'translucent_local uid' in the configuration file: slapd -g openldap -u openldap -f /etc/ldap/slapd.conf -d 65535 The search command I use: ldapsearch -x -W -D 'cn=branchadmin,dc=branch,dc=example,dc=com' \ -H ldap://localhost -b 'dc=example,dc=com' -LLL 'uid=*' uid The output[5] seems to show (on lines 523 and 615, for example), that uid=barney is found, but I'm not able to determine why it is not returned to the client. I also dumped the network packets to verify that uid=barney was not retured. It wasn't. sven [1] Entire /etc/ldap/slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/autofs.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload translucent sizelimit 500 tool-threads 1 backend bdb backend ldap database bdb directory /var/lib/ldap/translucent4 suffix "dc=example,dc=com" rootdn "cn=branchadmin,dc=branch,dc=example,dc=com" rootpw "admin" index objectclass eq index uid eq,sub lastmod off overlay translucent translucent_remote uid translucent_local uid uri "ldap://172.27.27.37" idassert-bind bindmethod=simple binddn="cn=mainadmin,dc=example,dc=com" credentials="admin" mode=none #end [2] slapcat on main ldap: dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization dc: example o: Simple example structuralObjectClass: organization dn: cn=mainadmin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: mainadmin description: LDAP administrator userPassword:: e2NyeXB0fTRUT2NoeFV0M3AyUEU= structuralObjectClass: organizationalRole dn: ou=People,dc=example,dc=com ou: People objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: uid=andrew,ou=People,dc=example,dc=com uid: andrew cn: Andrew sn: Andrewson uidNumber: 401 gidNumber: 501 homeDirectory: /home/andrew structuralObjectClass: person objectClass: person objectClass: posixAccount #end [3] slapcat on local branch, after a) one modification of existing 'description' field for uid=andrew, and b) one new local-only entry for uid=barney. dn: dc=example,dc=com structuralObjectClass: glue objectClass: top objectClass: glue dn: ou=people,dc=example,dc=com structuralObjectClass: glue objectClass: top objectClass: glue dn: uid=andrew,ou=People,dc=example,dc=com description: changed on branch only dn: uid=barney,ou=People,dc=example,dc=com uid: barney cn: Barney sn: Barneyson uidNumber: 402 gidNumber: 502 homeDirectory: /home/barney objectClass: person objectClass: posixAccount description: only exists on branch #end [4] slapd debug output. 1 @(#) $OpenLDAP: slapd 2.4.10 (Jul 17 2008 14:44:35) $ 2 buildd@ninsei:/build/buildd/openldap-2.4.10/debian/build/servers/slapd 3 ldap_pvt_gethostbyname_a: host=debian, r=0 4 daemon_init: <null> 5 daemon_init: listen on ldap:/// 6 daemon_init: 1 listeners to open... 7 ldap_url_parse_ext(ldap:///) 8 daemon: listener initialized ldap:/// 9 daemon_init: 2 listeners opened 10 ldap_create 11 slapd init: initiated server. 12 slap_sasl_init: initialized! 13 reading config file /etc/ldap/slapd.conf 14 line 1 (include /etc/ldap/schema/core.schema) 15 reading config file /etc/ldap/schema/core.schema [several lines of schema debugging removed] 208 line 7 (pidfile /var/run/slapd/slapd.pid) 209 line 8 (argsfile /var/run/slapd/slapd.args) 210 line 9 (loglevel none) 211 line 11 (modulepath /usr/lib/ldap) 212 line 12 (moduleload back_bdb) 213 loaded module back_bdb 214 bdb_back_initialize: initialize BDB backend 215 bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) 216 module back_bdb: null module registered 217 line 13 (moduleload back_ldap) 218 loaded module back_ldap 219 module back_ldap: null module registered 220 line 14 (moduleload translucent) 221 loaded module translucent 222 ==> translucent_initialize 223 module translucent: null module registered 224 line 16 (sizelimit 500) 225 line 17 (tool-threads 1) 226 line 19 (backend bdb) 227 line 20 (backend ldap) 228 line 22 (database bdb) 229 bdb_db_init: Initializing BDB database 230 line 23 (directory /var/lib/ldap/translucent4) 231 line 24 (suffix "dc=example,dc=com") 232 >>> dnPrettyNormal: <dc=example,dc=com> 233 => ldap_bv2dn(dc=example,dc=com,0) 234 <= ldap_bv2dn(dc=example,dc=com)=0 235 => ldap_dn2bv(272) 236 <= ldap_dn2bv(dc=example,dc=com)=0 237 => ldap_dn2bv(272) 238 <= ldap_dn2bv(dc=example,dc=com)=0 239 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> 240 line 25 (rootdn "cn=branchadmin,dc=branch,dc=example,dc=com") 241 >>> dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com> 242 => ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com,0) 243 <= ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com)=0 244 => ldap_dn2bv(272) 245 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 246 => ldap_dn2bv(272) 247 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 248 <<< dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com>, <cn=branchadmin,dc=branch,dc=example,dc=com> 249 line 26 (rootpw ***) 250 line 27 (index objectclass eq) 251 index objectClass 0x0004 252 line 28 (index uid eq,sub) 253 index uid 0x0714 254 line 29 (lastmod off) 255 line 31 (overlay translucent) 256 ==> translucent_db_init 257 line 32 (translucent_local uid) 258 line 33 (uri "ldap://172.27.27.37") 259 ==> translucent_db_config: uri 260 ldap_url_parse_ext(ldap://172.27.27.37) 261 line 38 (idassert-bind ***) 262 ==> translucent_db_config: idassert-bind 263 >>> dnNormalize: <cn=mainadmin,dc=example,dc=com> 264 => ldap_bv2dn(cn=mainadmin,dc=example,dc=com,0) 265 <= ldap_bv2dn(cn=mainadmin,dc=example,dc=com)=0 266 => ldap_dn2bv(272) 267 <= ldap_dn2bv(cn=mainadmin,dc=example,dc=com)=0 268 <<< dnNormalize: <cn=mainadmin,dc=example,dc=com> 269 >>> dnNormalize: <cn=Subschema> 270 => ldap_bv2dn(cn=Subschema,0) 271 <= ldap_bv2dn(cn=Subschema)=0 272 => ldap_dn2bv(272) 273 <= ldap_dn2bv(cn=subschema)=0 274 <<< dnNormalize: <cn=subschema> 275 matching_rule_use_init [schema lines omitted] 302 slapd startup: initiated. 303 backend_startup_one: starting "cn=config" 304 config_back_db_open 305 config_build_entry: "cn=config" 306 config_build_entry: "cn=module{0}" 307 config_build_entry: "cn=schema" 308 config_build_entry: "cn={0}core" 309 config_build_entry: "cn={1}cosine" 310 config_build_entry: "cn={2}nis" 311 config_build_entry: "cn={3}inetorgperson" 312 config_build_entry: "cn={4}autofs" 313 config_build_entry: "olcDatabase={-1}frontend" 314 config_build_entry: "olcDatabase={0}config" 315 config_build_entry: "olcDatabase={1}bdb" 316 config_build_entry: "olcOverlay={0}translucent" 317 ==> translucent_cfadd 318 config_build_entry: "olcDatabase=ldap" 319 backend_startup_one: starting "dc=example,dc=com" 320 bdb_db_open: "dc=example,dc=com" 321 bdb_db_open: database "dc=example,dc=com": dbenv_open(/var/lib/ldap/translucent4). 322 ==> translucent_db_open 323 backend_startup_one: starting "dc=example,dc=com" 324 ldap_back_db_open: URI=ldap://172.27.27.37 325 slapd starting 326 daemon: added 4r listener=(nil) 327 daemon: added 7r listener=0x82f6068 328 daemon: added 8r listener=0x82f6130 329 daemon: epoll: listen=7 active_threads=0 tvp=NULL 330 daemon: epoll: listen=8 active_threads=0 tvp=NULL 331 daemon: activity on 1 descriptor 332 daemon: activity on: 333 daemon: epoll: listen=7 active_threads=0 tvp=NULL 334 daemon: epoll: listen=8 active_threads=0 tvp=NULL 335 daemon: activity on 1 descriptor 336 daemon: activity on: 337 slap_listener_activate(8): 338 >>> slap_listener(ldap:///) 339 daemon: listen=8, new connection on 13 340 daemon: added 13r (active) listener=(nil) 341 conn=0 fd=13 ACCEPT from IP=127.0.0.1:51638 (IP=0.0.0.0:389) 342 daemon: epoll: listen=7 active_threads=0 tvp=NULL 343 daemon: epoll: listen=8 active_threads=0 tvp=NULL 344 daemon: activity on 1 descriptor 345 daemon: activity on: 346 daemon: epoll: listen=7 active_threads=0 tvp=NULL 347 daemon: epoll: listen=8 active_threads=0 tvp=NULL 348 daemon: activity on 1 descriptor 349 daemon: activity on: 13r 350 daemon: read active on 13 351 daemon: epoll: listen=7 active_threads=0 tvp=NULL 352 daemon: epoll: listen=8 active_threads=0 tvp=NULL 353 connection_get(13) 354 connection_get(13): got connid=0 355 connection_read(13): checking for input on id=0 356 ber_get_next 357 ldap_read: want=8, got=8 358 0000: 30 3b 02 01 01 60 36 02 0;...`6. 359 ldap_read: want=53, got=53 360 0000: 01 03 04 2a 63 6e 3d 62 72 61 6e 63 68 61 64 6d ...*cn=branchadm 361 0010: 69 6e 2c 64 63 3d 62 72 61 6e 63 68 2c 64 63 3d in,dc=branch,dc= 362 0020: 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 example,dc=com.. 363 0030: 61 64 6d 69 6e admin 364 ber_get_next: tag 0x30 len 59 contents: 365 ber_dump: buf=0x83a9dd8 ptr=0x83a9dd8 end=0x83a9e13 len=59 366 0000: 02 01 01 60 36 02 01 03 04 2a 63 6e 3d 62 72 61 ...`6....*cn=bra 367 0010: 6e 63 68 61 64 6d 69 6e 2c 64 63 3d 62 72 61 6e nchadmin,dc=bran 368 0020: 63 68 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 ch,dc=example,dc 369 0030: 3d 63 6f 6d 80 05 61 64 6d 69 6e =com..admin 370 ber_get_next 371 ldap_read: want=8 error=Resource temporarily unavailable 372 conn=0 op=0 do_bind 373 ber_scanf fmt ({imt) ber: 374 ber_dump: buf=0x83a9dd8 ptr=0x83a9ddb end=0x83a9e13 len=56 375 0000: 60 36 02 01 03 04 2a 63 6e 3d 62 72 61 6e 63 68 `6....*cn=branch 376 0010: 61 64 6d 69 6e 2c 64 63 3d 62 72 61 6e 63 68 2c admin,dc=branch, 377 0020: 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f dc=example,dc=co 378 0030: 6d 80 05 61 64 6d 69 6e m..admin 379 ber_scanf fmt (m}) ber: 380 ber_dump: buf=0x83a9dd8 ptr=0x83a9e0c end=0x83a9e13 len=7 381 0000: 00 05 61 64 6d 69 6e ..admin 382 >>> dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com> 383 => ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com,0) 384 <= ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com)=0 385 => ldap_dn2bv(272) 386 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 387 => ldap_dn2bv(272) 388 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 389 <<< dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com>, <cn=branchadmin,dc=branch,dc=example,dc=com> 390 conn=0 op=0 BIND dn="cn=branchadmin,dc=branch,dc=example,dc=com" method=128 391 do_bind: version=3 dn="cn=branchadmin,dc=branch,dc=example,dc=com" method=128 392 translucent_bind: <cn=branchadmin,dc=branch,dc=example,dc=com> method 128 393 conn=0 op=0: rootdn="cn=branchadmin,dc=branch,dc=example,dc=com" bind succeeded 394 conn=0 op=0 BIND dn="cn=branchadmin,dc=branch,dc=example,dc=com" mech=SIMPLE ssf=0 395 do_bind: v3 bind: "cn=branchadmin,dc=branch,dc=example,dc=com" to "cn=branchadmin,dc=branch,dc=example,dc=com" 396 send_ldap_result: conn=0 op=0 p=3 397 send_ldap_result: err=0 matched="" text="" 398 send_ldap_response: msgid=1 tag=97 err=0 399 ber_flush2: 14 bytes to sd 13 400 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 401 ldap_write: want=14, written=14 402 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 403 conn=0 op=0 RESULT tag=97 err=0 text= 404 daemon: activity on 1 descriptor 405 daemon: activity on: 406 daemon: epoll: listen=7 active_threads=0 tvp=NULL 407 daemon: epoll: listen=8 active_threads=0 tvp=NULL 408 daemon: activity on 1 descriptor 409 daemon: activity on: 13r 410 daemon: read active on 13 411 daemon: epoll: listen=7 active_threads=0 tvp=NULL 412 daemon: epoll: listen=8 active_threads=0 tvp=NULL 413 connection_get(13) 414 connection_get(13): got connid=0 415 connection_read(13): checking for input on id=0 416 ber_get_next 417 ldap_read: want=8, got=8 418 0000: 30 33 02 01 02 63 2e 04 03...c.. 419 ldap_read: want=45, got=45 420 0000: 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 .dc=example,dc=c 421 0010: 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 om.............. 422 0020: 00 87 03 75 69 64 30 05 04 03 75 69 64 ...uid0...uid 423 ber_get_next: tag 0x30 len 51 contents: 424 ber_dump: buf=0x83aa218 ptr=0x83aa218 end=0x83aa24b len=51 425 0000: 02 01 02 63 2e 04 11 64 63 3d 65 78 61 6d 70 6c ...c...dc=exampl 426 0010: 65 2c 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 e,dc=com........ 427 0020: 00 02 01 00 01 01 00 87 03 75 69 64 30 05 04 03 .........uid0... 428 0030: 75 69 64 uid 429 ber_get_next 430 ldap_read: want=8 error=Resource temporarily unavailable 431 conn=0 op=1 do_search 432 ber_scanf fmt ({miiiib) ber: 433 ber_dump: buf=0x83aa218 ptr=0x83aa21b end=0x83aa24b len=48 434 0000: 63 2e 04 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 c...dc=example,d 435 0010: 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 c=com........... 436 0020: 00 01 01 00 87 03 75 69 64 30 05 04 03 75 69 64 ......uid0...uid 437 >>> dnPrettyNormal: <dc=example,dc=com> 438 => ldap_bv2dn(dc=example,dc=com,0) 439 <= ldap_bv2dn(dc=example,dc=com)=0 440 => ldap_dn2bv(272) 441 <= ldap_dn2bv(dc=example,dc=com)=0 442 => ldap_dn2bv(272) 443 <= ldap_dn2bv(dc=example,dc=com)=0 444 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> 445 SRCH "dc=example,dc=com" 2 0 0 0 0 446 begin get_filter 447 PRESENT 448 ber_scanf fmt (m) ber: 449 ber_dump: buf=0x83aa218 ptr=0x83aa23f end=0x83aa24b len=12 450 0000: 87 03 75 69 64 30 05 04 03 75 69 64 ..uid0...uid 451 end get_filter 0 452 filter: (uid=*) 453 ber_scanf fmt ({M}}) ber: 454 ber_dump: buf=0x83aa218 ptr=0x83aa244 end=0x83aa24b len=7 455 0000: 00 05 04 03 75 69 64 ....uid 456 attrs: uid 457 conn=0 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=*)" 458 conn=0 op=1 SRCH attr=uid 459 ==> translucent_search: <dc=example,dc=com> (uid=*) 460 => bdb_search 461 bdb_dn2entry("dc=example,dc=com") 462 => bdb_dn2id("dc=example,dc=com") 463 <= bdb_dn2id: got id=0x1 464 entry_decode: "dc=example,dc=com" 465 <= entry_decode(dc=example,dc=com) 466 => access_allowed: search access to "dc=example,dc=com" "entry" requested 467 <= root access granted 468 => access_allowed: search access granted by manage(=mwrscxd) 469 search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 470 => bdb_dn2idl("dc=example,dc=com") 471 => bdb_filter_candidates 472 AND 473 => bdb_list_candidates 0xa0 474 => bdb_filter_candidates 475 OR 476 => bdb_list_candidates 0xa1 477 => bdb_filter_candidates 478 EQUALITY 479 => bdb_equality_candidates (objectClass) 480 daemon: activity on 1 descriptor 481 daemon: activity on: 482 daemon: epoll: listen=7 active_threads=0 tvp=NULL 483 daemon: epoll: listen=8 active_threads=0 tvp=NULL 484 => key_read 485 bdb_idl_fetch_key: [b49d1940] 486 <= bdb_index_read: failed (-30990) 487 <= bdb_equality_candidates: id=0, first=0, last=0 488 <= bdb_filter_candidates: id=0 first=0 last=0 489 => bdb_filter_candidates 490 PRESENT 491 => bdb_presence_candidates (uid) 492 <= bdb_presence_candidates: (uid) not indexed 493 <= bdb_filter_candidates: id=-1 first=1 last=4 494 <= bdb_list_candidates: id=-1 first=1 last=4 495 <= bdb_filter_candidates: id=-1 first=1 last=4 496 <= bdb_list_candidates: id=-1 first=1 last=4 497 <= bdb_filter_candidates: id=-1 first=1 last=4 498 bdb_search_candidates: id=-1 first=1 last=4 499 entry_decode: "ou=people,dc=example,dc=com" 500 <= entry_decode(ou=people,dc=example,dc=com) 501 => bdb_dn2id("ou=people,dc=example,dc=com") 502 <= bdb_dn2id: got id=0x2 503 entry_decode: "uid=andrew,ou=People,dc=example,dc=com" 504 <= entry_decode(uid=andrew,ou=People,dc=example,dc=com) 505 => bdb_dn2id("uid=andrew,ou=people,dc=example,dc=com") 506 <= bdb_dn2id: got id=0x3 507 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "2.5.17.0") no objectClass attribute 508 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "2.16.840.1.113730.3.2.6") no objectClass attribute 509 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "1.3.6.1.4.1.4203.666.3.4") no objectClass attribute 510 => test_filter 511 PRESENT 512 => access_allowed: search access to "uid=andrew,ou=People,dc=example,dc=com" "uid" requested 513 <= root access granted 514 => access_allowed: search access granted by manage(=mwrscxd) 515 <= test_filter 5 516 bdb_search: 3 does not match filter 517 entry_decode: "uid=barney,ou=People,dc=example,dc=com" 518 <= entry_decode(uid=barney,ou=People,dc=example,dc=com) 519 => bdb_dn2id("uid=barney,ou=people,dc=example,dc=com") 520 <= bdb_dn2id: got id=0x4 521 => test_filter 522 PRESENT 523 => access_allowed: search access to "uid=barney,ou=People,dc=example,dc=com" "uid" requested 524 <= root access granted 525 => access_allowed: search access granted by manage(=mwrscxd) 526 <= test_filter 6 527 ==> translucent_search_cb: uid=barney,ou=People,dc=example,dc=com 528 ldap_create 529 ldap_url_parse_ext(ldap://172.27.27.37) 530 =>ldap_back_getconn: conn=0 op=1: lc=0x83ab8c8 inserted refcnt=1 rc=0 531 ldap_sasl_bind 532 ldap_send_initial_request 533 ldap_new_connection 1 1 0 534 ldap_int_open_connection 535 ldap_connect_to_host: TCP 172.27.27.37:389 536 ldap_new_socket: 16 537 ldap_prepare_socket: 16 538 ldap_connect_to_host: Trying 172.27.27.37:389 539 ldap_pvt_connect: fd: 16 tm: -1 async: 0 540 ldap_open_defconn: successful 541 ldap_send_server_request 542 ber_scanf fmt ({it) ber: 543 ber_dump: buf=0x83b3b90 ptr=0x83b3b90 end=0x83b3bc1 len=49 544 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 545 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 546 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 547 0030: 6e n 548 ber_scanf fmt ({i) ber: 549 ber_dump: buf=0x83b3b90 ptr=0x83b3b95 end=0x83b3bc1 len=44 550 0000: 60 2a 02 01 03 04 1e 63 6e 3d 6d 61 69 6e 61 64 `*.....cn=mainad 551 0010: 6d 69 6e 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 min,dc=example,d 552 0020: 63 3d 63 6f 6d 80 05 61 64 6d 69 6e c=com..admin 553 ber_flush2: 49 bytes to sd 16 554 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 555 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 556 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 557 0030: 6e n 558 ldap_write: want=49, written=49 559 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 560 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 561 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 562 0030: 6e n 563 ldap_result ld 0x83ab908 msgid 1 564 wait4msg ld 0x83ab908 msgid 1 (timeout 100000 usec) 565 wait4msg continue ld 0x83ab908 msgid 1 all 1 566 ** ld 0x83ab908 Connections: 567 * host: 172.27.27.37 port: 389 (default) 568 refcnt: 2 status: Connected 569 last used: Wed Jul 30 14:50:54 2008 570 ** ld 0x83ab908 Outstanding Requests: 571 * msgid 1, origid 1, status InProgress 572 outstanding referrals 0, parent count 0 573 ld 0x83ab908 request count 1 (abandoned 0) 574 ** ld 0x83ab908 Response Queue: 575 Empty 576 ld 0x83ab908 response count 0 577 ldap_chkResponseList ld 0x83ab908 msgid 1 all 1 578 ldap_chkResponseList returns ld 0x83ab908 NULL 579 ldap_int_select 580 read1msg: ld 0x83ab908 msgid 1 all 1 581 ber_get_next 582 ldap_read: want=8, got=8 583 0000: 30 0c 02 01 01 61 07 0a 0....a.. 584 ldap_read: want=6, got=6 585 0000: 01 00 04 00 04 00 ...... 586 ber_get_next: tag 0x30 len 12 contents: 587 ber_dump: buf=0x83b4d08 ptr=0x83b4d08 end=0x83b4d14 len=12 588 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ 589 read1msg: ld 0x83ab908 msgid 1 message type bind 590 ber_scanf fmt ({eAA) ber: 591 ber_dump: buf=0x83b4d08 ptr=0x83b4d0b end=0x83b4d14 len=9 592 0000: 61 07 0a 01 00 04 00 04 00 a........ 593 read1msg: ld 0x83ab908 0 new referrals 594 read1msg: mark request completed, ld 0x83ab908 msgid 1 595 request done: ld 0x83ab908 msgid 1 596 res_errno: 0, res_error: <>, res_matched: <> 597 ldap_free_request (origid 1, msgid 1) 598 ldap_free_connection 0 1 599 ldap_free_connection: refcnt 1 600 ldap_parse_result 601 ber_scanf fmt ({iAA) ber: 602 ber_dump: buf=0x83b4d08 ptr=0x83b4d0b end=0x83b4d14 len=9 603 0000: 61 07 0a 01 00 04 00 04 00 a........ 604 ber_scanf fmt (}) ber: 605 ber_dump: buf=0x83b4d08 ptr=0x83b4d14 end=0x83b4d14 len=0 606 ldap_msgfree 607 ldap_search_ext 608 put_filter: "(objectclass=*)" 609 put_filter: simple 610 put_simple_filter: "objectclass=*" 611 ldap_build_search_req ATTRS: * 612 ldap_send_initial_request 613 ldap_send_server_request 614 ber_scanf fmt ({it) ber: 615 ber_dump: buf=0x83b3b90 ptr=0x83b3b90 end=0x83b3bdd len=77 616 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 617 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 618 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 619 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 620 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 621 ber_scanf fmt ({) ber: 622 ber_dump: buf=0x83b3b90 ptr=0x83b3b95 end=0x83b3bdd len=72 623 0000: 63 46 04 26 75 69 64 3d 62 61 72 6e 65 79 2c 6f cF.&uid=barney,o 624 0010: 75 3d 70 65 6f 70 6c 65 2c 64 63 3d 65 78 61 6d u=people,dc=exam 625 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 0a 01 00 0a 01 00 ple,dc=com...... 626 0030: 02 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 ...........objec 627 0040: 74 63 6c 61 73 73 30 00 tclass0. 628 ber_flush2: 77 bytes to sd 16 629 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 630 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 631 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 632 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 633 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 634 ldap_write: want=77, written=77 635 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 636 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 637 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 638 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 639 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 640 ldap_result ld 0x83ab908 msgid 2 641 wait4msg ld 0x83ab908 msgid 2 (infinite timeout) 642 wait4msg continue ld 0x83ab908 msgid 2 all 1 643 ** ld 0x83ab908 Connections: 644 * host: 172.27.27.37 port: 389 (default) 645 refcnt: 2 status: Connected 646 last used: Wed Jul 30 14:50:54 2008 647 ** ld 0x83ab908 Outstanding Requests: 648 * msgid 2, origid 2, status InProgress 649 outstanding referrals 0, parent count 0 650 ld 0x83ab908 request count 1 (abandoned 0) 651 ** ld 0x83ab908 Response Queue: 652 Empty 653 ld 0x83ab908 response count 0 654 ldap_chkResponseList ld 0x83ab908 msgid 2 all 1 655 ldap_chkResponseList returns ld 0x83ab908 NULL 656 ldap_int_select 657 read1msg: ld 0x83ab908 msgid 2 all 1 658 ber_get_next 659 ldap_read: want=8, got=8 660 0000: 30 27 02 01 02 65 22 0a 0'...e". 661 ldap_read: want=33, got=33 662 0000: 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 . ..ou=People,dc 663 0010: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 04 =example,dc=com. 664 0020: 00 . 665 ber_get_next: tag 0x30 len 39 contents: 666 ber_dump: buf=0x83b4d38 ptr=0x83b4d38 end=0x83b4d5f len=39 667 0000: 02 01 02 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f ...e".. ..ou=Peo 668 0010: 70 6c 65 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 ple,dc=example,d 669 0020: 63 3d 63 6f 6d 04 00 c=com.. 670 read1msg: ld 0x83ab908 msgid 2 message type search-result 671 ber_scanf fmt ({eAA) ber: 672 ber_dump: buf=0x83b4d38 ptr=0x83b4d3b end=0x83b4d5f len=36 673 0000: 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 e".. ..ou=People 674 0010: 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 ,dc=example,dc=c 675 0020: 6f 6d 04 00 om.. 676 read1msg: ld 0x83ab908 0 new referrals 677 read1msg: mark request completed, ld 0x83ab908 msgid 2 678 request done: ld 0x83ab908 msgid 2 679 res_errno: 32, res_error: <>, res_matched: <ou=People,dc=example,dc=com> 680 ldap_free_request (origid 2, msgid 2) 681 ldap_free_connection 0 1 682 ldap_free_connection: refcnt 1 683 ldap_parse_result 684 ber_scanf fmt ({iAA) ber: 685 ber_dump: buf=0x83b4d38 ptr=0x83b4d3b end=0x83b4d5f len=36 686 0000: 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 e".. ..ou=People 687 0010: 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 ,dc=example,dc=c 688 0020: 6f 6d 04 00 om.. 689 ber_scanf fmt (}) ber: 690 ber_dump: buf=0x83b4d38 ptr=0x83b4d5f end=0x83b4d5f len=0 691 ldap_msgfree 692 send_ldap_result: conn=0 op=1 p=3 693 send_ldap_result: err=0 matched="" text="" 694 send_ldap_response: msgid=2 tag=101 err=0 695 ber_flush2: 14 bytes to sd 13 696 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ 697 ldap_write: want=14, written=14 698 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ 699 conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= 700 daemon: activity on 1 descriptor 701 daemon: activity on: 13r 702 daemon: read active on 13 703 daemon: epoll: listen=7 active_threads=0 tvp=NULL 704 daemon: epoll: listen=8 active_threads=0 tvp=NULL 705 connection_get(13) 706 connection_get(13): got connid=0 707 connection_read(13): checking for input on id=0 708 ber_get_next 709 ldap_read: want=8, got=7 710 0000: 30 05 02 01 03 42 00 0....B. 711 ber_get_next: tag 0x30 len 5 contents: 712 ber_dump: buf=0x834fca0 ptr=0x834fca0 end=0x834fca5 len=5 713 0000: 02 01 03 42 00 ...B. 714 ber_get_next 715 ldap_read: want=8, got=0 716 ber_get_next on fd 13 failed errno=0 (Success) 717 connection_read(13): input error=-2 id=0, closing. 718 connection_closing: readying conn=0 sd=13 for close 719 daemon: activity on 1 descriptor 720 daemon: activity on: 721 daemon: epoll: listen=7 active_threads=0 tvp=NULL 722 daemon: epoll: listen=8 active_threads=0 tvp=NULL 723 connection_close: deferring conn=0 sd=13 724 conn=0 op=2 do_unbind 725 conn=0 op=2 UNBIND 726 connection_resched: attempting closing conn=0 sd=13 727 connection_close: conn=0 sd=13 728 translucent_connection_destroy 729 =>ldap_back_conn_destroy: fetching conn 0 730 daemon: removing 13 731 conn=0 fd=13 closed #end

1 0

FTP authentication against openldap
by Aravind Arjunan 31 Jul '08

31 Jul '08

hi, I had configured openldap in RHEL 5 and all my users are in ldap database. My FTP want to authenticate with my ldap users. how to do that, plz help me with this issue. Guide me with any link to configure FTP authentication with ldap.

2 1

slapd 2.4.10 and replication
by Christophe Thibault 31 Jul '08

31 Jul '08

Hi, I have two 2.4.10 slapd servers running on two machines, and I'm trying to setup replication. My problem is that the master dies when the slave try to connect to it (segmentation fault). I don't know where to search, so any help or idea is welcome :) * master configuration: ... syncprov-checkpoint 100 100 syncprov-sessionlog 100 ... * slave configuration: ... syncrepl rid=002 provider=ldap://172.16.0.3 type=refreshOnly interval=00:00:03:00 searchbase="dc=mycorp,dc=com" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mycorp,dc=com" credentials=xxxxxx retry="60 +" ... Thanks, chris -- Christophe THIBAULT - Planisware 102 Rue Etienne Dolet 92247 Malakoff Cedex France http://www.planisware.com

2 2

Re: Autofs-OpenLDAP Assistance
by Santosh Balan 31 Jul '08

31 Jul '08

Hi Buchan, The below settings you are saying are to be done on client side. But how would you configure seetings in ldap or the server side. How would the ldif files look like. Also I need it to communicate and authenticate for my qmail users. And my qmail users mails are stored in the /home partition of the Mail server. Then will it not conflict with my mail server's and login user's partition. How will I over come this issue. Can you please revert on the same. Anyways thanks for your reply. Thanks and Regards Santosh Balan +91-9819419509 > ----- Original Message ----- > From: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> > To: openldap-technical(a)openldap.org > Subject: Re: Autofs-OpenLDAP Assistance > Date: Wed, 30 Jul 2008 11:54:25 +0200 > > > On Tuesday 29 July 2008 20:19:33 Sven Ulland wrote: > > Santosh Balan wrote: > > > Can you please guide and provide some appropriate doccumentation or > > > method as how I hv to go about with the installation of OpenLDAP and > > > autofs such that it will authenticate my users and automatically > > > mounts the users partition. > > Depending on how your infrastructure is set up, you could get home directories > automounted for every user with a single automount (wildcard) rule. Unless you > give more details, it is difficult to know how you are associating the need > for home directories and automount rules. > > > To use ldap for login, you need to get nsswitch and pam to talk ldap. > > It is easily done by installing libnss-ldapd (or libnss-ldap -- they > > are functionally equivalent) and libpam-ldap. Package names are likely > > to be different on your platform -- these are from Debian. > > > > First change /etc/nsswitch.conf so that it reads something like this: > > > > passwd: compat ldap > > group: compat ldap > > shadow: compat ldap > > I would avoid compat unless you actually require the features. See the > discussion of compat in nsswitch.conf(5). Additionally, I would avoid adding > ldap to shadow unless you have applications that require access to the > password hash or are intending to use nss_ldap->pam_unix for authentication > (and forego any ldap authorization features). > > > hosts: files dns > > networks: files > > protocols: db files > > services: db files > > ethers: db files > > rpc: db files > > netgroup: nis > > automount: ldap > > > > Then set up /etc/pam.d/common-{account,auth,password,session} with the > > following *additions*: > > > > common-account: > > account sufficient pam_succeed_if.so uid < 1000 quiet > > account [default=bad success=ok user_unknown=ignore] pam_ldap.so > > account required pam_permit.so > > I would rather suggest adding: > > account sufficient pam_localuser.so > account sufficient pam_ldap.so > account required pam_deny.so > > otherwise password expiry, host attribute use etc. will most likely not work. > > > common-auth: > > auth requisite pam_succeed_if.so uid >= 1000 quiet > > auth sufficient pam_ldap.so use_first_pass > > auth required pam_deny.so > > > > common-password: > > password sufficient pam_ldap.so use_authtok > > password required pam_deny.so > > > > common-session > > session optional pam_ldap.so > > pam_ldap doesn't implement session as far as I know, pam_mkhomedir would be a > better candidate for the line above. > > > > > (There is probably some silly configuration in the above, but it > > works. I haven't looked into the details of PAM yet.) > > Have you tested every aspect with the configuration above? > > > Next, install autofs5-ldap (or v4 if you want). It is important that > > you understand the structure of autofs entries in ldap. You can get an > > overview here: http://efod.se/blog/archive/2006/06/27/autofs-and-ldap > > > > Finally, make sure that your /etc/ldap.conf (or /etc/ldap/ldap.conf), > > /etc/autofs_ldap_auth.conf and /etc/nss-ldapd.conf are set up to point > > to your ldap directory server. > > > > When things don't work, try running each daemon in debug mode. This > > is particularly true for slapd and the nslcd (that comes in > > libnss-ldapd). Also have a look in /var/log/auth.log or equivalent, to > > see if logins are accepted. > > > And disable nscd while troubleshooting. > > Regards, > Buchan > = -- Powered by Outblaze

1 0

Understanding TLS SSF
by J Davis 31 Jul '08

31 Jul '08

Greetings, I'm testing an installation of openldap 2.4.9. I want to enforce TLS for all access to the directory. My problem is that I cannot get the client to meet the ssf restictions I have in place. The documentation I've seen on ssf and tls_ssf is very sparse so I don't really understand what it does. I'm using self signed cert created using the openssl CA.sh script. Relevant portions of the slapd.conf... TLSCACertificateFile /etc/ldap/ssl/cacert.pem TLSCertificateFile /etc/ldap/ssl/servercrt.pem TLSCertificateKeyFile /etc/ldap/ssl/serverkey.pem ... access to * by tls_ssf=128 ssf=128 anonymous auth by tls_ssf=128 ssf=128 self write Relevant portions of the lapd.conf... TLS_CACERT /etc/ldap/ssl/cacert.pem With those ACLs in place I get the following error: $ ldapsearch -x -ZZ -D "uid=jake,ou=people,dc=example,dc=com" -W -b "uid=jake,ou=people,dc=example,dc=com" ldap_bind: Invalid credentials (49) And slapd in debug mode shows me that I didn't meet the ssf requirments... connection_read(15): unable to get TLS client DN, error=49 id=0 conn=0 fd=15 TLS established tls_ssf=32 ssf=32 ... <= check a_authz.sai_tls_ssf: ACL 128 > OP 32 I'm not really sure where to go from here. Any advice about how to increase the SSF of my connection would be greatly appreciated. Thanks, -Jake

6 8

Troubleshooting syncrepl
by John Oliver 30 Jul '08

30 Jul '08

I've set up a pair of OpenLDAP servers to work with, so that I can figure out my SSL problem without worrying about breaking my currently-working LDAP server. I got the producer up and running in about two minutes. I expected to get the consumer up just as fast, but ran into a problem... the sunchronization isn't succeeding. So I started logging and got: Consumer: Jul 30 08:55:32 unix-services2 slapd[8041]: slapd starting Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: added 4r Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: added 7r Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: select: listen=7 active_threads=0 tvp=zero Jul 30 08:55:32 unix-services2 slapd[8041]: =>do_syncrepl Jul 30 08:55:32 unix-services2 slapd[8041]: do_syncrep1: ldap_sasl_bind_s failed (49) Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: shutdown requested and initiated. Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: closing 7 Jul 30 08:55:32 unix-services2 slapd[8041]: slapd shutdown: waiting for 0 threads to terminate Producer: Jul 30 08:55:18 test1 slapd[4919]: connection_get(13) Jul 30 08:55:18 test1 slapd[4919]: connection_get(13): got connid=0 Jul 30 08:55:18 test1 slapd[4919]: connection_read(13): checking for input on id=0 Jul 30 08:55:18 test1 slapd[4919]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Jul 30 08:55:18 test1 slapd[4919]: daemon: select: listen=7 active_threads=0 tvp=NULL Jul 30 08:55:18 test1 slapd[4919]: daemon: select: listen=8 active_threads=0 tvp=NULL Jul 30 08:55:18 test1 slapd[4919]: do_bind Jul 30 08:55:18 test1 slapd[4919]: >>> dnPrettyNormal: <cn=syncuser,dc=mydomain,dc=com> Jul 30 08:55:18 test1 slapd[4919]: <<< dnPrettyNormal: <cn=syncuser,dc=mydomain,dc=com>, <cn=syncuser,dc=mydomain,dc=com> Jul 30 08:55:18 test1 slapd[4919]: do_bind: version=3 dn="cn=syncuser,dc=mydomain,dc=com" method=128 Jul 30 08:55:18 test1 slapd[4919]: conn=0 op=0 BIND dn="cn=syncuser,dc=mydomain,dc=com" method=128 Jul 30 08:55:18 test1 slapd[4919]: ==> bdb_bind: dn: cn=syncuser,dc=mydomain,dc=com Jul 30 08:55:18 test1 slapd[4919]: bdb_dn2entry("cn=syncuser,dc=mydomain,dc=com") Jul 30 08:55:18 test1 slapd[4919]: => bdb_dn2id("cn=syncuser,dc=mydomain,dc=com") Jul 30 08:55:18 test1 slapd[4919]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Jul 30 08:55:18 test1 slapd[4919]: send_ldap_result: conn=0 op=0 p=3 Jul 30 08:55:18 test1 slapd[4919]: send_ldap_result: err=49 matched="" text="" Jul 30 08:55:18 test1 slapd[4919]: send_ldap_response: msgid=1 tag=97 err=49 Jul 30 08:55:18 test1 slapd[4919]: conn=0 op=0 RESULT tag=97 err=49 text= Googling for do_syncrep1: ldap_sasl_bind_s failed (49) indicates that this is likely to be an authentication issue with my syncuser. I double-checked the password, and verified that it's set as cleartext in slapd.conf I then tried to log on to a machine using the producer as the authentication server, since there's nothing (that I can think of) that makes this user in any way special. It logs on... and about a half second later is booted back out. No logs on the client machine indicate why. Googling bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) led to many mentions of this almost certainly being a permissions issue, but: [root@test1 ~]# ls -l /var/lib/ldap/ total 69816 -rw-r--r-- 1 ldap ldap 2048 Jul 30 08:54 alock -rw------- 1 ldap ldap 28672 Jul 29 15:45 cn.bdb -rw------- 1 ldap ldap 24576 Jul 29 15:45 __db.001 -rw------- 1 ldap ldap 80019456 Jul 29 15:45 __db.002 -rw------- 1 ldap ldap 335552512 Jul 29 15:45 __db.003 -rw------- 1 ldap ldap 2359296 Jul 29 15:45 __db.004 -rw------- 1 ldap ldap 352256 Jul 29 15:45 __db.005 -rw------- 1 ldap ldap 24576 Jul 29 15:45 __db.006 -rw-r----- 1 ldap ldap 886 Jul 29 15:41 DB_CONFIG -rw------- 1 ldap ldap 24576 Jul 29 15:45 dn2id.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 gidNumber.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 givenName.bdb -rw------- 1 ldap ldap 98304 Jul 30 08:54 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jul 30 08:54 log.0000000001 -rw------- 1 ldap ldap 8192 Jul 29 15:45 loginShell.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 mail.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 memberUid.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 objectClass.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 ou.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 sn.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 uid.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 uidNumber.bdb They look OK to me. What can I do to further troubleshoot this issue? I want to make 100% sure that my underlying LDAP is working before I tackle the SSL part. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

1 1

role based access to various systems
by amit vyas 30 Jul '08

30 Jul '08

Hi All, I am little bit new to LDAP directory system. Presently, i am using OpenLDAP to authenticate users. Now i want authorization for various system(Like versioning system, bug tracking system etc.) So want to store the access rights corresponding to different roles in LDAP (Read, Write, Update, Delete permissions). Can anybody give me sample .ldif for the same or any other useful information. It will be very useful......... Regards Amit Download prohibited? No problem. CHAT from any browser, without download. Go to http://in.webmessenger.yahoo.com/

2 1

Autofs-OpenLDAP Assistance
by Santosh Balan 30 Jul '08

30 Jul '08

Hi Friends, I am new to this LDAP community. I am haivng redhat evironment on my servers and my clients are also linux based thin clients or redhat linux based clients. I am trying to configure LDAP to authenticate my user to login to the machine and then automatically mount a partition to the user's machine. I have searched through the net and unable to find an appropriate doccumentation on the same. Can you please guide and provide some appropriate doccumentation or method as how I hv to go about with the installation of OpenLDAP and autofs such that it will authenticate my users and automatically mounts the users partition. Thanks and Regards Santosh Balan +91-9819419509 = -- Powered by Outblaze

3 2

Re: N-way multimaster
by Miguel Jinez 29 Jul '08

29 Jul '08

Sure In this case the process was: master B and master C are without service master A performs a delete restart masters A B C Master A: # 20080729212056.000003Z, accesslog dn: reqStart=20080729212056.000003Z,cn=accesslog objectClass: auditDelete reqStart: 20080729212056.000003Z reqEnd: 20080729212056.000004Z reqType: delete reqSession: 33 reqAuthzID: cn=admin,dc=ar reqDN: cn=pbo101,dc=dominio,dc=ar reqResult: 0 Master B: # 20080729212438.000000Z, accesslog dn: reqStart=20080729212438.000000Z,cn=accesslog objectClass: auditModify reqStart: 20080729212438.000000Z reqEnd: 20080729212438.000001Z reqType: modify reqSession: 4294967295 reqAuthzID: cn=admin,dc=ar reqDN: dc=ar reqResult: 0 reqMod: contextCSN:= 20080728211620.143999Z#000000#003#000000 reqMod: contextCSN:= 20080729212056.356833Z#000000#001#000000 reqMod: contextCSN:= 20080728211533.044990Z#000000#002#000000 Master C: # 20080729212911.000000Z, accesslog dn: reqStart=20080729212911.000000Z,cn=accesslog objectClass: auditModify reqStart: 20080729212911.000000Z reqEnd: 20080729212911.000002Z reqType: modify reqSession: 4294967295 reqAuthzID: cn=admin,dc=ar reqDN: dc=ar reqResult: 0 reqMod: contextCSN:= 20080728211620.143999Z#000000#003#000000 reqMod: contextCSN:= 20080729212056.356833Z#000000#001#000000 reqMod: contextCSN:= 20080728211533.044990Z#000000#002#000000 Migue 2008/7/29 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Hi I have test from zero and I have test with historical information, I > > have > > found my old configuration and the logs are different, here master A: > > Can we see your actual logs, not the accesslog ones after the test when/i > fit fails. > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

translucent overlay with local-only entries
by Sven Ulland 29 Jul '08

29 Jul '08

I'm trying to extend an ldap directory using the translucent overlay, like many before me: http://www.openldap.org/lists/openldap-software/200802/msg00128.html http://www.openldap.org/lists/openldap-software/200802/msg00267.html http://www.openldap.org/lists/openldap-software/200511/msg00216.html http://www.openldap.org/lists/openldap-software/200707/msg00471.html Before version 2.4.8, this wasn't possible. Howard Chu seems to have fixed this in rev 1.40 (before release 2.4.8) of translucent.c: http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/overlays/translucent… (http://www.openldap.org/lists/openldap-bugs/200712/msg00109.html) Although it seems to have been fixed, I cannot get it to work on my setup. I use the packaged v2.4.10 in Debian testing. My config: # Config start include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload translucent sizelimit 500 tool-threads 1 backend hdb backend ldap database hdb directory /var/lib/ldap/translucent suffix "dc=example,dc=com" rootdn "cn=admin,dc=mybranch,dc=example,dc=com" rootpw "admin" overlay translucent uri "ldap://172.27.27.37" idassert-bind bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="admin" mode=none idassert-authzFrom "dn.subtree:dc=example,dc=com" # Config end This works perfectly fine for searches where the entry is remote. Changing entries works fine well, with the results stored in the local translucent db. Adding new entries works, but they are not returned on searches. I check this by running slapcat. So, it boils down to these questions: * Does Howard's patch not fully implement the searching? * Is my config wrong? * There is probably other ways to do this, perhaps using a meta ldap backend. With multiple backends, what determines where writes go? Probably where the object is based, but what about new objects? * Is it cleaner to keep my "branch" of the tree under a subdomain, such as mybranch.example.com using rwm, or should they all be on the main example.com domain? * Examples for exotic overlays are very scarce. It would be very helpful if anyone could provide their configuration file. sven

1 0

Modifying every entry in an LDAP address book
by Carr, Chris 29 Jul '08

29 Jul '08

Hi All, Apologies if this is a stupid question, but I can't find the answer via Google. I need to make the same modification to every entry in my address book. Can I do this with a single ldapmodify command? If so, what is the syntax for the mod file? I'm assuming something like this: dn: ?? changetype: modify add: objectClass objectClass: evolutionPerson ... but I can't think what the DN would be, since I don't really understand how wildcards work in DNs, if at all. The entries I want to modify are all in ou=addressbook,dc=mydomain, but all have different cns. Second, some of the entries already have that object class - will this cause a problem? Will ldapmodify simply ignore those entries, or create a duplicate identical objectClass, or crash? Many thanks in advance, CC This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

3 3

Client says Can't contact LDAP server, but it can!
by John Oliver 29 Jul '08

29 Jul '08

What can I do to troubleshoot this? OpenLDAP client says ldap_simple_bind Can't contact LDAP server but it can resolve the name, ping the server, connect to port 636... and I have no details as to why it thinks it cannot contact the server. Many other clients authenticate to the same server, and I'm using the same ldap.conf, nsswitch.conf, and pam.d/system-auth files. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

7 21

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical