- openldap-technical - openldap.org

Cannot start kerberos signing/sealing when using TLS/SSL
by Jeremiah Martell 08 Dec '08

08 Dec '08

I'm using openldap, cyrus-sasl, heimdal, and openssl. I use the standard kerberos "kinit" tool to get my TGT, this is successful. I use the standard openldap "ldapsearch" tool to attempt to do a LDAP+GSSAPI over TLS (cert level "demand") search, and I get two errors. The first error is an "inappropriate auth", which seems to come from openldap. The second error is "Cannot start kerberos signing/sealing when using TLS/SSL", which seems to come from GSSAPI-land. Interesting facts: - This fails against Windows 2003 AD. - But succeeds against a BSD box running an openldap server. - The following all had the cert level set to "demand"... - - LDAP works with the Win2003 AD. - - LDAP+SSL works with the Win2003 AD. - - LDAP+TLS works with the Win2003 AD. - - LDAP+GSSAPI works with the Win2003 AD. - - LDAP+GSSAPI+SSL works with the Win2003 AD. - - But LDAP+GSSAPI+TLS does NOT work with the Win2003 AD. - If I switch the cert level to "allow", then LDAP+GSSAPI+TLS works with Win2003 AD. It seems everything is ok with my kerberos setup, since LDAP+GSSAPI works. It seems everything is ok with my certs, since LDAP+SSL and LDAP+TLS and LDAP+GSSAPI+SSL works. I'm at a loss as to why this particular case: LDAP+GSSAPI+TLS (cert level "demand") against Windows 2003 AD doesn't work. I tried looking through the openldap, cyrus-sasl, heimdal, and openssl code for "Cannot start kerberos signing/sealing when using TLS/SSL" but I didn't find anything. My guess is that this comes from the server. The only thing I could find googling was from here: http://en.gentoo-wiki.com/wiki/Active_Directory_Authentication_using_LDAP that says: "GSSAPI Error: Cannot start kerberos signing/sealing when using TLS/SSL SASL/GSSAPI already encrypts the LDAP traffic, this error is trying to say TLS/SSL is redundant." My questions: (1) Is this simply the fact that Windows 2003 AD doesn't support LDAP+GSSAPI+TLS (with cert level set to "demand")? (2) Why would the Win2003 AD server behave properly with SSL but not TLS? (3) Why does the openldap server work fine, but not the Windows 2003 AD server? (3) Has this been addressed in some newer release of openldap/cyrus-sasl/heimdal/openssl code? (4) Is there anything I could have done wrong in my Win2003 AD setup? (5) Any other general suggestions/ideas to help? Thanks, -- - Jeremiah Martell http://inlovewithGod.com

2 1

bdb encryption
by ghenry＠OpenLDAP.org 08 Dec '08

08 Dec '08

Hi All, I'm just testing bdb encryption and it works as expected out of the box. But I'm trying to decrypt it using the bdb tools: [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_verify objectClass.bdb db_verify: Encrypted environment: no encryption key supplied Segmentation fault So it segfaults, but it's the same with the key: [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_verify -P "testing" objectClass.bdb db_verify: Invalid password Segmentation fault testing is set in slapd.conf via "cryptfile" and has the word "testing" in it: (gdb) run -P testing objectClass.bdb Starting program: /usr/local/BerkeleyDB.4.7/bin/db_verify -P testing objectClass.bdb db_verify: Invalid password [New Thread 0xb7fd86c0 (LWP 17626)] Program received signal SIGSEGV, Segmentation fault. 0x0021f82d in __memp_resize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so Missing separate debuginfos, use: debuginfo-install glibc-2.9-2.i686 (gdb) bt #0 0x0021f82d in __memp_resize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so #1 0x0021bac9 in __memp_set_cachesize () from /usr/local/BerkeleyDB.4.7/lib/libdb-4.7.so #2 0x08048cfd in __db_rpath () #3 0x0804b018 in ?? () #4 0x00000000 in ?? () (gdb) q Any ideas? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

why does ldapsearch just hang with SASL/EXTERNAL authentication started?
by borderline_ocd-er 08 Dec '08

08 Dec '08

hello list, :¬O H-E-E-E-E-E-L-L-L-L-P-P-P!!!! for the past week and a half, i've been trying to get an openldap client on a mac os x 10.4.11 (OpenLDAP 2.2) to talk to an ldap directory server (sun iPlanet directory server 5.1) on a solaris 9 sparc box; using client authentication with x509 certificates for both the server and the client. i have successfully configured client authn between the directory server (ds) on the solaris box and a precompiled ldapsearch binary client (also running on that same solaris box). the ldapsearch binary is part of the netscape security services (nss) ldap c sdk 6.0.x that came bundled with - what sun calls it's - "ds resource kit 5.2 (dsrk)". since client authn works successfully between those 2 components running local to each other, i figured a remote client authn setup shouldn't be much of a stretch (if the openldap.org docs are to be believed). BOY! was i wrong! after copying to my mac os x box, the same ca cert and client cert (in .pem format) that worked successfully on the solaris box, i configured ldap.conf and .ldaprc to point to the certs and keys (see below). when i run an openldap ldapsearch on the mac, the tls handshake appears to succeed (see below); then the sasl/external client authn appears to kick off; then it just hangs! the last thing that's output to the shell is "SASL/EXTERNAL authentication started". but the shell cursor just hangs there; flashing away - doing nothing! the solaris ds access logs seem to report that a bind took place as a result of the mac openldap ldapsearch attempt: "...conn=45 SSL client bound as cn=bilbo,ou=development,o=helpme.com" please, will you help me to get my mac openldap ldapsearch client to authenticate to my solaris ds using a client cert? i've read and reread the openldap.org tls docs (http://www.openldap.org/doc/admin24/tls.html); i've read and reread the openldap.org sasl docs (http://www.openldap.org/doc/admin24/sasl.html); i've scoured this list; i've scoured the cyrus sasl list (http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl); i've tried adding the "-I" switch to the ldapsearch command, but that results in an endless loop of being prompted over and over to enter an authorization id. i've tried editing /etc/syslog.conf with the following: "local4.* /var/log/openldap.log" but nothing ever gets logged to that file! i've spent so much time trying to solve this problem on my own, that my wife has threatened to leave me for my best friend if i don't stop spending so much time on this! my dog snarled at me and bit my behind today because he doesn't recognize me anymore! my daughter is talking about becoming an "exotic dancer" because i don't pay her enough attention from working on this! my failure to accomplish such a seemingly simple task has made me consider taking my own life! seriously though: I NEED YOUR HELP! thanks in advance for your help. ========================================================== ds access logs after successful ldapsearch on solaris box: ========================================================== ... [07/Dec/2008:04:29:38 +0000] conn=0 fd=49 slot=49 SSL connection from 127.0.0.1 to 127.0.0.1 [07/Dec/2008:04:29:38 +0000] conn=0 SSL 128-bit RC4; client O=helpme.com, OU=Development, CN=bilbo; issuer E=ldapca(a)helpme.com, CN=ldapca, OU=development, O=helpme.com, L=Chicago, ST=IL, C=US [07/Dec/2008:04:29:38 +0000] conn=0 SSL client bound as cn=bilbo,ou=development,o=helpme.com [07/Dec/2008:04:29:38 +0000] conn=0 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL [07/Dec/2008:04:29:38 +0000] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=bilbo,ou=development,o=helpme.com" [07/Dec/2008:04:29:38 +0000] conn=0 op=1 SRCH base="ou=development,o=helpme.com" scope=2 filter="(cn=bilbo)" attrs=ALL [07/Dec/2008:04:29:38 +0000] conn=0 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [07/Dec/2008:04:29:38 +0000] conn=0 op=2 UNBIND [07/Dec/2008:04:29:38 +0000] conn=0 op=2 fd=49 closed - U1 ... ========================================================== hanging mac osx openldap ldapsearch command results: ========================================================== bilbo$ ldapsearch -v -H ldap://bebop -s sub -b "" -LLL -d -7 -ZZ ldap_initialize( ldap://bebop ) ldap_create ldap_url_parse_ext(ldap://bebop) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP bebop:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.0.8:389 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_ndelay_on: 3 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_open_defconn: successful ldap_send_server_request ber_flush: 31 bytes to sd 3 ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (infinite timeout), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: bebop port: 389 (default) refcnt: 2 status: Connected last used: Sun Dec 7 16:04:48 2008 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ber_get_next ber_get_next: tag 0x30 len 95 contents: ber_dump: buf=0x004044b0 ptr=0x004044b0 end=0x0040450f len=95 0000: 02 01 01 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 ...xZ......;Star 0010: 74 20 54 4c 53 20 72 65 71 75 65 73 74 20 61 63 t TLS request ac 0020: 63 65 70 74 65 64 2e 53 65 72 76 65 72 20 77 69 cepted.Server wi 0030: 6c 6c 69 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 lling to negotia 0040: 74 65 20 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 te SSL...1.3.6.1 0050: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_read: message type extended-result msgid 1, original id 1 ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 ber_scanf fmt (a) ber: ber_dump: buf=0x004044b0 ptr=0x004044f7 end=0x0040450f len=24 0000: 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 ..1.3.6.1.4.1.14 0010: 36 36 2e 32 30 30 33 37 66.20037 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x004044b0 ptr=0x004044b3 end=0x0040450f len=92 0000: 78 5a 0a 01 00 04 00 04 3b 53 74 61 72 74 20 54 xZ......;Start T 0010: 4c 53 20 72 65 71 75 65 73 74 20 61 63 63 65 70 LS request accep 0020: 74 65 64 2e 53 65 72 76 65 72 20 77 69 6c 6c 69 ted.Server willi 0030: 6e 67 20 74 6f 20 6e 65 67 6f 74 69 61 74 65 20 ng to negotiate 0040: 53 53 4c 2e 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e SSL...1.3.6.1.4. 0050: 31 2e 31 34 36 36 2e 32 30 30 33 37 1.1466.20037 ber_scanf fmt (x) ber: ber_dump: buf=0x004044b0 ptr=0x004044f7 end=0x0040450f len=24 0000: 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 ..1.3.6.1.4.1.14 0010: 36 36 2e 32 30 30 33 37 66.20037 ber_scanf fmt (}) ber: ber_dump: buf=0x004044b0 ptr=0x0040450f end=0x0040450f len=0 ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com, issuer: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com TLS certificate verification: depth: 0, err: 0, subject: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=bebop, issuer: /C=US/ST=IL/L=Chicago/O=helpme.com/OU=development/CN=ldapca/emailAddress=ldapca(a)helpme.com TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write certificate verify A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A ldap_sasl_interactive_bind_s: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_int_sasl_open: host=bebop => ldap_dn2bv(16) ldap_err2string <= ldap_dn2bv(O=helpme.com,OU=Development,CN=bilbo)=0 Success SASL/EXTERNAL authentication started [shell just hangs here] ========================================================== ========================================================== ds access logs after hanging ldapsearch from mac os x: ========================================================== ... [07/Dec/2008:16:04:48 +0000] conn=45 fd=49 slot=49 connection from 10.0.0.9 to 10.0.0.8 [07/Dec/2008:16:04:48 +0000] conn=45 op=0 EXT oid="1.3.6.1.4.1.1466.20037" [07/Dec/2008:16:04:48 +0000] conn=45 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [07/Dec/2008:16:04:49 +0000] conn=45 SSL 128-bit RC4; client O=helpme.com, OU=Development, CN=bilbo; issuer E=ldapca(a)helpme.com, CN=ldapca, OU=development, O=helpme.com, L=Chicago, ST=IL, C=US [07/Dec/2008:16:04:49 +0000] conn=45 SSL client bound as cn=bilbo,ou=development,o=helpme.com [end of file] ========================================================== ldap.conf file: ========================================================== HOST bebop BASE dc=bebop,dc=helpme,dc=net TLS_REQCERT demand TLS_CACERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bebopCACert.pem ========================================================== .ldaprc file: ========================================================== URI ldaps://bebop:636 HOST bebop BASE "" TLS_REQCERT demand TLS_CACERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bebopCACert.pem TLS_CERT /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bilboClientCert.pem TLS_KEY /Users/bilbo/development/projects/tutorials/ldap/conf/.security/take5/bilboClientKey.pem SASL_MECH EXTERNAL ==========================================================

1 0

Using AD authentication with an external LDAP for authorization
by Stefan Stefansson 08 Dec '08

08 Dec '08

Hi. I'm new to the world of LDAP and directory servers and trying to figure out the best solution to my problem. This isn't exactly OpenLDAP specific, I still haven't figured out whether OpenLDAP is the right thing to use or whether there is any good solution to my situation. So I hope you forgive me for asking this here but I'm hoping to tap into the collective knowledge of this list for ideas. My situation is that I have taken over the systems administration of a group of Linux servers for the Computer Science department at my school. The school has an IT department but we would like to be independent of them, both to relieve them of as much as possible of our demands (which can be quite demanding and unorhadox) as well as having a more agile environment here (again touching on the fact that they are overloaded). The IT department mostly runs Microsoft solutions and the whole domain is controlled by Active Directory. I'm not familiar with AD myself so I don't know whether it's a particularly "good setup" or not but I have no reason to believe otherwise. So, what I want to do is set up our own directory server but of course I would like to use some open source solutions... or at the very least, something that runs on Linux. There I would like to control authorization for different users to different servers, clusters, web systems (such as wiki webs, Subversion, bug tracking software etc). On the other hand, I would prefer that authentication be somehow delegated to the AD server for any user who is on the domain to avoid duplicating data. However, I still would like to be able to define additional users in my LDAP directory server that are not necessarily on the domain. So my setup would have to be able to distinguish whether authentication should be handled by my LDAP server or the AD server. I would think this could happen in two ways: 1) user credentials are replicated over to the LDAP server from AD which means that LDAP would handle all authentication or 2) LDAP server would delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows. I assume 1 is difficult to do as sending the user credentials out from AD is probably considered bad practice (if it is at all possible that is). The backup plan would be for me to get administrative rights to some part of the AD server and then we'd use only that server for all authentication and authorization requirements but as I said, we would like to be as independent from their services as possible in addition to not being particularly fond of having to use AD (is there any sort of a usable web access to that? would this mean I would have to have a Windows box set up to perform any administrative tasks?). This is my situation. Sorry for the log winded explanation. Does anybody have an idea of how to accomplish something like this? I'd be happy to hear about any case studies or white papers on similar subjects (I can't believe I'm the first one to want to do this). I'm also open for suggestions on what tools to use. Open source is not a requirement (but preferred). Best regards, Stefan Freyr.

4 3

OpenLDAP + Active Directory User and Password Sync
by Animesh Bansriyar 07 Dec '08

07 Dec '08

Hi All, I have been working on getting Active Directory User Information (username/password) to sync with OpenLDAP. I have been working on different theories to get them to sync when I chanced upon acctsync. Acctsync (http://acctsync.sourceforge.net/) seems to do the work but looks like there has been no work on it since 2005. I am looking forward to revive the project and want to contribute as well on it. If there is something similar can somebody please point me out to it. This is what I am looking for: 1. Any User Added to Active Directory shall be added to OpenLDAP as well and any password modified from Active Directory should be modified in OpenLDAP as well - where OpenLDAP would be used for System Auth in a Linux environment. 2. Any User Added to OpenLDAP should be added to Active Directory along with the same credentials and any password modified in OpenLDAP should be modified in Active Directory as well. I have somewhat been able to take care of the second requirement but the first seems to be the more difficult one in a Windows 2008 Environment - The appoach I have taken is to have a daemon running which polls the OpenLDAP Server with clear-text passwords every few minutes and adds/modifes accounts in the AD Server accordingly - I know this is the least elegant way to do it but as of now it works for me. Can somebody suggest ways to do the above or maybe share experiences on the same. Thanks, Animesh

1 0

Re: Syncrepl question
by Quanah Gibson-Mount 05 Dec '08

05 Dec '08

--On Friday, December 05, 2008 1:18 PM -0800 Ivan Ordonez <iordonez(a)nature.berkeley.edu> wrote: > Hi Quanah, > > I was able to get it to work earlier when I add the startls=critical > line. It work when I did it on the slave1, at the time, I made the > slave1 as the master. Thanks so much for that. Now moving on the the > real master, things did not go well. Now the issue is that, any changes > I make on the master, doesn't go to the slaves. I have two slaves and I > want those two to get the changes. > > example: > > Master > | > _ _ _ _ _| |_ _ _ _ _ > | | > | | > | | > Slave1 Slave2 > > Now, when I make any change on the master, the changes will take effect > only on master and not on the slaves. I will get this error on both > slaves. > Is this because of the acl.bdc.readonly.conf line I have on both slave's > slapd.conf file? pdbedit -Lv username still work only on account were no > changes are made. Do you see any errors on the master from the slaves binding? Are you sure they have the right permissions to the master? Did you look at what sync logging shows? What is the contextCSN on your master versus your slaves? At this point, I suggest we take this discussion back to the list, since we got back your earlier config issue (starttls not being set in the syncrepl config). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 3

Syncrepl question
by Ivan Ordonez 04 Dec '08

04 Dec '08

Hi all, We have a small size domain with about 500 users and computers. We are using Samba with Openldap integration to authenticate user login and file sharing. Our setup is consist of 3 servers running Gentoo Linux - 1PDC and 2BDCs. As for replication, we are still using "slurpd". Any changes or modification is done through the PDC which replicates the changes to BDC1, then from BDC1, it then goes down to BDC2 - it's like a chain. We want to start using "syncrepl" soon as a way to replicate our database but I'm not sure were to start. We want to setup all of our machine to sync with each other everyday, and not worry which machine is use to make changes, modification, etc.... I'm not sure which syncrepl function to use to achieve what we want to do. Is "N-Way Multi Master replication" the correct choice to do this? We are using "BDB" database on each servers, and would like to achieve this with minimal downtime if possible. What is the best way to do this? Please advise. Any help is greatly appreciated. -Ivan

3 12

How to take backup of the openldap users data from the command prompt in LINUX Fedora
by Jyotishmaan Ray 04 Dec '08

04 Dec '08

My problem. I had been using the phpldapadmin browser 1.0.1 to access the openldap database. Recently when I observed that when I logged onto the phpldapadmin browser, the features of the browser didnt show up as usually it appears. So that was my problem as such now I am not able to use the GUI of the browser to do importing of the ldif files for adding new users to my database. Now that the situation is urgent, I need to take a back up of my openldap database for the users data. Please give me the full comand details, so that I can take a back up of my database safely before exploring the problem of phpldapadmin browser. Thanks, in advance, jmaan Thanks, Jyotishmaan Ray Moderator Of Paradise Groups http://yahoogroups.com/group/Spirituality-Paradise Are You Spiritually Aware !!! Are You Enjoying Yourself !!! See What All You Had Been Missing !!!! Please Join Immediately By Sending A Blank Mail @ Spirituality-Paradise-subscribe(a)yahoogroups.com

3 3

OpenLDAP 2.4.10 Logging
by Lydon, Mark 03 Dec '08

03 Dec '08

I am running OpenLDAP 2.4.10 in a Solaris 10 local zone. All working fine, except that I want to log to a specific file using this command line; nohup /usr/local/libexec/slapd -d 64 -d 256 2> /tmp/slapd.log & This run ok in background, but when I exit my shell the job ends. I've often used nohup like this to start jobs and disassociate them from the users login shell, why doesn't it work here? Regards Mark Lydon AT&T

2 1

Samba objects replication
by mike 03 Dec '08

03 Dec '08

Hello everybody. I have configurated Samba with openLdap. My problem is that openldap slave does not synchronize the samba objects from the openldap master. All the others objects (ou, o, dc) are synchronized normaly Can someone help me please? Thanks Migue

2 1

2.4.13 could not start
by owen nirvana 02 Dec '08

02 Dec '08

libldap_r-2.4.so.2 no version information (reqired by slapd) liblber-2.4.so.2 no version information (reqired by slapd) in debian lenny-081114, I don't remove openldap 2.4.11 debian package which had installed, because synpatic always want to remove many many related package too. But I don't think it is the problem. thanks for instruction gtalk:freeespeech@gmail.com

2 1

Can join Domain but cannot login.
by Emil Sicad - ISD 02 Dec '08

02 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

2 2

hello
by Donny George 01 Dec '08

01 Dec '08

Hello After much work i set up and openldap server and client and established their connectivity and also populated the database with phpldapadmin. but wen i do ldapsearch -x or getent passwd or when i search for the specific ids i cant get the user information which i entered through the gui. as i am not sure the config files which i should look into to correct this error, could someone guide me. did i miss in installing soething or have i not edited any specific file thank you in advance -- Donny George

1 0

RE: Some servers are delay synced...
by Quanah Gibson-Mount 01 Dec '08

01 Dec '08

Look for any change noting fixes to slapo-syncprov and/or syncrepl. --Quanah --On Monday, December 01, 2008 1:56 PM +0000 Bad Guy <badguy9588(a)hotmail.com> wrote: > Would you mind telling me the ITS# related to this ? > > I can't find it in the changes of 2.4.12 and 2.4.13 about this one. > > Thanks > >> Date: Mon, 1 Dec 2008 00:30:24 -0800 >> From: quanah(a)zimbra.com >> To: badguy9588(a)hotmail.com; openldap-technical(a)openldap.org >> Subject: Re: Some servers are delay synced... >> >> --On Monday, December 01, 2008 7:39 AM +0000 Bad Guy >> <badguy9588(a)hotmail.com> wrote: >> >> > Dear sir, >> > >> > We have got a N-way master (N=4) openldap running in version 2.4.11 >> > under linux environment. >> > >> > Any idea on this ? >> >> Yes, read the changelog for the changes between 2.4.11 and 2.4.13. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Principal Software Engineer >> Zimbra, Inc >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration > > > > __________________________________________________ > 用部落格分享照片、影音、趣味小工具和最愛清單，盡捊> 秀出你自己 — Windows Live Spaces -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Authenticate a user
by Mansour Al Akeel 01 Dec '08

01 Dec '08

Hello all, I am trying to create a user and authenticate this user. I need to give an admin a way to access and modify account. I was able to succeffuly add a user, but can not connect using this account. The only way I am able to connect is using the Manager's DN. I keep on getting invalid credentials. I have reset the password for this user few times to make sure it's correct. Still unable to authenticate. I am using JXplorer to connect to that server. Here's the corresponding section from the log file. I hope it helps. Dec 1 13:52:11 neptune slapd[13518]: >>> slap_listener(ldap:///) Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: do_bind Dec 1 13:52:11 neptune slapd[13518]: >>> dnPrettyNormal: <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: <<< dnPrettyNormal: <uid=user,dc=test,dc=com>, <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: do_bind: version=3 dn="uid=user,dc=test,dc=com" method=128 Dec 1 13:52:11 neptune slapd[13518]: bdb_dn2entry("uid=user,dc=test,dc=com") Dec 1 13:52:11 neptune slapd[13518]: send_ldap_result: conn=13 op=0 p=3 Dec 1 13:52:11 neptune slapd[13518]: send_ldap_response: msgid=1 tag=97 err=49 Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: ber_get_next on fd 12 failed errno=0 (Success) Dec 1 13:52:11 neptune slapd[13518]: connection_closing: readying conn=13 sd=12 for close Dec 1 13:52:11 neptune slapd[13518]: connection_close: conn=13 sd=-1 I don't know what I am missing, but I have been trying to resolve this for few hours with no success.

1 1

how group work with samba & openldap ?
by franck dufau 01 Dec '08

01 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hye all, i have install samba as PDC with openldap authentification everything work fine. But i want to create différent group with différent privileges on folder How gestion of group work with Openldap authentification because users are not in /etc/passwd and domain group are not in /etc/group !? I don't find information about this... can you help me ? cordialement Franck Dufau -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkkz66UACgkQrKIazktK/hICSgCeOiQGmEHKk5qHGiC5sMTzyux7 uMgAn2LY3axBykW29YkGQy1k4+5vi0dE =hPaV -----END PGP SIGNATURE-----

2 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 01 Dec '08

01 Dec '08

---- Original message ---- >Date: Tue, 25 Nov 2008 15:52:57 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Monday, November 24, 2008 10:00 PM -0800 Quanah Gibson-Mount ><quanah(a)zimbra.com> wrote: > >> --On Monday, November 24, 2008 6:05 PM -0800 Quanah Gibson-Mount >> <quanah(a)zimbra.com> wrote: >> >>> --On Monday, November 24, 2008 9:00 PM -0500 William Jojo >>> <w.jojo(a)hvcc.edu> wrote: >>> >>>> >>>> >>>> ---- Original message ---- >>>>> Date: Thu, 20 Nov 2008 11:02:40 -0800 >>>>> From: Quanah Gibson-Mount <quanah(a)zimbra.com> >>>>> Subject: Re: Delta-sync symptom in 2.4.11 >>>>> To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org >>>>> >>>>> --On Thursday, November 20, 2008 10:38 AM -0500 William Jojo >>>>> <w.jojo(a)hvcc.edu> wrote: >>>>> >>>>> >>>>>> Otherwise this is just like test043, except or the missing dn's. :-) >>>>>> >>>>>> Any ideas? >>>>> >>>>> Try current RE24 CVS. There have been a number of replication related >>>>> fixes made since 2.4.11. >>>>> >>>> >>>> I just tried 2.4.13. The problem still persists. I will check out the >>>> CVS version in the morning. >>> >>> There's nothing different between RE24 and 2.4.13 at this point in time, >>> so there's no point in trying RE24 if you've tried 2.4.13 and it still >>> fails. >>> >>> I suggest you submit an ITS with a way to easily reproduce the issue. >> >> Also make sure to include your exact configuration on the master & >> replica, and any log messages at loglevel sync, so the contextCSN data is >> gathered. > >Also, does the replicator have unlimited time and size limits to search the >master with? > Quanah, Just got back from holiday to find that tests I launched before hand had completed successfully. I had realized that I had not set unlimited prior to my previous tests. Thank you very much for your persistence in following up. Although not a bug (thankfully), I did realize my ignorance of some configuration options. Cheers, Bill

1 0

Can join domain but cannot login
by Emil Sicad - ISD 01 Dec '08

01 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

1 0

{SSHA} for PHP
by Jack van Rock 01 Dec '08

01 Dec '08

Hi, I want to modify a website-login-system (PHP) to check passwords which are deocoded with SSHA. My script should compare the clear password, which I get from a FORM, with the SSHA-hash of the password, which is in the database (MySQL). The dates in the MySQL-DB comes from a LDAP. This is my script: <?php $password_sub = "test"; //Das Passwort erhalte ich über ein HTML-Formular $passsowrd_hash_db = base64_decode("e1NTSEF9aH...."); //Diesen base64-Hash erhalte ich aus der Datenbank. //Er wird gleich decodiert, da man daraus das $salt benötigt. //Dann hat er die Form {SSHA}hxtMi.... $salt = base64_decode(substr($passsowrd_hash_db , 32)); //Berechnung des $salt $hash = "{SSHA}" . base64_encode(pack("H*", sha1($password_sub.$salt)).$salt); ?> But the script doesn't work, because the generated hash isn't the same as the hash from the database. But I don't now, what's wrong? May someone help me? m@xx

2 1

Some servers are delay synced...
by Bad Guy 01 Dec '08

01 Dec '08

Dear sir, We have got a N-way master (N=4) openldap running in version 2.4.11 under linux environment. The 4 servers can be synced immediately. However, after running for several hours, 2 of the servers are synced immediately while the other 2 servers are synced after around 60 mins. Scenairo : - Server 1, 2, 3, 4 are synced. After running for several hours, the following symptoms occur : - update record in server 3, server 4 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 4, server 3 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 1, server 2 will be updated immediately, but server 3 and server 4 got the update 1 hour later. - update record in server 2, server 1 will be updated immediately, but server 3 and server 4 got the update 1 hour later. Server 1 and server 2 are in same LAN segment, server 3 and server 4 in another LAN segment. There are firewalls between server 1/2 and server 3/4, but for same LAN segment, no firewall in between, only firewall in between different LAN segment. Any idea for this 1 hour delay synced ? Every server are config with syncrepl as shown below : bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=ABCDE" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" # Performance tuning directives sizelimit 5000 threads 50 idletimeout 0 cachesize 10000 checkpoint 256 15 Also, from the LDAP log, it shows a lot of "cmp -1, too old" message. Also, from the log, some error message like the following is found : server01 slapd[6386]: do_syncrep2: rid=004 (-1) Can't contact LDAP server server01 slapd[6386]: do_syncrepl: rid=004 retrying server01 slapd[6386]: syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) server01 slapd[6386]: syncrepl_entry: rid=004 be_search (0) server01 slapd[6386]: syncrepl_entry: rid=004 cn=test1,ou=test,o=ABCD server01 slapd[6386]: syncrepl_entry: rid=004 be_modify (0) Any idea on this ? Thanks a lot.... _________________________________________________________________ 下載 Windows Live Messenger 8.5 搶鮮版，多元溝通、盡情分享，和即時傳訊好友線上同樂！— 立即下載 http://get.live.com/zh-cht-tw/betas/messenger_betas

2 1

SASL error
by Mansour Al Akeel 30 Nov '08

30 Nov '08

I am not able to modify a user from CLI. [root@neptune ~]# ldapsearch -D "cn=Manager,dc=test,dc=com" -W -b "dc=test,dc=com" -x -h localhost I get the all the enteries. However, When I do: [root@neptune ~]# ldapmodify -D "cn=Manager,dc=test,dc=com" -W -h localhost Enter LDAP Password: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database If I use -x option, it hangs there for ever after I enter the password. Any idea ?

2 2

hello
by Donny George 28 Nov '08

28 Nov '08

Hello I installed ldap client and software on two ubuntu machines. but when i try to log in with the phpldapadmin gui it displays Network Error (tcp_error) A communication error occurred: "Connection refused" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time. i am new to ldap and i cudnt really find a forum or thread which was talking about this problem. hope someone can help me -- Donny George

2 1

Community request: Real World OpenLDAP Deployments
by Gavin Henry 28 Nov '08

28 Nov '08

Dear All, I'd like to get some examples written up for http://www.openldap.org/doc/admin24/appendix-deployments.html If anyone is interested and allowed to share some information, I'd love to hear from you. The more strange the setup the better! Many thanks, Gavin. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

3 2

Samba failed to bind Ldap
by Emil Sicad - ISD 26 Nov '08

26 Nov '08

Good day to all, Im new to LDAP, I've been working with SAMBA-LDAP implem. and i have these messages logs: Nov 25 17:56:59 smbldap slapd[9974]: sql_select option missing Nov 25 17:56:59 smbldap slapd[9974]: auxpropfunc error no mechanism available Nov 25 17:56:59 smbldap ldap: slapd startup succeededs Nov 25 17:57:07 smbldap smbd[9987]: [2008/11/25 17:57:07, 0] lib/smbldap.c:smbldap_connect_system(850) Nov 25 17:57:07 smbldap smbd[9987]: failed to bind to server with dn= cn=Manager,dc=fcb.net,dc=. Error: Can't contact LDAP server Nov 25 17:57:07 smbldap smbd[9987]: (unknown) Nov 25 17:57:23 smbldap smbd[9987]: [2008/11/25 17:57:23, 0] lib/smbldap.c:smbldap_search_suffix(1155) Nov 25 17:57:23 smbldap smbd[9987]: smbldap_search_suffix: Problem during the LDAP search: (unknown) (Timed out) Question 1) Is my ldap working fine? 2) Why can't samba bind to Ldap? Pls teach me to understand those kind errors. Emil Sicad Cebu Mitsumi Inc Information Systems Division

3 5

schema design and schema restrictions
by Mansour Al Akeel 26 Nov '08

26 Nov '08

Hello all, I an new to LDAP, and I have a need to migrate the existing system to ldap as this will ease a bit the management for the new system implementation. I need to authenticate users for a web site, and for the internal system ( linux, windows stations .... etc). Now the available account objectclass is structural so I can not user inetorgperson with account as both are structural. In this case I decided to extend inetOrgPerson, and add username and password as a MUST attributes. This is because all the users have access to the web site and they need authentication, but some users will need to have access to the machines. In this case I will create a new objectClass (ie. accountInfo) which containts the info I need (home directory, shell, loginScript, .... etc). The issue here is how do I restrict the accountInfo to be added under User ? This is in fact not only specific to this senario. I couldn't find any docs about how to prevent objectClass domain to be added under group ! Finally, how do other ldap admin deal with similar cases ? Any advice ? thank you.

4 13

Tracking down persistent OpenLDAP corruption
by Gilbert Wilson 26 Nov '08

26 Nov '08

So... I'm having a problem with persistent corruption in Apple's Open Directory. I believe this corruption is related to OpenLDAP and the BerkeleyDB. I was hoping that folks here might be able to help me track down whether this is the problem or not. Essentially, what is happening is that user accounts will "disappear" from workgroup manager and dscl[1]. Accounts that have maintained a persistent connection will continue to be authenticated. But, accounts that are not authenticated will be unable to authenticate. The Directory Administrator account, for example, cannot authenticate at these times. If I restart slapd, all the missing accounts that had persistent connections will no longer be able to authenticate. An LDIF export, however, will show that the accounts are all still there. A regular repair and a catastrophic repair of of the BerkleyDB does not work.[2] The first time this happened, it DID work, but subsequent events have not been so easily fixed. A restore from backup is the only way to fix it. However, I suspect that there is malformed data lurking somewhere in the OpenLDAP system. The backups all have this malformed data. Thus, it doesn't take very much for the system to get corrupted again. A hard shutdown does it every time, and a minor upgrade to the OS did it, too. The standard suggested fix is destroy and rebuild the Open Directory setup. For obvious reasons, I would like to avoid this. I want to know *what* is happening. If it is, in fact, malformed data that is becoming corrupt, *what* data should I be examining, *where* is it located, and *how* do I check it for anomalies? Has anyone else had this kind of persistent corruption of their LDAP system? What was causing it? How did you find it? Any leads or words of wisdom would be greatly appreciated. Gilbert Wilson [1] http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/dsc… [2] http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/db_…

2 1

Disabling User Account
by piyush joshi 26 Nov '08

26 Nov '08

Dear Team, Is there any Schema or Attribute which can be used to disable user account if that account is not being used from one month or by providing date in advance to disable the account in future automatically. -- Regards Piyush Joshi 9415414376

3 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 25 Nov '08

25 Nov '08

---- Original message ---- >Date: Thu, 20 Nov 2008 11:02:40 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Thursday, November 20, 2008 10:38 AM -0500 William Jojo ><w.jojo(a)hvcc.edu> wrote: > > >> Otherwise this is just like test043, except or the missing dn's. :-) >> >> Any ideas? > >Try current RE24 CVS. There have been a number of replication related >fixes made since 2.4.11. > I just tried 2.4.13. The problem still persists. I will check out the CVS version in the morning. Cheers, Bill >--Quanah > >-- > >Quanah Gibson-Mount >Principal Software Engineer >Zimbra, Inc >-------------------- >Zimbra :: the leader in open source messaging and collaboration

2 3

Re: configuring ppolicy overlay using cn=config
by Quanah Gibson-Mount 25 Nov '08

25 Nov '08

--On Tuesday, November 25, 2008 11:19 AM +0100 Vincent Panel <yohonet(a)gmail.com> wrote: > Well, I've more or less solved the problem : > > I've guessed the equivalent for cn=config was the following ldif entry : > > dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcPPolicyConfig > olcOverlay: {1}ppolicy > olcPPolicyDefault: "cn=default,ou=policies,dc=example,dc=com" > > And here's what I've got when I added this entry : > > ldap_add: Invalid syntax (21) > additional info: olcPPolicyDefault: value #0 invalid per syntax > > Now, I've removed the quotes of the last line and I have another > error, but it seems caused by the PPolicyDefault object not > existing... > > But I'm a bit moving forward without any piece of documentation, it's > a bit hard... Please keep replies on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Issues in Performance Tesing of OpenLDAP using SLAMD
by Shilpa Sethi 24 Nov '08

24 Nov '08

Hi all, Currently I am involved in an activity that deals with measuring performance of OpenLDAP on Solaris 10 - x_86 machine. Hardware Specs - 1. Two identical servers (Servers 'NodeA' and 'NodeB') with the following configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2220 (2.8GHz/1MB) processor * 1x 4GB PC2-5300 DDR2-667 memory * 2x 146GB HDD 15K RPM (Hardware RAID-1, so available disk space is 146 GB). 2. One server 'NodeC' is used as a traffic injector and has the following hardware configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2218 * 4x 2GB PC2-5300 DDR2-667 memory * 4x 73GB HDD 10K RPM. Software installation common to all servers: 1. JDK 1.6 2. Symas CDS Version 3.9.3 For traffic injection, SLAMD v2.0.0-alpha1 is installed on NodeC. Both Node A and B are Mirror-Mode replicas. The database is having 1 Million subscribers and both the cache sizes are set as follows in slapd.conf : cachesize 250000 idlcachesize 250000 i.e 25% of the subscriber base. Two identical SLAMD SearchRate Jobs, one pointing to Node A and other to Node B are run from Node C. However, there is a wide difference in the number of lookups/sec performed in both the servers. The read rates obtained vary in the ratio of 1:7 or so on both the servers. I am using 1 SLAMD client and 2 threads for targeting on 1 server. If I increase the number of thread, SLAMD starts reporting exceptions. Please suggest a way by which Predictable/ similar read rates could be achieved on both the servers as both being exactly same. Thanks a ton in advance for suggesting a solution. Regards Shilpa Sethi A R I C E N T Plot 6, Electronic City, Sector - 18, Gurgaon 122015 Haryana, India ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 11

Symbol problem with 2.4.13
by William Jojo 24 Nov '08

24 Nov '08

AIX 5.3, OpenLDAP 2.4.13, BDB 4.6.21.3 Previously I emailed the list about symlinking libldap.so to libldap_r.so. For OpenLDAP 2.4.11 this worked perfectly. I have built 2.4.13 with the exact same options and now I get the following error from ldapsearch after symlinking: Could not load program ldapsearch: rtld: 0712-001 Symbol ldap_derefresponse_free was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_parse_derefresponse_control was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_create_deref_control_value was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. Is this a problem with lazy runtime resolution or did something library-wise change in this version? Or, am I just being an idiot and missing something obvious? Cheers, Bill

2 1

Lost Replications
by Burton, Kris - Acision 24 Nov '08

24 Nov '08

All, I am running 2.4.11 with ITS 5709 back ported. What I found digging through CVS was that this impacted syncprov.c 1.147.2.38 ctxcsn.c 1.40.2.6 -> 1.40.2.10 proto-slap.h 1.670.2.31 I can attach my patch file if that would be helpful. What we are seeing now is that on our patched version of 2.4.11 that we lose every 32767 or 32768 entry. This is consistent first we lose the 32767 then the 32768 and this pattern continues rotating back and forth. We pulled the latest RE24 branch and the problem appears to be resolved there. I am not sure if this is a separate ITS, that has been resolved or if there is more to the ITS 5709 that I missed. Hopefully this problem is distinct enough that someone recognizes it and can point me to the proper fix. In the test we produced this we were running mirror mode replication and can produce the problem adding 1 million entries via slapadd. We plan to move forward with 2.4.13 when it's released but for now we need to go forward with 2.4.11. Thanks, Kris Burton This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

RE: Data sync tools
by Bad Guy 24 Nov '08

24 Nov '08

The delay seems due to lost of network connections can't be detected (traceroute indicates 7 hops). So, can I use mastercheckint=5 in slapd.conf to periodic check the master server ? 5 means 5 sec ? Also, the parameter "mastercheckint" can be used in N-way master ? Thanks a lot. > Date: Thu, 20 Nov 2008 20:51:02 +0000> From: ghenry(a)OpenLDAP.org> To: badguy9588(a)hotmail.com> CC: openldap-technical(a)openldap.org> Subject: Re: Data sync tools> > > ----- "Bad Guy" <badguy9588(a)hotmail.com> wrote:> > > Dear all,> > > > We are running a multi-master openldap 2.4.11, we always get delay> > sync in some servers.> > > > Is there any way to do a periodic re-sync without restarting the> > openldap slapd daemon ?> > Can you provide more details please.> > -- > Kind Regards,> > Gavin Henry.> OpenLDAP Engineering Team.> > E ghenry(a)OpenLDAP.org> > Community developed LDAP software.> > http://www.openldap.org/project/ _________________________________________________________________ 聰明搜尋和瀏覽網路的免費工具列 — MSN 搜尋工具列 http://toolbar.live.com/

2 2

ldap_simple_bind_s ok ,but ldap_simple_bind no
by owen nirvana 24 Nov '08

24 Nov '08

I write a dll using Novel CLDAP SDK, because no dev files from openLDAP could be use in windows. basically, they are same, and I found the same problems yet. ldap_simple_bind could not work , but ldap_simple_bind_s is ok. the former return "Operations Error", maybe it is the problem of LDAP Server, ( debian lenny, openLDAP 2.4.11 deb) gtalk:freeespeech@gmail.com

2 1

configuring ppolicy overlay using cn=config
by Vincent Panel 21 Nov '08

21 Nov '08

Hi, I was able to succesfully load the module and "assign" the overlay to the database by using cn=config configuration style. I had to import an LDIF similar to this : add olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy to have the equivalent of the "overlay ppolicy" directive in slapd.conf But now, I try to have the equivalent of the "ppolicy_default" directive. I've had a quick look at the code and it seems and attribute olcPPolicyDefault exists, but it doesn't work... Could you give me a hand ? Thanks, Vincent

2 1

Re: import LDIF file from openldap to redhat directory server
by Pierangelo Masarati 21 Nov '08

21 Nov '08

Please keep postings to the list revathi ganesh wrote: > Thanks for your reply.. > Can you give me the procedure how to back up the entire openldap to LDIF file > > # ldapsearch -x -LLL > openldap.ldif > > Is this correct. No. Please read my previous message, which contains an indication of the correct procedure. p. > > Thanks > > > --- On Fri, 21/11/08, Pierangelo Masarati <ando(a)sys-net.it> wrote: > >> From: Pierangelo Masarati <ando(a)sys-net.it> >> Subject: Re: import LDIF file from openldap to redhat directory server >> To: "revathi ganesh" <cholam20(a)yahoo.co.in> >> Cc: openldap-technical(a)openldap.org >> Date: Friday, 21 November, 2008, 12:23 AM >> revathi ganesh wrote: >>> Dear gurus >>> >>> I have installed redhat directory server in a new >> server. The OS is RHEL V5. >>> We already are running openldap in RHEL V4. Now how >> can I import the all the datas (user accounts) from openldap >> to RHDS. >>> Please give me the procedure. >> To extract the data in LDIF, you can use slapcat(8). Then, >> you probably better ask on a RHDS list. >> >> p. >> >> >> Ing. Pierangelo Masarati >> OpenLDAP Core Team >> >> SysNet s.r.l. >> via Dossi, 8 - 27100 Pavia - ITALIA >> http://www.sys-net.it >> ----------------------------------- >> Office: +39 02 23998309 >> Mobile: +39 333 4963172 >> Fax: +39 0382 476497 >> Email: ando(a)sys-net.it >> ----------------------------------- > > > Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/ Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

6 6

Memory consumption issue
by tkohlhepp 21 Nov '08

21 Nov '08

Hi guys, I've discovered a major memory issue. We have an OpenLDAP server (2.4.11) running with almost 2 million entries. When I do a ldapsearch to retrieve the entire tree the memory consumption grows and grows and will never stop before it ate the entire RAM and swap. My slapd.conf file looks like this: include /var/ldap/ldap-ds/etc/schema/core.schema include /var/ldap/ldap-ds/etc/schema/netmobile.schema include /var/ldap/ldap-ds/etc/schema/netmobile.acc.schema include /var/ldap/ldap-ds/etc/schema/netmobile.zMRDB.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/ldap/ldap-ds/var/run/slapd.pid argsfile /var/ldap/ldap-ds/var/run/slapd.args access to * by dn="cn=replica,ou=replica,ou=ldapaccounts,o=netmldap" write by users read by anonymous read access to * by self write by users read by anonymous read #threads 2 # all logging #loglevel -1 # only syncrepl logging loglevel 16640 ####################################################################### # BDB database definitions ####################################################################### database monitor access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,ou=netm,ou=people,o=netmldap" write by dn.exact="cn=admin,ou=netm,ou=people,o=netmldap" read by * none database bdb suffix "cn=accesslog" rootdn "cn=Admin,o=netmldap" directory /var/ldap/ldap-ds/cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=Admin,o=netmldap" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database config rootdn "cn=admin,cn=config" rootpw config database bdb suffix "o=netmldap" rootdn "cn=Admin,o=netmldap" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}5ycg8tSV/i0Z99FKaylr0Az5x1nBA8TC directory /var/ldap/ldap-ds/o=netmldap #dbcachesize 1000000 cachesize 1000 idlcachesize 3000 cachefree 500 searchstack 8 #readonly on # Indices to maintain index default pres,eq index cn index netmzMRDBPhoneNumber index netmAccNumAddr index netmAccNumPort index netmLogin2 index netmPortalName index netmCarrierID # new indices - 2007-01-15 index netmLogin pres,eq index netmClientContractUniqueName index netmPrivateMail index netmContactTecEmail index netmContactBillingEmail index netmFirmEmail index netmContactCommEmail index netmzMRDBCarrier index netmzMRDBblacklistLA index netmzMRDBPortingDate index objectClass pres,eq index entryCSN,entryUUID eq # Save the time that the entry gets modified lastmod on overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 limits dn.exact="cn=Admin,o=netmldap" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited sizelimit -1 The DB_CONFIG look like this set_cachesize 0 8435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 # will automatically remove transaction logs # this setting isn't recommended set_flags DB_LOG_AUTOREMOVE When I start slapd is consumes that much RAM total kB 478476 After doing the search it looks like this total kB 937316 I've done a pmap -x to see where the memory goes but this process is marked as anonymous. So I don't know how to get this memory back. I have to restart the LDAP server to get this memory released. I would appreciate if someone could help me to solve this issue. Thanks Thorsten

5 7

Ldap Add Fail
by karthikeyan.chetty＠wipro.com 20 Nov '08

20 Nov '08

Dear open-ldap Team, Currently we are using ldap Version-2.4.8 on our Fedora Core 9 machine. When we try to create a computer account using ldap-add with non admin user we are getting error "insufficientAccessRights". Please let us know how we can add computer account in Active Directory with non admin users?? Thanks in advance. S.Karthikeyan Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

RE: Debugging a user authentication
by Adrian Marsh 20 Nov '08

20 Nov '08

All, I'm not sure if my questions here are getting through to the group (I don't see a copy to myself) I've diagnosed this issue. The user has a "£" (UK Pound) in his password. Remove it and everything authenticates OK. Are there settings in Apache/LDAP for controlling what characters can be used as passwords? Adrian ________________________________ From: Adrian Marsh Sent: 14 November 2008 11:49 To: 'openldap-technical(a)openldap.org' Subject: Debugging a user authentication Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

5 11

Delta-sync symptom in 2.4.11
by William Jojo 20 Nov '08

20 Nov '08

Running 2.4.11 on AIX 5.3, I have setup a delta-syncrepl test with bdb (not hdb). Now the software passes test043, but when I setup the first copy from the master, the following happened: The master is populated with 62485 dn's. When the replica was started it sync'ed 29786 dn's. I had to stop the replica and restart it to make the sync move along (several times...). second sync pulls 15858 dn's third sync pulls 4428 dn's forth sync pulls nothing, but the replica has only 50072 dn's and does not sync further. Is does not appear to be an ACL issue since the replicator account has read access to * on the master. Otherwise this is just like test043, except or the missing dn's. :-) Any ideas? Cheers, Bill

2 1

import LDIF file from openldap to redhat directory server
by revathi ganesh 20 Nov '08

20 Nov '08

Dear gurus I have installed redhat directory server in a new server. The OS is RHEL V5. We already are running openldap in RHEL V4. Now how can I import the all the datas (user accounts) from openldap to RHDS. Please give me the procedure. Thanks Cholam20 From Chandigarh to Chennai - find friends all over India. Go to http://in.promos.yahoo.com/groups/citygroups/

2 1

RE: cont contact server since 3 days+please help
by Burton, Kris - Acision 20 Nov '08

20 Nov '08

>From the results below it looks like your server is not even coming up. This would explain why you are not able to search or add entries. Next thing to look at is to see if you are getting any useful information in the slapd.log. This should be in /var/log/slapd.log. If you don't know where it is located then try using the locate command I think ubuntu should have that or something equivalent. If you don't find one then you might need to enable the log in /etc/syslog.conf. I use RH so I assume something similar is available on ubuntu. I added the list back to the CC so others that might know more about ubuntu specifics can help and so they can assist you as well. --Kris ________________________________ From: Donny George [mailto:donny008@gmail.com] Sent: Wednesday, November 19, 2008 3:13 PM To: Burton, Kris - Acision Subject: Re: cont contact server since 3 days+please help hello kris this are the results that i get when i try to listen , guess this is not wat u were expecting root@ubuntu:/home/administrator# ps -eaf | grep slapd root 14183 14172 0 22:07 pts/0 00:00:00 grep slapd root@ubuntu:/home/administrator# netstat -na | grep 389 root@ubuntu:/home/administrator# telnet 10.4.139.5<http://10.4.139.5> 389 Trying 10.4.139.5... telnet: Unable to connect to remote host: Connection refused i tried the earlier steps like ldapsearch -d 255 after reading different forums of ldap but please dont misunderstand me to be an expert in openldap could you tell me how to establish the connectivity or where did i go wrong thanking you don On Wed, Nov 19, 2008 at 10:16 AM, Burton, Kris - Acision <kris.burton(a)acision.com<mailto:kris.burton@acision.com>> wrote: Have you on the server side verified that LDAP is up and listening on the proper port? ps -eaf | grep slapd netstat -na | grep 389 tcp 0 0 0.0.0.0:389<http://0.0.0.0:389> 0.0.0.0:* LISTEN If the above come back and indicate it is up and listening see if you can telnet to the <ip> 389 and get something back. Also you could check to see if you are getting errors on server startup by checking the slapd.log on the server side and see if it is reporting any errors. If you are using the command line search are you specifying the remote server using the -h option? Most of the errors seem to indicate there is nothing listening on the server to handle the search request. --Kris Burton ________________________________ From: openldap-technical-bounces+kris.burton=acision.com<http://acision.com>@OpenLDAP.org [mailto:openldap-technical-bounces+kris.burton<mailto:openldap-technical-bounces%2Bkris.burton>=acision.com<http://acision.com>@OpenLDAP.org] On Behalf Of Donny George Sent: Wednesday, November 19, 2008 8:47 AM To: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Subject: cont contact server since 3 days+please help hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389<http://10.4.139.5:389> ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389<http://10.4.139.5:389> ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. -- Donny George This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

3 3

Data sync tools
by Bad Guy 20 Nov '08

20 Nov '08

Dear all, We are running a multi-master openldap 2.4.11, we always get delay sync in some servers. Is there any way to do a periodic re-sync without restarting the openldap slapd daemon ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Error on boot
by Ronni Feldt 19 Nov '08

19 Nov '08

Hi, I've installed and configured LDAP and Kerberos which works fine. The only problem is that when I start my computer, I get the following error: udevd[2282]: nss_ldap: failed to bind to LDAP Server ldap://ldap.one.com: Can't contact LDAP Server udevd[2282]: reconnecting to LDAP Server... udevd[2282]: could not connect to any LDAP Server as (null) - Can't contact LDAP Server udevd[2282]: could not search LDAP Server - Server is unavailable I then have restart and boot into another dist I have installed and edit the following files: nsswitch.conf pam.d/common-auth common-account common-password common-session And remove kerberos & ldap Restart and then I can login, but without Kerberos and LDAP. How do I solve this? Best Regards Ronni

3 2

Advise on tuning
by Maykel Moya 19 Nov '08

19 Nov '08

I have a box (Proliant DL560) with this features: - 4GB RAM - 3 x Xeon 2.8 GHz - 2 x HD SCSI 10k RPM (No RAID) I have the BDB in one of those HD and the logs in the other one. When I installed the server I wasn't enough sure about a correct value for cachesize so I decided to play safe. sldcu DB_CONFIG --------------- set_cachesize 0 1073741824 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/sldcu set_flags DB_LOG_AUTOREMOVE accesslog DB_CONFIG ------------------- set_cachesize 0 715827883 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/accesslog set_flags DB_LOG_AUTOREMOVE I was reading this[1] yesterday and found out that a I have a very large value. For my dc=sld,dc=cu DB I have a 6.2 MB dn2id.bdb and a 56 MB id2entry.bdb, the DIT contains about 60k entries. Normally I larger value is a Good Thing(TM) but I'm specially worried about slapd using around 40%-50% time of (one) CPU and eventually a message of 'deferring operation' gets logged. The server is attending 30 connections per second sustained during working hours. Read Waiters are about 100 sustained during this same period. Yesterday I sent a message to the list asking for opinions about that value for Read Waiters because it doesn't sound good to me, but well, I know that 'sounds good' is very subjective. I was running 2.3.38 yesterday morning and upgraded to 2.4.11. With the same setup (only the slapd changed) the mail service got deeply affected. Dovecot began to take several (+10) seconds to authenticate, in other cases, the POP3/IMAP connection was dropped due to timeout. While Dovecot was failing my slapd.log were solid filled by 'deferring operation' messages. I stopped Dovecot, the messages dissapears, I started Dovecot, the message began again to fill logs. So, I thank it could be some problem on Dovecot side (although it was playing nice with slapd 2.3.38). Thanks God I hit man slapd-hdb and learn about cache tuning values there. I then raised olcDbCacheSize / olcDbDNCacheSize / olcDbIDLCacheSize and things began to calm down. I wonder how slapd 2.3.38 were nicely serving Dovecot without the tuning I made. On the other hand I have the suspiction, based on benchmark data published on the list, that there is something wrong with that large cache plus 50% CPU for less than 30 connections per second. I very much appreciate any help/advise/hint someone could give me about this issue. Regards, maykel [1] http://www.openldap.org/faq/data/cache/1075.html

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Will do. I'm glad that there are community as such. This is a great place to learn and get help. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Thanks very much Gavin for all your help. All is working as it should. >> > > No problem. Just make sure you pass on what you've learned :-) > >

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Thanks very much Gavin for all your help. All is working as it should. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Few more questions Gavin. >> >> Our primary domain controller certificate is also expiring next month. >> What is the best way to handle this? Does the certificate and keys on >> the backup domain controller has any connection to the certs and keys >> of the primary domain controller and the other backup domain >> controller? >> > > Other than being signed by the Certificate Authority, none. As long as > you use the same FQDN for the certs as before and the CA doesn't change, > then all is good. > > >> I would be relieve to hear that I can make brand new certificate and >> keys for each machine and they have no connection with each other. >> >> Thanks for all your help. >> >> -Ivan >> >> >> ghenry(a)OpenLDAP.org wrote: >> >> ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: >> >> Looking at the debug log, it is expired. It puzzle me because the >> certs on the other two machine are working correctly. Check their >> expiry dates with: >> >> openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text >> >> Since this is the case (certificate expires), is it safe to create a >> new one for this machine? Of course, then sign it with the cacert, >> something like: >> >> ./CA.sh -newreq >> ./CA.sh -sign >> > >

1 0

cont contact server since 3 days+please help
by Donny George 19 Nov '08

19 Nov '08

hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George

2 1

Re: Openldap and TLS issue
by ghenry＠OpenLDAP.org 19 Nov '08

19 Nov '08

----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > Looking at the debug log, it is expired. It puzzle me because the > certs on the other two machine are working correctly. Check their expiry dates with: openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text > Since this is the case (certificate expires), is it safe to create a > new one for this machine? Of course, then sign it with the cacert, something like: ./CA.sh -newreq ./CA.sh -sign -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Looking at the debug log, it is expired. It puzzle me because the certs on the other two machine are working correctly. Since this is the case (certificate expires), is it safe to create a new one for this machine? Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Hi, >> >> Our environment is consist of 3 domain controllers - 1 primary and 2 >> backup. All domain controller are running on Gentoo platform using >> Samba with Openldap for user login and authentication. One of the >> backup domain controller has been acting up lately and will not start >> >> samba properly. A quick look at the log showed: >> >> slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= >> slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) >> slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 >> (IP=0.0.0.0:389) >> >> It seems obvious that the issue is with certificate. The certificate >> we >> are using was created using the primary domain controller and were >> then >> copied to both backup domain controller. If I create a brand new >> certificate using the backup domain controller having certificate >> issue, >> will that interfere with the certificate on the primary domain >> controller? Will that cause confusion on the domain? Creating a brand >> >> new certificate is the only solution I can think of to fix this issue. >> > > http://www.openldap.org/faq/data/cache/185.html > > Has one of your certs expired? By default OpenSSL scripts do 365 days. > >

1 0

Slow Data sync
by Bad Guy 19 Nov '08

19 Nov '08

Hi all, I am using openldap 2.4.11, and configure as 4-way Master, config files for server A,B,C,D are shown below : Server A : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 001 Server B : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 002 Server C : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 003 Server D : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 004 I find a strange behaviour, data can be synced within all 4 servers, however, after some time, I find that when I add/update data in server A, it can sync to server B immediately, server C and server D can't receive the updated data., I check the log in server C and server D, there is no data push to C and D. (I set the log level 16384 to log the sync) When I add record in server C, data can be sync to server D immediately, server A and server B can't receive the updated data. But after some time (may be 1-2 hours), the data between the 4 servers are synced finally. Another information is that server A and B are in same segment, server C and server D are in same segment, but server A and C/D are in different segment. The ping test between servers are fast. I also use telnet server A/B/C/D 389, the response is fast. Any idea ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Must pwdReset always be set explicitly?
by Akke Bengtsson 19 Nov '08

19 Nov '08

The draft description of ppolicy (draft-behera-ldap-password-policy-09.txt) from July 17 2005 says among other things "If the value the pwdMustChange is TRUE and the modification is performed by a password administrator, then the pwdReset attribute is set to TRUE. My impression, using OpenLDAP up to v.2.4.10 is that it rather is implemented as "...and the pwdReset attribute is set to TRUE, the user has to change his password." (i.e. to set pwdReset signals the very fact that I am a password administrator.)? (On the other hand - the reset of the pwdReset attribute when the user actually chooses a new password is as expected automatically performed by the OpenLDAP software.) The Behera draft expired more than two years ago - in a more recent IETF draft by Zeilenga from march 2008, there is a suggestion to replace pwdReset by passwdChangeRequired. Also this draft is expired by now - did it make way into any OpenLDAP code? Best Regards Akke Bengtsson IT-Forum, IT-Arkitektur och systemutveckling Karolinska Universitetssjukhuset 141 86 STOCKHOLM

1 0

Openldap and TLS issue
by Ivan Ordonez 18 Nov '08

18 Nov '08

Hi, Our environment is consist of 3 domain controllers - 1 primary and 2 backup. All domain controller are running on Gentoo platform using Samba with Openldap for user login and authentication. One of the backup domain controller has been acting up lately and will not start samba properly. A quick look at the log showed: slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 (IP=0.0.0.0:389) It seems obvious that the issue is with certificate. The certificate we are using was created using the primary domain controller and were then copied to both backup domain controller. If I create a brand new certificate using the backup domain controller having certificate issue, will that interfere with the certificate on the primary domain controller? Will that cause confusion on the domain? Creating a brand new certificate is the only solution I can think of to fix this issue. I've already re-install samba, openldap and smbldap-tools twice to no avail. samba 3.0.32 openldap 2.3.43 smbldap-tools 0.9.4-r1 Thanks in advance. -Ivan

1 0

Mailing list query
by Stelios A. 18 Nov '08

18 Nov '08

Hello all, My user.ldif is like: dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Somename sn: Somelastname cn: Somename Somelastname uid: ssomelastname uidNumber: 1002 gidNumber: 100 homeDirectory: /home/ssomelastname loginShell: /bin/bash mail: ssomelastname(a)mydomain.edu.com userPassword: some password encrypted Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com Example ldif: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com What I want is somehow to get all uid of the users belonging to each of my groups in order to build a mailing list with postfix. I've created a file called ldap-aliases.cf with the following inside: server_host = ldaps://myhostname search_base = dc=mydomain,dc=edu,dc=com scope = sub version = 3 query_filter = (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) result_attribute = uid bind = yes bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com bind_pw = mypasswordwithoutencryption The above works ok without errors but it just displays all users in my ldap. I tried several different ways but can't find out how to add to the query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com and also a second more complicated query, that is to show me all users uid where not belonging to any Group (ou=Groups,dc=mydomain,dc=edu,dc=com) Any help is much appreciated. Thanks

4 10

CSN Too Old potential Bug
by Burton, Kris - Acision 17 Nov '08

17 Nov '08

All, I want to ask the list about this before I try to open an ITS to make sure that I am understanding everything correctly. We are running OpenLDAP 2.4.11. I selectively tried to back post ITS 5709 to our source, because we were losing replications. Applying this seemed to help and reduced the number of lost replications. We are running in mirror mode using refreshAndPersist, and doing a high volume of adds to the master, on the order of 100/s. We have run numerous iterations of the same test with very aggressive NTP updates that are keeping both the master and consumer within 50 microseconds of one another. Which I saw recommended as a possible solution in a previous message thread. This seemed to make little to no difference in the replication loss. >From looking at the code I was thinking that the lost replications might be due to entries being queued on the master side in non-ascending order which I was seeing preceding the replication that would be rejected on the consumer side. What I thought was happening is that the logic that traverses the queue to mark committed CSNs and updates the contextCSN was getting out of sync because of this, and orphaning replications that were still pending, because they are too old, but in reality they have never been added to the consumer. I just pulled the latest code from RE24 and reran the test, the latest code is better than before with just the back post of 5709 on 2.4.11, but we are still losing a small percentage of the replications with the "CSN too old" message. With the latest code I am still seeing a correlation between the out of sync queuing on the master and the replications that are rejected on the consumer. During this run NTP was keeping the 2 systems within 10 microseconds of each other, with the most aggressive synch interval that is configurable at 16 seconds. Below I have log snippets and some of the relevant configuration information. If more is desired then please let me know and I will provide it. #### MASTER ##### Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c9568b0 20081114194304.892065Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x42803100 20081114194305.078713Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=14 op=17167 ADD dn="uniqueIdentifier=Evad_Added_tele_5450408582,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4680b100 20081114194305.078878Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43004100 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=12 op=13844 RESULT tag=105 err=0 text= Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c87e670 20081114194305.068251Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 ADD dn="uniqueIdentifier=Evad_Added_tele_5450009858,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4780d100 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=12 op=17496 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5a7f8340 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=13 op=19983 ADD dn="uniqueIdentifier=Evad_Added_tele_5450509990,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ae77160 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=14 op=19598 ADD dn="umbillingnumber=5450409797,uniqueIdentifier=Evad_Added_tele_5450409797,ou=s…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.936884Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=11 op=16763 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.947725Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ad51170 20081114194502.917288Z#000000#001#000000 ### CONSUMER ### Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_add (0) Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002 Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_search (0) Nov 14 14:45:39 ng04be04 slapd[24622]: slap_queue_csn: queing 0x2b4737c990 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: slap_graduate_commit_csn: removing 0x2b473ca890 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.936884Z#000000#001#000000 ### Replication Config ### dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig ... olcSyncrepl: {0}rid=2 provider=ldap://ldap.server.com bindmethod=si mple timeout=0 network-timeout=0 binddn="cn=Directory Manager,o=ricuc.com" cr edentials="secret" starttls=no filter="(objectclass=*)" searchbase="o=ricuc.com" scope=sub schemachecking=off type=refreshandpersist retry="60 +" olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 ### Hardware ### Dual Quad Core Xeon 2.83GHz 32GB RAM 8x15000rpm RAID10 Separate LUNS for db and txn logs Kris Burton Software Engineer ________________________________________ Acision. Innovation. Assured. www.acision.com 4870 Sadler Road Suite 200 Glen Allen, VA 23060 USA This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 4

openldap client over ssl
by Beijing Normal Univ 16 Nov '08

16 Nov '08

Hi I am new to openldap and ssl. I would like to use only the openldap client sdk. What I want to do is use the openldap client sdk to develop some tools which could comunicate with ldap server over ssl channel. Do I still need openssl? Maybe I should ask my question this way: Openssl will need to be used to generate the certificate etc. Does my application itself requre openssl libraries if it needs to support ssl? I think the answer probably is yes. Thanks

1 0

OpenLDAP interop with AD questions
by Christopher Barry 16 Nov '08

16 Nov '08

Hi All, I'm still researching methods, and trying to find the best way to integrate our Unix hosts with AD in a way that makes sense for us. The goal is to have a single user/password db in AD, and have all of the old NIS map data in OpenLDAP. SSO would be a nice to have feature too. I've read more stuff than I can count, but I'm still more than a little confused. The translucent overlay looks cool (if it'll even work with AD), but I'm not sure it's the right answer for us with respect to keeping the maps local to OpenLDAP. Any suggestions or doc links you can post? Thanks, -C

4 3

Re: Mailing list query
by Stelios A. 15 Nov '08

15 Nov '08

That query does not return any result. root@myserver:/etc/postfix# postmap -q mail_Group ldap:/etc/postfix/ldap-aliases.cf postmap: warning: dict_ldap_open: /etc/postfix/ldap-aliases.cf: Fixed query_filter cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr is probably useless root@myserver:/etc/postfix# Regarding my second query, I have 5 groups where only staff is assigned to each one depending the department. Then the rest of the users (students) does not belong to any group so in order to get all uid's of students I need to query the whole ldap excluding the groups. 2008/11/15 Chris <cjl(a)viptalk.net>: > > On Nov 15, 2008, at 12:22 AM, Stelios A. wrote: > >> Hello all, >> >> My user.ldif is like: >> >> dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com >> objectClass: inetOrgPerson >> objectClass: posixAccount >> objectClass: person >> objectClass: organizationalPerson >> objectClass: top >> givenName: Somename >> sn: Somelastname >> cn: Somename Somelastname >> uid: ssomelastname >> uidNumber: 1002 >> gidNumber: 100 >> homeDirectory: /home/ssomelastname >> loginShell: /bin/bash >> mail: ssomelastname(a)mydomain.edu.com >> userPassword: some password encrypted >> >> Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com >> Example ldif: >> >> dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr >> cn: IT >> objectClass: groupOfUniqueNames >> uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com >> >> What I want is somehow to get all uid of the users belonging to each >> of my groups in order to build a mailing list with postfix. >> >> I've created a file called ldap-aliases.cf with the following inside: >> >> server_host = ldaps://myhostname >> search_base = dc=mydomain,dc=edu,dc=com >> scope = sub >> version = 3 >> query_filter = >> (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) >> result_attribute = uid >> bind = yes >> bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com >> bind_pw = mypasswordwithoutencryption >> >> The above works ok without errors but it just displays all users in my >> ldap. >> I tried several different ways but can't find out how to add to the >> query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > > Try setting this as your search base: > cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > >> and also a second more complicated query, that is to show me all users >> uid where not belonging to any Group >> (ou=Groups,dc=mydomain,dc=edu,dc=com) > > Not quite sure I understand what you're looking for there. > > -- Stelios A

1 0

Active Directory caching
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, I'm looking for some references/answers as to how OpenLDAP and Active Directory work with regards to caching. The scenario I'm seeing is this: I have Apache on a RHEL5 machine authenticating users via LDAP. Its set to cache for 600s, so I dont overload the server unnecessarily. What I'm seeing though, is that something somewhere is caching old passwords. I can change the users password several times, and LDAP will authenticate using any of the passwords previously used. I've tried some timing tests of my own, and it seems that it takes up to 50mins for me first password change to take effect (an odd time to me). So I'm trying to figure out whos caching the other passwords, is it LDAP, or is it AD ? And if so where are the settings to look at? And what timers are involved? I actually don't mind the idea of caching older passwords, but only so long as I know how long it will be for, and what mechanism is doing it, then I can change it if need be. I'm setting these directives (taken straight from the Apache examples). LDAPSharedCacheSize 200000 LDAPCacheEntries 1024 LDAPCacheTTL 600 LDAPOpCacheEntries 1024 LDAPOpCacheTTL 600 My setups quite simple. Ive one Domain Controller. No proxies involved. I've read what I can online, and am getting stuck. Thanks, Adrian

2 1

Debugging a user authentication
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

2 2

LDAP logs
by Tom Cooper 14 Nov '08

14 Nov '08

Hi all, I am running openldap 2.3.27 and in the database directory log files are created called log.00000xxxx where xxxx is an incrementing number. Each log file is 10MB in size. Searching for it it looks like Berkely DB logs. How do I get rid of it as it chews up my disk space quite quickly? I have noticed that if they are deleted, my database becomes corrupted. Thanks. Tom To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

3 2

startup ldap problem
by GanGan 13 Nov '08

13 Nov '08

hello all, My problem, when I start my server ldap in my log Nov 13 12:34:10 srvtest3 slapd[3738]: daemon: shutdown requested and initiated. Nov 13 12:34:10 srvtest3 slapd[3738]: slapd shutdown: waiting for 0 threads to terminate Nov 13 12:34:10 srvtest3 slapd[3738]: slapd stopped. Nov 13 12:34:12 srvtest3 slapd[3800]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 2 2008 04:29:17) $ brewbuilder@hs20-bc2-2.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 55: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 60: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 65: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3801]: slapd starting I do not understand where is the problem, in my /etc/ldap.conf ? this command : getent passwd no user displays ldap someone would have an idea? thanks -- - GanGan -

4 4

(no subject)
by Bad Guy 12 Nov '08

12 Nov '08

Dear all, I am running the openldap 2.4.11 with 4 way masters (SID=001 to 004) configured. (my suffix is empty in slapd.conf) The data can be synced initially. I add records in 1 server and all the other 3 servers will have the new record added. However, I found that after running for some time, one server will have corrupted contextCSN in SID=001. dn: contextCSN:: sCttCIio0wAxNTQzMTMuMDQ1Mjk3WiMwMDAwMDAjMDAyIzAwMDAwMA== contextCSN: 20081107061013.853051Z#000000#001#000000 contextCSN: 20081107073602.911356Z#000000#003#000000 contextCSN: 20081107061028.825773Z#000000#004#000000 The contextCSN for SID=002 in server 1 is corrupted. So, whenever there is an update in SID=002 server, the SID=001 server will never get the update, however, when there is update in SID=003 or SID=004 server, the records will get updated in SID=001. We have a background cron job in each server running at 1 minutes interval to retrieve the records and set some user defined attributes if it meet some certain criteria. What's the cause to this corruption ? Is there any way to recover the corrupted contextCSN by command or script without rebuild the data ? Thanks _________________________________________________________________ 用部落格分享照片、影音、趣味小工具和最愛清單，盡情秀出你自己 — Windows Live Spaces http://spaces.live.com/

3 4

Password protection of TLS key
by Akke Bengtsson 12 Nov '08

12 Nov '08

Is it still a requirement that TLS keys must have their password nullified before using them in an openldap context? Some experimentation with slapd startup has revealed that for some combinations of OS and OpenLDAP version, I will be given a prompt for the TLS password and can also input it and the slapd daemon starts correctly. On other systems, I was prompted for the password but before I even could enter it, the slapd startup crashed. The tests were all performed doing a manual startup via "/etc/init.d/ldap start". Automatic startup means that the password, instead of being entered by a person, has to reside on file and thereby be accessible to potential intruders. Is there any way to prevent unprotected keys or passwords to keys in this context? Akke Bengtsson

2 1

Cannot modify directory entry with custom attribute
by James S. White 10 Nov '08

10 Nov '08

I cannot add a custom objectclass to a directory entry. When I remove my custom objectclass and attributes, I can modify the entry normally. When I add them, I get an "Invalid Syntax (21)" error. I've googled extensively, and can find other cases of this happening, but not an effective solution. What am I missing here? Details: #/etc/ldap/schema/venn.schema attributetype ( 1.1.2.1.1 NAME 'vennBase' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.2 NAME 'vennClass' DESC 'A single set this host belongs to' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClass ( 1.1.2.2.1 NAME 'vennHost' SUP top AUXILIARY MUST ( vennBase $ vennClass ) ) #added to /etc/ldap/slapd.conf include /etc/ldap/schema/venn.schema # command /etc/init.d/slapd restart #freyr.ldif dn: cn=freyr,ou=Hosts,dc=websages,dc=com cn: freyr objectclass: top objectclass: ipHost objectclass: device objectclass: vennHost ipHostNumber: 72.14.177.235 vennBase: debian-etch vennClass: ldap_server vennClass: bind9_server vennClass: cfengine_server vennClass: openldap_server vennClass: irc_server # command ldapmodify -xh freyr.websages.com -D "cn=root,dc=websages,dc=com" -f freyr.ldif -W #error modifying entry "cn=freyr,ou=Hosts,dc=websages,dc=com" ldap_modify: Invalid syntax (21) additional info: objectclass: value #3 invalid per syntax if I remove all the venn* stuff from the .ldif, everything works fine... Any help would be appreciated.

1 1

moving ldap-db via file-copying?
by Silvana 10 Nov '08

10 Nov '08

Hello! I hope you can help me, migrate my old ldap-db, problem is this: Our old server was running with ldap2.2.7? to serve as backend to the sambaserver and as of today its refusing to work or give errors (the ldap-daemon seems to start, but doesn't open the port, is not accessible, gives no errors and has to be killed, because stopping it gives no reaction) now, i've set up a new machine, to use ldap, given it the same suffix, cn, etc. the version of ldap is a newer one, than on the old box, although i'm not sure, how far they are removed. is it in some way possible, to just copy the files in /var/lib/ldap/ from the old server and insert them into the new box in the same folder? if so, which files would be ok to overwrite, which not? or woul i have to tweak some other files for that as well? or is this completely inconceivable (as i dread is the case), and if yes, how am i to get the files from the old server to the new one? any help on this would be greatly appreciated bye silvana

3 3

Re: ldap attributes - performance problem?
by Pavlos Parissis 09 Nov '08

09 Nov '08

On Sun, 09 Nov 2008 08:52:21 -0800 radim.roska(a)gmail.com wrote: > Hi, > > ok..then i guess there is not a problem :)..of course I'll add indexes, but > I was just thinking if its ok to have a lot of same attributes.. If the schema allows multiple values for this attribute then from OL point of view is fine. I assume that apache or any other LDAP client which is going to fetch this attribute will correctly handle the multiple values. Cheers, Pavlos > > thanks, > Radim > > On Nov 9, 2008 11:43am, Pavlos Parissis <p_pavlos(a)freemail.gr> wrote: > > Hi, > > > > > > > > I don't real understand your concerns. > > > > > > > > Are you worry about LDAP search performance? > > > > Adding indexes is your solution on this. > > > > > > > > Cheers, > > > > Pavlos > > > > > > > > > > > > On Sat, 8 Nov 2008 21:15:02 +0100 > > > > "Radim Roska" wrote: > > > > > > > > > Hi, > > > > > > > > > > I'm thinking about solution to following problem: authorization to > > > > > directories on our file server (accessed by webdav). Is it a performance > > > > > issue to build solution on following pattern? > > > > > > > > > > part of user's ldif > > > > > ... > > > > > uid=someone > > > > > allow_dir: directory1 > > > > > allow_dir: directory2 > > > > > allow_dir: directory3 > > > > > allow_dir: directory4 > > > > > > > > > > and then just htaccess directives in apache for every of these > directories > > > > > :) > > > > > > > > > > > > > > > it could happen that someone would have eg 50 of these > attributes...would > > > > > it be a problem? > > > > > > > > > > Thanks for advice and advanced opinion :) > > > > > Radim > > > > > > > >

1 0

ldap attributes - performance problem?
by Radim Roska 09 Nov '08

09 Nov '08

Hi, I'm thinking about solution to following problem: authorization to directories on our file server (accessed by webdav). Is it a performance issue to build solution on following pattern? part of user's ldif ... uid=someone allow_dir: directory1 allow_dir: directory2 allow_dir: directory3 allow_dir: directory4 and then just htaccess directives in apache for every of these directories :) it could happen that someone would have e.g. 50 of these attributes...would it be a problem? Thanks for advice and advanced opinion :) Radim

2 1

Re: any tools for data resync....
by Gavin Henry 07 Nov '08

07 Nov '08

----- "Paul Lee" <paul(a)hk.fujitsu.com> wrote: > Dear all, > > My customers is very concern on the data synchronization on the 4-way > > masters openldap servers. > > If in case there is record unsync (due to whatever reason, e.g. > network > failure, CSN too old, etc), will there be any tools to resync the data > ? > > If there is such tools, we can execute a cron job to do this. They will retry depending on what settings you have if there is a connection problem. Can you try on 2.4.12, not 2.4.9 and also host your config somewhere. You can quickly check all contextCSN are the same via: [ghenry@suretec ~]$ ldapsearch -x -LLL -H ldap://host1 -s base -b 'dc=suretecsystems,dc=com' contextCSN dn: dc=suretecsystems,dc=com contextCSN: 20081025222436.822813Z#000000#000#000000 [ghenry@suretec ~]$ ldapsearch -x -LLL -H ldap://host2 -s base -b 'dc=suretecsystems,dc=com' contextCSN dn: dc=suretecsystems,dc=com contextCSN: 20081025222436.822813Z#000000#000#000000 -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

2 1

Indexing integers
by Sean Burford 06 Nov '08

06 Nov '08

Hi, I have been looking for the index to apply to integer attributes to speed up less than/greater than filters, but have turned up nothing. These searches work, but eq and pres indexes don't seem to affect their speed. Is there an index that help with integer ordering searches? Thanks Sean

2 1

any tools for data resync....
by Paul Lee 05 Nov '08

05 Nov '08

Dear all, My customers is very concern on the data synchronization on the 4-way masters openldap servers. If in case there is record unsync (due to whatever reason, e.g. network failure, CSN too old, etc), will there be any tools to resync the data ? If there is such tools, we can execute a cron job to do this. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

OPENLDAP installation error
by Sujeet Vanage 05 Nov '08

05 Nov '08

Hi I am getting following error when tried to configure open ldap Basically I just need OPEN LDAP client library and not directory server I issued following command $ ./configure --disable-slapd --disable-slurpd and got this error message configure:4505: error: C compiler cannot create executables See `config.log' for more details. I checked that cc and gcc are installed and in PATH any idea how to solve? Pleas help below are some details from config.log >>>>>>>>>>>>>>>>>> ## ----------- ## ## Core tests. ## ## ----------- ## configure:1616: checking build system type configure:1634: result: sparc-sun-solaris2.10 configure:1642: checking host system type configure:1656: result: sparc-sun-solaris2.10 configure:1664: checking target system type configure:1678: result: sparc-sun-solaris2.10 configure:1707: checking for a BSD-compatible install configure:1762: result: build/shtool install -c configure:1773: checking whether build environment is sane configure:1816: result: yes configure:1881: checking for gawk configure:1910: result: no configure:1881: checking for mawk configure:1910: result: no configure:1881: checking for nawk configure:1897: found /usr/bin/nawk configure:1907: result: nawk configure:1917: checking whether make sets $(MAKE) configure:1937: result: yes configure:2146: checking configure arguments configure:3644: WARNING: slapd disabled, ignoring --enable-bdb argument configure:3644: WARNING: slapd disabled, ignoring --enable-hdb argument configure:3644: WARNING: slapd disabled, ignoring --enable-monitor argument configure:3644: WARNING: slapd disabled, ignoring --enable-relay argument configure:3680: WARNING: slapd disabled, ignoring --enable-seqmod argument configure:3680: WARNING: slapd disabled, ignoring --enable-syncprov argument configure:3748: result: done configure:3917: checking for cc configure:3933: found /usr/ucb/cc configure:3943: result: cc configure:3967: checking for ar configure:3983: found /usr/ccs/bin/ar configure:3993: result: ar configure:4052: checking for style of include used by make configure:4080: result: GNU configure:4421: checking for C compiler version configure:4424: cc --version </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4427: $? = 1 configure:4429: cc -v </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4432: $? = 1 configure:4434: cc -V </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4437: $? = 1 configure:4460: checking for C compiler default output file name configure:4463: cc conftest.c >&5 /usr/ucb/cc: language optional software package not installed configure:4466: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define OPENLDAP_PACKAGE "OpenLDAP" | #define OPENLDAP_VERSION "2.4.11" | #define LDAP_VENDOR_VERSION 20411 | #define LDAP_VENDOR_VERSION_MAJOR 2 | #define LDAP_VENDOR_VERSION_MINOR 4 | #define LDAP_VENDOR_VERSION_PATCH 11 | #define HAVE_MKVERSION 1 | /* end confdefs.h. */ | | int | main () | { | | ; | return 0; | } configure:4505: error: C compiler cannot create executables See `config.log' for more details. ## ---------------- ## ## Cache variables. ## ## ---------------- ## ac_cv_build=sparc-sun-solaris2.10 ac_cv_build_alias=sparc-sun-solaris2.10 ac_cv_env_CC_set= ac_cv_env_CC_value= ac_cv_env_CFLAGS_set= ac_cv_env_CFLAGS_value= ac_cv_env_CPPFLAGS_set= ac_cv_env_CPPFLAGS_value= ac_cv_env_CPP_set= ac_cv_env_CPP_value= ac_cv_env_LDFLAGS_set= ac_cv_env_LDFLAGS_value= ac_cv_env_build_alias_set= ac_cv_env_build_alias_value= ac_cv_env_host_alias_set= ac_cv_env_host_alias_value= ac_cv_env_target_alias_set= ac_cv_env_target_alias_value= ac_cv_host=sparc-sun-solaris2.10 ac_cv_host_alias=sparc-sun-solaris2.10 ac_cv_prog_AR=ar ac_cv_prog_AWK=nawk ac_cv_prog_CC=cc ac_cv_prog_make_make_set=yes ac_cv_shtool=build/shtool ac_cv_target=sparc-sun-solaris2.10 >>>>>>>>>>> Thanks Sujeet Vanage

2 1

Ldap Add Fail
by ahmed.feroz＠wipro.com 05 Nov '08

05 Nov '08

Dear open-ldap Team, Currently we are using ldap Version-2.4.8 on our Fedora Core 9 machine. When we try to create a computer account using ldap-add with non admin user we are getting error "insufficientAccessRights". Please let us know how we can add computer account in Active Directory with non admin users?? Thanks in advance. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

CSN too old again....
by Paul Lee 04 Nov '08

04 Nov '08

Dear all, I have 4 servers with version 2.4.9 configured into 4 way masters, the name of the servers are disb01 (SID:001), disb02 (SID:002), pisb01 (SID:003) and pisb02 (SID:004). Attached is the config file for the 4 servers. All the 4 servers are configured and started on Oct 29 night. At that time, I test the data synchronization, the result is positive. However, today, customer reported that data synchronization occurs, then, I perform the following simple test and find that data is really can't replicated. - When I added a record (the key is 20081104105123.573091Z#000000#003#000000) in pisb01, the data can be replicated to pisb02, but the other 2 servers disb01 and disb02 cannot find this record. The log in disb01 and disb02 indicates that the CSN is too old. - When I added a record (the key is 20081104105455.436768Z#000000#001#000000) in disb01, the data can be replicated to pisb01, but the other 2 servers disb02 and pisb02 cannot find this record. The log in disb01 and disb02 indicates that the CSN is too old. The log for the 4 servers is attached... Any possible reasons for this error "CSN too old" ? I find from the log that seems all servers received update at the same time (up to seconds, no millisecond is shown in the log) Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 002 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 001 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 003 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/pccw.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la #modulepath /usr/local/libexec/openldap/ #moduleload ppolicy.la # Password policy #overlay ppolicy #ppolicy_default "cn=default,ou=Policies" #ppolicy_default "cn=default,ou=Policies,o=HKSARG" # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "" rootdn "cn=Manager" #rootdn "ou=SCIG,ou=Govt-Dept,o=HKSARG,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}hzt3Mw7MTu+PvXuk8p24xMwLyscP2rls # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass,entryCSN,entryUUID,cn,pwdChangedTime eq #replogfile /var/lib/ldap/openldap-master-replog loglevel 16384 logfile /var/lib/ldap/ldap.log overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" ppolicy_hash_cleartext #access to * by dn="cn=Manager" write by * read access to * by anonymous auth by * write by dn.base="o=HKSARG" write by * none access to * by * write access to * by * read #database monitor #syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=001 provider=ldap://disb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=002 provider=ldap://disb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=003 provider=ldap://pisb01:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" syncrepl rid=004 provider=ldap://pisb02:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" mirrormode on serverID 004 #overlay syncprov #syncprov-checkpoint 100 10 #syncprov-sessionlog 100 # Performance tuning directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15

1 0

LDAP_RES_ENTRY vs LDAP_RES_RESULT
by owen nirvana 04 Nov '08

04 Nov '08

i'm a newbie. I am writing an application about pki, which needs openldap, when I try to query an entry from ldap server, openLDAP return LDAP_RES_ENTRY or LDAP_RES_RESULT if successful. I could not understande the difference between them. In my opnion , ENTRY is inferior to RESULT, LDAP should give me a result, and I get one or more entries from this result. I don't know why LDAP have to give me a message not LDAP_RES_RESULT ,but LDAP_RES_ENTRY in some conditions. btw, I try to complie the source 2.4.11 or 12, the make is successful, but the test script maybe could not start slapd. without doubt, openldap 2.4.11 from debian package works fine, I don't know why? os: debian lenny 20080902 gtalk:freeespeech@gmail.com

2 2

Trigerring an action after an ldapadd or modify
by daniel rahmeh 04 Nov '08

04 Nov '08

hi, is it possible with openldap to trigger an action (like a shell script) after a succesfull ldapadd or ldapmodify operation. I was looking for an overlay that does the job but i didn't find it. any help will be appreciated. thank you

3 3

Re: regarding ldap filters "extensible match search"
by Hamidreza Hamedtoolloei 02 Nov '08

02 Nov '08

Hey Hallvard, thanks for your prompt response. My big concern is that at the time of search I am not aware of the ldap tree structure. In other words, I only know about root, project, and site1, and dont have any info about rest of the tree (existence of site 2 etc). Perhaps I can do one search for excluded sites like site2, and use the result to return appropriate users. this should be possible as I am using jLDAP to connect to ldap directory from my java code. I would like to do one query though.....not sure if it is possible! ________________________________ From: Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no> To: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Sunday, November 2, 2008 9:26:54 AM Subject: Re: regarding ldap filters "extensible match search" Hamidreza Hamedtoolloei writes: > given the partial tree below, how can I return users in the root, > project, and site1 (i.e. dont want to return site2 users). ldapsearch -x ... '(&(uid=hamedtoolloei)(!(ou:dn:=site2)))' This omits results that have ou=site2 in the DN. -- Hallvard

1 0

regarding ldap filters "extensible match search"
by Hamidreza Hamedtoolloei 02 Nov '08

02 Nov '08

Hi all, given the partial tree below, how can I return users in the root, project, and site1 (i.e. dont want to return site2 users). note that site2 might have nested sites. I would rather to perform only one query. I've been playing with the "extensible match search", but site the rootDN is part of the site2DN, it returns the site2 users as well... dc=example,dc=com | | | | | ou=users,dc=example,dc=com | o=project,dc=example,dc=com | | | | | | | | ou=users,o=project,dc=example,dc=com | | | | ou=site1,o=project,dc=example,dc=com ou=site2,o=project,dc=example,dc=com | | | | ou=users, ou=site1,o=project,dc=example,dc=com ou=users,ou=site2,o=project,dc=example,dc=co

2 1

GSSAPI Error: An invalid name was supplied (Not enough space)
by Ben Lentz 31 Oct '08

31 Oct '08

Greetings list, I am using openldap-2.4.12 with cyrus-sasl 2.1.22 with mit krb5-1.6.3 on an AIX 5.3, TL8, SP2 machine. Whenever I try to use GSSAPI with ldapsearch against a Microsoft Active Directory server, I get the following error: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) When I run the process through truss -rall -wall -f, I see the following error near the failure: GSSAPI Error: An invalid name was supplied (Not enough space) I am able to acquire a kerberos ticket, I can list the GSSAPI plugin using pluginviewer, and I can ldapsearch against the MSAD server using simple authentication. I have searched Google and can find no reference to the "Not enough space" error. Has anyone else seen this before or can anyone shed any light on this? Thanks in advance.

1 0

Password hash in openldap
by Paul Lee 31 Oct '08

31 Oct '08

Dear all, Last time I changes the slapd.conf to restrict anonymous user to see the userPassword attribute from 3rd party LDAP browser. However, our client still wants to encrypt/hash the password stored in LDAP because he says that he can user other users auth to the LDAP and then can see other users' password (e.g. he can see his boss's password). Since we have the admin portal to change the user password as well, seems it can't restrict userpassword attribute by self read/write. Also, we will use the password policy and restrict users to re-use the last 12 passwords. So, my question is that is it possible to hash the password stored in openldap, also, the password stored in the password history is also hashed so that even other users can't see the password of others. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 1

create quota to openldap group
by Kermito le kermit 29 Oct '08

29 Oct '08

hello all, I am use openldap to debian all work fine i use openldap +samba pdc to my domain. now i wabt to add a quota to the groupe in my openldap which a tool quota (edquota etc ..). I can but quota to sambausers but no for other groups any ideas

1 0

difference between /etc/ldap.conf /etc/openldap/ldap.conf
by GanGan 29 Oct '08

29 Oct '08

hello all one question ! What is the difference between /etc/ldap.conf and /etc/openldap/ldap.conf ? thanks in advance -- - GanGan -

4 7

ldap queries to AD server
by Lynn York 28 Oct '08

28 Oct '08

Hello, I am seeing a large amount of queries for users such as vpopmail, postmaster, anonymous and a few other users being sent to the AD server via the openldap proxy. Below is a snippet of the log, I was curious how I could stop the servers from searching for these users via ldap? [ snippet ] Oct 28 14:32:54 ldap-proxy slapd[21165]: conn=2828 op=56 SRCH base="ou=Internal,dc=mgmt,dc=test,dc=net" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=vpopmail))" Oct 28 14:32:54 ldap-proxy slapd[21165]: conn=2828 op=56 SRCH attr=uid userPassword shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire shadowFlag [ end snippet ]

1 0

"bulk-reload" of database and replication
by Sebastian Benoit 28 Oct '08

28 Oct '08

Hi, we are developing a application using openldap and have the following problem: We plan a setup using one master-ldap server (with normally few write operations). The database will be replicated to (initially) two slave-servers using syncrepl replication. Now, at the beginning (until the complete system is set up to work with the ldap-server) we will need to re-initialize the complete database from scratch. This reload takes about 10 minutes using perl-ldap and a tcp-connection to the server. During this time the application accessing the slave servers should still see the old view of the database. The switch from old data to new data on the slave-servers should be as fast as possible to avoid clients seeing wrong (or not existing) data. I thought about writing data in LDIF format and the create a new database from that using slapadd. But then there still is the replication problem. What methods to others use to solve this? Thanks for you help, /Benno -- Sebastian Benoit <benoit-lists(a)fb12.de>

3 2

slurpd replication problem.
by Choi, Justin 28 Oct '08

28 Oct '08

I am seeing invalid credential error logs a lot. Could you guys let me know how to solve this issue? Thanks. Server Log(slurpd -d 2) Replicated Log (/usr/sbin/slapd -u ldap -d 2 -h ldap:///) Slapd.conf database bdb suffix "dc=ijji,dc=com" rootdn "cn=Manager,dc=ijji,dc=com" rootpw {SSHA}EpkPadkANDlpX7yfcsa2WbA+bSssh0S4 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/ijji.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub #updatedn cn=Replication Manager,dc=ijji,dc=com #updateref ldap://ca1xc115.ijji.com access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Manager,dc=ijji,dc=com" write by * read access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * read # Replicas of this database replogfile /var/lib/ldap/openldap-master-replog replica host=ca1xc115.ijji.com:389 binddn="cn=Replication Manager,dc=ijji,dc=com" bindmethod=simple credentials=skdltmwkq loglevel -1 database bdb suffix "dc=ijji,dc=com" rootdn "cn=Manager,dc=ijji,dc=com" rootpw {SSHA}EpkPadkANDlpX7yfcsa2WbA+bSssh0S4 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/ijji.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub updatedn "cn=Replication Manager,dc=ijji,dc=com" updateref ldap://ca1xc124.ijji.com access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Manager,dc=ijji,dc=com" write by * read access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * read # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM loglevel -1 Justin Choi Sr. Security Engineer NHN USA, Inc. 3353 Michelson Suite 250 Irvine, CA 92612 Mobile (408) 329-8554 MSN iD: counterhacker(a)live.com <mailto:amyoh79@hotmail.com> Office (949) 863-1292 ext 256 Fax (949) 863-9418

2 1

nss_initgroups_ignoreusers
by Lynn York 26 Oct '08

26 Oct '08

Hello, I seem to be having an issue with nss_initgroups_ignoreusers. I have the following line in my /etc/ldap.conf file but it still seems to search ldap for the users. Can anyone shed some light on this issue for me? Also, I am running nss_ldap version >= 2.53. I have supplied a snippet of the sldap log. [ /etc/ldap.conf ] nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,postm aster,anonymous,apache [end ] [ log snippet ] Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=140 fd=48 ACCEPT from IP=127.0.0.1:59736 (IP=0.0.0.0:389) Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SRCH base="ou=Internal,dc=mgmt,dc=test,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=postmaster))" Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 op=0 STARTTLS Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 op=0 RESULT oid= err=0 text= Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SEARCH RESULT tag=101 err=0 nentries=0 text= Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=28 SRCH base="ou=Internal,dc=mgmt, dc=test,dc=com " scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=postmaster))" Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=28 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 fd=62 TLS established tls_ssf=256 ssf=256 [ end snippet ] Thanks

1 0

active option crypt
by Kermito le kermit 26 Oct '08

26 Oct '08

hello all, i am to know how to activate option crypt in install of open ldap when i make this commande i see in the log crypt ..... no ./configure --enable-crypt

2 1

Upgrade from openldap 2.4.9 to 2.4.12
by Paul Lee 23 Oct '08

23 Oct '08

Dear all, I am currently having 4 LDAP servers running in 4-way masters mode, the current version is 2.4.9 and there are around 100k records. The db version is 4.2. If I want to upgrade to version 2.4.12, I should upgrade the db to 4.4 or above, right ? but if the db version is upgraded, how to preserve my existing 100k records, any formal procedure to convert the data to the new format ? Is my following procedure correct ? - upgrade the db version to 4.4 - upgrade openldap in 1 machine to 2.4.12 - delete all the files in /usr/local/var/openldap-data - stop 2 more openldap servers, leaving only 1 running version 2.4.9 - start the new server running version 2.4.12, then, records will be created in 2.4.12. - repeat for others servers. Is this correct ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

3 5

Security issue : userPassword is shown
by Paul Lee 23 Oct '08

23 Oct '08

Hi all, I use a 3rd party LDAP browser to browse the users that I created. I can see the userPassword clearly (plain text). Is there any way to avoid this ? When I use slapcat command to export to LDIF file, the userPassword field is encrypted, but why using 3rd party browser will show the password in plain text ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

6 7

Re: Upgrade from openldap 2.4.9 to 2.4.12
by Oliver Liebel 23 Oct '08

23 Oct '08

yes. absolutely correct: 2.4.12 needs 4.4+ http://www.openldap.org/software/release/readme.html Rein Tollevik schrieb: > Oliver Liebel skrev: >> keep it simple. >> first, theres no need of upgrading your bdb. >> 4.2.52 has the longest history to be stable. >> for bdb versions, see: >> http://www.openldap.org/lists/openldap-technical/200807/msg00138.html > > As of version 2.4.12, the bdb backend only support db versions 4.4 and > higher. See the README file. So the upgrade from 4.2 *is* required. > > Rein Tollevik > Basefarm AS > > ____________ Virus checked by G DATA AntiVirusKit Version: AVK 19.1180 from 23.10.2008 Virus news: www.antiviruslab.com

1 0

LDAP + SAMBA PDC
by Arun NAIR 23 Oct '08

23 Oct '08

Hey Guys, I have made an LDAP + Samba PDC and am able to add users to it as well. But when I try to login using ssh to the user name I get the error message Permission denied (publickey,gssapi-with-mic,password). I'm really reaching the deadlines now and have tried all the resources I could get my hands on it would be greatly appreciated if you guys can help me out with this. Regards, Arun Nair

3 2

Case sensitive uid attribute
by Martin Benson 22 Oct '08

22 Oct '08

Hi I am currently using Buchan Milne's OpenLDAP 2.3.43 rpm's on a RHEL 4.4 installation. I use the core, cosine, inetorgperson and NIS schema's and everything works great. I mainly use OpenLDAP as an authentication server and I have a problem where the uid is not case sensitive. If I create a user called "Martin" then it will also allow me to log in as "martin" and then fails as it cannot find my home directory. I have had a look at the schema files and in the core.schema and the core.ldif the uid entry is commented out. It contains an entry "EQUALITY caseIgnoreMatch" and I tried to change it to "EQUALITY caseExactMatch". Now I realise that I shouldn't be touching the core.schema but I don't know how else to do this without invalidating all the entries in the current database. No surprise but changing the attribute and uncommenting the uid entry did not work so any help would be appreciated. Sorry for not including all the usual files like slapd.conf but they are on the server at work and I am at home. Martin Benson

2 1

How to confirm syncrepl is working properly
by Mike Simonton 22 Oct '08

22 Oct '08

Hello everyone, I'm trying to learn how to use OpenLDAP and syncrepl, and I have two issues. First, how do I get past the following error, and second, how do I confirm that syncrepl is actually working?? Here's the slaptest error: # slaptest -f /usr/local/etc/openldap/slapd.conf bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=promptutech,dc=local". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable config file testing succeeded ...and here's my slapd.conf. Any ideas?? cat /usr/local/etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/promptu.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /opt/promptu/openldap/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to * by dn.base="cn=replica,dc=promptutech,dc=local" read by * break ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=promptutech,dc=local" rootdn "cn=Manager,dc=promptutech,dc=local" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=0 provider=ldap://ptsunray02 type=refreshOnly interval=00:00:05:00 searchbase="dc=promptutech,dc=local" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=replica,dc=promptutech,dc=local" credentials="secret" updateref ldap://localhost mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 Thanks for your help! Mike

2 2

How to disable or enable an ldap user account
by RamakrishnaDeepak Battu 22 Oct '08

22 Oct '08

Hello everyone, Can any one point me to how u can disable/enable an ldap user account.Thanks in advance. regards, deepak.

7 6

LDAP proxy for AD
by Lynn York 22 Oct '08

22 Oct '08

Hello, I have been attempting to use openldap as a proxy to AD with no success. I have attempted multiple different ways that I found online. I am able to get the proxy server to connect to AD, but I cannot get a client server to connect through the proxy to the AD server. Can anyone suggest anything? -Lynn

7 22

TLS not working (even though SSL does) -- logging trouble
by Kyle Barger 21 Oct '08

21 Oct '08

I have an OpenLDAP 2.3 server that is up and running. I have been trying to add SSL and TLS. SSL connections on port 636 work fine. However the TLS connection on 389 is not working. The only errors are "TLS accept failure" and "TLS negotiation failure." I've not been able to dig up any more information, even using the -d option, and I notice that people have posted log files with detailed TLS trace messages. How can I enable the TLS logging to find out what's going on? Thanks. -- Kyle Barger Director of Information Systems The Lutheran Theological Seminary at Philadelphia (For questions about your computer, network, or telephone service, email helpdesk(a)ltsp.edu)

2 1

Issue while implementing Password Policy
by daljeet.mehta＠wipro.com 21 Oct '08

21 Oct '08

Hi, I am trying to implement password policy in OpenLDAP. There are already similar postings on the same issue. But I tried all the possible solutions and now I am really tired after one week. Here are the details about my problem Operating System: Red Hat Linux ES 5.0 OpenLDAP Release: 2.3.39 During the addition of userPassword node I get the following error. ldapadd -f /root/openldap/openldap-2.3.39/servers/slapd/schema/paswd_policy1.ldif -D "cn=Manager,dc=xyz,dc=com" -w secret -x adding new entry "cn=default,ouname=ppolicy,oname=P_Policy,dc=xyz,dc=com" ldapadd: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax Then after reading some of the issues related to it, I tried every possible solution. I added overlay path in my slapd.conf and I got the following error. ./slapd -f /root/openldap/openldap-2.3.39/servers/slapd/slapd.conf -d 1 @(#) $OpenLDAP: slapd 2.3.39 (Aug 25 2008 11:38:51) $ root@localhost.localdomain:/root/openldap/openldap-2.3.39/servers/slapd <mailto:root@localhost.localdomain:/root/openldap/openldap-2.3.39/server s/slapd> daemon_init: listen on ldap:/// <ldap:///> daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:/// <ldap:///> ) daemon: listener initialized ldap:/// <ldap:///> daemon_init: 2 listeners opened slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) overlay "ppolicy" not found slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Following is my configuration file snapshot:- # This file should NOT be world readable. # include /root/openldap/openldap-2.3.39/servers/slapd/schema/core.schema include /root/openldap/openldap-2.3.39/servers/slapd/schema/local.schema include /root/openldap/openldap-2.3.39/servers/slapd/schema/java.schema include /root/openldap/openldap.3.39/servers/slapd/schema/inetorgperson.schema #include /root/openldap/openldap-2.3.39/servers/slapd/schema/ppolicy.schema include /etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org <ldap://root.openldap.org/> pidfile /var/run/slapd.pid argsfile /var/run/slapd.args # Load dynamic backend modules: modulepath /root/openldap/openldap-2.3.39 modulepath /servers/slapd/overlays modulepath /usr/sbin moduleload ppolicy.la moduleload back_hdb.la moduleload back_monitor.la #modulepath %MODULEDIR% # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la moduleload ppolicy.la moduleload /root/openldap/openldap-2.3.39/libraries/libldap overlay ppolicy ppolicy_default "cn=default,ouname=ppolicy,oname=P_POLICY,dc=xyz,dc=com" ppolicy_use_lockout #overlay ppolicy #overlay refint # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=xyz,dc=com" rootdn "cn=Manager,dc=xyz,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq Trust me I did R & D for 7 days. Even I did a free installation of same version and of newer version(2.4.11 release) also I got the same error. Can you please tell me the steps to make this working. Now it has become matter of life and death for me and I will do possibly anything resolve it. Thanks in advance for your help. Thanks & Regards, Daljeet Mehta Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

referral and replication
by jakjr 21 Oct '08

21 Oct '08

Hi all, I'm using slapd 2.3.30-5 on Debian Etch. I have 1 provider and 2 consumers using refreshAndPersist replication. The replication works fine, but when I add a referral object on provider, this object is not replicate to the consumers. Is normal not replicate referrals ?? Thanks João Alfredo.

1 1

How to implement Extended DNs for Samba4?
by Andrew Bartlett 21 Oct '08

21 Oct '08

At the CIFS plugfest it became clear that Samba3 requires that we complete the implementation of 'extended DN' replies in the Samba4 LDAP server. This means that a DN in things like memberOf are in the form: <GUID=0bc11d00-e431-40a0-8767-344a320142fa>;<SID=S-1-2-3-2345>;cn=abartlet,cn=users,dc=abartlet,dc=net (or so, I've just made this one up) If the magic 'extended DN' control is specificed, then we have to return this form to the client, and it would work really well to store it in that form on the backend, and if they do not specify the control, only then strip it back to the 'normal' DN. The problem is now particularly how to implement these locally - inside Samba4 it should be pretty easy to have the right triggers in the existing memberOf module, but how to implement this in OpenLDAP and (eventually) FedoraDS. Currently OpenLDAP uses the refint and memberOf modules, knowing that this attribute is simply a DN, nothing more. These modules (and probably the input validation) will no doubt be unable to cope with the 'extended' DN form. Is it reasonable to ask that OpenLDAP carry a module so Samba-specific in it's application (reading the objectSid and entryUUID and formatting the link that way)? Should we try to just fill this in with another search as part of the search entry callback? (at great performance cost). Any thoughts? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

3 8

LDAP + SSH + Key Auth
by openLDAP 17 Oct '08

17 Oct '08

I would like to use public keys on my OS X servers for my LDAP users to use SSH. All indications from the OSX list is that it is not possible. I was hoping someone on this list could confirm that LDAP/Key Pair/SSH is not possible or point me in the right direction to where someone has figured it out. I would like to centrally control SSH access and not have to have local accounts on all of my servers. Any help is appreciated.

3 3

What is the Difference between a LDAP client Prompting for Password as opposed ...
by Kumar, Amit H. 17 Oct '08

17 Oct '08

Hello All, Scenario: OpenLDAP Client Machine <-----talking------> OpenLDAP Server Machine. Both Client and Server are two different machines. What is the Difference between an OpenLDAP client Prompting for Password and then authenticating with the OpenLDAP server via TLS as opposed to : An OpenLDAP client redirecting the authentication request to an OpenLDAP server to prompt for the password and do the authentication. What kind of setup would we require if we want the OpenLDAP Server to prompt for the password and do the authentication for an end user to login onto the OpenLDAP client machine. Any thoughts will be of great help!!! Thank you, Amit

1 0

multiple suffix
by Kermito le kermit 15 Oct '08

15 Oct '08

hello all i want to know if is possible to have multiple suffix to same database ex: suffix dc=exemple,dc=org suffix dc=msn,dc=com any ideas

5 6

Complete list of APIs?
by Brad T Waldorf 14 Oct '08

14 Oct '08

Hi. Does a complete list of client APIs from ldap.h exist? The list provided in the "INDEX" section of the 'ldap' man page doesn't seem to contain all APIs. http://www.openldap.org/software/man.cgi?query=ldap&sektion=3&apropos=0&man… +2.4-Release Thanks

1 0

Help me clear in design
by Phan Dang Duy Thinh 14 Oct '08

14 Oct '08

Hi experts, I'm new member in LDAP. Although I've finished configured a Linux server qmail - ldap but I still have some points unclear, let's I explain: For example, I have a lap using some services require authenticate, ex: qmail, radius, ftp, ... I want to save the user information (username, password, ... ) in only one place, so I decided to using LDAP. (number of users are quite large) But after implement qmail-ldap (it now runs good), I don't know how to continue to implement radius service (or other services). Reason is I can't integrate the radius information into qmail database (although I included qmail.schema and radius.schema in slapd.conf). The question: is there a way to integrate data of one schema in to an existed schema? I want to design a structure like this: [qmail information] [radius information] [other service ....] \ | / \ | / \ | / \ | / [common user information] (username, password) Do I have to write my own schema for doing this? (Schema that include both [qmail service information] and [radius service information]) Please give me an advice how to solve this? Thanks, -- Phan Dang Duy Thinh

1 0

Solaris 10 native Client with TLS to OpenLDAP
by John Gee 13 Oct '08

13 Oct '08

Hello, i have a problem with connecting Solaris10 native LDAP Client to a openLDAP Server (slapd 2.4.11) with TLS. The replication from Server ldap01 to ldap02 works fine with TLS, so i think that the problem must be on client site (Solaris 10 native LDAP Client - latest Patchset). Without TLS it works. Maybe someone can give me a hint - -(slapd - debug)--- >>> slap_listener(ldaps:///) connection_get(11): got connid=207 connection_read(11): checking for input on id=207 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(11): got connid=207 connection_read(11): checking for input on id=207 TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1053 connection_read(11): TLS accept failure error=-1 id=207, closing connection_closing: readying conn=207 sd=11 for close connection_close: conn=207 sd=11 -( slapd.conf - tls part)--- TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCACertificateFile /opt/openldap/var/openldap-data/ca-cert.pem TLSCertificateFile /opt/openldap/var/openldap-data/ldap01.kleinfeld.ch.pem TLSCertificateKeyFile /opt/openldap/var/openldap-data/ldap01.kleinfeld.ch TLSVerifyClient never -( solaris 10 - client )---- # import the ca-cert certutil -N -d /var/ldap certutil -A -n "ca-cert" -i /tmp/ldap/ca-cert.pem -a -t CT -d /var/ldap/ # import ldap-server certs certutil -A -d /var/ldap/ -n "ldap01.kleinfeld.ch" -t C,, -i ldap01.kleinfeld.ch.pem certutil -A -d /var/ldap/ -n "ldap02.kleinfeld.ch" -t C,, -i ldap02.kleinfeld.ch.pem # list cert-db certutil -L -d /var/ldap ca-cert CT,, ldap02.kleinfeld.ch C,, ldap01.kleinfeld.ch C,, # initialize ldap-client ldapclient manual -v \ -a credentialLevel=proxy \ -a authenticationMethod=tls:simple \ -a serviceAuthenticationMethod=pam_ldap:tls:simple \ -a proxyDN=cn=proxyAgent,ou=profile,o=kleinfeld,c=ch \ -a proxyPassword=xxxxxxxxxxxx \ -a defaultsearchbase=ou=unix,o=kleinfeld,c=ch \ -a defaultServerList="ldap01.kleinfeld.ch ldap02.kleinfeld.ch" \ -a certificatePath=/var/ldap \ -a domainName=kleinfeld.ch \ -a attributeMap=passwd:gecos=cn \ -a objectClassMap=group:posixGroup=posixGroup \ -a objectClassMap=passwd:posixAccount=posixAccount \ -a objectClassMap=shadow:shadowAccount=shadowAccount \ -a serviceSearchDescriptor=passwd:ou=people,ou=unix,o=kleinfeld,c=ch?one \ -a serviceSearchDescriptor=group:ou=groups,ou=unix,o=kleinfeld,c=ch?one \ -a serviceSearchDescriptor=netgroup:ou=netgroup,ou=unix,o=kleinfeld,c=ch?one # output from ldapclient Parsing credentialLevel=proxy Parsing authenticationMethod=tls:simple Parsing serviceAuthenticationMethod=pam_ldap:tls:simple Parsing proxyDN=cn=proxyAgent,ou=profile,o=kleinfeld,c=ch Parsing proxyPassword=UnIXpRoXY Parsing defaultsearchbase=ou=unix,o=kleinfeld,c=ch Parsing defaultServerList=ldap01.kleinfeld.ch Parsing certificatePath=/var/ldap Parsing domainName=kleinfeld.ch Parsing attributeMap=passwd:gecos=cn Parsing objectClassMap=group:posixGroup=posixGroup Parsing objectClassMap=passwd:posixAccount=posixAccount Parsing objectClassMap=shadow:shadowAccount=shadowAccount Parsing serviceSearchDescriptor=passwd:ou=people,ou=unix,o=kleinfeld,c=ch?one Parsing serviceSearchDescriptor=group:ou=groups,ou=unix,o=kleinfeld,c=ch?one Parsing serviceSearchDescriptor=netgroup:ou=netgroup,ou=unix,o=kleinfeld,c=ch?one Arguments parsed: Handling manual option Proxy DN: cn=proxyAgent,ou=profile,o=kleinfeld,c=ch Proxy password: {NS1}xxxxxxxxxxxxxxxxxxxxx Credential level: 1 Authentication method: 3 About to modify this machines configuration by writing the files Stopping network services sendmail not running nscd not running autofs not running Stopping ldap stop: sleep 100000 microseconds stop: sleep 200000 microseconds stop: network/ldap/client:default... success nisd not running nis(yp) not running Removing existing restore directory file_backup: stat(/etc/nsswitch.conf)=0 file_backup: (/etc/nsswitch.conf -> /var/ldap/restore/nsswitch.conf) file_backup: stat(/etc/defaultdomain)=0 file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain) file_backup: stat(/var/nis/NIS_COLD_START)=-1 file_backup: No /var/nis/NIS_COLD_START file. file_backup: nis domain is "kleinfeld.ch" file_backup: stat(/var/yp/binding/kleinfeld.ch)=-1 file_backup: No /var/yp/binding/kleinfeld.ch directory. file_backup: stat(/var/ldap/ldap_client_file)=0 file_backup: (/var/ldap/ldap_client_file -> /var/ldap/restore/ldap_client_file) file_backup: (/var/ldap/ldap_client_cred -> /var/ldap/restore/ldap_client_cred) Starting network services start: /usr/bin/domainname kleinfeld.ch... success start: sleep 100000 microseconds start: network/ldap/client:default... success restart: sleep 100000 microseconds restart: milestone/name-services:default... success System successfully configured authenticationMethod: tls:simple serviceAuthenticationMethod: arg[0]: pam_ldap:tls:simple defaultSearchBase: ou=unix,o=kleinfeld,c=ch credentialLevel: proxy domainName: kleinfeld.ch proxyDN: cn=proxyAgent,ou=profile,o=kleinfeld,c=ch objectclassMap: arg[0]: group:posixGroup=posixGroup arg[1]: passwd:posixAccount=posixAccount arg[2]: shadow:shadowAccount=shadowAccount attributeMap: arg[0]: passwd:gecos=cn serviceSearchDescriptor: arg[0]: passwd:ou=people,ou=unix,o=kleinfeld,c=ch?one arg[1]: group:ou=groups,ou=unix,o=kleinfeld,c=ch?one arg[2]: netgroup:ou=netgroup,ou=unix,o=kleinfeld,c=ch?one proxyPassword: xxxxxxxxxxxxx defaultServerList: ldap01.kleinfeld.ch certificatePath: /var/ldap thanks in advance John

4 8

ldap_start_tls_s() usage related errors
by dhiraj.prasad＠tcs.com 12 Oct '08

12 Oct '08

Hello, I have configured LDAP server on linux with TLS support and was able to fetch data from it using the 'ldapsearch' utility. However, when i tried to do this searching via code i got following errors: Error at Server Side: slap_listener_activate(10): >>> slap_listener(ldaps://) connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(15): TLS accept failure error=-1 id=47, closing connection_closing: readying conn=47 sd=15 for close connection_close: conn=47 sd=15 Error at Client side: [root@localhost LDAP1]# ./ldapSearch ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost.localdomain:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 19, subject: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com, issuer: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Error in ldap_start_tls_s -1:Can't contact LDAP serverTest..1 ldap_bind_s ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request Test..2: -1 ldap_err2string Failure of LDAP bind -1-Can't contact LDAP server [root@localhost LDAP1]# Snippet of client code for TLS support used by Me: ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE, "/root/cacert.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_CERTFILE, "/usr/local/etc/openldap/ldap.client.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_KEYFILE, "/usr/local/etc/openldap/ldap.client.key.pem"); ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); status = ldap_start_tls_s(ld, NULL, NULL); Please let me know as to what is missing in my code that is triggering the above errors. Also if there are any sample TLS client code, please let me know where can i get it. Thanks, Dhiraj Kumar Prasad Tata Consultancy Services Mailto: dhiraj.prasad(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Outsourcing ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 1

How to make two attribute unique
by piyush joshi 10 Oct '08

10 Oct '08

Hello All, I wanna know is it possible to make 2 attributes unique Example -: mail and mailAlternateAddress , I mean to say if i have set abc(a)expmple.net in mail attribute as a value and if then I try to add same to the mailAlternateAddress attribute it will prevent me to do this and also vice versa. -- Regards Piyush Joshi 9415414376

2 3

CSN too old
by Paul Lee 09 Oct '08

09 Oct '08

Dear all, I am using openldap version 2.4.9, I am using 4 ldap servers with 4-way master configured. Data can be synronized initially, but when the records is getting more and more, now is around 100k records, I always find data is not synronized between the four ldap servers. I find that "CSN is too old, ignoring" in the LDAP log file. Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: cookie=rid=003,sid=001,csn=20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: rid=003 CSN too old, ignoring 20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: cookie=rid=002,sid=001,csn=20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: rid=002 CSN too old, ignoring 20080923200403.713637Z#000000#003#000000 Sep 24 04:04:03 disb01 slapd[28779]: do_syncrep2: cookie=rid=002,sid=001,csn=20080923200403.739461Z#000000#002#000000 Sep 24 04:04:03 disb01 slapd[28779]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Sep 24 04:04:03 disb01 slapd[28779]: syncrepl_entry: rid=002 be_search (0) Sep 24 04:04:03 disb01 slapd[28779]: syncrepl_entry: rid=002 cn=pwdfail,ou=SCIG,ou=Govt-Dept,o=HKSARG Any idea of this kind of error and how to fixed it ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

4 13

Large stack allocations
by Sean Burford 09 Oct '08

09 Oct '08

Hi, bdb_search() allocates space for 128k candidate IDs and 64k scope IDs on the stack (about 768k of memory). bdb_idl_fetch_key() also allocates a large buffer on the stack (262352 bytes). Most other functions allocate roughly 1kB. Using the stack rather than heap limits the size of these structures (idl.h observes: "IDL sizes - likely should be even bigger. limiting factors: sizeof(ID), thread stack size") Using the stack for large allocations also creates the possibility of these arrays straddling the guard page (possibly resulting in local variables ending up in neighboring memory regions). Would the performance cost of using the heap or thread local storage for these allocations outweigh the benefit of being able to use bigger arrays? If you're interested in some statistics about slapd's stack usage, the static analysis perl script on kegel.com matches what I'm seeing from real running slapds: http://www.kegel.com/stackcheck/ -- Thanks, Sean Burford

2 1

slapd.conf and 2 databases
by Kermito le kermit 09 Oct '08

09 Oct '08

hello all, I am new to openldap and i want to now how put 2 databases in slpad.conf, when i make this in my config , slpad start but i see this message : bdb(dc=example,dc=com): PANIC: fatal region error detected; run recovery help please

2 1

Re: AW: Re: AW: Re: AW: StartTLS is not working
by Dat Duong 09 Oct '08

09 Oct '08

Hi Hauke, I've followed the mini tutorial and got stuck at the path for the server certificates in your tutorial. The path is not correct for slapd. Can you verify? TLSCertificateFile /usr/lib/ssl/certs/<fqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/private/<fqdn>.key.pem thanks ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical <openldap-technical(a)openldap.org> Sent: Thursday, October 9, 2008 12:46:00 AM Subject: AW: Re: AW: Re: AW: StartTLS is not working Hi Dat, > I've added the below to /etc/openldap/ldap.conf on RHEL 5: > TLS_CACERT /etc/openldap/cacerts/ServerCA.chain.pem > TLS_REQCERT demand > > and still getting errors messages... below: > > TLS certificate verification: Error, self signed certificate The LDAP server does not send a server certificate but a self signed certificate. Are you sending the RootCA's certificate? Create a server certificate as described in the tutorial and let your LDAP server use this. I assume that you will have to read a bit more about certificates and openssl to understand all the steps of the mini tutorial. Rergards, Hauke ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: openldap-software <openldap-software(a)openldap.org> Cc: Dat Duong <datduong2000(a)yahoo.com> Sent: Wednesday, October 8, 2008 2:09:11 AM Subject: AW: Re: AW: StartTLS is not working Hi Dat, glad to see that the first problem has been solved now. As Dieter already pointed out, we need to know how the certificates have been created. As a rough overview, you will need to run through following steps: 0. Understand the basic idea: At the end of this MiniHowto, you will have three certification authorities: UserCA: For user certificates (usually password protected) ServerCA: For server certificates (usually NOT password protected) RootCA: The CA that everyone has to trust in the end. This CA only exists to create and verify the UserCA and ServerCA. For your LDAP server, you create a server certificate with your ServerCA. The LDAP clients will accept the LDAP certificate as long as they trust the ServerCA. They will trust the ServerCA because they trust the RootCA. To make them do so, you will need the certificates of the ServerCA AND the RootCA on each client. Just to make sure: We are not talking about copying the LDAP certificate to the client. Instead, you will copy the CA certificates to the client. 1. Create directory structure and files containing random numbers (need to be root for this): # Make sure uuencode is installed. On Debian based # systems, type # # apt-get install sharutils # cd /usr/lib/ssl/ for i in RootCA ServerCA UserCA; do mkdir -p $i/newcerts; mkdir $i/certs; mkdir $i/crl; mkdir $i/private; touch $i/index.txt; echo 01 > $i/serial; chmod -R g-rwx,o-rwx $i; done for i in `find /usr/lib/ssl/ -name private` do cat /dev/urandom | uuencode -m bla | head -19 | sed "s/begin.*//g" | tail -18 | xargs | sed "s/ //g" > $i/.rand chmod 770 $i/.rand ls -l $i/.rand done At the end of this step, you will have three subdirectories in /usr/lib/ssl: RootCA: Contains the root CA's self-signed certificate and private key as well as the certificates created by the root CA. ServerCA: Contains the CA which is used to create server certificates. Again, the directory contains of the server CA's certificate and key as well as the certificates created by the server CA. UserCA: Contains the CA which is used to create user certificates. 2. openssl.cnf Adapt your openssl.cnf (should be in /usr/lib/ssl, too) to have proper entries for each of the CAs: HOME = /usr/lib/ssl [ RootCA ] dir = /usr/lib/ssl/RootCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/RootCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/RootCA.key.pem RANDFILE = $dir/private/.rand policy = policy_match x509_extensions = ca_cert [ ServerCA ] dir = /usr/lib/ssl/ServerCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/ServerCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/ServerCA.key.pem RANDFILE = $dir/private/.rand x509_extensions = usr_cert (Same with [ UserCA ]) There are more options to be set, but they depend on your environment. Have a look at the default_days, default_md, ... parameters. 1. Create a self signed certificate (RootCA): cd /usr/lib/ssl/RootCA # Create the private key first # You will be asked for a new pasword here. Make it a good one and remember it ;-) openssl genrsa -aes256 -out /usr/lib/ssl/RootCA/private/RootCA.key.pem -rand /usr/lib/ssl/RootCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/RootCA/private/RootCA.key.pem # Now create a certification request. Because the cert is self-signed, this # directly creates the RootCA's certificate. You will be asked for the # password you just created. # # All in one line: openssl req -new -x509 -days 1827 -key /usr/lib/ssl/RootCA/private/RootCA.key.pem -out /usr/lib/ssl/RootCA/RootCA.cert.pem # Copy the certificate to the certs directory and create a link named like # the cert's hash value cp RootCA.cert.pem certs/00.pem cd certs ln -s /usr/lib/ssl/RootCA/certs/00.pem `openssl x509 -hash -noout -in 00.pem`.0 Now you should have the cert (00.pem) and something like 1a2783e8.0 pointing to /usr/lib/ssl/RootCA/00.pem 2. Create the ServerCA cd /usr/lib/ssl/ServerCA # Create the private key for the ServerCA # You will be asked for a new password here. Do not make it the same as the RootCA's # password, but still - make it a good one. # openssl genrsa -aes256 -out /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -rand /usr/lib/ssl/ServerCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/ServerCA/private/ServerCA.key.pem # Create the certification request. You will be asked for the # newly created password. # (All in one line) openssl req -new -days 1827 -key /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -out /usr/lib/ssl/ServerCA/ServerCA.req.pem # Let the RootCA sign the request and create the certificate. # You will need the RootCA's password for this. # openssl ca -name RootCA -in /usr/lib/ssl/ServerCA/ServerCA.req.pem -out /usr/lib/ssl/ServerCA/ServerCA.cert.pem # Copy and link the certificate. # mv /usr/lib/ssl/RootCA/newcerts/01.pem /usr/lib/ssl/RootCA/certs/ cd /usr/lib/ssl/RootCA/certs/ ln -s 01.pem `openssl x509 -in 01.pem -hash -noout`.0 # And copy the part neccessary for browser integration into # another file (this is the part between BEGIN CERTIFICATE and END CERTIFICATE) # cd /usr/lib/ssl/ServerCA sed -n '/-----BEGIN CERTIFICATE-----/,$p' ServerCA.cert.pem > ServerCA.crt # Create the CACerts file used on the client side to verify a server cert mkdir /usr/lib/ssl/cacerts/ cat /usr/lib/ssl/RootCA/RootCA.cert.pem /usr/lib/ssl/ServerCA/ServerCA.cert.pem > /usr/lib/ssl/cacerts/ServerCA.chain.pem # The newly created file (ServerCA.chain.pem) is the CACertsFile which has to be copied # to every client. Create a /usr/lib/ssl/cacerts/ directory on the client side and copy # the file to that location. 3. Do the same with the User CA 4. Create your LDAP server certificate. As for the name in your cert, use the fqdn of the machine you are running the server on. cd /usr/lib/ssl/ServerCA # You will NOT need a password here # openssl genrsa -out <fqdn-of-your-server>.key.pem -rand ./private/.rand 2048 openssl req -new -key <fqdn-of-your-server>.key.pem -out <fqdn-of-your-server>.req.pem # But here, you will be asked for the ServerCA's password openssl ca -name ServerCA -in <fqdn-of-your-server>.req.pem -out <fqdn-of-your-server>.cert.pem Move and link the new certificate (in newcerts) as above. 5. Configure LDAP server and clients Make sure that your ldap server can read its own private key. If your ldap server is running as user openldap, make sure that this user owns the private key in /usr/lib/ssl/ServerCA/private/ Normal users should never be allowed to read the key! This would break the whole security mechanism. In your slapd.conf, you will have TLSCertificateFile /usr/lib/ssl/certs/<fqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/private/<fqdn>.key.pem And on client side ldap.conf: TLS_CACERT /usr/lib/ssl/cacerts/ServerCA.chain.pem TLS_REQCERT demand Hope this helps, Hauke p.s.: The description is strongly influenced by Frank Steidl's tutorial as it can be found at http://fra.nksteidl.de/Erinnerungen/OpenSSL.php ----- Ursprüngliche Mail ----- Von: "Dieter Kluenter" < dieter(a)dkluenter.de > An: openldap-technical(a)openldap.org Gesendet: Dienstag, 7. Oktober 2008 22:34:14 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: StartTLS is not working Dat Duong < datduong2000(a)yahoo.com > writes: > Hi Hauke, > > I still can't get TLS to work. Here is the error message. > > TLS certificate verification: Error, self signed certificate > tls_write: want=7, written=7 > 0000: 15 03 01 00 02 02 30 ......0 > TLS trace: SSL3 alert write:fatal:unknown CA > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Please describe the parameters to create your certificate chain. I presume you have not signed your certificates with a known certificate authority. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------ -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

2 1

AW: Re: AW: Re: AW: StartTLS is not working
by Hauke Coltzau 09 Oct '08

09 Oct '08

Hi Dat, > I've added the below to /etc/openldap/ldap.conf on RHEL 5: > TLS_CACERT /etc/openldap/cacerts/ServerCA.chain.pem > TLS_REQCERT demand > > and still getting errors messages... below: > > TLS certificate verification: Error, self signed certificate The LDAP server does not send a server certificate but a self signed certificate. Are you sending the RootCA's certificate? Create a server certificate as described in the tutorial and let your LDAP server use this. I assume that you will have to read a bit more about certificates and openssl to understand all the steps of the mini tutorial. Rergards, Hauke ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: openldap-software <openldap-software(a)openldap.org> Cc: Dat Duong <datduong2000(a)yahoo.com> Sent: Wednesday, October 8, 2008 2:09:11 AM Subject: AW: Re: AW: StartTLS is not working Hi Dat, glad to see that the first problem has been solved now. As Dieter already pointed out, we need to know how the certificates have been created. As a rough overview, you will need to run through following steps: 0. Understand the basic idea: At the end of this MiniHowto, you will have three certification authorities: UserCA: For user certificates (usually password protected) ServerCA: For server certificates (usually NOT password protected) RootCA: The CA that everyone has to trust in the end. This CA only exists to create and verify the UserCA and ServerCA. For your LDAP server, you create a server certificate with your ServerCA. The LDAP clients will accept the LDAP certificate as long as they trust the ServerCA. They will trust the ServerCA because they trust the RootCA. To make them do so, you will need the certificates of the ServerCA AND the RootCA on each client. Just to make sure: We are not talking about copying the LDAP certificate to the client. Instead, you will copy the CA certificates to the client. 1. Create directory structure and files containing random numbers (need to be root for this): # Make sure uuencode is installed. On Debian based # systems, type # # apt-get install sharutils # cd /usr/lib/ssl/ for i in RootCA ServerCA UserCA; do mkdir -p $i/newcerts; mkdir $i/certs; mkdir $i/crl; mkdir $i/private; touch $i/index.txt; echo 01 > $i/serial; chmod -R g-rwx,o-rwx $i; done for i in `find /usr/lib/ssl/ -name private` do cat /dev/urandom | uuencode -m bla | head -19 | sed "s/begin.*//g" | tail -18 | xargs | sed "s/ //g" > $i/.rand chmod 770 $i/.rand ls -l $i/.rand done At the end of this step, you will have three subdirectories in /usr/lib/ssl: RootCA: Contains the root CA's self-signed certificate and private key as well as the certificates created by the root CA. ServerCA: Contains the CA which is used to create server certificates. Again, the directory contains of the server CA's certificate and key as well as the certificates created by the server CA. UserCA: Contains the CA which is used to create user certificates. 2. openssl.cnf Adapt your openssl.cnf (should be in /usr/lib/ssl, too) to have proper entries for each of the CAs: HOME = /usr/lib/ssl [ RootCA ] dir = /usr/lib/ssl/RootCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/RootCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/RootCA.key.pem RANDFILE = $dir/private/.rand policy = policy_match x509_extensions = ca_cert [ ServerCA ] dir = /usr/lib/ssl/ServerCA certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/ServerCA.cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/ServerCA.key.pem RANDFILE = $dir/private/.rand x509_extensions = usr_cert (Same with [ UserCA ]) There are more options to be set, but they depend on your environment. Have a look at the default_days, default_md, ... parameters. 1. Create a self signed certificate (RootCA): cd /usr/lib/ssl/RootCA # Create the private key first # You will be asked for a new pasword here. Make it a good one and remember it ;-) openssl genrsa -aes256 -out /usr/lib/ssl/RootCA/private/RootCA.key.pem -rand /usr/lib/ssl/RootCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/RootCA/private/RootCA.key.pem # Now create a certification request. Because the cert is self-signed, this # directly creates the RootCA's certificate. You will be asked for the # password you just created. # # All in one line: openssl req -new -x509 -days 1827 -key /usr/lib/ssl/RootCA/private/RootCA.key.pem -out /usr/lib/ssl/RootCA/RootCA.cert.pem # Copy the certificate to the certs directory and create a link named like # the cert's hash value cp RootCA.cert.pem certs/00.pem cd certs ln -s /usr/lib/ssl/RootCA/certs/00.pem `openssl x509 -hash -noout -in 00.pem`.0 Now you should have the cert (00.pem) and something like 1a2783e8.0 pointing to /usr/lib/ssl/RootCA/00.pem 2. Create the ServerCA cd /usr/lib/ssl/ServerCA # Create the private key for the ServerCA # You will be asked for a new password here. Do not make it the same as the RootCA's # password, but still - make it a good one. # openssl genrsa -aes256 -out /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -rand /usr/lib/ssl/ServerCA/private/.rand 2048 chmod g-rwx,o-rwx /usr/lib/ssl/ServerCA/private/ServerCA.key.pem # Create the certification request. You will be asked for the # newly created password. # (All in one line) openssl req -new -days 1827 -key /usr/lib/ssl/ServerCA/private/ServerCA.key.pem -out /usr/lib/ssl/ServerCA/ServerCA.req.pem # Let the RootCA sign the request and create the certificate. # You will need the RootCA's password for this. # openssl ca -name RootCA -in /usr/lib/ssl/ServerCA/ServerCA.req.pem -out /usr/lib/ssl/ServerCA/ServerCA.cert.pem # Copy and link the certificate. # mv /usr/lib/ssl/RootCA/newcerts/01.pem /usr/lib/ssl/RootCA/certs/ cd /usr/lib/ssl/RootCA/certs/ ln -s 01.pem `openssl x509 -in 01.pem -hash -noout`.0 # And copy the part neccessary for browser integration into # another file (this is the part between BEGIN CERTIFICATE and END CERTIFICATE) # cd /usr/lib/ssl/ServerCA sed -n '/-----BEGIN CERTIFICATE-----/,$p' ServerCA.cert.pem > ServerCA.crt # Create the CACerts file used on the client side to verify a server cert mkdir /usr/lib/ssl/cacerts/ cat /usr/lib/ssl/RootCA/RootCA.cert.pem /usr/lib/ssl/ServerCA/ServerCA.cert.pem > /usr/lib/ssl/cacerts/ServerCA.chain.pem # The newly created file (ServerCA.chain.pem) is the CACertsFile which has to be copied # to every client. Create a /usr/lib/ssl/cacerts/ directory on the client side and copy # the file to that location. 3. Do the same with the User CA 4. Create your LDAP server certificate. As for the name in your cert, use the fqdn of the machine you are running the server on. cd /usr/lib/ssl/ServerCA # You will NOT need a password here # openssl genrsa -out <fqdn-of-your-server>.key.pem -rand ./private/.rand 2048 openssl req -new -key <fqdn-of-your-server>.key.pem -out <fqdn-of-your-server>.req.pem # But here, you will be asked for the ServerCA's password openssl ca -name ServerCA -in <fqdn-of-your-server>.req.pem -out <fqdn-of-your-server>.cert.pem Move and link the new certificate (in newcerts) as above. 5. Configure LDAP server and clients Make sure that your ldap server can read its own private key. If your ldap server is running as user openldap, make sure that this user owns the private key in /usr/lib/ssl/ServerCA/private/ Normal users should never be allowed to read the key! This would break the whole security mechanism. In your slapd.conf, you will have TLSCertificateFile /usr/lib/ssl/certs/<fqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/private/<fqdn>.key.pem And on client side ldap.conf: TLS_CACERT /usr/lib/ssl/cacerts/ServerCA.chain.pem TLS_REQCERT demand Hope this helps, Hauke p.s.: The description is strongly influenced by Frank Steidl's tutorial as it can be found at http://fra.nksteidl.de/Erinnerungen/OpenSSL.php ----- Ursprüngliche Mail ----- Von: "Dieter Kluenter" < dieter(a)dkluenter.de > An: openldap-technical(a)openldap.org Gesendet: Dienstag, 7. Oktober 2008 22:34:14 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: StartTLS is not working Dat Duong < datduong2000(a)yahoo.com > writes: > Hi Hauke, > > I still can't get TLS to work. Here is the error message. > > TLS certificate verification: Error, self signed certificate > tls_write: want=7, written=7 > 0000: 15 03 01 00 02 02 30 ......0 > TLS trace: SSL3 alert write:fatal:unknown CA > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Please describe the parameters to create your certificate chain. I presume you have not signed your certificates with a known certificate authority. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------ -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

ldapadd error
by Kermito le kermit 08 Oct '08

08 Oct '08

hello all i am new to openldap and i have some problem to use, i follow the exemple in quick start guide to make my slpad.conf but when i what to populta my data base i have error in the log i see conn=0 op=0 BIND dn="cn=Manager,dc=example,dc=com" method=128 conn=0 op=0 BIND dn="cn=Manager,dc=example,dc=com" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 ADD dn="dc=example,dc=com" Erreur de segmentation i am to debian help me please

1 0

problem searching directory for a certificate
by drewgr 07 Oct '08

07 Oct '08

Folks, I have a Java based application using JNDI to connect with OpenLDAP. One of the functions requires searching the directory for a given certificate. No matter what I try, this will not work with OpenLDAP. I think that either OpenLDAP just is not able to search for binary data, or more likely there is something "special" about the "userCertificate;binary" attribute. I turned on full tracing in the LDAP log, and I see the following when the relevant search is executed. >>> serialNumberAndIssuerPretty: <various "graphics" characters > get_ava: illegal value for attributeType userCertificate end get_filter 0 end get_filter_list end get_filter 0 filter: (&(?=undefined)) => get_ctrls => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" attrs: The "filter: (&(?=undefined))" seems really fishy to me. When I do any other search, the line looks more like "(&(uid=GregD))" From the application side, it appears that the request succeeded, but it returns nothing. I know the certificate exists in the directory, as I can search on an ordinary attribute like uid and then get the userCertificate;binary attribute from the result. The data returned is a valid certificate. I have watched the packet stream back and forth, and the query is getting transmitted to the slapd correctly, but no matches are returned. Setting com.sun.jndi.ldap.trace.ber to System.out in the application gives trace data which indicates the same thing. To further validate my suspicions that this is an OpenLDAP issue, I set up a Sun Directory Server instance on the same server, and I am able to perform the search against that software. I've also started looking around the OpenLDAP source code, but so far have not found the smoking gun. Can anyone shed some light on this for me? The OS is CentOS 5.2, latest patches. The OpenLdap version is 2.3.27-8 as reported by rpm. Thanks Greg

2 1

Re: AW: StartTLS is not working
by Dat Duong 07 Oct '08

07 Oct '08

Hi Hauke, I still can't get TLS to work. Here is the error message. TLS certificate verification: Error, self signed certificate tls_write: want=7, written=7 0000: 15 03 01 00 02 02 30 ......0 TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed. ldap_err2string ldap_start_tls: Connect error (-11) Thanks ----- Original Message ---- From: Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical <openldap-technical(a)openldap.org> Sent: Tuesday, October 7, 2008 1:25:37 AM Subject: AW: StartTLS is not working Hi Dat, first of all: Please send your questions to the list so that other users with the same problem can find the solution, too. To your problem: Please make sure that you have a correct value for your ServerCA's private key in your openssl.cnf. It should read something like this: [ ServerCA ] # Where is the base directory for the ServerCA dir = /usr/lib/ssl/ServerCA # Where is the ServerCA's certificate certificate = $dir/ServerCA.cert.pem # and where is the ServerCA's private key private_key = $dir/private/ServerCA.key.pem Without the private key, the ServerCA will not be able to sign your LDAP certificate. You will find more configuration hints for openssl.cnf in the tutorial. Hope this helps, Hauke -- ----- Ursprüngliche Mail ----- Von: "Dat Duong" <datduong2000(a)yahoo.com> An: "hauke coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Dienstag, 7. Oktober 2008 09:06:07 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: StartTLS is not working Hi Hauke, I read your instruction on how to create Root CA ...I have a hard time understanding the step. I have a question on how to sign the ldap server certificated using Server CA? I get an error message: bash-3.00# openssl ca -name ServerCA -in afldap01.req.pem -out afldap01.cert.pem Using configuration from /usr/local/ssl/openssl.cnf variable lookup failed for ServerCA::private_key 18908:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=ServerCA name=private_key Thanks Dat -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

2 1

LVM snapshot as a backup method
by Pavlos Parissis 07 Oct '08

07 Oct '08

Hi, Has anyone used LVM snapshot as a backup method when downtime isn't allowed and slapcat takes hours to finish? I have to find a way to backup the LDAP without bring it down or set it in ReadOnly mode, thus I thought about the LVM snapshot. I can run LVM snapshot every day and then run db_recover -c for making the snapshot LDAP DB in a good state. Am I missing something in the above idea? Cheers, Pavlos

2 3

RE: JDBC-LDAP Bridge Driver and Tomcat Connection Pooling
by Hu, William 07 Oct '08

07 Oct '08

I got the following when try to use connection pooling from Tomcat. There maybe an issue with auto commit, read only and transaction isolation settings. Does your driver use these settings? Or are they not implemented? Thanks in advance com.jaspersoft.jasperserver.api.JSException: jsexception.error.creating.connection com.jaspersoft.jasperserver.api.JSException: jsexception.error.creating.connection at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:61) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.BaseJdbcDa taSource.setReportParameterValues(BaseJdbcDataSource.java:52) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.setReportParameterValues(JdbcDataSourceService.java:66) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:633) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:333) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.executeReport(EngineServiceImpl.java:765) at com.jaspersoft.jasperserver.api.engine.jasperreports.domain.impl.ReportUnitR equest.execute(ReportUnitRequest.java:60) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.execute(EngineServiceImpl.java:265) at com.jaspersoft.jasperserver.war.action.ViewReportAction.executeReport(ViewRe portAction.java:329) at com.jaspersoft.jasperserver.war.action.ViewReportAction.verifyData(ViewRepor tAction.java:222) at sun.reflect.GeneratedMethodAccessor376.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethod Invoker.java:103) at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:13 6) at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.jav a:203) at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.j ava:142) at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.jav a:61) at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:180) at org.springframework.webflow.engine.State.enter(State.java:200) at org.springframework.webflow.engine.Transition.execute(Transition.java:229) at org.springframework.webflow.engine.TransitionableState.onEvent(Transitionabl eState.java:112) at org.springframework.webflow.engine.Flow.onEvent(Flow.java:572) at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEven t(RequestControlContextImpl.java:207) at org.springframework.webflow.engine.impl.FlowExecutionImpl.signalEvent(FlowEx ecutionImpl.java:214) at org.springframework.webflow.executor.FlowExecutorImpl.resume(FlowExecutorImp l.java:238) at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopU tils.java:281) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint (ReflectiveMethodInvocation.java:187) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:154) at org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.inv oke(MethodSecurityInterceptor.java:66) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:176) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopPro xy.java:210) at $Proxy13.resume(Unknown Source) at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRe quest(FlowRequestHandler.java:115) at org.springframework.webflow.executor.mvc.FlowController.handleRequestInterna l(FlowController.java:170) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(Abstrac tController.java:153) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(Si mpleControllerHandlerAdapter.java:45) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl et.java:820) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle t.java:755) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer vlet.java:396) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java :350) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.common.UploadMultipartFilter.doFilter(Upload MultipartFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:264) at org.acegisecurity.ui.switchuser.SwitchUserProcessingFilter.doFilter(SwitchUs erProcessingFilter.java:335) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecur ityInterceptor.java:107) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSec urityInterceptor.java:72) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslatio nFilter.java:110) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(Ano nymousProcessingFilter.java:125) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.api.metadata.user.service.impl.MetadataAuthentic ationProcessingFilter.doFilter(MetadataAuthenticationProcessingFilter.java:1 41) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.util.RequestParameterAuthenticationFilter.do Filter(RequestParameterAuthenticationFilter.java:97) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessin gFilter.java:181) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFil ter.java:217) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpS essionContextIntegrationFilter.java:191) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148) at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.util.CharacterEncodingFilter.doFilter(Charac terEncodingFilter.java:70) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt erProxy.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.ja va:213) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.ja va:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126 ) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105 ) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java :107) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869) at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processC onnection(Http11BaseProtocol.java:664) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.jav a:527) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWo rkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.jav a:684) at java.lang.Thread.run(Thread.java:595) Caused by: org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool exhausted at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:103) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:58) ... 94 more Caused by: java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPoo l.java:806) at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:95) ... 95 more org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool exhausted org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool exhausted at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:103) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:58) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.BaseJdbcDa taSource.setReportParameterValues(BaseJdbcDataSource.java:52) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.setReportParameterValues(JdbcDataSourceService.java:66) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:633) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:333) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.executeReport(EngineServiceImpl.java:765) at com.jaspersoft.jasperserver.api.engine.jasperreports.domain.impl.ReportUnitR equest.execute(ReportUnitRequest.java:60) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.execute(EngineServiceImpl.java:265) at com.jaspersoft.jasperserver.war.action.ViewReportAction.executeReport(ViewRe portAction.java:329) at com.jaspersoft.jasperserver.war.action.ViewReportAction.verifyData(ViewRepor tAction.java:222) at sun.reflect.GeneratedMethodAccessor376.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethod Invoker.java:103) at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:13 6) at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.jav a:203) at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.j ava:142) at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.jav a:61) at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:180) at org.springframework.webflow.engine.State.enter(State.java:200) at org.springframework.webflow.engine.Transition.execute(Transition.java:229) at org.springframework.webflow.engine.TransitionableState.onEvent(Transitionabl eState.java:112) at org.springframework.webflow.engine.Flow.onEvent(Flow.java:572) at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEven t(RequestControlContextImpl.java:207) at org.springframework.webflow.engine.impl.FlowExecutionImpl.signalEvent(FlowEx ecutionImpl.java:214) at org.springframework.webflow.executor.FlowExecutorImpl.resume(FlowExecutorImp l.java:238) at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopU tils.java:281) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint (ReflectiveMethodInvocation.java:187) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:154) at org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.inv oke(MethodSecurityInterceptor.java:66) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:176) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopPro xy.java:210) at $Proxy13.resume(Unknown Source) at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRe quest(FlowRequestHandler.java:115) at org.springframework.webflow.executor.mvc.FlowController.handleRequestInterna l(FlowController.java:170) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(Abstrac tController.java:153) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(Si mpleControllerHandlerAdapter.java:45) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl et.java:820) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle t.java:755) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer vlet.java:396) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java :350) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.common.UploadMultipartFilter.doFilter(Upload MultipartFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:264) at org.acegisecurity.ui.switchuser.SwitchUserProcessingFilter.doFilter(SwitchUs erProcessingFilter.java:335) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecur ityInterceptor.java:107) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSec urityInterceptor.java:72) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslatio nFilter.java:110) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(Ano nymousProcessingFilter.java:125) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.api.metadata.user.service.impl.MetadataAuthentic ationProcessingFilter.doFilter(MetadataAuthenticationProcessingFilter.java:1 41) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.util.RequestParameterAuthenticationFilter.do Filter(RequestParameterAuthenticationFilter.java:97) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessin gFilter.java:181) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFil ter.java:217) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpS essionContextIntegrationFilter.java:191) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148) at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.util.CharacterEncodingFilter.doFilter(Charac terEncodingFilter.java:70) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt erProxy.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.ja va:213) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.ja va:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126 ) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105 ) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java :107) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869) at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processC onnection(Http11BaseProtocol.java:664) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.jav a:527) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWo rkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.jav a:684) at java.lang.Thread.run(Thread.java:595) Caused by: java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPoo l.java:806) at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:95) ... 95 more java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions java.util.NoSuchElementException: Could not create a validated object, cause: LDAP Does Not Support Transactions at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPoo l.java:806) at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.ja va:95) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.createConnection(JdbcDataSourceService.java:58) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.BaseJdbcDa taSource.setReportParameterValues(BaseJdbcDataSource.java:52) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.JdbcDataSo urceService.setReportParameterValues(JdbcDataSourceService.java:66) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:633) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.fillReport(EngineServiceImpl.java:333) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.executeReport(EngineServiceImpl.java:765) at com.jaspersoft.jasperserver.api.engine.jasperreports.domain.impl.ReportUnitR equest.execute(ReportUnitRequest.java:60) at com.jaspersoft.jasperserver.api.engine.jasperreports.service.impl.EngineServ iceImpl.execute(EngineServiceImpl.java:265) at com.jaspersoft.jasperserver.war.action.ViewReportAction.executeReport(ViewRe portAction.java:329) at com.jaspersoft.jasperserver.war.action.ViewReportAction.verifyData(ViewRepor tAction.java:222) at sun.reflect.GeneratedMethodAccessor376.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.webflow.util.DispatchMethodInvoker.invoke(DispatchMethod Invoker.java:103) at org.springframework.webflow.action.MultiAction.doExecute(MultiAction.java:13 6) at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.jav a:203) at org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.j ava:142) at org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.jav a:61) at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:180) at org.springframework.webflow.engine.State.enter(State.java:200) at org.springframework.webflow.engine.Transition.execute(Transition.java:229) at org.springframework.webflow.engine.TransitionableState.onEvent(Transitionabl eState.java:112) at org.springframework.webflow.engine.Flow.onEvent(Flow.java:572) at org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEven t(RequestControlContextImpl.java:207) at org.springframework.webflow.engine.impl.FlowExecutionImpl.signalEvent(FlowEx ecutionImpl.java:214) at org.springframework.webflow.executor.FlowExecutorImpl.resume(FlowExecutorImp l.java:238) at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl .java:25) at java.lang.reflect.Method.invoke(Method.java:585) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopU tils.java:281) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint (ReflectiveMethodInvocation.java:187) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:154) at org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.inv oke(MethodSecurityInterceptor.java:66) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(Reflect iveMethodInvocation.java:176) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopPro xy.java:210) at $Proxy13.resume(Unknown Source) at org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRe quest(FlowRequestHandler.java:115) at org.springframework.webflow.executor.mvc.FlowController.handleRequestInterna l(FlowController.java:170) at org.springframework.web.servlet.mvc.AbstractController.handleRequest(Abstrac tController.java:153) at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(Si mpleControllerHandlerAdapter.java:45) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl et.java:820) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle t.java:755) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer vlet.java:396) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java :350) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.common.UploadMultipartFilter.doFilter(Upload MultipartFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:264) at org.acegisecurity.ui.switchuser.SwitchUserProcessingFilter.doFilter(SwitchUs erProcessingFilter.java:335) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.invoke(FilterSecur ityInterceptor.java:107) at org.acegisecurity.intercept.web.FilterSecurityInterceptor.doFilter(FilterSec urityInterceptor.java:72) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslatio nFilter.java:110) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(Ano nymousProcessingFilter.java:125) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.api.metadata.user.service.impl.MetadataAuthentic ationProcessingFilter.doFilter(MetadataAuthenticationProcessingFilter.java:1 41) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.util.RequestParameterAuthenticationFilter.do Filter(RequestParameterAuthenticationFilter.java:97) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessin gFilter.java:181) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFil ter.java:217) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferenc esFilter.java:165) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpS essionContextIntegrationFilter.java:191) at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterCh ainProxy.java:274) at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148) at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at com.jaspersoft.jasperserver.war.util.CharacterEncodingFilter.doFilter(Charac terEncodingFilter.java:70) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt erProxy.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application FilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh ain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.ja va:213) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.ja va:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126 ) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105 ) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java :107) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869) at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processC onnection(Http11BaseProtocol.java:664) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.jav a:527) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWo rkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.jav a:684) at java.lang.Thread.run(Thread.java:595)

1 0

question regarding ACLs
by Kick, Claus 07 Oct '08

07 Oct '08

Hello all, Since there is some time, I figured I rectify our openldap configuration and use proper ACLs. We are using the following version on Solaris 10: [xxxx:/opt/csw/libexec]$ ./slapd -V @(#) $OpenLDAP: slapd 2.3.39 (Feb 22 2008 18:51:52) $ asmoore@ra Our user subtree is organized as shown below: o=suffix ou=people,o=suffix uid=kdz,ou=people,o=suffix uid=hyc,ou=people,o=suffix ou=removed_accounts,ou=people,o=suffix uid=abcd,ou=removed_accounts,ou=people,o=suffix uid=efgh,ou=removed_accounts,ou=people,o=suffix Basically, I want a getent passwd not to list entries below ou=removed_accounts,ou=people,o=suffix, for a client application still considers the removed accounts as users (it probably searches the whole subtree). I read the documentation for 2.3: http://www.openldap.org/doc/admin23/slapdconfig.html#Access%20Control <http://www.openldap.org/doc/admin23/slapdconfig.html> And found this: The scope can be either base, one, subtree, or children. Where base matches only the entry with provided DN, one matches the entries whose parent is the provided DN, subtree matches all entries in the subtree whose root is the provided DN, and children matches all entries under the DN (but not the entry named by the DN). So, I figured that an ACL (no global ACLs any longer) like this access to dn.one="ou=People,o=suffix" by * write Should hide the removed accounts and only show the active ones. But it does not, it still contains all the children of ou=removed_accounts,ou=people,o=suffix And of ou=people,o=suffix Using dn.base="ou=People,o=suffix" by * write Works as expected and getent passwd not return any ldap users, solely the /etc/passwd users. The client system in question is a Solaris 10 machine, I have kept the client configuration unchanged for the tests so far: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 127.0.0.1 NS_LDAP_SEARCH_BASEDN= o=suffix NS_LDAP_SEARCH_TIME= 90 NS_LDAP_CACHETTL= 0 There are only two other ACLs in place: 1. access to dn.one="ou=Group,o=siemensmedical.com" by * write This one works fine, getent group returns all the groups it should return and the changes can be done as well. 2. access to dn.subtree="ou=Roles,o=siemensmedical.com" by * write This one works fine as well, it returns the role structure as requested and changes work as well. Where am I making a mistake? Best regards, Claus

2 3

openLDAP TLS APIs usage issue
by dhiraj.prasad＠tcs.com 07 Oct '08

07 Oct '08

Hello, I have configured LDAP server on linux with TLS support and was able to fetch data from it using the ldapsearch utility. However, when i tried to do this searching via code i got following errors: Error at Server Side: slap_listener_activate(10): >>> slap_listener(ldaps://) connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(15): got connid=47 connection_read(15): checking for input on id=47 TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(15): TLS accept failure error=-1 id=47, closing connection_closing: readying conn=47 sd=15 for close connection_close: conn=47 sd=15 Error at Client side: [root@localhost LDAP1]# ./ldapSearch ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost.localdomain:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 19, subject: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com, issuer: /C=IN/ST=MH/O=TCS/OU=EIS/CN=localhost.localdomain/emailAddress=dhiraj.prasad(a)tcs.com TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Error in ldap_start_tls_s -1:Can't contact LDAP serverTest..1 ldap_bind_s ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request Test..2: -1 ldap_err2string Failure of LDAP bind -1-Can't contact LDAP server [root@localhost LDAP1]# Snippet of client code for TLS support used by Me: ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTFILE, "/root/cacert.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_CERTFILE, "/usr/local/etc/openldap/ldap.client.pem"); ldap_set_option(ld, LDAP_OPT_X_TLS_KEYFILE, "/usr/local/etc/openldap/ldap.client.key.pem"); ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON); val = LDAP_OPT_X_TLS_ALLOW; ldap_set_option (ld, LDAP_OPT_X_TLS, &val); status = ldap_start_tls_s(ld, NULL, NULL); Please let me know as to what is missing in my code that is triggering the above errors. Also if there are any sample TLS client code, please let me know where can i get it. Thanks, Dhiraj Kumar Prasad Tata Consultancy Services Mailto: dhiraj.prasad(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Outsourcing ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

loglevel and logfile
by Ashraf Mohamed 07 Oct '08

07 Oct '08

hi, I am trying to turn on debugging for slapd and direct the debug output to a specific file on OpenLDAP 2.4.11 on linux without using syslog. I tried using slapd.conf; configured logfile and loglevel. And the only way I could get it working is by passing in the -d option to slapd. It does not seem to use the loglevel/logfile values if I don't pass in the -d option. I also tried using slapd.d. I am able to set olcLogLevel but I can't set olcLogFile. It won't even let me add it to the config. Ideas? Thanks much. Ashraf

2 1

AW: StartTLS is not working
by Hauke Coltzau 07 Oct '08

07 Oct '08

Hi Dat, first of all: Please send your questions to the list so that other users with the same problem can find the solution, too. To your problem: Please make sure that you have a correct value for your ServerCA's private key in your openssl.cnf. It should read something like this: [ ServerCA ] # Where is the base directory for the ServerCA dir = /usr/lib/ssl/ServerCA # Where is the ServerCA's certificate certificate = $dir/ServerCA.cert.pem # and where is the ServerCA's private key private_key = $dir/private/ServerCA.key.pem Without the private key, the ServerCA will not be able to sign your LDAP certificate. You will find more configuration hints for openssl.cnf in the tutorial. Hope this helps, Hauke -- ----- Ursprüngliche Mail ----- Von: "Dat Duong" <datduong2000(a)yahoo.com> An: "hauke coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Dienstag, 7. Oktober 2008 09:06:07 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: StartTLS is not working Hi Hauke, I read your instruction on how to create Root CA ...I have a hard time understanding the step. I have a question on how to sign the ldap server certificated using Server CA? I get an error message: bash-3.00# openssl ca -name ServerCA -in afldap01.req.pem -out afldap01.cert.pem Using configuration from /usr/local/ssl/openssl.cnf variable lookup failed for ServerCA::private_key 18908:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=ServerCA name=private_key Thanks Dat -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

Problem with usage of suffixmassage and meta database
by Padgett,Phil 06 Oct '08

06 Oct '08

I am attempting to use "database meta" to direct queries to either one of two backend databases. The queries come in in the form "cn=user1,dc=alpha,dc=ufl,dc=edu" or "cn=user2,dc=beta,dc=ufl,dc=edu". I have multible local databases alpha, beta, and prod. There are some accounts which have info in those databases and others which should be redirected to a campus active directory server. If I send in the requests as "cn=user1,dc=ufl,dc=edu", etc then both the local databases and the remote active directory one can service them. This works well. I would like to call them with the alpha, beta, or prod in the dn so that the appropriate local database is consulted but if there is no match then the active directory server is queried. I seem to be having problems with the suffixmassage directive since this does not seem to be working. Any help would be appreciated. Below is the relevent section of my slapd.conf file. Thanks. Phil database meta suffix "dc=ufl,dc=edu" uri "ldap://localhost:390/dc=alpha,dc=ufl,dc=edu" uri "ldap://localhost:390/dc=beta,dc=ufl,dc=edu" uri ldap://localhost:390/dc=prod,dc=ufl,dc=edu uri "ldap://ldap.ad.ufl.edu/dc=alpha,dc=ufl,dc=edu" acl-authcDN "cn=SVC-LDAP,OU=Service Accounts,OU=Departments,OU=UF,DC=ad,DC=ufl,DC=edu" acl-passwd 'ssssssssss' rewriteEngine on suffixmassage "dc=alpha,dc=ufl,dc=edu" "dc=ad,dc=ufl,dc=edu" lastmod off

1 0

Re: Incorrect snippet in delta-syncrepl example in admin guide?
by Brad T Waldorf 06 Oct '08

06 Oct '08

My own thoughts, for what they're worth... A "complete working examples" section would be invaluable. The most useful part of the man pages for the command line & admin tools was the example section... it ties everything together. Same for the examples in the admin guide... a complete example to compliment the conceptual words is priceless. Funny you mention it, but i was also disappointed in the N-Way configuration example (17.4.3)... but because it was in the "new" config file format, which i wasn't using. Anyway, I understand you want readers to read thoroughly and try creating their own configuration from scratch... but i've found it's rare that a user will spend the time to "properly" understand something before they actually try making it work. Rather, they try something, research/fix the error, try again, research/fix, etc... whatever it takes to get it working as quick as possible. In my experience, syntax diagrams and working examples are the most important, time-saving (and sanity-saving) pieces of documentation. Having working example configurations that are commented thoroughly ("see section ____ for more info on configuration specifics for this", "modify the following statements with your own specific values", etc.) might be the best solution. Thanks again for all your help

1 0

Re: Incorrect snippet in delta-syncrepl example in admin guide?
by Pierangelo Masarati 06 Oct '08

06 Oct '08

Gavin Henry wrote: > ----- "Pierangelo Masarati" <ando(a)sys-net.it> wrote: > >> Brad T Waldorf wrote: >>> I would >>> definitely recommend replacing "may need to" with "must" in the >> following >>> statement, as you suggested. "This ACL may need to be merged with >> other >>> ACL statements." >> Probably, that whole example should be removed, as it belongs to >> access >> control rather than to replication. > > It's hard to present complete examples that way. I've other external feedback in various forums > whereby users complain that N-Way is hard to understand, but they merely need to read the whole guide. I0'm not speaking in general, but specifically related to that case. access to * by <canreadall> read by * break is: 1) generic, not necessarily specific to replication 2) incomplete, since it needs to integrate with other access rules 3) should be per-database, rather than global, IMHO. So like it's now it creates more trouble than it helps solving. > I'm tempted to move complete working examples to the follow existing empty section: > > http://www.openldap.org/doc/admin24/appendix-deployments.html Sounds good. > This would however promoted copy-and-paste configurations. That's inevitable, I fear, no matter what. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

rfc4523
by Gavin Henry 06 Oct '08

06 Oct '08

Hi All, How can slapd take advantage of rfc4523 for example? test21 only shows search/add/delete to a users entry, so I'm trying to understand the bigger picture from the server and clients point of view. Is it intended to be used just as a data store for 3rd party application to retrieve all the X.509 information? Thanks, Gavin.

2 1

Using ACIs in our opensource project
by Faraz Khan 06 Oct '08

06 Oct '08

Dear All, We are developing a webbased opensource identity management solution which includes a graphical frontend to manage openldap ACLs. Previously we were using Cn=config and 'standard' ACLs to manage our tree but we later moved on to OpenLdap ACIs for in-tree ACLs. Gavin Henry suggested that I take this discussion to the list since ACIs are not being actively maintained and its advisable to move to the 'normal' openldap ACLs. My problem with that model is that management through a graphical interface becomes VERY ugly (parsing and rendering text acls, maintaining priority, managing referential integrity if a dn is deleted, etc). I have found OpenLdapACIs extremely handy to use for my task. We are willing to provide resources/dev time in the future for the support of OpenLDAP ACIs since its crucial to our project. I wanted to know if support/interest is the ONLY problem or are there fundamental flaws in the way ACIs work? Thank you. -- Faraz R Khan Zivios::Open Source Enterprise Management www.zivios.org

1 0

Incorrect snippet in delta-syncrepl example in admin guide?
by Brad T Waldorf 05 Oct '08

05 Oct '08

Hi. I used the Delta-syncrepl configuration example from the admin guide (http://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl) to create configuration files for a basic 1 Master, 1 Slave configuration. With a populated & functional master, i started the slave and hit this error... slap_client_connect: URI=ldap://9.57.13.249:389 DN="cn=user.replicator,ou=people ,dc=exampleb,dc=com" ldap_sasl_bind_s failed (49)+ (The replicator DN couldn't bind.) In fact, i couldn't execute a basic ldapsearch while binding as the replicator DN... kept getting "ldap_bind: Invalid credentials (49)". Long story short, the fix was to comment out the following ACL statements in the master config file ... i could then bind as the replicator DN and delta-syncrepl worked... # Give the replica DN unlimited read access. access to * by dn.base="cn=user.replicator,ou=People,dc=exampleb,dc=com" read by * break I might be missing something... but based on my results, it seems like those ACL statements aren't needed and actually prevented me from delta-syncrepl'ing successfully. Wanted to pass along this info incase i'm actually on to something... so you can fix the documentation if need be. Thanks! Master slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Give the replica DN unlimited read access. #access to * # by dn.base="cn=user.replicator,ou=People,dc=exampleb,dc=com" read # by * break # Accesslog database definitions database hdb suffix cn=accesslog directory /usr/local/var/openldap-data/db/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=user.replicator,ou=People,dc=exampleb,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database hdb suffix "dc=exampleb,dc=com" rootdn "cn=kingb,dc=exampleb,dc=com" rootpw pappie directory /usr/local/var/openldap-data index objectclass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="cn=user.replicator,ou=People,dc=exampleb,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Slave slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database hdb suffix "dc=exampleb,dc=com" rootdn "cn=kingb,dc=exampleb,dc=com" rootpw pappie directory /usr/local/var/openldap-data index entryUUID eq # syncrepl directives syncrepl rid=0 provider=ldap://(my_ip_address):389 bindmethod=simple binddn="cn=user.replicator,ou=People,dc=exampleb,dc=com" credentials=metsrbad searchbase="dc=exampleb,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://(my_ip_address):389

2 3

AW: Re: AW: openldap and TLS certificates
by Hauke Coltzau 03 Oct '08

03 Oct '08

Hi Nick, just to make sure: Your CA certificate is not the same as your ldap server certificate, is it? If so, then there will be the problem. To get a proper server certificate, you will have to do the following steps: 1. Create a root CA (that means, create a self signed certificate) 2. Using your root CA, create a CA for your server certificate generation and, if needed, a user CA for your user certificate generation Now you have two certificates, already. A root CA cert and a server CA cert. Still, those are not your ldap server certificates. 3. With your server CA (NOT the root ca), create a server certificate for ldap. 4. Copy the server CA certificate and the root CA certificate into one file and call it something like serverca.chain.pem. This is NOT your ldap server certificate but the certification authority, your client will trust. 5. The serverca.chain.pem is to be copied to your ldap client and will be used as CACertFile. So if the client receives the ldap server cert, it can check that it came from a trusted CA and therefore can be accpeted. There is a very good tutorial for the CA creation available at http://fra.nksteidl.de/Erinnerungen/OpenSSL.php, but it is in German. I used that tutorial and it worked out perfectly. Hope, it helps, Hauke ----- Ursprüngliche Mail ----- Von: "Nick Kasparidis" <nick.kasparidis(a)toumaz.com> An: "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> CC: "openldap-technical" <openldap-technical(a)openldap.org> Gesendet: Donnerstag, 2. Oktober 2008 12:04:43 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: openldap and TLS certificates Hello again, I followed your instructions, and I keep getting the same errors. I have also tried to remove the entries before the actual certificate and still no change. There was another suggestion on generating the certificates. I will try that and hope for the best. Thanks for the help Nick On Tue, 2008-09-30 at 02:10 +0200, Hauke Coltzau wrote: > Hi Nick, > > it took me some time to set up TLS successfully, so I'm with > you in this journey ;-) > > >From my own experience, I would suggest to start verfifying > the server first. Let the client simply have the > > TLS_CACERT /<path>/<to>/<cachain>/cacert.chain.pem > TLS_REQCERT demand > > options set and not send any certificate at all. > On the server's side, only set > > TLSCertificateFile /your/cert.pem > TLSCertificateKeyFile /your/private/key.pem > > You will not need a CACert file on the server for now. > > Make sure that the client will not send any certificate, so > check your current users .ldaprc, because the client certificate > depends on the user that runs the ldapsearch command. > > If you can set up TLS this way, you can be sure that the > server is valid. To validate your client, you will need > a .ldaprc in the current user's home directory which points > to the user's cert and key. The server must be able to > verify the user's cert. > > Hope, this helps, > > Hauke > > > ----- Ursprüngliche Mail ----- > Von: "Nick Kasparidis" <nick.kasparidis(a)toumaz.com> > An: openldap-technical(a)openldap.org > Gesendet: Montag, 29. September 2008 17:11:10 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien > Betreff: openldap and TLS certificates > > Hello everyone, > I seem to have a problem with setting up secure connections with my > LDAP server. I believe the problem has mainly to do with my certificates > rather than anything else. I used the tutorial provided by the openLDAP > admin guide to generate my certificates > http://damncoolpics.blogspot.com/2008/09/oktoberfest-2008-in-munich.html > > My slapd.conf files has the following entries > > #SSL/TLS Options > TLSCipherSuite HIGH:MEDIUM > TLSCACertificateFile /usr/local/etc/slapd-cacert.pem > TLSCertificateFile /usr/local/etc/slapd-cert.pem > TLSCertificateKeyFile /usr/local/etc/slapd-key.pem > > and my ldap.conf > TLS_CACERTDIR /etc/openldap/cacerts > TLS_CACERT /etc/openldap/cacerts/slapd-cert.pem > > slapd-cacert.pem is the certificate of the CA > slapd-cert.pem is the server certificate (same copy on client and > server) > slapd-key.pem is the server key (I manually removed the certificate > request that was generated by the process on the link above) > > I start the server using /usr/local/libexec/slapd -h ldap:/// ( also > tried the -d 9 flag for debugging), and when I use ldapsearch I get the > following errors > > (from the client) > ldapsearch -x -ZZ (I have most of the settings in my ldap.conf) > > ldap_start_tls: Connect error (-11) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > (from the server with the -d 9 flag) > I get load of stuff, but the important seems to be the following > > TLS trace: SSL3 alert read:fatal:unknown CA > TLS trace: SSL_accept:failed in SSLv3 read client certificate A > TLS: can't accept. > TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca > s3_pkt.c:1053 > connection_read(12): TLS accept failure error=-1 id=0, closing > > When I try a search without the -ZZ flag everything works fine. When I > created the certificates I tried different common names. I tried the ip > address, fully qualified name (as shown below), the short name, even my > name, but no luck. I have read the proper RFC but could not get > anyusefull information. By the way I have a local DNS server and the > domain name should match the correct IP address (and the reverse). > > Truth is I do not know much about SSL and certificates, so I might be > missing something. Just for your information, The certificate authority > is the same with the LDAP server. I will provide the certificate below, > with email and addresses altered. Also the hashes have been altered so > key and cert will not match. I merely provide them just in case you see > something wrong in the syntax. > > The server certificate > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: 1 (0x1) > Signature Algorithm: sha1WithRSAEncryption > Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Validity > Not Before: Sep 29 09:49:07 2008 GMT > Not After : Sep 29 09:49:07 2009 GMT > Subject: C=GB, ST=Oxfordshire, L=Abingdon, O=Company,, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > RSA Public Key: (2048 bit) > Modulus (2048 bit): > 00:c4:4d:49:ce:35:a6:80:67:d5:c5:ea:2e:5a:b0: > 0f:96:a2:de:28:c3:97:fc:5d:9d:05:57:ae:a8:db: > d4:cd:8c:bb:1d:4d:2c:41:51:45:0e:c9:17:8f:a0: > 5b:bb:a0:5e:d3:d7:5d:a4:64:dd:23:9a:64:ad:dc: > 7b:49:5a:92:68:65:32:6c:0c:50:84:8a:75:26:da: > 76:7f:65:13:14:0a:05:eb:5e:d3:f7:1e:89:7f:a2: > d8:1b:4a:46:28:ee:98:5f:f9:bd:21:88:df:76:5c: > b9:8e:7e:5b:09:29:65:e7:6b:a7:5b:5f:4a:99:77: > 7d:6c:d1:44:7e:7a:77:05:fe:1c:b9:6d:2b:e2:57: > 63:63:29:b3:cb:c6:68:35:b5:81:fa:ef:ee:ba:c0: > 54:3e:d8:70:0a:f6:c9:39:74:21:f8:75:b9:08:89: > 6a:5e:e3:fe:1e:5e:37:b0:29:2d:13:35:b4:7c:aa: > 55:3e:c3:c4:59:cd:08:e1:ef:21:43:29:0f:82:8f: > 84:7d:f2:65:b5:79:2e:fc:87:7c:7d:ca:fb:7a:ef: > 54:c4:33:20:ed:f5:8a:64:de:60:18:60:07:ee:f9: > ea:0f:97:bf:af:63:e1:e4:e8:b2:15:1b:5f:95:fd: > ad:c7:83:8c:94:f3:e4:ef:95:63:f0:d4:a8:f8:49: > 13:05 > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Basic Constraints: > CA:FALSE > Netscape Comment: > OpenSSL Generated Certificate > X509v3 Subject Key Identifier: > > 1F:9F:4E:5A:C8:61:53:4B:5F:50:28:84:F8:D7:45:54:C0:C9:7E:67 > X509v3 Authority Key Identifier: > > keyid:7C:5A:92:7E:5C:6B:3E:9B:0E:87:46:7C:FB:27:8F:34:AD:42:3B:27 > > Signature Algorithm: sha1WithRSAEncryption > 04:3d:f9:64:e9:c1:13:8c:98:e6:b6:33:a9:e0:8b:8e:b0:68: > 2f:70:8e:8e:b4:b2:6f:61:7c:bd:63:f2:cb:20:b8:6e:4f:0a: > 53:5f:ba:ed:32:20:c7:31:24:0c:c3:e8:d6:42:1c:a8:3e:7b: > 32:b4:87:94:71:d6:8b:ca:c9:57:f5:9f:fc:8d:89:77:e2:3e: > ac:49:cd:c8:c7:01:83:41:41:a6:05:7c:df:c6:37:0e:15:d8: > d2:51:3f:a5:92:b7:bf:3f:65:4e:68:71:b7:4e:3e:26:f6:15: > fe:38:72:e1:f9:b7:60:29:e8:ff:78:3c:aa:34:be:e8:46:f1: > 5f:87:8b:a1:60:8b:82:31:ca:5e:a1:31:83:e7:b7:90:be:a5: > 2f:ac:f7:1c:fe:af:89:15:02:af:c7:4f:2f:97:87:2b:0b:83: > 5c:07:83:f9:f9:c7:63:00:69:fa:c9:d0:fc:fb:7a:ef:7a:41: > 1c:e0:99:e4:01:73:7f:94:fa:2c:12:0f:8e:3f:8f:b4:9b:b6: > 85:42:90:1a:aa:d6:11:9b:49:db:83:f9:19:1e:dd:8b:0a:c7: > b5:c0:5c:06:78:ca:f1:75:f9:8b:eb:c0:94:b0:3f:96:fc:b8: > 88:7c:52:46:ad:ab:bb:22:52:c1:31:dc:87:a7:c9:bd:de:98: > bd:76:45:2b > -----BEGIN CERTIFICATE----- > MIIESTCCAzGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix > FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYdVQQKExlUb3VtYXogVGVjaG5vbG9n > eSBMaW8pdGVkMQswCQYDVQQLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt > YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv > bTAeFw0wODA5MjkwOTQ5MDdaFw0wOTA5MjkwOTQ5MDdaMIGyMQswCQYDVQQGEwJH > QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxETAPBgNVBAcTCEFiaW5nZG9uMSIwIAYD > VQQKExlUb3VtYXogVGVjaG5vbG9neSBMaW1pdGVkMQswCQYDVQQLEwJJVDEeMBwG > A1UEAxMVbWFnZ2llLmVuZy50b3VtYXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNr > Lmthc3BhcmlkaXNAdG91bWF6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC > AQoCggEBAMRNSc41poBn1cXqLlqwD5ai3ijDl&xdnQVXrqjb1M2cux1NLEFRRQ7J > F4+gW7ugXtPXXaRk3SOaZK3ce0lakmhlMmwMUISKdSbadn9lExQKBete0/ceiX+i > 2BtKRijumF/5vSGI33ZcuY5+WwkpZedrp1tfSpl3fWzRRH56dwX+3LltK+JXY2Mp > s8vGaDW1gfrv7rrAVD7YcAr2yTl0Ifh1uQiJal7j/h5eN7ApLRM1tHyqVT7DxFnN > COHvIUMpD4KPhH3yZbV5LvgHfH3K+3rvVMQzIO31imTeYBdgB+756g+Xv69j4eTo > shUbX5X9rceCjJTz5O+VY/DUqPhJEwUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglg > hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O > BBYEFB+fXlrIYVNLX1AphPjXRVTAyX9nMB8GA1UdIwQYMBaAFHxakn5cWz6bDodG > fPsnjzSuQjsnMA0GCSqGSIb3DQEBBQUAA4IBAQAEPflk6cETjJjmtjOp4IuOsGgv > cI6OtLNvYXy9Y/LLILhuTwpTX7rtMiDGMCQMw+jWQhyoPnsytIeUcdaLyslX9Z/8 > jYl34j6sSc3IxwGDQUGmBXzPxjcOFdjSUT+lkre/P2VOaHG3Tj4m9hX+OHLh+bdg > Kej/eDyqNL7oRvFfh4uhYIuCMcpeoTGD57eQvQUvrPcc/q+JFQKvx08vl4crC4NM > B4P5+cdjAGn6ydD8+3rvekEc4JnkAXN/lPosEg+OP4+0m7aFQpAaqtYRmknbg/kZ > Ht2LCse1wFwGeMrxdfmL68CUsD+W/LiIfFJGrau7IlLBMdyHp8m93pi9dkUr > -----END CERTIFICATE----- > > > The CA certificate > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: 0 (0x0) > Signature Algorithm: sha1WithRSAEncryption > Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Validity > Not Before: Sep 29 09:48:17 2008 GMT > Not After : Sep 29 09:48:17 2011 GMT > Subject: C=GB, ST=Oxfordshire, O=Company, OU=IT, > CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > RSA Public Key: (2048 bit) > Modulus (2048 bit): > 00:a6:6e:3b:1f:87:e9:1a:c9:e9:5c:3a:b8:96:19: > af:c9:e7:41:87:72:76:55:a8:fc:db:3c:05:55:9c: > 25:8f:83:5b:35:05:9f:cb:7b:4e:9b:3a:84:98:60: > 46:d5:79:be:c1:4c:b5:ea:cd:79:2b:c2:33:86:05: > 67:98:e4:62:77:d7:cf:98:c3:52:93:6c:ba:1c:fc: > a3:f9:81:26:ea:d8:a1:56:cd:74:f5:47:fe:0f:8d: > 95:7a:b7:8b:14:25:e7:9d:e2:e7:46:a2:d6:90:4c: > 25:94:16:20:51:78:6a:68:da:e0:06:2c:45:4e:27: > c4:2b:8b:bc:a9:e2:fb:c5:c1:8b:9d:33:5f:e3:be: > d1:f5:53:9d:2b:0c:bf:2a:95:e6:57:29:5e:ef:ab: > 3a:e9:33:09:00:c3:7d:94:aa:a9:b4:3c:08:9d:e8: > e6:92:f2:60:03:ed:12:1d:df:81:9f:a7:d2:81:7f: > 3e:8b:fa:a4:01:ba:c1:49:1c:51:02:c6:54:3c:48: > 9a:3f:18:54:04:35:c4:e1:c7:12:f6:7a:26:7e:47: > 04:e6:f8:fc:ed:8c:2e:17:05:62:b6:73:9a:4e:52: > 10:17:92:52:38:3a:4d:2d:32:ab:76:c8:61:ab:36: > cd:52:f9:95:bb:87:63:ad:5d:d3:d0:f9:6f:06:a6: > 29:6f > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Basic Constraints: > CA:FALSE > Netscape Comment: > OpenSSL Generated Certificate > X509v3 Subject Key Identifier: > > 7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 > X509v3 Authority Key Identifier: > > keyid:7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 > > Signature Algorithm: sha1WithRSAEncryption > 2b:b9:65:09:2d:ff:c0:80:dd:e0:f4:d0:01:9a:87:b9:da:54: > d2:f1:e4:0a:56:0b:cf:31:55:97:9f:93:62:df:59:3d:11:5b: > 06:6c:e7:f9:56:9b:c8:e8:e0:77:54:12:5b:ca:98:f9:c7:fa: > c6:41:45:6d:14:31:2d:d6:19:a8:41:ba:89:55:5a:7f:5c:79: > 1b:05:36:d7:e4:00:7b:e7:ae:5e:56:74:12:f9:fa:ab:63:0f: > f6:8e:97:cc:53:d3:91:7e:4b:48:6e:15:27:bc:73:4a:68:1f: > ff:36:67:b2:fa:6b:38:40:0c:f2:99:5f:75:2a:4f:27:21:a8: > fb:b5:9a:c3:7a:05:a5:45:03:3f:cf:85:21:eb:42:69:23:af: > d5:b8:32:17:4e:a5:52:c2:3e:01:bd:1f:f2:1a:b6:f0:f8:8f: > d9:d0:70:30:08:39:37:42:84:42:67:27:74:16:be:e7:2d:0f: > 54:e8:3d:8b:6f:6c:76:a6:39:d9:df:e4:b9:33:9a:92:5b:3e: > b2:6a:8a:8f:2e:9c:3a:01:54:c7:3e:0e:f4:45:9c:bd:f6:39: > e9:8c:9d:95:60:e7:2a:10:f6:ac:4a:a2:b7:16:bf:06:44:76: > 4b:5d:51:5a:0b:82:b0:53:f6:4a:d7:04:f0:85:7e:34:c6:fc: > 50:1a:c4:b3 > -----BEGIN CERTIFICATE----- > MIIENjCCAx6gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix > FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYDVQQKExlUb3VtYXogVGVjaG5vbG9n > eSBMaW1pdGVkMQswCQYDV1QLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt > YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv > bTAeFw0wODA5MjkwOTQ4MTdaFw0xMTA5MjkwOTQ4MTdaMIGfMQswCQYDVQQGEwJH > QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxIjAgBgNVBAoTGVRvdW1heiBUZWNobm9s > b2d5IExpbWl0ZWQxCzAJBgNVBAsTAklUMR4wHAYDVQQDExVtYWdnaWUuZW5nLnRv > dW1hei5jb20xKTAnBgkqhki39w0BCQEWGm5pY2sua2Fz5GFyaWRpc0B0b3VtYXou > Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApm47H4fpGsnpXDq4 > lhmvyedAh3J2Vaj82zwFVZwlj4NbNQWfy3tOmzqEmGBG1Xm+wUy16s15K8IzhgVn > mORid9fPmMNSk2y6HPyj+YEm6tihVs109Uf+D42VereLFCHnneLnRqLWkEwllBYg > UXhqaNrgBixFTifEK4u8qeL7xUGLnTNf477R9VOdKwy/KpXmVyle76s66TMJAMN9 > lKqptDwInejmkvJgA+0SHd+Bn6fSgX8+i/qkAbrBSRxRAsZUPEia3xhUBDXE4ccS > 9nomfkcE5vj87YwuFwVitnOZTlIQF5JSODpNLTKrdsHhqzbNUvmVu4djrV3T0Plv > BqYpbwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM > IEdlbmVyYXRlZC5DZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUfFqSflxbPpsOh0Z8+yeP > NK5COycwHwYDVR0jBBgwFoAUfFqSflxbPpsOh0Z8+yePNK5COycwDQYJKoZIhvcN > AQEFBQADggEBACu5ZQkt/8CA3eD00AGah7naVNLx5ApWC88xVZefk2LfWT0RWwZs > H/lWm8jo4HdUElvKmPnH+sZBRW0UMS3WGahBuolVWn9ceRsFNtfkAHvnrl5WdBL5 > +qtjD4aOl8xT05F+S0huFSe8c0poH/82Z7L6azhADPKZ73UqTychTPu1msN6BaVF > Az/PhSHrQmkj39W4MhdOpFLCPgG9H/IatvD4j9nQcDAIOTdChEJnJ3QWvuctD1To > PYtvbHamOdnf5LkzmpJbPrJiio8unDoBVMc+DvRFnL32OemMnzVg5yoQ9qxKorcW > vwZEdktdUVoLgrBT9krXBPCFfjTG/FAaxLM= > -----END CERTIFICATE----- > > and finally the server key, which I modified slightly be removing a > certificate request entry > > -----BEGIN RSA PRIVATE KEY----- > MIIEowIBAAKCAQEAxE1JzjWmgGfVxeouWrAPlqLeKMOX/F2dBVeuqNvUzZy7HU0s > QVFFDskXj6B9u6Be09ddpGTdI5pkrdx7SVqSaGUybAxQhIp1Jtp2f2UTFAoF617T > 9x6Jf6LYG0pGKO6YX/m9IYjfdly5jn5bCSll52unW19KmXd9bNFEfnp3Bf7cuW0r > 4ldjYymzy8ZoNbWB+u/uusBUPthwCvbJOXQh+HW5CIlqXuP+Hl43bCktEzW0fKpV > PsPEWc0I4e8hQykPgo+EffJltXku/Id8fcr7eu9UxDMg7fWKZN5gF2AH7vnqD5e/ > r2Ph5OiyFRtflf2tx4KMlPPk75Vj8NSo+EkTBQIDAQABAoIBAFkajAniKHXYrBxu > NCRODoVd4GG4huCyzXeDWXCkeG/sWLLwOMpdTW9ssBktvPXp0aFu/L6GWiqzBkg0 > 8HFXf2WLqduJq3K+NncwauFgy8wo0I8KOETPw7IABQA+MqKZyuilv8fdDTH43PFl > QYVjGTJ2lzzOgFow9unSA7k1dZluTeMyE+RzpVYwE/WSgsOFa7qYQnCXy0hlx85u > /SNU5383/v1cvrSghDCbZ2WrllHAerjUep1FNDounGkhiWj+JWUfddL7zYM+KVdJ > AKRaxeYo+UTAVa9rd9D8qgZo5oIJ6l53bvobkwcrVnAoYPxtzAjhcBhgtQjXSXrJ > YrHhKQECgYEAavUIAaT/XfHDXuXYMHnSf/ZgAqipOv36OPPnXnpg0yZbyLs/dgN6 > GYVBtvd3ugfQ3ZEUfOwYw2wVq6hItq6+lQRjL+G5IsoeyKJXGIpBdlr7Yhhes1gv > 4R5nGB97+F9kBVEmDephg0K++EeKRZMpzUgn1cBvBXrcfJsUc8OAFbUCgYEAy31q > k8HXBltJz7QQxmXLZogFkb0dxxXUrax202e6XsqroUpmUWx1n75TVnnP4QNH0Tqx > 8EQTDMZzQRHgFidwLAzhpI16Ex1fLfSw/lMQij7ojxtGp8LbC057dGpseBxwTPjP > I5dpdIl2Mt8HeH5qMiizRls1EcSu1RK9cPhOWhECgjEAtU+pFSwCoQKDIgU1+EE4 > nuJQEyOpO7qEH5RS5jaLJ/sdn/551TcwSdRgLuj5agea/VEq7ZyZgcC1GFZxLE6X > dejGubzLpBMpDrzBnS7EaRTbQ2YJATtfy7n6juduqSe/03eErOrLtQcoFjjP98zX > //Nd671gxXEyt/lTxrpeK5ECgYBFbIFq7awFkCmLgjxi46HUVj3ILgQ1wt3vbrKP > h4kPBAgwG+jyiJVMratTCnYAp5Td7i988EyrhB0YKxgPlt7vOGnXMSlf0hqB3ERy > UDaJY9MF1+FwJMuEfP8jhZeCFvm9WPmag/LHfoVj6rFqy35BpJ8dNsrRSA/5w837 > 98sLcQKBgBBfNJdPOGjgLZxLM5hXI88UkYFc3ppVh83SHSikKULO5d7wrWeQDR9V > u3t+sx8bl067E2dILPzTa9qLt3RO+GPCwOQMQUywNBh7jQ1BjaOg/4ctlJkjAdKo > x4hAG2dU5Z7iEob5AWpfv3+A5taS8P9RjI1O2jUwnTR84vqJtNx7 > -----END RSA PRIVATE KEY----- > > Any ideas would be welcome > > Best Regards > Nick > >

2 1

Questions about OpenLDAP for account authentication
by Phill Edwards 03 Oct '08

03 Oct '08

I have a linux server which provides a number of services such as samba, firewall, DNS, postfix, spam filtering etc to PCs on a small LAN. The client PCs on the LAN are Windows XP. I find it a pain when someone needs to change a password that you have to do it first on the PC, then make sure it's the same on the corresponding linux account and also for Samba. I thought I might use OpenLDAP so that there's only 1 password to change and was hoping I could use it to manage accounts. I've read a lot of HOWTOs but still have some questions. - Can I use an OpenLDAP frontend (eg JXplorer) and OpenLDAP to create new accounts on a linux machine, specify the group and have it create a new home dir etc (like when you run useradd)? - Does openldap replace the need to have the accounts in /etc/passwd? Once I've copied the existing linux accounts from /etc/passwd, should I delete them from /etc/passwd using userdel so that I don't have the account in two places? - I also want to use OpenLDAP to provide a common address book which will be used mainly by Outlook. I know that Outlook can query the LDAP address book, but can it also update it? It seems that there are lots of apps to query OpenLDAP but updating the entries is a little arcane. Regards, Phill

2 1

OpenLDAP 2.4.10 Import Errors
by Lydon, Mark 03 Oct '08

03 Oct '08

Hello, perhaps someone can help me with this issue, as I am an LDAP novice. I am migrating from an IBM Tivoli LDAP server to OpenLDAP 2.4.10 running under Solaris 10. I have the new service up and running, and am trying to export entries from old to new ldap servers using an LDAP Browser/Editor. There are additional schema entries to be considered, and these have been configured with a line in the slapd.conf file as follows; include /usr/local/etc/openldap/schema/npr.schema And npr.schema contains; objectClass ( 1.3.6.1.4.1.4203.1.4.6 NAME 'openbookmarks' DESC 'NPR GMIS Report Bookmark' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.5 NAME 'vpnbookmarks' DESC 'NPR MDNS Report Bookmark' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.4 NAME 'openscheduledreports' DESC 'NPR GMIS Scheduled Report' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.3 NAME 'vpnscheduledreports' DESC 'NPR MDNS Scheduled Report' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.2 NAME 'usergruas' DESC 'NPR User GRUAs' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.7 NAME 'useraccounts' DESC 'NPR User Accounts' MAY displayName AUXILIARY ) objectClass ( 1.3.6.1.4.1.4203.1.4.0 NAME 'newaccntlist' DESC 'NPR User Account Lists' MAY displayName AUXILIARY ) attributetype ( 1.3.6.1.4.1.4203.1.4.0 NAME ( 'newaccntlist' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.7 NAME ( 'useraccounts' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.2 NAME ( 'usergruas' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.3 NAME ( 'vpnscheduledreports' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.4 NAME ( 'openscheduledreports' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.5 NAME ( 'vpnbookmarks' ) SUP name ) attributetype ( 1.3.6.1.4.1.4203.1.4.6 NAME ( 'openbookmarks' ) SUP name ) But when I run the import approx 1000 out of the 4000 entries are discarded with errors such as; Root error: [LDAP: error code 21 - vpnscheduledreports: value #0 invalid per syntax] 05:21:23 PM: Failed to synchronize entries Root error: [LDAP: error code 21 - vpnbookmarks: value #0 invalid per syntax] 05:21:24 PM: Failed to synchronize entries Root error: [LDAP: error code 21 - useraccounts: value #0 invalid per syntax] It is obviously complaining about the entries that use the additional scheme attributes, but I have no idea why. Any help is greatly appreciated.

2 4

Re: Shared Addressbook using LDAP
by Tarak Ranjan 03 Oct '08

03 Oct '08

--- Tarak Ranjan <contacttrm(a)yahoo.co.in> wrote: > > --- Tarak Ranjan <contacttrm(a)yahoo.co.in> wrote: > > > > > > > > Message: 3 > > > Date: Wed, 01 Oct 2008 09:49:53 +0200 > > > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > > > Subject: Re: Shared Addressbook using LDAP > > > To: openldap-technical(a)openldap.org > > > Message-ID: <87y718hhzy.fsf(a)magenta.l4b.de> > > > Content-Type: text/plain; charset=iso-8859-1 > > > > > > Tarak Ranjan <contacttrm(a)yahoo.co.in> writes: > > > > > > > Hi List, > > > > I am configuring a shared addressbook for > > > > squirrelmail. > > > > but the problem is it's showing the only > single > > > email > > > > address of the user, using that email id i'm > > login > > > > into the webmail. > > > > > > > > here is my slapd.conf. > > > > > > > > include > /etc/openldap/schema/core.schema > > > > include > > /etc/openldap/schema/cosine.schema > > > > include > > > > /etc/openldap/schema/inetorgperson.schema > > > > allow bind_v2 > > > > pidfile /var/run/openldap/slapd.pid > > > > argsfile /var/run/openldap/slapd.args > > > > loglevel 256 > > > > access to * > > > > by self write > > > > by anonymous auth > > > > by users read > > > > access to > > > > > > > > > > dn.children="ou=addressbook,dc=mail,dc=example,dc=com" > > > > by self write > > > > by anonymous read > > > > by users read > > > [...] > > > > > > I presume that the access rules for > > > dn.children=ou=addressbook.. are > > > not taken by cut and paste from your slapd.conf > > > file, otherwise this > > > rules are not honored, as the rules have to be > > > written in a folded line. > > > With regard to your question, change the rule > > > dn.children=ou=addressbook... to > > > dn.subtree=ou=addressbook.. > > > If you want to protect the base entry > > > ou=addressbook, define something > > > like > > > access to > > > dn.base=ou=addressbook... > > > attrs=entry,children by ... > > > access to dn.children=ou=addressbook... by... > > > > > === message truncated === > > > > Hi List, > > after changing the dn.children=ou=addressbook... > to > > dn.subtree=ou=addressbook.. , i'm getting the same > > result. > > > > Only single address i'm getting, using the ID i'm > > logging in . > > > > /\ > > Tarak > > > > > please submit an example of your searchstring. > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://www.dpunkt.de/buecher/2104.html > GPG Key ID:8EF7B6C6 > 53°08'09,95"N > 10°08'02,42"E > > > Hi List, > > [root@mail ~]# ldapsearch -x -b > 'ou=addressbook,dc=mail,dc=example,dc=com' > '(objectclass=*)' > # extended LDIF > # > # LDAPv3 > # base <ou=addressbook,dc=mail,dc=example,dc=com> > with > scope subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # addressbook, mail.example.com > dn: ou=addressbook,dc=mail,dc=example,dc=com > ou: addressbook > objectClass: top > objectClass: organizationalUnit > > # Tarak, addressbook, mail.example.com > dn: > cn=Tarak,ou=addressbook,dc=mail,dc=example,dc=com > cn: Tarak > givenName: Tarak Ranjan > sn: Mukherjee > mail: tarak.ranjan(a)example.com > objectClass: top > objectClass: inetOrgPerson > > # Amit, addressbook, mail.example.com > dn: cn=Amit,ou=addressbook,dc=mail,dc=example,dc=com > cn: Amit > givenName: Amit > sn: Sharda > mail: amit(a)example.com > objectClass: top > objectClass: inetOrgPerson > > # Anand, addressbook, mail.example.com > dn: > cn=Anand,ou=addressbook,dc=mail,dc=example,dc=com > cn: Anand > givenName: Anand > sn: Adkoli > mail: anand(a)example.com > objectClass: top > objectClass: inetOrgPerson > > /\ > Tarak > > Hi List, The problem is that , when i'm deleting the particular entry in LDAP, & after that when i logging in Webmail i m getting other addressbook entries. but when i'm creating entry like cn=John,cn=Tarak,ou=addressbook,dc=mail,dc=example,dc=com the entry is coming twice, i have 33 entry & if i make sub entry for those 33 entries , it's horrible it showing 66 times the same entry.. pleas guide where i m wrong Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

autogroup error
by nooroon 03 Oct '08

03 Oct '08

hi, i'd like to use the autogroup module found in the contrib tree of the openldap sources. So I took sources from openldap.org and rebuilt openldap 2.4.11. I've also built manually autogroup.so, thanks to its makefile, and copied it with other ldap modules. Then I've followed the quick start user guide from openldap.org, to build the dc=example,dc=com tree. It's working fine with this simple configuration. In order to test the autogroup module, I have followed the README of this module, an dmodified my slapd.conf and my dyngroup.schema. Then my slapd starts correctly, but every request generates an error. Here is the error that can be seen in debug logs : ... ldap_read: want=8 error=Resource temporarily unavailable conn=0 op=1 do_search ... send_ldap_result: err=53 matched="" text="operation not supported within namingContext" seoverlay autogroupnd_ldap_response: msgid=2 tag=101 err=53 ... If i remove "overlay autogroup" and "autogroup-attrset groupOfURLs memberURL member" from slapd.conf, everythings works perfectly!! Does someone can help me to get autogroup work? thanks!

1 0

samba: Active Directory support requires ldap_initialize
by Wayne Rasmussen 02 Oct '08

02 Oct '08

Having a problem with openldap-2.4.11 for use with Samba-3.2.4 and am looking for help fixing the issue. system info: uname -m = sun4u uname -r = 5.9 uname -s = SunOS uname -v = Generic_118558-25 #building openldap CC=gcc #echo $CC #exit CPPFLAGS="-I/usr/local/include -I/usr/local/ssl/include -I/usr/local/BerkeleyDB.4.2/include -I/usr/local/include/sasl" LDFLAGS="-L/usr/local/lib -L/usr/local/ssl/lib -L/usr/local/BerkeleyDB.4.2/lib" export CC CPPFLAGS LDFLAGS # CFLAGS='-D_AVL_H' export CFLAGS # ./configure --enable-bdb make depend make install #end building openldap #build samba make clean ./configure --with-ldap --with-acl-support --with-ads --with-pam --with-winbind --with-krb5=/usr/local #####make #####make install #end build samba The configure script fails with the following: checking for LDAP support... yes checking ldap.h usability... yes checking ldap.h presence... yes checking for ldap.h... yes checking lber.h usability... yes checking lber.h presence... yes checking for lber.h... yes checking for ber_tag_t... yes checking for ber_scanf in -llber... yes checking for ber_sockbuf_add_io... yes checking for LDAP_OPT_SOCKBUF... yes checking for LBER_OPT_LOG_PRINT_FN... yes checking for ldap_init in -lldap... yes checking for ldap_set_rebind_proc... yes checking whether ldap_set_rebind_proc takes 3 arguments... 3 checking for ldap_initialize... no checking whether LDAP support is used... yes checking for Active Directory and krb5 support... yes checking for ldap_initialize... (cached) no configure: error: Active Directory support requires ldap_initialize

2 1

Conditionals in LDAP
by Tom Cooper 02 Oct '08

02 Oct '08

Hi all, I am fairly new to OpenLDAP and I was requested to set up the following: We have ADSL users to authenticate on freeradius which reads the user info via an OpenLDAP server. Now when the user has used a certain amount of data he must be flagged as blocked. His connection is disconnected and upon reconnection he is assigned a different IP address with restricted connectivity untile he tops up his account. I can see that his information needs to be changed in LDAP to maybe assign him to a different uid, something like this: uid=xxxxxx,dc=radius,dc=example,dc=com (Original) changed to uid=xxxxxx,dc=blocked,dc=radius,dc=example,dc=com. My question is now how do I accomplish this, because on the client side he will still try to authenticate as uid=xxxxxx,dc=radius,dc=example,dc=com and I can not control what credentials are sent? Is it maybe better accomplished from freeradius than from LDAP? The record needs to be changed in LDAP for our admin portal to make use of this to check the client's status. Regards, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 1

OpenLDAP back-sql ldap_add error:53
by Arun NAIR 02 Oct '08

02 Oct '08

Hey Guys, When I try to add the base ldif file i get the error mentioned below. Please help me out with this. its really urgent. Regards, Arun Nair *This is my base domain ldif file:* dn: dc=abc,dc=corp ou: rootobject description: LDAP Admin objectClass: top objectClass: dcObject objectClass: organizationalUnit dc: abc description: ABC Corp dn: ou=People,dc=abc,dc=corp ou: People description: users of abc corp objectClass: organizationalUnit *Complete debug log of ldapadd:* [root@centserver mysql]# ldapadd -x -D "cn=root,dc=abc,dc=corp" -W -f /tmp/abc.corp.ldif -d 1 ldap_create Enter LDAP Password: ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP centserver.abc.corp:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush: 46 bytes to sd 4 ldap_result ld 0x99156e8 msgid 1 ldap_chkResponseList ld 0x99156e8 msgid 1 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL wait4msg ld 0x99156e8 msgid 1 (infinite timeout) wait4msg continue ld 0x99156e8 msgid 1 all 1 ** ld 0x99156e8 Connections: * host: centserver.abc.corp port: 389 (default) refcnt: 2 status: Connected last used: Thu Oct 2 20:34:46 2008 ** ld 0x99156e8 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x99156e8 Response Queue: Empty ldap_chkResponseList ld 0x99156e8 msgid 1 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL ldap_int_select read1msg: ld 0x99156e8 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x99156e8 msgid 1 message type bind ber_scanf fmt ({eaa) ber: read1msg: ld 0x99156e8 0 new referrals read1msg: mark request completed, ld 0x99156e8 msgid 1 request done: ld 0x99156e8 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree adding new entry "dc=abc,dc=corp" ldap_add_ext ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 151 bytes to sd 4 ldap_result ld 0x99156e8 msgid 2 ldap_chkResponseList ld 0x99156e8 msgid 2 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL wait4msg ld 0x99156e8 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x99156e8 msgid 2 all 1 ** ld 0x99156e8 Connections: * host: centserver.abc.corp port: 389 (default) refcnt: 2 status: Connected last used: Thu Oct 2 20:34:46 2008 ** ld 0x99156e8 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 0x99156e8 Response Queue: Empty ldap_chkResponseList ld 0x99156e8 msgid 2 all 1 ldap_chkResponseList returns ld 0x99156e8 NULL ldap_int_select read1msg: ld 0x99156e8 msgid 2 all 1 ber_get_next ber_get_next: tag 0x30 len 56 contents: read1msg: ld 0x99156e8 msgid 2 message type add ber_scanf fmt ({eaa) ber: read1msg: ld 0x99156e8 0 new referrals read1msg: mark request completed, ld 0x99156e8 msgid 2 request done: ld 0x99156e8 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_perror ldap_add: Server is unwilling to perform (53) additional info: operation not permitted within namingContext ldap_free_connection 1 1 ldap_send_unbind ber_flush: 7 bytes to sd 4 ldap_free_connection: actually freed

1 0

AW: openldap and TLS certificates
by Hauke Coltzau 02 Oct '08

02 Oct '08

Hi Nick, it took me some time to set up TLS successfully, so I'm with you in this journey ;-) >From my own experience, I would suggest to start verfifying the server first. Let the client simply have the TLS_CACERT /<path>/<to>/<cachain>/cacert.chain.pem TLS_REQCERT demand options set and not send any certificate at all. On the server's side, only set TLSCertificateFile /your/cert.pem TLSCertificateKeyFile /your/private/key.pem You will not need a CACert file on the server for now. Make sure that the client will not send any certificate, so check your current users .ldaprc, because the client certificate depends on the user that runs the ldapsearch command. If you can set up TLS this way, you can be sure that the server is valid. To validate your client, you will need a .ldaprc in the current user's home directory which points to the user's cert and key. The server must be able to verify the user's cert. Hope, this helps, Hauke ----- Ursprüngliche Mail ----- Von: "Nick Kasparidis" <nick.kasparidis(a)toumaz.com> An: openldap-technical(a)openldap.org Gesendet: Montag, 29. September 2008 17:11:10 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: openldap and TLS certificates Hello everyone, I seem to have a problem with setting up secure connections with my LDAP server. I believe the problem has mainly to do with my certificates rather than anything else. I used the tutorial provided by the openLDAP admin guide to generate my certificates http://damncoolpics.blogspot.com/2008/09/oktoberfest-2008-in-munich.html My slapd.conf files has the following entries #SSL/TLS Options TLSCipherSuite HIGH:MEDIUM TLSCACertificateFile /usr/local/etc/slapd-cacert.pem TLSCertificateFile /usr/local/etc/slapd-cert.pem TLSCertificateKeyFile /usr/local/etc/slapd-key.pem and my ldap.conf TLS_CACERTDIR /etc/openldap/cacerts TLS_CACERT /etc/openldap/cacerts/slapd-cert.pem slapd-cacert.pem is the certificate of the CA slapd-cert.pem is the server certificate (same copy on client and server) slapd-key.pem is the server key (I manually removed the certificate request that was generated by the process on the link above) I start the server using /usr/local/libexec/slapd -h ldap:/// ( also tried the -d 9 flag for debugging), and when I use ldapsearch I get the following errors (from the client) ldapsearch -x -ZZ (I have most of the settings in my ldap.conf) ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (from the server with the -d 9 flag) I get load of stuff, but the important seems to be the following TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(12): TLS accept failure error=-1 id=0, closing When I try a search without the -ZZ flag everything works fine. When I created the certificates I tried different common names. I tried the ip address, fully qualified name (as shown below), the short name, even my name, but no luck. I have read the proper RFC but could not get anyusefull information. By the way I have a local DNS server and the domain name should match the correct IP address (and the reverse). Truth is I do not know much about SSL and certificates, so I might be missing something. Just for your information, The certificate authority is the same with the LDAP server. I will provide the certificate below, with email and addresses altered. Also the hashes have been altered so key and cert will not match. I merely provide them just in case you see something wrong in the syntax. The server certificate Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Validity Not Before: Sep 29 09:49:07 2008 GMT Not After : Sep 29 09:49:07 2009 GMT Subject: C=GB, ST=Oxfordshire, L=Abingdon, O=Company,, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:c4:4d:49:ce:35:a6:80:67:d5:c5:ea:2e:5a:b0: 0f:96:a2:de:28:c3:97:fc:5d:9d:05:57:ae:a8:db: d4:cd:8c:bb:1d:4d:2c:41:51:45:0e:c9:17:8f:a0: 5b:bb:a0:5e:d3:d7:5d:a4:64:dd:23:9a:64:ad:dc: 7b:49:5a:92:68:65:32:6c:0c:50:84:8a:75:26:da: 76:7f:65:13:14:0a:05:eb:5e:d3:f7:1e:89:7f:a2: d8:1b:4a:46:28:ee:98:5f:f9:bd:21:88:df:76:5c: b9:8e:7e:5b:09:29:65:e7:6b:a7:5b:5f:4a:99:77: 7d:6c:d1:44:7e:7a:77:05:fe:1c:b9:6d:2b:e2:57: 63:63:29:b3:cb:c6:68:35:b5:81:fa:ef:ee:ba:c0: 54:3e:d8:70:0a:f6:c9:39:74:21:f8:75:b9:08:89: 6a:5e:e3:fe:1e:5e:37:b0:29:2d:13:35:b4:7c:aa: 55:3e:c3:c4:59:cd:08:e1:ef:21:43:29:0f:82:8f: 84:7d:f2:65:b5:79:2e:fc:87:7c:7d:ca:fb:7a:ef: 54:c4:33:20:ed:f5:8a:64:de:60:18:60:07:ee:f9: ea:0f:97:bf:af:63:e1:e4:e8:b2:15:1b:5f:95:fd: ad:c7:83:8c:94:f3:e4:ef:95:63:f0:d4:a8:f8:49: 13:05 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 1F:9F:4E:5A:C8:61:53:4B:5F:50:28:84:F8:D7:45:54:C0:C9:7E:67 X509v3 Authority Key Identifier: keyid:7C:5A:92:7E:5C:6B:3E:9B:0E:87:46:7C:FB:27:8F:34:AD:42:3B:27 Signature Algorithm: sha1WithRSAEncryption 04:3d:f9:64:e9:c1:13:8c:98:e6:b6:33:a9:e0:8b:8e:b0:68: 2f:70:8e:8e:b4:b2:6f:61:7c:bd:63:f2:cb:20:b8:6e:4f:0a: 53:5f:ba:ed:32:20:c7:31:24:0c:c3:e8:d6:42:1c:a8:3e:7b: 32:b4:87:94:71:d6:8b:ca:c9:57:f5:9f:fc:8d:89:77:e2:3e: ac:49:cd:c8:c7:01:83:41:41:a6:05:7c:df:c6:37:0e:15:d8: d2:51:3f:a5:92:b7:bf:3f:65:4e:68:71:b7:4e:3e:26:f6:15: fe:38:72:e1:f9:b7:60:29:e8:ff:78:3c:aa:34:be:e8:46:f1: 5f:87:8b:a1:60:8b:82:31:ca:5e:a1:31:83:e7:b7:90:be:a5: 2f:ac:f7:1c:fe:af:89:15:02:af:c7:4f:2f:97:87:2b:0b:83: 5c:07:83:f9:f9:c7:63:00:69:fa:c9:d0:fc:fb:7a:ef:7a:41: 1c:e0:99:e4:01:73:7f:94:fa:2c:12:0f:8e:3f:8f:b4:9b:b6: 85:42:90:1a:aa:d6:11:9b:49:db:83:f9:19:1e:dd:8b:0a:c7: b5:c0:5c:06:78:ca:f1:75:f9:8b:eb:c0:94:b0:3f:96:fc:b8: 88:7c:52:46:ad:ab:bb:22:52:c1:31:dc:87:a7:c9:bd:de:98: bd:76:45:2b -----BEGIN CERTIFICATE----- MIIESTCCAzGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYdVQQKExlUb3VtYXogVGVjaG5vbG9n eSBMaW8pdGVkMQswCQYDVQQLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv bTAeFw0wODA5MjkwOTQ5MDdaFw0wOTA5MjkwOTQ5MDdaMIGyMQswCQYDVQQGEwJH QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxETAPBgNVBAcTCEFiaW5nZG9uMSIwIAYD VQQKExlUb3VtYXogVGVjaG5vbG9neSBMaW1pdGVkMQswCQYDVQQLEwJJVDEeMBwG A1UEAxMVbWFnZ2llLmVuZy50b3VtYXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNr Lmthc3BhcmlkaXNAdG91bWF6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAMRNSc41poBn1cXqLlqwD5ai3ijDl&xdnQVXrqjb1M2cux1NLEFRRQ7J F4+gW7ugXtPXXaRk3SOaZK3ce0lakmhlMmwMUISKdSbadn9lExQKBete0/ceiX+i 2BtKRijumF/5vSGI33ZcuY5+WwkpZedrp1tfSpl3fWzRRH56dwX+3LltK+JXY2Mp s8vGaDW1gfrv7rrAVD7YcAr2yTl0Ifh1uQiJal7j/h5eN7ApLRM1tHyqVT7DxFnN COHvIUMpD4KPhH3yZbV5LvgHfH3K+3rvVMQzIO31imTeYBdgB+756g+Xv69j4eTo shUbX5X9rceCjJTz5O+VY/DUqPhJEwUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglg hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O BBYEFB+fXlrIYVNLX1AphPjXRVTAyX9nMB8GA1UdIwQYMBaAFHxakn5cWz6bDodG fPsnjzSuQjsnMA0GCSqGSIb3DQEBBQUAA4IBAQAEPflk6cETjJjmtjOp4IuOsGgv cI6OtLNvYXy9Y/LLILhuTwpTX7rtMiDGMCQMw+jWQhyoPnsytIeUcdaLyslX9Z/8 jYl34j6sSc3IxwGDQUGmBXzPxjcOFdjSUT+lkre/P2VOaHG3Tj4m9hX+OHLh+bdg Kej/eDyqNL7oRvFfh4uhYIuCMcpeoTGD57eQvQUvrPcc/q+JFQKvx08vl4crC4NM B4P5+cdjAGn6ydD8+3rvekEc4JnkAXN/lPosEg+OP4+0m7aFQpAaqtYRmknbg/kZ Ht2LCse1wFwGeMrxdfmL68CUsD+W/LiIfFJGrau7IlLBMdyHp8m93pi9dkUr -----END CERTIFICATE----- The CA certificate Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=GB, ST=Oxfordshire, O=Company, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Validity Not Before: Sep 29 09:48:17 2008 GMT Not After : Sep 29 09:48:17 2011 GMT Subject: C=GB, ST=Oxfordshire, O=Company, OU=IT, CN=ldapserver.eng.mydomain.com/emailAddress=admin@mydomain.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:a6:6e:3b:1f:87:e9:1a:c9:e9:5c:3a:b8:96:19: af:c9:e7:41:87:72:76:55:a8:fc:db:3c:05:55:9c: 25:8f:83:5b:35:05:9f:cb:7b:4e:9b:3a:84:98:60: 46:d5:79:be:c1:4c:b5:ea:cd:79:2b:c2:33:86:05: 67:98:e4:62:77:d7:cf:98:c3:52:93:6c:ba:1c:fc: a3:f9:81:26:ea:d8:a1:56:cd:74:f5:47:fe:0f:8d: 95:7a:b7:8b:14:25:e7:9d:e2:e7:46:a2:d6:90:4c: 25:94:16:20:51:78:6a:68:da:e0:06:2c:45:4e:27: c4:2b:8b:bc:a9:e2:fb:c5:c1:8b:9d:33:5f:e3:be: d1:f5:53:9d:2b:0c:bf:2a:95:e6:57:29:5e:ef:ab: 3a:e9:33:09:00:c3:7d:94:aa:a9:b4:3c:08:9d:e8: e6:92:f2:60:03:ed:12:1d:df:81:9f:a7:d2:81:7f: 3e:8b:fa:a4:01:ba:c1:49:1c:51:02:c6:54:3c:48: 9a:3f:18:54:04:35:c4:e1:c7:12:f6:7a:26:7e:47: 04:e6:f8:fc:ed:8c:2e:17:05:62:b6:73:9a:4e:52: 10:17:92:52:38:3a:4d:2d:32:ab:76:c8:61:ab:36: cd:52:f9:95:bb:87:63:ad:5d:d3:d0:f9:6f:06:a6: 29:6f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 X509v3 Authority Key Identifier: keyid:7C:5A:92:7E:5C:5B:3E:9B:0E:87:46:7C:FB:27:8F:34:AE:42:3B:27 Signature Algorithm: sha1WithRSAEncryption 2b:b9:65:09:2d:ff:c0:80:dd:e0:f4:d0:01:9a:87:b9:da:54: d2:f1:e4:0a:56:0b:cf:31:55:97:9f:93:62:df:59:3d:11:5b: 06:6c:e7:f9:56:9b:c8:e8:e0:77:54:12:5b:ca:98:f9:c7:fa: c6:41:45:6d:14:31:2d:d6:19:a8:41:ba:89:55:5a:7f:5c:79: 1b:05:36:d7:e4:00:7b:e7:ae:5e:56:74:12:f9:fa:ab:63:0f: f6:8e:97:cc:53:d3:91:7e:4b:48:6e:15:27:bc:73:4a:68:1f: ff:36:67:b2:fa:6b:38:40:0c:f2:99:5f:75:2a:4f:27:21:a8: fb:b5:9a:c3:7a:05:a5:45:03:3f:cf:85:21:eb:42:69:23:af: d5:b8:32:17:4e:a5:52:c2:3e:01:bd:1f:f2:1a:b6:f0:f8:8f: d9:d0:70:30:08:39:37:42:84:42:67:27:74:16:be:e7:2d:0f: 54:e8:3d:8b:6f:6c:76:a6:39:d9:df:e4:b9:33:9a:92:5b:3e: b2:6a:8a:8f:2e:9c:3a:01:54:c7:3e:0e:f4:45:9c:bd:f6:39: e9:8c:9d:95:60:e7:2a:10:f6:ac:4a:a2:b7:16:bf:06:44:76: 4b:5d:51:5a:0b:82:b0:53:f6:4a:d7:04:f0:85:7e:34:c6:fc: 50:1a:c4:b3 -----BEGIN CERTIFICATE----- MIIENjCCAx6gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBnzELMAkGA1UEBhMCR0Ix FDASBgNVBAgTC094Zm9yZHNoaXJlMSIwIAYDVQQKExlUb3VtYXogVGVjaG5vbG9n eSBMaW1pdGVkMQswCQYDV1QLEwJJVDEeMBwGA1UEAxMVbWFnZ2llLmVuZy50b3Vt YXouY29tMSkwJwYJKoZIhvcNAQkBFhpuaWNrLmthc3BhcmlkaXNAdG91bWF6LmNv bTAeFw0wODA5MjkwOTQ4MTdaFw0xMTA5MjkwOTQ4MTdaMIGfMQswCQYDVQQGEwJH QjEUMBIGA1UECBMLT3hmb3Jkc2hpcmUxIjAgBgNVBAoTGVRvdW1heiBUZWNobm9s b2d5IExpbWl0ZWQxCzAJBgNVBAsTAklUMR4wHAYDVQQDExVtYWdnaWUuZW5nLnRv dW1hei5jb20xKTAnBgkqhki39w0BCQEWGm5pY2sua2Fz5GFyaWRpc0B0b3VtYXou Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApm47H4fpGsnpXDq4 lhmvyedAh3J2Vaj82zwFVZwlj4NbNQWfy3tOmzqEmGBG1Xm+wUy16s15K8IzhgVn mORid9fPmMNSk2y6HPyj+YEm6tihVs109Uf+D42VereLFCHnneLnRqLWkEwllBYg UXhqaNrgBixFTifEK4u8qeL7xUGLnTNf477R9VOdKwy/KpXmVyle76s66TMJAMN9 lKqptDwInejmkvJgA+0SHd+Bn6fSgX8+i/qkAbrBSRxRAsZUPEia3xhUBDXE4ccS 9nomfkcE5vj87YwuFwVitnOZTlIQF5JSODpNLTKrdsHhqzbNUvmVu4djrV3T0Plv BqYpbwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM IEdlbmVyYXRlZC5DZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUfFqSflxbPpsOh0Z8+yeP NK5COycwHwYDVR0jBBgwFoAUfFqSflxbPpsOh0Z8+yePNK5COycwDQYJKoZIhvcN AQEFBQADggEBACu5ZQkt/8CA3eD00AGah7naVNLx5ApWC88xVZefk2LfWT0RWwZs H/lWm8jo4HdUElvKmPnH+sZBRW0UMS3WGahBuolVWn9ceRsFNtfkAHvnrl5WdBL5 +qtjD4aOl8xT05F+S0huFSe8c0poH/82Z7L6azhADPKZ73UqTychTPu1msN6BaVF Az/PhSHrQmkj39W4MhdOpFLCPgG9H/IatvD4j9nQcDAIOTdChEJnJ3QWvuctD1To PYtvbHamOdnf5LkzmpJbPrJiio8unDoBVMc+DvRFnL32OemMnzVg5yoQ9qxKorcW vwZEdktdUVoLgrBT9krXBPCFfjTG/FAaxLM= -----END CERTIFICATE----- and finally the server key, which I modified slightly be removing a certificate request entry -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAxE1JzjWmgGfVxeouWrAPlqLeKMOX/F2dBVeuqNvUzZy7HU0s QVFFDskXj6B9u6Be09ddpGTdI5pkrdx7SVqSaGUybAxQhIp1Jtp2f2UTFAoF617T 9x6Jf6LYG0pGKO6YX/m9IYjfdly5jn5bCSll52unW19KmXd9bNFEfnp3Bf7cuW0r 4ldjYymzy8ZoNbWB+u/uusBUPthwCvbJOXQh+HW5CIlqXuP+Hl43bCktEzW0fKpV PsPEWc0I4e8hQykPgo+EffJltXku/Id8fcr7eu9UxDMg7fWKZN5gF2AH7vnqD5e/ r2Ph5OiyFRtflf2tx4KMlPPk75Vj8NSo+EkTBQIDAQABAoIBAFkajAniKHXYrBxu NCRODoVd4GG4huCyzXeDWXCkeG/sWLLwOMpdTW9ssBktvPXp0aFu/L6GWiqzBkg0 8HFXf2WLqduJq3K+NncwauFgy8wo0I8KOETPw7IABQA+MqKZyuilv8fdDTH43PFl QYVjGTJ2lzzOgFow9unSA7k1dZluTeMyE+RzpVYwE/WSgsOFa7qYQnCXy0hlx85u /SNU5383/v1cvrSghDCbZ2WrllHAerjUep1FNDounGkhiWj+JWUfddL7zYM+KVdJ AKRaxeYo+UTAVa9rd9D8qgZo5oIJ6l53bvobkwcrVnAoYPxtzAjhcBhgtQjXSXrJ YrHhKQECgYEAavUIAaT/XfHDXuXYMHnSf/ZgAqipOv36OPPnXnpg0yZbyLs/dgN6 GYVBtvd3ugfQ3ZEUfOwYw2wVq6hItq6+lQRjL+G5IsoeyKJXGIpBdlr7Yhhes1gv 4R5nGB97+F9kBVEmDephg0K++EeKRZMpzUgn1cBvBXrcfJsUc8OAFbUCgYEAy31q k8HXBltJz7QQxmXLZogFkb0dxxXUrax202e6XsqroUpmUWx1n75TVnnP4QNH0Tqx 8EQTDMZzQRHgFidwLAzhpI16Ex1fLfSw/lMQij7ojxtGp8LbC057dGpseBxwTPjP I5dpdIl2Mt8HeH5qMiizRls1EcSu1RK9cPhOWhECgjEAtU+pFSwCoQKDIgU1+EE4 nuJQEyOpO7qEH5RS5jaLJ/sdn/551TcwSdRgLuj5agea/VEq7ZyZgcC1GFZxLE6X dejGubzLpBMpDrzBnS7EaRTbQ2YJATtfy7n6juduqSe/03eErOrLtQcoFjjP98zX //Nd671gxXEyt/lTxrpeK5ECgYBFbIFq7awFkCmLgjxi46HUVj3ILgQ1wt3vbrKP h4kPBAgwG+jyiJVMratTCnYAp5Td7i988EyrhB0YKxgPlt7vOGnXMSlf0hqB3ERy UDaJY9MF1+FwJMuEfP8jhZeCFvm9WPmag/LHfoVj6rFqy35BpJ8dNsrRSA/5w837 98sLcQKBgBBfNJdPOGjgLZxLM5hXI88UkYFc3ppVh83SHSikKULO5d7wrWeQDR9V u3t+sx8bl067E2dILPzTa9qLt3RO+GPCwOQMQUywNBh7jQ1BjaOg/4ctlJkjAdKo x4hAG2dU5Z7iEob5AWpfv3+A5taS8P9RjI1O2jUwnTR84vqJtNx7 -----END RSA PRIVATE KEY----- Any ideas would be welcome Best Regards Nick -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

2 1

Re: Shared Addressbook using LDAP
by Tarak Ranjan 01 Oct '08

01 Oct '08

--- Tarak Ranjan <contacttrm(a)yahoo.co.in> wrote: > > > > Message: 3 > > Date: Wed, 01 Oct 2008 09:49:53 +0200 > > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > > Subject: Re: Shared Addressbook using LDAP > > To: openldap-technical(a)openldap.org > > Message-ID: <87y718hhzy.fsf(a)magenta.l4b.de> > > Content-Type: text/plain; charset=iso-8859-1 > > > > Tarak Ranjan <contacttrm(a)yahoo.co.in> writes: > > > > > Hi List, > > > I am configuring a shared addressbook for > > > squirrelmail. > > > but the problem is it's showing the only single > > email > > > address of the user, using that email id i'm > login > > > into the webmail. > > > > > > here is my slapd.conf. > > > > > > include /etc/openldap/schema/core.schema > > > include > /etc/openldap/schema/cosine.schema > > > include > > > /etc/openldap/schema/inetorgperson.schema > > > allow bind_v2 > > > pidfile /var/run/openldap/slapd.pid > > > argsfile /var/run/openldap/slapd.args > > > loglevel 256 > > > access to * > > > by self write > > > by anonymous auth > > > by users read > > > access to > > > > > > dn.children="ou=addressbook,dc=mail,dc=example,dc=com" > > > by self write > > > by anonymous read > > > by users read > > [...] > > > > I presume that the access rules for > > dn.children=ou=addressbook.. are > > not taken by cut and paste from your slapd.conf > > file, otherwise this > > rules are not honored, as the rules have to be > > written in a folded line. > > With regard to your question, change the rule > > dn.children=ou=addressbook... to > > dn.subtree=ou=addressbook.. > > If you want to protect the base entry > > ou=addressbook, define something > > like > > access to > > dn.base=ou=addressbook... > > attrs=entry,children by ... > > access to dn.children=ou=addressbook... by... > > > === message truncated === > > Hi List, > after changing the dn.children=ou=addressbook... to > dn.subtree=ou=addressbook.. , i'm getting the same > result. > > Only single address i'm getting, using the ID i'm > logging in . > > /\ > Tarak > > please submit an example of your searchstring. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E Hi List, [root@mail ~]# ldapsearch -x -b 'ou=addressbook,dc=mail,dc=example,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <ou=addressbook,dc=mail,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # addressbook, mail.example.com dn: ou=addressbook,dc=mail,dc=example,dc=com ou: addressbook objectClass: top objectClass: organizationalUnit # Tarak, addressbook, mail.example.com dn: cn=Tarak,ou=addressbook,dc=mail,dc=example,dc=com cn: Tarak givenName: Tarak Ranjan sn: Mukherjee mail: tarak.ranjan(a)example.com objectClass: top objectClass: inetOrgPerson # Amit, addressbook, mail.example.com dn: cn=Amit,ou=addressbook,dc=mail,dc=example,dc=com cn: Amit givenName: Amit sn: Sharda mail: amit(a)example.com objectClass: top objectClass: inetOrgPerson # Anand, addressbook, mail.example.com dn: cn=Anand,ou=addressbook,dc=mail,dc=example,dc=com cn: Anand givenName: Anand sn: Adkoli mail: anand(a)example.com objectClass: top objectClass: inetOrgPerson /\ Tarak Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

1 0

Re: Shared Addressbook using LDAP
by Tarak Ranjan 01 Oct '08

01 Oct '08

> Message: 3 > Date: Wed, 01 Oct 2008 09:49:53 +0200 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > Subject: Re: Shared Addressbook using LDAP > To: openldap-technical(a)openldap.org > Message-ID: <87y718hhzy.fsf(a)magenta.l4b.de> > Content-Type: text/plain; charset=iso-8859-1 > > Tarak Ranjan <contacttrm(a)yahoo.co.in> writes: > > > Hi List, > > I am configuring a shared addressbook for > > squirrelmail. > > but the problem is it's showing the only single > email > > address of the user, using that email id i'm login > > into the webmail. > > > > here is my slapd.conf. > > > > include /etc/openldap/schema/core.schema > > include /etc/openldap/schema/cosine.schema > > include > > /etc/openldap/schema/inetorgperson.schema > > allow bind_v2 > > pidfile /var/run/openldap/slapd.pid > > argsfile /var/run/openldap/slapd.args > > loglevel 256 > > access to * > > by self write > > by anonymous auth > > by users read > > access to > > > dn.children="ou=addressbook,dc=mail,dc=example,dc=com" > > by self write > > by anonymous read > > by users read > [...] > > I presume that the access rules for > dn.children=ou=addressbook.. are > not taken by cut and paste from your slapd.conf > file, otherwise this > rules are not honored, as the rules have to be > written in a folded line. > With regard to your question, change the rule > dn.children=ou=addressbook... to > dn.subtree=ou=addressbook.. > If you want to protect the base entry > ou=addressbook, define something > like > access to > dn.base=ou=addressbook... > attrs=entry,children by ... > access to dn.children=ou=addressbook... by... > === message truncated === Hi List, after changing the dn.children=ou=addressbook... to dn.subtree=ou=addressbook.. , i'm getting the same result. Only single address i'm getting, using the ID i'm logging in . /\ Tarak Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

Shared Addressbook using LDAP
by Tarak Ranjan 01 Oct '08

01 Oct '08

Hi List, I am configuring a shared addressbook for squirrelmail. but the problem is it's showing the only single email address of the user, using that email id i'm login into the webmail. here is my slapd.conf. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 access to * by self write by anonymous auth by users read access to dn.children="ou=addressbook,dc=mail,dc=example,dc=com" by self write by anonymous read by users read database bdb suffix "dc=mail,dc=example,dc=com" rootdn "cn=Manager,dc=mail,dc=example,dc=com" rootpw {SSHA}WtGEFDMu4JYHmuGNngBNib80Nwka9o20 directory /var/lib/ldap index objectClass eq,pres dbconfig set_cachesize 0 10485760 0 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 , /\ Tarak Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

2 1

OpenLDAP 2.4 replication to a write-only LDAP server
by Brouwer, Onno - Acision 30 Sep '08

30 Sep '08

Hi List, I am trying to set up replication from an OpenLDAP 2.4 master to a write-only LDAP slave. This slave is not really an LDAP slave, but has an LDAP interface to have changes replicated to it. In earlier OpenLDAP releases I could use slurpd for this, but since this has been deprecated I am trying to get it working using syncrepl. Based on what I found in the online manual I am trying to achieve this with an additional OpenLDAP 2.4 proxy which replicates changes it learns from the master through syncrepl to the slave through the LDAP backend. Is there some way I can get this to work? If the slave is a real LDAP server, then the proxy works, but it stores the contextCSN on the slave, and not on the proxy. If I have some form of storing this contextCSN elsewhere then I might try to start the proxy (in case it dies) with this contextCSN value specified on the command line. Also, when I try to ban searches on the slave (since it is a write-only slave), the proxy thinks none of the master entries exist on the slave and then happily tries to add them to the slave, resulting in duplicate errors. Any help would be greatly appreciated! Regards, Onno This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

bindpw and SSHA
by Nick Kasparidis 29 Sep '08

29 Sep '08

Hello everyone, I have a small problem setting up my ldap client. The issue comes from trying to force authenticated queries. So I have set the following lines in my slapd.conf disallow bind_anon require authc on the client side I have added the following lines to my ldap.conf binddn cn=manager,dc=domain,dc=com bindpw {SSHA}<the hash> Using this approach I cannot get a connection to the ldap server. I checked through wireshark, and I get a packet bindResponse(1) invalidCredentials () If on the other hand I when use the cleartext password, instead of SSHA then everything works fine. I am not sure if it is important but the 'bindRequest(1) simple' packet contains the text {SSHA}<hash> exactly as it appears in the ldap.conf file. Should it be processed on the client end? I have created the SSHA hash using slappasswd on the server machine, and then I copied and pasted the text across to my ldap.conf file. The hashes used by the server and client are identical. Have I done something wrong, should I encrypt the password using another way? Also if there is another way to initiate an authenticated query without using plaintext passwords, please let me know. By the way my server is openldap 2.4.10 on solaris 10 (sparc) and the client I experiment with openldap 2.2.13-12 on RHEL4.7 (i386) Thank you Nick

2 3

Error with OpenLDAP
by Arun NAIR 28 Sep '08

28 Sep '08

Hey Guys, My configuration I'm not sure doesn't seems to be working too well, it was working this morning now its not. If you could analyze it for me and tell me how I can achieve 100% success with this would be great. Thanks in advance for all the time extended Regards, Arun Nair The current error that I'm getting is * [root@centserver ~]# service ldap start Checking configuration files for slapd: WARNING: No dynamic config support for database sql. backend_startup_one: bi_db_open failed! (1) slap_startup failed (test would succeed using the -u switch) [FAILED] * *My slapd.conf file is as under: * # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema loglevel -1 # Define global ACLs to disable default read access. defaultaccess read access to * by * read access to * by self write # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap moduleload back_sql.la ####################################################################### # sql database definitions ####################################################################### database sql suffix dc=abc,dc=corp rootdn cn=Manager,dc=abc,dc=corp rootpw {CRYPT}2aFSZAS2uxw.. dbname ldap dbuser ldap dbpasswd password subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_query "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no TLSCertificateFile /etc/openldap/ldap.cert TLSCertificateKeyFile /etc/openldap/ldap.key *My odbc.ini configuration is as under: * *[ODBC Data Sources] *myodbc5 = MyODBC 5.1.5 Driver DSN *[myodbc5] *Driver = /usr/lib/libmyodbc5.so Description = LDAP Connector SERVER = localhost PORT = USER = ldap Password = password Database = ldap SOCKET = /var/lib/mysql/mysql.sock

1 0

index_param failed
by Denis BUCHER 27 Sep '08

27 Sep '08

Hello ! I have cyrus (IMAP mailserver) working perfectly based on openldap, BUT I have some strange messages in the logs that I would like to understand/correct : * bdb_equality_candidates: (accountStatus) index_param failed (18) * bdb_equality_candidates: (virtualdomain) index_param failed (18) * bdb_equality_candidates: (description) index_param failed (18) This is exactly ONE session where one of our users (description=dbucher(a)ourcompany.ch) is sending a mail to the outside world (dbucher(a)destdomain.ch). If someone would be nice enough to explain me exactly what it means, and how to solve this problem, it would be very nice... I already searched a lot to find help on this topic, without success, I found some possible solutions but I don't know exactly how to test them : 1. define the approriate indexes in slapd.conf, reindex and restart 2. Check the actual index files to make sure they're correct permissions, etc, and then try a db_recover. In slapd.conf I have : index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub I tryed to add : index accountStatus,description eq but : # slapindex bdb_db_open: database already in use backend_startup_one: bi_db_open failed! (-1) slap_startup failed Thanks a lot in advance for your help Denis Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND anonymous mech=implicit ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(|(&(objectClass=CourierMailAccount)(mail=dbucher@ourcompany.ch)(accountStatus=active))(&(cn=mailadmin)(description=dbucher@ourcompany.ch)))" Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SRCH attr=dn Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (accountStatus) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (description) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND anonymous mech=implicit ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND dn="cn=dbucher,ou=users,ou=ourcompany.ch,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND dn="cn=dbucher,ou=users,ou=ourcompany.ch,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=dbucher(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=dbucher(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 fd=20 ACCEPT from IP=127.0.0.1:41775 (IP=0.0.0.0:389) Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierDomainAlias)(virtualdomain=destdomain.ch))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SRCH attr=virtualdomain Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (virtualdomain) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:35 mailhost slapd[2099]: conn=24038 fd=20 closed (connection lost)

2 4

DB_KEYEXIST: Key/data pair already exists
by Stelios A. 26 Sep '08

26 Sep '08

Hello all, I have 2 users with identical Full Name and their ldif change on mail, uid, username and home directory in order to avoid ldap constraints. However, even though I have no other constraints apart from unique_attributes uid mail uidNumber homeDirectory I'm getting the following error and cannot add the 2nd user. root@masterldap:~# slapadd -l debug.ldif -f /etc/ldap/slapd.conf => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="cn=Full Name,ou=Users,dc=mydomain,dc=com" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) root@masterldap:~# Any ideas how I can see which attribute is causing the problem? -- Stelios A

3 4

RFT0001 : Request For Thoughts
by Christopher Barry 24 Sep '08

24 Sep '08

Hi everyone, If this post here is in poor taste, please pardon my interruption. It's just that I figured those here would have a high probability of trying to do as I am trying to do. Background: I'm a debian-head from the early 90's, but I'm new to OpenLDAP, and this is my first post here. I'm about halfway done with Mastering OpenLDAP, and I've been lurking here for a month or so, trying to understand how things work, and looking for questions like mine. I also just read Kerberos, the definitive guide as a primer into understanding how my team can make everyone 'Just Get Along(tm)' in a multi-platform global enterprise, while leveraging open source projects. Rough Goals: * We're exploring ways in which we can have a single user/group database for everything, everywhere in our domain. * Additionally, we want as 'SSO' an environment as possible. * We also want to keep, and even extend all the other NIS functionality we use today - only without the NIS limitations. * We also need to be able to phase it in, or even have it overlap with our current situation for a period, so it's not an all-or-nothing kind of change. The Parts Bin: There's a bunch of parts around, and they all kind of fit together, but to my current understanding anyway, seem to create a few different incomplete solutions, such as: * Samba/Winbind/Kerberos (possibly backed by OpenLDAP) * OpenLDAP/Kerberos with trusts to AD * AD using 2003R2 and possibly custom schema modifications if required. My question really is what are others doing to solve this type of problem? Architecturally, what is the best approach given the above desired outcome? Thanks to all for your thoughts and insight on this, Regards, Christopher Barry Systems Engineer QLogic

2 3

Re: Configuring MirrorMode via cn=config
by p_pavlos＠freemail.gr 24 Sep '08

24 Sep '08

> > ----- "Pavlos Parissis" <p_pavlos(a)freemail.gr> wrote: > > > Hello all, > > > > I am writing to ask for a confirmation on the steps that I followed > > to > > configure MirrorMode replication via cn=config > > > > The step is the typical, 2 nodes where m1 is the first node and m2 is > > the second one. > > > > 1) start m1 > > 2) create dit > > 3) add mirrormode_user > > OK. > > > 4) slaptest -f slapd.conf -F slapd.d > > chown -R ds-ldap.ds-ldap slapd.d > > Why do this? Why not start m1 from a basic slapd.d and then add all > above on the fly via cn=config? Because I don't have a basic slapd.d, the dir is empty. The replica configuration are added via cn=config when I have converted my basic slapd.conf to slapd.d on both servers. I don't think that I do something wrong here or stupid, what do you think? > > 5) stop m1 ;start m1 > > 6) enable sync log > > 7) start m2 > > 8) slaptest -f slapd.conf -F slapd.d > > chown -R ds-ldap.ds-ldap slapd.d > > 9) stop m2;start m2 > > 10) enable sync log > > 11) add replication configuration on m1 [1] > > 12) add replication configuration on m2 [2] > > See above. Cheers, Pavlos

1 0

accesslog misses out on entries during slapd failure
by Sean Burford 23 Sep '08

23 Sep '08

Hi, An add operation was underway on my HDB backend. Around one second later, a large group modification ran slapd out of memory. Slapd was then unresponsive until a watchdog killed and restarted it two minutes later. The add operation successfully modified the database but never appeared in the audit log nor the syncrepl access log, so it was never replicated to the replicas. Is it by design that modifications hit the database before being recorded in the audit and access logs? This is with OpenLDAP 2.3.39, BDB 4.4. Logs: Sep 22 09:15:16 host slapd[27404]: conn=102591 op=5 ADD dn="uid=username,ou=people,dc=example,dc=com" ... Sep 22 09:15:17 host slapd[27404]: conn=99395 op=131974 MOD dn="cn=biggroup,ou=groups,dc=example,dc=com" Sep 22 09:15:17 host slapd[27404]: conn=99395 op=131974 MOD attr=member memberuid Sep 22 09:15:17 host slapd[27404]: ch_malloc of 242464 bytes failed Sep 22 09:15:17 host slapd[27404]: conn=102732 op=2 UNBIND Sep 22 09:15:17 host slapd[27404]: conn=102732 fd=124 closed Sep 22 09:17:33 host slapd: allocation failed: 0 Sep 22 09:17:33 host slapd: allocation failed: 12 Config snippet: database hdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw ... directory /var/lib/ldap cachesize 25000 idlcachesize 75000 checkpoint 512 1 lastmod on ... indexes ... ... ACLs ... overlay auditlog auditlog /var/lib/ldif/auditlog/example.com.ldif overlay syncprov syncprov-sessionlog 1000 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 02+23:46 01+23:46 -- Thanks, Sean Burford

2 1

slapd stops accepting connections - OpenSolaris
by Josh Rivel 23 Sep '08

23 Sep '08

Hello. I am running OpenLDAP 2.4.11 on OpenSolaris snv_91 on a Sun X2200. After a few minutes, the box stops accepting connections on port 389, even though the slapd process is still running, and the machine still shows itself listening on port 389. I am attaching my slapd.conf, ldap.conf, and DB_CONFIG files. I had the same behaviour with the Blastwave package which was version 2.3.39, so I figured "OK Let me upgrade to 2.4.11" but same behaviour. I have roughly 800 OpenSolaris clients that need to connect to the box, and I currently see roughly 300 established connections to the server on port 389. Thanks, Josh

1 0

Pls help : how to make mail id as unique attribute
by Somnath Pal 22 Sep '08

22 Sep '08

Hi list, We have an openldap server 2.4 on redhat enterprise linux 4 update 7. We import users from Windows Active Directory(AD) running Windows Server 2003. We are mapping the mail attribute from the source (AD) to the destination (openldap) & want the mail id to be unique accross the ldap directory so that no two email ids will be same while replicating from different Source . How to achive that ? Do we have to modify our schema ? We are using the following schema in our slapd.conf - include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema Can you pls help ? Thanks & Regards, Somnath Pal Server Management Unit International Computing Centre (ICC) E-mail: pal(a)unicc.org

2 2

Configuring MirrorMode via cn=config
by Pavlos Parissis 21 Sep '08

21 Sep '08

Hello all, I am writing to ask for a confirmation on the steps that I followed to configure MirrorMode replication via cn=config The step is the typical, 2 nodes where m1 is the first node and m2 is the second one. 1) start m1 2) create dit 3) add mirrormode_user 4) slaptest -f slapd.conf -F slapd.d chown -R ds-ldap.ds-ldap slapd.d 5) stop m1 ;start m1 6) enable sync log 7) start m2 8) slaptest -f slapd.conf -F slapd.d chown -R ds-ldap.ds-ldap slapd.d 9) stop m2;start m2 10) enable sync log 11) add replication configuration on m1 [1] 12) add replication configuration on m2 [2] I did testing on the replication and it worked. But, I noticed that when I configured the syncpro overlay after the replicas both servers stopped responding. I will try to reproduce that issue and get some debug messages, may be I didn't something wrong or it is a bug. Cheers, Pavlos [1] Replication configuration for node m1 dn: cn=config changetype: modify add: olcServerID olcServerID: 1 dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcLimits olcLimits: {0}dn.base="cn=mirrormode_user,o=solution.acision.com" size.soft=un limited size.hard=unlimited time.soft=unlimited time.hard=unlimited - add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://m2 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://m1 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcMirrorMode olcMirrorMode: TRUE - add: olcDbIndex olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq ############################### [2] replication configuration for node m2 dn: cn=config changetype: modify add: olcServerID olcServerID: 2 dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcLimits olcLimits: {0}dn.base="cn=mirrormode_user,o=solution.acision.com" size.soft=un limited size.hard=unlimited time.soft=unlimited time.hard=unlimited - add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://m2 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://m1 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcMirrorMode olcMirrorMode: TRUE - add: olcDbIndex olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq

1 0

Auth issues with openldap proxy to AD
by Lynn York 20 Sep '08

20 Sep '08

Hello, I am having some issues with authentication with an openldap proxy to AD. When I query the user I am able to get back the userPassword attribute and everything looks to be correct. I can "su username" and it works properly, but when I attempt to "ssh user@localhost" it will not accept the password. The password is stored as {crypt}. I am trying to pin point whether this is a PAM issue or an ldap issue. Any help or suggestions would be greatly appreciated. Thanks, Lynn

2 1

Re: Differences between MirrorMode and 2-way mulit-master
by ghenry＠OpenLDAP.org 19 Sep '08

19 Sep '08

----- "Almir Karic" <redduck666(a)gmail.com> wrote: > On Fri, Sep 19, 2008 at 11:44 AM, Pavlos Parissis > <p_pavlos(a)freemail.gr> wrote: > > Well I must admit I can't read very so I will guess that > > the reason is to guarantee consistency in the database. > > > > How do you guarantee consistency in the database on N-way > Multi-Master > > replication where any member can accept write operations? > > AFAIK openldap can't do "true" write anywhere. the configuration is > one "true" master on which writes are happening, the remaining N-1 > masters just issue the referrals to the "true" master which can > optionally be server side followed with slapo-chain making writes on > the N-1 "non-true" masters transparent to the clients. You need to check what you know then ;-) Who told you above or did you make it up? http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master%2… Multi-Master means just that. Write to *any* master and replication is handled by Syncrepl not slapo-chain. It wouldn't be Multi-master is there was one "true" master, as that's not multi-master! slapo-chain can be used to "chain" writes back to a Master from a slave. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

Re: Differences between MirrorMode and 2-way mulit-master
by ghenry＠OpenLDAP.org 19 Sep '08

19 Sep '08

Please also cc the list. > http://www.openldap.org/doc/admin24/replication.html#MirrorMode%20replicati… > > If I understood it correctly, on N-way Multi-Master replication any > member can > accept write operations while on MirrorMode only must|should accept > write > operations. Correct. > I had a MirrorMode configured and I was able to send writes on > both servers and each server was replicating the changes without > problems. > The test which I did was very simple, first add/remove an entry on the > first > and then add/remove an entry on the second. > > So, the above test made to wonder about the differences between > MirrorMode and > 2-way mulit-master. > > what is the reason on a MirrorMode replication to force all write > operations to > one of the members of the replication? Did you read the above link? It doesn't look like you did. > BTW, what about the syncpro overlay settings which are not part of > the > MirrorMode configuration example? Again, please read the docs: http://www.openldap.org/doc/admin24/replication.html#MirrorMode It specifically says: "17.4.4.1. Mirror Node Configuration This is the same as the Set up the provider slapd section." where it links to the section that show the syncprov overlay config. Please read the docs. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

3 3

Regarding LDAP Replication(Repost)
by ashish mahamuni 19 Sep '08

19 Sep '08

Hello Everybody, I've one query regarding LDAP master/slave configuration. When we set replication,We put same root DN on master as well as on slave. Also If my organization have any unique OID that will also get replicated on slave. But as per my knowledge, ideally we should not use existing OID's and root DN(not sure about root DN) because it could cause inconsistency. How this replication works indeed? Regards, Ash Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

Fw: Re: Differences between MirrorMode and 2-way mulit-master
by Pavlos Parissis 18 Sep '08

18 Sep '08

By mistake I replied to Gavin Henry and not the list, I am sorry for this. On Thu, 18 Sep 2008 20:40:17 +0100 (BST) Gavin Henry <ghenry(a)OpenLDAP.org> wrote: > > ----- "Pavlos Parissis" <p_pavlos(a)freemail.gr> wrote: > > > Hi all, > > > > I am experimenting with different replication configurations and I may > > have a rather silly question. > > > > Are any differences between a MirrorMode and 2 node Multi-Master > > replication? > > >From configuration point of view they look like the same, but are > > they? > > > > Reading the Admin guide I see that on the MirrorMode configuration > > example there are no syncpro overlay settings, shouldn't be? > > This explains it: > > http://www.openldap.org/doc/admin24/replication.html#MirrorMode%20replicati… If I understood it correctly, on N-way Multi-Master replication any member can accept write operations while on MirrorMode only must|should accept write operations. I had a MirrorMode configured and I was able to send writes on both servers and each server was replicating the changes without problems. The test which I did was very simple, first add/remove an entry on the first and then add/remove an entry on the second. So, the above test made to wonder about the differences between MirrorMode and 2-way mulit-master. what is the reason on a MirrorMode replication to force all write operations to one of the members of the replication? BTW, what about the syncpro overlay settings which are not part of the MirrorMode configuration example? Thanks, Pavlos

1 0

Differences between MirrorMode and 2-way mulit-master
by p_pavlos＠freemail.gr 18 Sep '08

18 Sep '08

Hi all, I am experimenting with different replication configurations and I may have a rather silly question. Are any differences between a MirrorMode and 2 node Multi-Master replication? >From configuration point of view they look like the same, but are they? Reading the Admin guide I see that on the MirrorMode configuration example there are no syncpro overlay settings, shouldn't be? Cheers, Pavlos

1 0

Ldap and root access on workstations
by Nick Rathke 17 Sep '08

17 Sep '08

HI, I have what I hope is an easy question ( and I hope this is the right place to post this ). I have a situation where we are using openldap and a large number of users who also have local root level access to their own workstations. Is there a way in ldap to allow root access without letting them su to another user ? Is there some ACL that I can put into place that would prevent this ? -Nick

5 6

Re: custom bind attribute
by Stefano Zanmarchi 16 Sep '08

16 Sep '08

Hi, what I am trying to achieve is to have both a Shibboleth IdP and an Imap server (that's why different IPs) authenticate against openldap, with different credentials. My aim is to let Openldap handle this difference and let the Imap and IdP server unaware of this, they'd just need to do a simple bind. Thanks again, Stefano

2 1

Regarding LDAP Replication
by ashish mahamuni 15 Sep '08

15 Sep '08

Hello Everybody, I've one query regarding LDAP master/slave configuration. When we set replication,We put same base DN on master as well as on slave. Also If my organization have any unique OID that will also get replicated on slave. But as per my knowledge, ideally we should not use existing OID's and base DN's(not sure about base DN's) because it could cause inconsistency. How this replication works indeed? Regards, Ash Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

Re: pwd* Attributes and replication
by Eyal Marantenboim 15 Sep '08

15 Sep '08

Hi, here are the configs: Thanks! MASTER: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/openldap-2.4.11/etc/openldap/schema/core.schema include /opt/openldap-2.4.11/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.11/etc/openldap/schema/inetorgperson.schema include /opt/openldap-2.4.11/etc/openldap/schema/dnszone.schema include /opt/openldap-2.4.11/etc/openldap/schema/nis.schema include /opt/openldap-2.4.11/etc/openldap/schema/sudo.schema include /opt/openldap-2.4.11/etc/openldap/schema/DUAConfigProfile.schema include /opt/openldap-2.4.11/etc/openldap/schema/solaris.schema include /opt/openldap-2.4.11/etc/openldap/schema/ppolicy.schema include /opt/openldap-2.4.11/etc/openldap/schema/autofs.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/openldap-2.4.11/var/run/slapd.pid argsfile /opt/openldap-2.4.11/var/run/slapd.args allow bind_v2 password-hash {MD5} database monitor # TLS configuration TLSCipherSuite HIGH:MEDIUM:TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/ca-ldap.crt TLSCertificateFile /etc/openldap/ldap1.crt TLSCertificateKeyFile /etc/openldap/ldap1.key ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=empresa,dc=com" rootdn "cn=root,dc=empresa,dc=com" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/openldap-2.4.11/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Database access list access to attrs=userPassword by self write by anonymous auth access to attrs=shadowLastChange by self write by * read access to * by * read # Replication overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Password policies overlay ppolicy ppolicy_default "cn=Password,ou=Policies,dc=empresa,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout # Access Logging overlay accesslog logdb cn=log logops bind logsuccess TRUE # Access DB database bdb suffix "cn=log" directory /opt/openldap-2.4.11/var/openldap-accesslog rootdn "cn=log" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart, eq,pres # Syncrepl overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE SLAVE: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/openldap-2.4.11/etc/openldap/schema/core.schema include /opt/openldap-2.4.11/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.11/etc/openldap/schema/inetorgperson.schema include /opt/openldap-2.4.11/etc/openldap/schema/dnszone.schema include /opt/openldap-2.4.11/etc/openldap/schema/nis.schema include /opt/openldap-2.4.11/etc/openldap/schema/sudo.schema include /opt/openldap-2.4.11/etc/openldap/schema/DUAConfigProfile.schema include /opt/openldap-2.4.11/etc/openldap/schema/solaris.schema include /opt/openldap-2.4.11/etc/openldap/schema/ppolicy.schema include /opt/openldap-2.4.11/etc/openldap/schema/autofs.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/openldap-2.4.11/var/run/slapd.pid argsfile /opt/openldap-2.4.11/var/run/slapd.args allow bind_v2 password-hash {MD5} database monitor # TLS configuration TLSCACertificateFile /etc/openldap/cacerts/ca-ldap.crt TLSCertificateFile /etc/openldap/ldap2.crt TLSCertificateKeyFile /etc/openldap/ldap2.key ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=empresa,dc=com" rootdn "cn=root,dc=empresa,dc=com" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/openldap-2.4.11/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Database Access list access to * attrs=userPassword by self write by anonymous auth access to * attrs=shadowLastChange by self write by * read access to * by * read # Replication # Transparently proxy updates to master overlay chain chain-uri "ldap://ldap1.empresa.com" chain-idassert-bind bindmethod="simple" binddn="cn=root,dc=empresa,dc=com" credentials="password" mode="self" chain-tls start chain-return-error TRUE # Replication agent syncrepl rid=123 provider=ldaps://ldap1.empresa.com type=refreshOnly interval=00:00:01:00 searchbase="dc=empresa,dc=com" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=on retry="60 10 300 3" bindmethod=simple binddn="cn=root,dc=empresa,dc=com" credentials=password # Refer updates to master updateref ldap://ldap1.empresa.com/ # Password policies overlay ppolicy ppolicy_default "cn=Password,ou=Policies,dc=empresa,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout # Access Logging overlay accesslog logdb cn=log logops bind logsuccess TRUE # Access DB database bdb suffix "cn=log" directory /opt/openldap-2.4.11/var/openldap-accesslog rootdn "cn=log" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart, eq,pres syncrepl rid=124 provider=ldaps://ldap1.empresa.com bindmethod=simple binddn="cn=root,dc=empresa,dc=com" credentials=password type=refreshOnly interval=00:00:01:00 filter="(objectClass=*)" retry="5 +" searchbase="cn=log" logbase="cn=log" syncdata=accesslog # type=refreshAndPersist # schemachecking=on updateref ldap://ldap1.empresa.com/ ----- Original Message ---- From: Gavin Henry <ghenry(a)OpenLDAP.org> To: Eyal Marantenboim <eyalmdiveo(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Monday, September 15, 2008 12:46:15 PM Subject: Re: pwd* Attributes and replication Eyal Marantenboim wrote: > Hi, > > We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. > When a user tries to bind with incorrect credential, the master server > gets populated with pwdFailureTime attribute. > After 4 times of entering wrong credentials, pwdAccountLockedTime is > added to that user. > > Our problem is that the secondary server (using syncrepl) is not > replicating the pwd* values. > I've noticed that neither entryCSN nor contextCSN are being updated (on > the master) when pwdFailureTime is added to the user (I'm not sure if it > should actually change). > But, when we change any other attribute (userPassword, etc) on the > master, that does change entryCSN, and all pwd* attributes do get > updated in the seconday server. > > appreciate your help. > Thanks! > Config? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

custom bind attribute
by Stefano Zanmarchi 15 Sep '08

15 Sep '08

Hi all, I'd like to let users bind against an attribute other than "userPassword". Is it possible or is userPassword hardcoded? Moreover I'd like to serve bind requests from one IP against "userPassword" and bind requests from another IP against another (custom) attribute. Is this possible by any chance? Thank you very much for your help, Stefano

2 1

Migrating AD Users/Groups to samba-ldap server
by janskey 15 Sep '08

15 Sep '08

Hi All, I need advice on how i can pull down AD users/groups (password of each users) to samba-ldap server. I already configured my server using the howto: * http://www.howtoforge.com/openldap-samba-domain-controller-ubuntu7.10 * http://ubuntuforums.org/showthread.php?t=640760 I tried also ldifde to create ldif files and tried to populate in smbldap-tools. But it has an error, some sort of compatibility of ldif syntax. Our objective is to phase out or Win2003 AD server and user samba+ldap authentication scheme. cheers, janskey

2 1

Active directory change notification using open ldap library: errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece
by susant sahani 15 Sep '08

15 Sep '08

Hi , I am trying to syncing up with Active directory. When ever there is a change in active directory it should send the information. But It's keep on sending me this error message . errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece LDAP_SERVER_NOTIFICATION_OID_W "1.2.840.113556.1.4.528" char* base="dc=ad,dc=hello123,dc=com"; char* filter="(objectClass=*)"; controls[0] = create_psearch_control (LDAP_SERVER_NOTIFICATION_OID_W, 1, 1); controls[1] = 0; ret = ldap_search_ext (ld, base, LDAP_SCOPE_SUBTREE, filter, 0, /* attrs */ 0, /* attrsonly */ controls, 0, /* clientctrls */ 0, /* timeout */ LDAP_NO_LIMIT, &msgid); while ((ret = ldap_result (ld, msgid, LDAP_MSG_RECEIVED, &timeout, &entries)) >= 0) { LDAPMessage *entry; LDAPControl **ec_controls; if (!ret) { printf ("Timed out\n"); continue; } } Please let me know what I am doing wrong. -- Thanks, Susant

1 0

Syncrepl missing cn,sn and givenName
by Stelios A. 13 Sep '08

13 Sep '08

Hello all, I'm going mad with a problem during syncrepl. I have one master and one slave. When I add one entry to the master the record is replicated to the slave without a problem but without all fields and this is causing me problems as from a shell cannot resolve the user using for example the command 'id username'. That gives me an error, no such a user and cause further problems with existin email setup. Under master ldap everything works/resolves fine. If I manually add the whole tree of the master including the 'username' entry then it works fine. Master entry is like: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Kostas sn: Somelastname cn: Kostas Somelastname uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com and slave when replicated has: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com If you check the fields that missing from slave are: cn, sn and givenName My slave slapd.conf has: syncrepl rid=001 provider=ldap://192.168.1.110 type=refreshOnly interval=00:00:05:00 retry="30 10 600 20" searchbase="dc=mydomain,dc=com" attrs="*" scope=sub binddn="uid=syncrepl,ou=System,dc=mydomain,dc=com" credentials=smypassword updateref ldap://192.168.1.110 Any help is much appreciated. Thanks a lot

2 1

Chage for LDAP
by Gustavo Mendes de Carvalho 13 Sep '08

13 Sep '08

Hi All, Is there any tool for LDAP that works like chage, to inform when I changed my password, when will expire, and so on. I am using Openldap 2.3.39 with ppolicy. Thanks --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

Re: Help: Slow LDAP search with high %iowait
by Victor 12 Sep '08

12 Sep '08

Would you folks mind sharing some thoughts/ideas on this? Thanks a lot! --- On Mon, 9/8/08, Victor <victorfuman(a)yahoo.com> wrote: > From: Victor <victorfuman(a)yahoo.com> > Subject: Help: Slow LDAP search with high %iowait > To: openldap-technical(a)openldap.org > Date: Monday, September 8, 2008, 5:35 PM > Hi , > > I did quite a bit reading and research before I send email > to this list for help. If I have missed some basic concepts > here, please execuse my ignorance. Thanks for your help and > time in advance. > > 1. Summary > The initial search in my prototyping with OpenLDAP (slapd + > BDB) seemed to be slow. What is the reason and How could I > fix it? > > 2. Configuration > 2.1 Environment > Linux CentOS, 1 hard disk (therefore unfortunately the BDB > transaction logs and database files are written to the same > disk), 120GB disk space (80% unused), 1GB RAM, reserved for > this prototyping, OpenLDAP 2.3.39 with default BDB > installation > > 2.2 slapd.conf (modified trivially for discussion > purpose) > # global configuration > loglevel 0 > > # BDB > database bdb > suffix "dc=test,dc=dummy,dc=com" > rootdn > "cn=Manager,dc=test,dc=dummy,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for > details. > # Use of strong authentication encouraged. > rootpw secret > # The database directory MUST exist prior to running slapd > AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > directory /usr/local/var/openldap-data > #Other DB configuration > idlcachesize 60000 > cachesize 20000 > # Indices to maintain > # the indexes are to support search in first name, last > name and email for both exact match and wild cards in the > end > index objectClass eq > index gn pres,eq,sub > index sn pres,eq,sub > index mail pres,eq,sub > > 2.3 DB_CONFIG (for BDB) > set_cachesize 0 52428800 1 > set_lg_bsize 2097512 > set_flags DB_LOG_AUTOREMOVE > set_lg_regionmax 262144 > > 2.4 Data setup > 2 million records (users with gn, sn, email, mobile, street > address, etc. in the BDB; all records are indexed using the > index in the above slapd.conf; grouped by the first > character of lastName. For example, > dn: ou=Z,dc=test,dc=dummy,dc=com > objectclass: organizationalUnit > ou: Z > > Sample LDIF entry: > #Directory Entry > dn: > uid=ABCDEFGHIJKLMNOPQRSTUVWXYZ123459,ou=F,dc=test,dc=dummy,dc=com > objectclass: top > objectclass: person > objectclass: organizationalPerson > objectclass: inetOrgPerson > uid: ABCDEFGHIJKLMNOPQRSTUVWXYZ123459 > ...... (details omitted) > > 3. Symptom/Problem > > It was very slow in the first (fresh) search if I searched > by wildcard firstname only like "Larry*" (which > returned 478 entries/users). The response time was generally > higher than 5 seconds Depending the count of records found, > the response time might exceed 20 or even 50 seconds. During > the search, the "iostat" result showed +95% > %iowait, await was much higher that svctm, the device %util > was over 96%. Here is the "iostat" output: > > Time: 10:51:34 AM > avg-cpu: %user %nice %sys %iowait %idle > 3.10 0.00 1.40 95.50 0.00 > > Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s > rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util > hda 0.00 2.90 64.94 65.33 1322.68 580.22 > 661.34 290.11 14.61 51.99 343.51 7.44 96.92 > dm-0 0.00 0.00 64.94 72.53 1322.68 580.22 > 661.34 290.11 13.84 55.44 330.62 7.06 96.99 > dm-1 0.00 0.00 0.00 0.00 0.00 0.00 > 0.00 0.00 0.00 0.00 0.00 0.00 0.00 > > > However, The subsequent search (using the exact search > criteria) is much faster (within 200ms). I believe it is > because of the cache. > > I did a "db_stat -m" check and saw +90% cache hit > rate (I guess it is normal?). The detailed output is in the > attachment. > > 4. Questions > The "iostat" output showed obvious I/O > bottleneck. Assuming I can't upgrade my hardware (for > example, adding another disk specifically for writing > transaction logs to), assuming I won't set a limit to > the max number of entried returned, is there anything else I > can do (typically BDB/slapd tuning or configuration) to make > the fresh/first search much faster (say within 2 seconds for > the worst case)? Did I do anything wrong? Please advise. > > Thanks a lot! > > Vic

3 5

CREATE LDAP REPLICA
by LITLE TUX 12 Sep '08

12 Sep '08

Hi i install openldap in servers and create replica but is not runin perfectly My entry in ldap server: MASTER SERVER: replogfile /var/log/replica/replica.log replica host=hostname_slave.domain.com:389 binddn="cn=Administrator,dc=domain,dc=com" bindmethod=simple credentials=123456 tls=none ################################################## ###################### SLAVE SERVER: updatedn "cn=Administrator,dc=domain,dc=com" updateref ldap://hostname_master.domain.com In my /etc/hosts configure any hostnames... The file replica.log is empty and not create replica. I execute normaly /etc/init.d/slurpd start only master server. Is necessary running slurod daemon is slave server? Exist other configuration to slapd.conf? My slapd.conf is same in master and slave except lines reference the replica. Thanks for your helps..... Best

1 0

pwd* Attributes and replication
by Eyal Marantenboim 12 Sep '08

12 Sep '08

Hi, We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. When a user tries to bind with incorrect credential, the master server gets populated with pwdFailureTime attribute. After 4 times of entering wrong credentials, pwdAccountLockedTime is added to that user. Our problem is that the secondary server (using syncrepl) is not replicating the pwd* values. I've noticed that neither entryCSN nor contextCSN are being updated (on the master) when pwdFailureTime is added to the user (I'm not sure if it should actually change). But, when we change any other attribute (userPassword, etc) on the master, that does change entryCSN, and all pwd* attributes do get updated in the seconday server. appreciate your help. Thanks!

1 0

Re: Reentrant library question.
by William Jojo 12 Sep '08

12 Sep '08

---- Original message ---- >Date: Thu, 11 Sep 2008 14:55:14 +0100 >From: Duncan Gibb <Duncan.Gibb(a)SiriusIT.co.uk> >Subject: Re: Reentrant library question. >To: William Jojo <w.jojo(a)hvcc.edu> >Cc: openldap-technical(a)openldap.org > >William Jojo wrote: > >WJ> I manage a set of packages [..] for AIX 5.3 and 6.1. > >WJ> Is it safe to [..] > >WJ> libldap.so -> libldap_r.so > >Disclaimer: I do not speak AIX. > That's ok, I do. :-) :-) >The Debian Linux OpenLDAP packages have been doing this since 2.4.7. >We've deployed these and not come across any serious problems (said he, >about to roll out a 2.4.11 backport...). > Sounds wonderful! Thanks a bunch! Cheers, Bill > >Cheers > > >Duncan > >-- >Duncan Gibb, Technical Architect >Sirius Corporation - The Open Source Experts >http://www.siriusit.co.uk/ >Tel: +44 870 608 0063 || +44 7977 441 515

1 0

Reentrant library question.
by William Jojo 11 Sep '08

11 Sep '08

I manage a set of packages under the name pWare for AIX 5.3 and 6.1. I am upgrading the core OpenLDAP from 2.3.38 to 2.4.11 and wanted to do something IBM does with libc. They link libc.a -> libc_r.a Is it safe to do the same in OpenLDAP such that: libldap.so -> libldap_r.so ? Then I rebuild any packages that depended on 2.3 for 2.4. Cheers, Bill

3 3

LDAP log analysis
by Praveen Kumar 11 Sep '08

11 Sep '08

Hi, I am using LDAP server for authentication, where i am successful in making an user to log in into a machine after authentication from ldap server. Now i want to see at the server side at what time the user asked for authentication and was successfully authenticated. In other words how can the log about any authentication request and successful reply to that can be seen for each request made to the server. Regards

2 1

[Solved] AW: Re: AW: Re: AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable))
by Hauke Coltzau 10 Sep '08

10 Sep '08

Hi all, Wow, it seems to be done ;-) To put it in a nutshell: - apt-get purge MIT-Kerberos* - apt-get install Heimdal* - tried and failed, tried and failed, ... - apt-get purge heimdal*, cyrus*, openldap* - apt-get libssl-dev and libdb dev packages - got cyrus, openldap and heimdal tarballs - configured, compiled, tested, failed, configured, compiled, tested, failed, conf.......... ...... ...... ... --- ... ... --- ... configured, compiled, succeeded! - Followed well known configuration instructions Voila! ldapsearch -Y GSSAPI works ldaps works (without client verification, did not solve that yet, server verification works fine) login with kerberos authentication works (with proxy ticket for the machine, this way I avoid having PLAIN username/password send to slapd) su, id, etc. works Seems, as if doing it by hand is still the best way ;-) Thanks again for your help, Hauke ----- Ursprüngliche Mail ----- Von: "Quanah Gibson-Mount" <quanah(a)zimbra.com> An: "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> CC: openldap-software(a)openldap.org Gesendet: Montag, 8. September 2008 21:44:16 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: AW: Re: AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable)) --On Monday, September 08, 2008 9:26 PM +0200 Hauke Coltzau <hauke.coltzau(a)FernUni-Hagen.de> wrote: > ii libsasl2-modules-gssapi-mit 2.1.22.dfsg1-18ubuntu2 \\ > Cyrus SASL - pluggable authentication module I would highly recommend using Heimdal on the master side. But that's up to you. ;) > - In the first approach, the user already has a TGT and asks the KDC for > a "ldap/fqdn@REALM-ticket"? This is done by ldapsearch, not by slapd? > Hence, slapd "only" needs access to its keytab to be able to decrypt the > clients messages? I believe that is correct, yes. At Stanford, I had to point slapd at the keytab in a shell script, but I believe that was because I was using SASL/GSSAPI to do replication as well. It's been a while. ;) > - And in the second one, the user provides username and password (plain), > slapd converts the username into a principle (user@REALM) and forwards > this to saslauthd? So this should be secured via TLS? You can try securing it via startTLS, but nothing blocks a user from still doing it in the clear, unfortunately (i.e., you can reject the non-secured bind, but they'll have already sent their credentials, so anyone sniffing would be able to get them). > There used to be a well-known howto for all this at > http://www.bayour.com/LDAPv3-HOWTO.html but the site is offline for some > days now. This howto is completely wrong, and the various folks have asked the author to take it down for years. I'm glad to hear it is not accessible. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration --

2 1

syncrepl - Base DN is not within the database naming context.
by Brad T Waldorf 10 Sep '08

10 Sep '08

Sorry in advance if i'm missed something obvious (which is what the text of this error makes me think), but i've spent 2 days on this and could use another set of eyes. I hit the error in the subject when trying to set up basic refreshAndPersist replication with 2 separate BDB databases defined and populated. The error happens on only 1 of the databases (replication works fine on the other.) (slapd.conf for Master....) include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=exampleb1,dc=com" rootdn "cn=kingb1,dc=exampleb1,dc=com" rootpw password directory /usr/local/var/openldap-data/bdb1 index objectClass,sn,mail,street,pager eq database bdb suffix "o=baseballs" rootdn "cn=admin,o=baseballs" rootpw password directory /usr/local/var/openldap-data/bdb2 index objectClass,sn,mail,street,pager eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 database monitor (slapd.conf for Slave...) include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=exampleb1,dc=com" rootdn "cn=kingb1,dc=exampleb1,dc=com" rootpw password directory /usr/local/var/openldap-data/bdb1 index objectClass,sn,mail,street,pager eq database bdb suffix "o=baseballs" rootdn "cn=admin,o=baseballs" rootpw password directory /usr/local/var/openldap-data/bdb2 index objectClass,sn,mail,street,pager eq syncrepl rid=492 provider=ldap://9.00.00.000:389 type=refreshAndPersist retry="120 +" searchbase="dc=exampleb1,dc=com" bindmethod=simple binddn="cn=kingb1,dc=exampleb1,dc=com" credentials=password database monitor I get the Master up and populated before starting the Slave. When i start the Slave, i get the error. Here's the output with -d 256... (line 38 is the end of the syncrepl chunk... the "credentials=password" line) OpenLDAP 2.4.6 Standalone LDAP Server (slapd)/test/slapd_multibackendsS.conf: li ne 38: Base DN "dc=exampleb1,dc=com" is not within the database naming context.+ CSMP0097I 22.50.28 CPU-C SS-BSS SSU-HPN IS-01 failed to add syncinfo+ CSMP0097I 22.50.28 CPU-C SS-BSS SSU-HPN IS-01 slapd stopped.+ CSMP0097I 22.50.28 CPU-C SS-BSS SSU-HPN IS-01 connections_destroy: nothing to destroy.+ If i modify the syncrepl statement in the slave to replicate the other database, replication of "o=baseballs" works... syncrepl rid=493 provider=ldap://9.00.00.000:389 type=refreshAndPersist retry="120 +" searchbase="o=baseballs" bindmethod=simple binddn="cn=admin,o=baseballs" credentials=password The data in "dc=exampleb1,dc=com" is straight from the output of the MakeLDIF utility. I've added/searched/modified it a bunch before trying this particular replication scenario. So... how stupid am i?? Do you see anything i'm missing? Thanks for your help...

3 4

Openldap force replication
by Govind c 10 Sep '08

10 Sep '08

Hi, Is there a way to force the replication between Master and the slave?. The number of objects and entries are the same in both master and slave,however the some fields don`t have the same content (eg : last login time)Wondering if there is way to keep both in sync in terms of content and objects/entries. Cheers CG

3 6

Check errors from Jexplore!
by Nguyen Quang Huy 10 Sep '08

10 Sep '08

Hi all! Im Setup Openldapv2.x, Im setup following guide: http://www.linuxmail.info/openldap-setup-howto/ Im connect from Jexplore to Openldap --> OK, I can open no-ip..vv, but I open org --> error appear: Im dont know check location.. Help me! ************************************************* Nguyen Quang Huy Add: Tang 4 - Trung Tâm Tin Hoc So 8 Le Thai To - Hoan Kiem - Ha Noi Mob: 0914-257-830 Tel: 04-9288858 ext 425 Fax: + 84 4 928 9213 Email: <mailto:quanghuy@vpb.com.vn> quanghuy(a)vpb.com.vn LinQ: <mailto:kquanghuy@web.vpb.com.vn> quanghuy(a)web.vpb.com.vn

2 1

Problem With postfix
by LITLE TUX 09 Sep '08

09 Sep '08

Hi peoples .... i'm tryng configure openldap with postfix but qhen try add the below entry i receive next error: gheorghe:~/difs # ldapadd -f base.ldif -x -D cn=Administrator,dc=domain,dc=com-w 123456 adding new entry "relativeDomainName=@, ou=dns,dc=domain,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax My ldif file: dn: relativeDomainName=@, ou=dns,dc=domain,dc=com objectClass: dNSZone relativeDomainName: @ zoneName: domain.com dNSTTL: 3600 dNSClass: IN sOARecord: ns3.domain.com. administrator.domain.com. 2001030201 3600 1800 604800 86400 nSRecord: ns3.domain.com. mXRecord: 30 mail.domain.com. My include schemas: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba3.schema include /etc/openldap/schema/dnszone.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/qmail.schema include /etc/openldap/schema/postfix.schema Any help is welcome...!!!! Best Regards!

3 2

Help: Slow LDAP search with high %iowait
by Victor 08 Sep '08

08 Sep '08

Hi , I did quite a bit reading and research before I send email to this list for help. If I have missed some basic concepts here, please execuse my ignorance. Thanks for your help and time in advance. 1. Summary The initial search in my prototyping with OpenLDAP (slapd + BDB) seemed to be slow. What is the reason and How could I fix it? 2. Configuration 2.1 Environment Linux CentOS, 1 hard disk (therefore unfortunately the BDB transaction logs and database files are written to the same disk), 120GB disk space (80% unused), 1GB RAM, reserved for this prototyping, OpenLDAP 2.3.39 with default BDB installation 2.2 slapd.conf (modified trivially for discussion purpose) # global configuration loglevel 0 # BDB database bdb suffix "dc=test,dc=dummy,dc=com" rootdn "cn=Manager,dc=test,dc=dummy,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data #Other DB configuration idlcachesize 60000 cachesize 20000 # Indices to maintain # the indexes are to support search in first name, last name and email for both exact match and wild cards in the end index objectClass eq index gn pres,eq,sub index sn pres,eq,sub index mail pres,eq,sub 2.3 DB_CONFIG (for BDB) set_cachesize 0 52428800 1 set_lg_bsize 2097512 set_flags DB_LOG_AUTOREMOVE set_lg_regionmax 262144 2.4 Data setup 2 million records (users with gn, sn, email, mobile, street address, etc. in the BDB; all records are indexed using the index in the above slapd.conf; grouped by the first character of lastName. For example, dn: ou=Z,dc=test,dc=dummy,dc=com objectclass: organizationalUnit ou: Z Sample LDIF entry: #Directory Entry dn: uid=ABCDEFGHIJKLMNOPQRSTUVWXYZ123459,ou=F,dc=test,dc=dummy,dc=com objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson uid: ABCDEFGHIJKLMNOPQRSTUVWXYZ123459 ...... (details omitted) 3. Symptom/Problem It was very slow in the first (fresh) search if I searched by wildcard firstname only like "Larry*" (which returned 478 entries/users). The response time was generally higher than 5 seconds Depending the count of records found, the response time might exceed 20 or even 50 seconds. During the search, the "iostat" result showed +95% %iowait, await was much higher that svctm, the device %util was over 96%. Here is the "iostat" output: Time: 10:51:34 AM avg-cpu: %user %nice %sys %iowait %idle 3.10 0.00 1.40 95.50 0.00 Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util hda 0.00 2.90 64.94 65.33 1322.68 580.22 661.34 290.11 14.61 51.99 343.51 7.44 96.92 dm-0 0.00 0.00 64.94 72.53 1322.68 580.22 661.34 290.11 13.84 55.44 330.62 7.06 96.99 dm-1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 However, The subsequent search (using the exact search criteria) is much faster (within 200ms). I believe it is because of the cache. I did a "db_stat -m" check and saw +90% cache hit rate (I guess it is normal?). The detailed output is in the attachment. 4. Questions The "iostat" output showed obvious I/O bottleneck. Assuming I can't upgrade my hardware (for example, adding another disk specifically for writing transaction logs to), assuming I won't set a limit to the max number of entried returned, is there anything else I can do (typically BDB/slapd tuning or configuration) to make the fresh/first search much faster (say within 2 seconds for the worst case)? Did I do anything wrong? Please advise. Thanks a lot! Vic

1 0

AW: Re: AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable))
by Hauke Coltzau 08 Sep '08

08 Sep '08

Hi Quanah, thanks again for your answer. > Did you make sure the GSSAPI module was installed with Cyrus-SASL? IIRC, > it's a separate package under Ubuntu. > > p libgssapi2-heimdal > - Heimdal Kerberos - GSSAPI support library > p libsasl2-modules-gssapi-heimdal > - Pluggable Authentication Modules for SASL (GSSAPI) > p libsasl2-modules-gssapi-mit > - Cyrus SASL - pluggable authentication modules (GSSAPI) ii libsasl2-modules-gssapi-mit 2.1.22.dfsg1-18ubuntu2 \\ Cyrus SASL - pluggable authentication module > > (b) saslauthd and SASL/GSSAPI are unrelated. I.e., you don't need to be > > running saslauthd for SASL/GSSAPI to work. > > Now I'm confused. I always understood the way to use > > Kerberos authentication for accessing the ldap directory > > to be: > > > > LDAP->SASL->Kerberos > > > > and that I have to fill the SASL part with something real, > > like saslauthd. What did I miss here? > > SASL/GSSAPI uses the existing Kerberos ticket to auth a user to LDAP > > When using saslauthd, you do a simple bind to the LDAP server, which then > connects to the KDC, gets a ticket, and auths the user. > > Two very different things. I.e., the first, the user already has authed to > the KDC. In the second, they haven't. I see the difference, but still have some questions: - In the first approach, the user already has a TGT and asks the KDC for a "ldap/fqdn@REALM-ticket"? This is done by ldapsearch, not by slapd? Hence, slapd "only" needs access to its keytab to be able to decrypt the clients messages? - And in the second one, the user provides username and password (plain), slapd converts the username into a principle (user@REALM) and forwards this to saslauthd? So this should be secured via TLS? I'm just looking for a setup that restricts access to LDAP to authenticated users (except, of course, information neccessary for authentication purposes). I need to use Kerberos for authentication, because I want to use NFSv4. There used to be a well-known howto for all this at http://www.bayour.com/LDAPv3-HOWTO.html but the site is offline for some days now. Thanks again for your help, Hauke --

1 0

AW: Re: SASL bind with Kerberos: (was: Simple binds with SASL/GSSAPI (Resource temporarily unavailable))
by Hauke Coltzau 08 Sep '08

08 Sep '08

Hi Quanah, thank you for your immediate reply. (a) Which Kerberos implementation are you using? MIT Kerberos 5 as shipped with Hardy (1.6.dfsg.3~beta1-2ubuntu1) (b) saslauthd and SASL/GSSAPI are unrelated. I.e., you don't need to be running saslauthd for SASL/GSSAPI to work. Now I'm confused. I always understood the way to use Kerberos authentication for accessing the ldap directory to be: LDAP->SASL->Kerberos and that I have to fill the SASL part with something real, like saslauthd. What did I miss here? Thanks again, Hauke p.s.: ZCS fan here ;-) --

2 1

Simple binds with SASL/GSSAPI (Resource temporarily unavailable)
by Hauke Coltzau 08 Sep '08

08 Sep '08

Hi all, I have a problem to make simple binds with authentication done by kerberos5. I use OpenLDAP to store all user account information and have everything set up so far that users can login: $ su - testuser Password: $ klist Ticket cache: FILE:/tmp/krb5cc_2000_yukVIJ Default principal: testuser@REALM Valid starting Expires Service principal 09/08/08 16:54:16 09/09/08 02:54:16 krbtgt/REALM@REALM renew until 09/09/08 16:54:16 Kerberos 4 ticket cache: /tmp/tkt2000 klist: You have no tickets cached $ id uid=2000(testuser) gid=2000(dusers) groups=2000(dusers) uid, gid,etc. have been successfully taken from the LDAP directory. But then, ldapsearch fails: $ ldapsearch SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) $ Details: ======== Currently, the KDC and the LDAP-Server reside on the same host, running Ubuntu 8.04 x64_64. I made sure that principals exist for <fqdn>@REALM ldap/<fqdn>@REALM host/<fqdn>@REALM and exported them to /etc/krb5.keytab as well as /etc/ldap/ldap.keytab, which is now owned by the openldap user. # ktutil ktutil: rkt /etc/krb5.keytab ktutil: l slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 ldap/<fqdn>@REALM 2 6 ldap/<fqdn>@REALM 3 4 host/<fqdn>@REALM 4 4 host/<fqdn>@REALM 5 4 <fqdn>@REALM 6 4 <fqdn>@REALM ktutil: ktutil: clear ktutil: rkt /etc/ldap/ldap.keytab ktutil: l slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 ldap/<fqdn>@REALM 2 6 ldap/<fqdn>@REALM 3 4 host/<fqdn>@REALM 4 4 host/<fqdn>@REALM 5 4 <fqdn>@REALM 6 4 <fqdn>@REALM # ll /etc/ldap/ldap.keytab -rw------- 1 openldap openldap 512 2008-09-08 15:23 /etc/ldap/ldap.keytab (Even tried 666, but that didn't change anything. If I move this file, slapd complains, so I'm pretty sure it's actually been used) Next, I set START=yes and MECHANISMS="kerberos5" in /etc/default/saslauthd, started saslauthd and tested: # testsaslauthd -u testuser -p <secret> 0: OK "Success." As recommended, I used sasl-sample-server and /-client to test the configuration SASSL/GSSAPI <-> Kerberos: # sasl-sample-client -s ldap -m GSSAPI -n <fqdn> (partial output) service=ldap Waiting for mechanism list from server... Forcing use of mechanism GSSAPI Choosing best mechanism from: GSSAPI Using mechanism GSSAPI Preparing initial. Sending initial response... C: .... ... Username: testuser@REALM SSF: 56 Waiting for encoded message... recieved decoded message 'srv message 1' sending encrypted message 'client message 1' On the sample-server side, it's the same, 'client message 1' was successfully decoded. Next thing I did was to add following lines to /etc/ldap/slapd.conf sasl-secprops noplain,noactive,noanonymous sasl-regexp uid=(.*),cn=<domain>,cn=gssapi,cn=auth ldap:///dc=...??sub?uid=$1 sasl-regexp uid=(.*),cn=<domain>,cn=gssapi,cn=auth uid=$1,dc=... and created /usr/lib/sasl2/slapd.conf mech_list: gssapi digest-md5 cram-md5 external pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux keytab: /etc/ldap/ldap.keytab Then I chgrouped /var/run/saslauthd to openldap and gave g=rwx permissions to the directory: # ls -al /var/run/saslauthd/ total 0 drwxrwxr-x 2 root openldap 100 2008-09-08 16:36 . drwxr-xr-x 15 root root 580 2008-09-08 12:13 .. srwxrwxrwx 1 root root 0 2008-09-08 16:36 mux -rw------- 1 root root 0 2008-09-08 16:36 mux.accept -rw------- 1 root root 0 2008-09-08 16:36 saslauthd.pid.lock But now, when trying ldapsearch on the same machine, it fails: $ klist Ticket cache: FILE:/tmp/krb5cc_2000_tA7220 Default principal: testuser@REALM Valid starting Expires Service principal 09/08/08 16:33:05 09/09/08 02:33:05 krbtgt/REALM@REALM renew until 09/09/08 16:33:05 09/08/08 16:33:46 09/09/08 02:33:05 ldap/<fqdn>@REALM renew until 09/09/08 16:33:05 Kerberos 4 ticket cache: /tmp/tkt2000 klist: You have no tickets cached $ ldapsearch SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) $ And on the server side: # echo $KRB5_KTNAME /etc/ldap/ldap.keytab # slapd -d127 -h "ldap:///" -u openldap -g openldap ... >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=GSSAPI datalen=583 SASL [conn=0] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Resource temporarily unavailable) send_ldap_result: conn=0 op=1 p=3 send_ldap_result: err=80 matched="" text="SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Resource temporarily unavailable)" send_ldap_response: msgid=2 tag=97 err=80 ber_flush2: 158 bytes to sd 13 ... and saslauthd is not contacted at all: # saslauthd -d -a kerberos5 saslauthd[7243] :main : num_procs : 5 saslauthd[7243] :main : mech_option: NULL saslauthd[7243] :main : run_path : /var/run/saslauthd saslauthd[7243] :main : auth_mech : kerberos5 saslauthd[7243] :ipc_init : using accept lock file: /var/run/saslauthd/mux.accept saslauthd[7243] :detach_tty : master pid is: 0 saslauthd[7243] :ipc_init : listening on socket: /var/run/saslauthd/mux saslauthd[7243] :main : using process model saslauthd[7244] :get_accept_lock : acquired accept lock saslauthd[7243] :have_baby : forked child: 7244 saslauthd[7243] :have_baby : forked child: 7245 saslauthd[7243] :have_baby : forked child: 7246 saslauthd[7243] :have_baby : forked child: 7247 <no more output> What did I do wrong this time ;-) ? Best regards, Hauke --

2 2

ldapadd of LDIF files with attribute 'apple-generateduid' not allowed [Resolved]
by Alexander Hartner 07 Sep '08

07 Sep '08

At it turns out the problem was with the objectClasses. I should have used : objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: extensibleObject Instead of objectClass: top objectClass: person objectClass: inetOrgPerson Adding the extra attributes to the objectClass resolved this problem. Thanks for all your help. Regards Alex On 21 Feb 2008, at 11:56, Alexander Hartner wrote: > I am trying to import a simple LDIF file into OpenDirectory on OS X > 10.5.2 Leopard Server. > > However when I issue the following ldapadd command I get an error : > > ldapadd -D [rootdn] -x -w [secretPassword] -f Import.ldif > > Error : 65 Object class violation" > attribute 'apple-generateduid' not allowed > > > I would have thought that I had specified apple-generateduid, but I > didn't. > > This is my import file > -----------BEGIN----------- > # Alexander Hartner > dn: cn=Alexander Hartner2,cn=people,dc=macbook-znet,dc=local > objectClass: top > objectClass: person > objectClass: inetOrgPerson > displayName: Alexander Hartner2 > cn: Alexander Hartner2 > givenName: Alexander > sn: Hartner > mail: alex(a)j2anywhere.com > initials: A > o: j2anywhere.com > -----------END----------- > > I know this might not be the best forum for OS X support, but I am a > bit stuck on this. > Thanks in advance. > Alex > > >

2 2

anish_patil wants to keep up with you on Twitter
by anish_patil 07 Sep '08

07 Sep '08

To find out more about Twitter, visit the link below: http://twitter.com/i/6de68cfefa92375374ca938a55b8e865fa2162ab Thanks, -The Twitter Team About Twitter Twitter is a unique approach to communication and networking based on the simple concept of status. What are you doing? What are your friends doing—right now? With Twitter, you may answer this question over SMS, IM, or the Web and the responses are shared between contacts. This message was sent by a Twitter user who entered your email address. If you'd prefer not to receive emails when other people invite you to Twitter, click here: http://twitter.com/i/optout/dd31dad00025fa765c3307138c272038991bea18

1 0

Re: RHEL 5 will not do TLS/SSL authentication
by Dat Duong 05 Sep '08

05 Sep '08

Does anyone have the answer to my problem? thanks ----- Original Message ---- From: Dat Duong <datduong2000(a)yahoo.com> To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Cc: openldap-technical(a)openldap.org Sent: Wednesday, September 3, 2008 7:45:45 AM Subject: Re: RHEL 5 will not do TLS/SSL authentication The slapd.conf is on Solaris 10 machine. This is how I compiled from the source for Openssl and Openldap. #cd openssl.0.98h # ./config shared # make clean # make # make install # cd openldap-2.4.11 # env LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/local/ssl/lib" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.4.2/lib -L/usr/local/ssl/lib -R/usr/local/lib -R/usr/local/BerkeleyDB.4.2/lib -R/usr/local/ssl/lib" CPPFLAGS="-I/usr/local/include -I/usr/local/BerkeleyDB.4.2/include -I/usr/local/ssl/include" ./configure --enable-bdb --enable-crypt --with-tls --without-cyrus-sasl # make depend # make clean ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, September 3, 2008 5:17:14 AM Subject: Re: RHEL 5 will not do TLS/SSL authentication On Wednesday 03 September 2008 09:49:54 Dat Duong wrote: > I'm thinking, if the gnutls which installed by default, was causing the > problem?? It doesn't matter if gnutls is installed, what matters is what OpenLDAP was compiled against. Now, you stated that you are using RHEL 5, and gave no other details of what software you installed, so it would be logical to assume you are using only the RHEL 5 packages. On RHEL 5, OpenLDAP 2.3.27 is compiled against openssl 0.9.8b. But, since you have some weird paths reflected in your slapd.conf etc., maybe you have built your own software. If you have, you need to supply the details thereof, or we are all wasting our time. Regards, Buchan

1 0

Re: Help needed to set up N-way multimaster replication
by piyush joshi 04 Sep '08

04 Sep '08

I have added serverid 1 to first server and serverid 2 to secondserver and rid=001 with syncrepl on both the server also added mirrormode true on both node but now when i make changes to one server that is not reflected to another one while before adding mirrormode true whenever i was trying to make changes in dir it gives me error [ Sep 4 10:18:39 mail slapd[20141]: conn=5 op=1 RESULT tag=103 err=53 text=shadow context; no update referral ] So now no idea where I am wrong. Please help me ... On Wed, Sep 3, 2008 at 6:25 PM, Miguel Jinez <miguel.jinez(a)gmail.com> wrote: > Hello, maybe try with a mirrormode line, look the comments in red > > Migue > > 2008/9/3 piyush joshi <joy.piyush(a)gmail.com> > > >> *Dear All,* >> *I am using openldap-2.4.11 version and trying to use >> N-way multimaster replication so that changes made to first server reflects >> to second and* *vice versa but with my current set up if i use syncprov >> overlay and syncrepl on both server then it doesn't allow me to make changes >> in any ldap server but if i configure syncprov overlay on one server and >> configure syncrepl on another server it allow me to make changes and as well >> reflect the changes to another however still i can't make changes to second >> ldap server my both server configuration is as follows. please let me know >> what is wrong with this configuration or what all changes to be made >> to running it.* >> >> Configuration on First LDAP Server >> >> allow bind_v2 >> include /usr/local/openldap/etc/openldap/schema/core.schema >> include /usr/local/openldap/etc/openldap/schema/corba.schema >> include /usr/local/openldap/etc/openldap/schema/cosine.schema >> include /usr/local/openldap/etc/openldap/schema/nis.schema >> include >> /usr/local/openldap/etc/openldap/schema/inetorgperson.schema >> pidfile /usr/local/openldap/var/run/slapd.pid >> argsfile /usr/local/openldap/var/run/slapd.args >> modulepath /usr/local/openldap/libexec/openldap >> moduleload syncprov >> password-hash {SSHA} >> database hdb >> suffix "dc=***,dc=com" >> rootdn "cn=root,dc=***,dc=com" >> rootpw {SSHA}yZkqhHmELfmUTsaQyfxgXBqq95gugTA4 >> directory /usr/local/openldap/var/openldap-data >> index uid pres,eq >> index cn,sn pres,eq,approx,sub >> index objectClass eq >> index entryCSN,entryUUID eq >> syncrepl rid=001 >> provider=ldap://192.168.1.12 >> type=refreshAndPersist >> retry="5 5 300 +" >> searchbase="dc=***,dc=com" >> attrs=* >> binddn="cn=root,dc=***,dc=com" >> credentials=secret >> > mirrormode true > > >> overlay syncprov >> syncprov-checkpoint 50 10 >> database monitor >> loglevel 256 >> >> >> Configuration on Second LDAP Server >> >> allow bind_v2 >> include /usr/local/openldap/etc/openldap/schema/core.schema >> include /usr/local/openldap/etc/openldap/schema/corba.schema >> include /usr/local/openldap/etc/openldap/schema/cosine.schema >> include /usr/local/openldap/etc/openldap/schema/nis.schema >> include >> /usr/local/openldap/etc/openldap/schema/inetorgperson.schema >> pidfile /usr/local/openldap/var/run/slapd.pid >> argsfile /usr/local/openldap/var/run/slapd.args >> >> modulepath /usr/local/openldap/libexec/openldap >> moduleload syncprov >> password-hash {SSHA} >> >> database hdb >> suffix "dc=***,dc=com" >> rootdn "cn=root,dc=***,dc=com" >> rootpw {SSHA}9nbNE9l1rTvPCoU95zgo6vVoL3nMRzMI >> directory /usr/local/openldap/var/openldap-data >> index uid pres,eq >> index cn,sn pres,eq,approx,sub >> index objectClass eq >> index entryCSN,entryUUID eq >> syncrepl rid=001 >> provider=ldap://192.168.1.8 >> type=refreshAndPersist >> retry="5 5 300 +" >> searchbase="dc=***,dc=com" >> attrs=* >> binddn="cn=root,dc=***,dc=com" >> credentials=secret >> mirrormode true >> > > >> overlay syncprov >> syncprov-checkpoint 50 10 >> database monitor >> loglevel 256 >> >> >> Thanks Regards >> >> Piyush Joshi >> 9415414376 >> >> >> >> >> >> > > -- Regards Piyush Joshi 9415414376

3 4

objectclass sambaSamAccount
by Laurence Mayer 03 Sep '08

03 Sep '08

Hi, OS: Linux Redhat x86_64 OpenLdap 2.3.27 I am trying to add an objectclass sambaSamAccount to my ou=People. My goal would be to have both samba and posix account for each user. I have included the samba schema to the slapd.conf file. I tried adding this to a file and running ldapadd: dn: uid=laurence, ou=People,dc=istraresearch,dc=com sambaLogonTime: 0 displayName: Laurence Mayer sambaLMPassword: xxxxx sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201 objectClass: sambaSamAccount sambaAcctFlags: [UX ] gidNumber: 100 sambaKickoffTime: 2147483647 sambaPwdLastSet: 1010179230 sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 sambaNTPassword: xxxx However I received the error: adding new entry "uid=laurence, ou=People,dc=istraresearch,dc=com" ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute Please can you tell me what I need to do to achieve this. Thanks in advance Laurence

4 10

Re: RHEL 5 will not do TLS/SSL authentication
by Dat Duong 03 Sep '08

03 Sep '08

The slapd.conf is on Solaris 10 machine. This is how I compiled from the source for Openssl and Openldap. #cd openssl.0.98h # ./config shared # make clean # make # make install # cd openldap-2.4.11 # env LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/local/ssl/lib" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.4.2/lib -L/usr/local/ssl/lib -R/usr/local/lib -R/usr/local/BerkeleyDB.4.2/lib -R/usr/local/ssl/lib" CPPFLAGS="-I/usr/local/include -I/usr/local/BerkeleyDB.4.2/include -I/usr/local/ssl/include" ./configure --enable-bdb --enable-crypt --with-tls --without-cyrus-sasl # make depend # make clean ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: Dat Duong <datduong2000(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, September 3, 2008 5:17:14 AM Subject: Re: RHEL 5 will not do TLS/SSL authentication On Wednesday 03 September 2008 09:49:54 Dat Duong wrote: > I'm thinking, if the gnutls which installed by default, was causing the > problem?? It doesn't matter if gnutls is installed, what matters is what OpenLDAP was compiled against. Now, you stated that you are using RHEL 5, and gave no other details of what software you installed, so it would be logical to assume you are using only the RHEL 5 packages. On RHEL 5, OpenLDAP 2.3.27 is compiled against openssl 0.9.8b. But, since you have some weird paths reflected in your slapd.conf etc., maybe you have built your own software. If you have, you need to supply the details thereof, or we are all wasting our time. Regards, Buchan

1 0

Re: RHEL 5 will not do TLS/SSL authentication
by Buchan Milne 03 Sep '08

03 Sep '08

On Wednesday 03 September 2008 09:49:54 Dat Duong wrote: > I'm thinking, if the gnutls which installed by default, was causing the > problem?? It doesn't matter if gnutls is installed, what matters is what OpenLDAP was compiled against. Now, you stated that you are using RHEL 5, and gave no other details of what software you installed, so it would be logical to assume you are using only the RHEL 5 packages. On RHEL 5, OpenLDAP 2.3.27 is compiled against openssl 0.9.8b. But, since you have some weird paths reflected in your slapd.conf etc., maybe you have built your own software. If you have, you need to supply the details thereof, or we are all wasting our time. Regards, Buchan

1 0

Help needed to set up N-way multimaster replication
by piyush joshi 03 Sep '08

03 Sep '08

*Dear All,* *I am using openldap-2.4.11 version and trying to use N-way multimaster replication so that changes made to first server reflects to second and* *vice versa but with my current set up if i use syncprov overlay and syncrepl on both server then it doesn't allow me to make changes in any ldap server but if i configure syncprov overlay on one server and configure syncrepl on another server it allow me to make changes and as well reflect the changes to another however still i can't make changes to second ldap server my both server configuration is as follows. please let me know what is wrong with this configuration or what all changes to be made to running it.* Configuration on First LDAP Server allow bind_v2 include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/corba.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/local/openldap/libexec/openldap moduleload syncprov password-hash {SSHA} database hdb suffix "dc=***,dc=com" rootdn "cn=root,dc=***,dc=com" rootpw {SSHA}yZkqhHmELfmUTsaQyfxgXBqq95gugTA4 directory /usr/local/openldap/var/openldap-data index uid pres,eq index cn,sn pres,eq,approx,sub index objectClass eq index entryCSN,entryUUID eq syncrepl rid=001 provider=ldap://192.168.1.12 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=***,dc=com" attrs=* binddn="cn=root,dc=***,dc=com" credentials=secret overlay syncprov syncprov-checkpoint 50 10 database monitor loglevel 256 Configuration on Second LDAP Server allow bind_v2 include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/corba.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/local/openldap/libexec/openldap moduleload syncprov password-hash {SSHA} database hdb suffix "dc=***,dc=com" rootdn "cn=root,dc=***,dc=com" rootpw {SSHA}9nbNE9l1rTvPCoU95zgo6vVoL3nMRzMI directory /usr/local/openldap/var/openldap-data index uid pres,eq index cn,sn pres,eq,approx,sub index objectClass eq index entryCSN,entryUUID eq syncrepl rid=001 provider=ldap://192.168.1.8 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=***,dc=com" attrs=* binddn="cn=root,dc=***,dc=com" credentials=secret overlay syncprov syncprov-checkpoint 50 10 database monitor loglevel 256 Thanks Regards Piyush Joshi 9415414376

2 1

Re: RHEL 5 will not do TLS/SSL authentication
by Buchan Milne 03 Sep '08

03 Sep '08

On Tuesday 02 September 2008 21:26:10 Dat Duong wrote: > Also I did the certs test on the client RHEL5: And it failed for some reason, meaning this isn't an OpenLDAP problem, but an OpenSSL problem. > > # openssl s_client -connect xxx.xxx.xxx.xxx:636 -showcerts -state -CAfile > /etc/openldap/cacerts/cacert.pem > > > CONNECTED(00000003) > SSL_connect:before/connect initialization > SSL_connect:SSLv2/v3 write client hello A > SSL_connect:SSLv3 read server hello A > depth=1 > /C=US/ST=California/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo. >com verify return:1 > depth=0 /C=US/ST=California/L=Mountain > View/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo.com verify > return:1 > SSL_connect:SSLv3 read server certificate A > SSL_connect:SSLv3 read server done A > SSL_connect:SSLv3 write client key exchange A > SSL_connect:SSLv3 write change cipher spec A > SSL_connect:SSLv3 write finished A > SSL_connect:SSLv3 flush data At this point, I get: SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=ZA .... > SSL3 alert read:fatal:bad record mac > SSL_connect:failed in SSLv3 read finished A > 29751:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record > mac:s3_pkt.c:1057:SSL alert number 20 29751:error:140790E5:SSL > routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: > So it looks like a problem with the certificate. > > > ----- Original Message ---- > From: Dat Duong <datduong2000(a)yahoo.com> > To: Buchan Milne <bgmilne(a)staff.telkomsa.net>; > openldap-technical(a)openldap.org Sent: Tuesday, September 2, 2008 12:14:12 > PM > Subject: Re: RHEL 5 will not do TLS/SSL authentication > > > I'm using ldapsearch from openldap-2.4.xx on Solaris 10. I can do the > ldapsearch with -ZZ option and I can get the result back just fine. > However, on my RHEL 5 using the native ldapsearch with -ZZ and a -d1 > options for debug, will give some errors below. I can do a ldapsearch > without the -ZZ and it just run fine. > > ERROR: > > TLS trace: SSL_connect:before/connect initialization > TLS trace: SSL_connect:SSLv2/v3 write client hello A > TLS trace: SSL_connect:SSLv3 read server hello A > TLS certificate verification: depth: 1, err: 19, subject: > /C=US/ST=California/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo. >com, issuer: > /C=US/ST=California/O=/OU=/CN=ldap01.example.com/emailAddress=dduong@yahoo. >com TLS certificate verification: Error, self signed certificate in > certificate chain TLS trace: SSL3 alert write:fatal:unknown CA > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect. > ldap_perror > ldap_start_tls: Connect error (-11) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > **** Here is how I setup the TLS: > > On the Client side, I copied over the cacert.pem from the server to > /etc/openldap/cacerts/cacert.pem. A look at the cacert.pem show: > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: > b1:fe:10:70:c6:7e:fe:24 > Signature Algorithm: sha1WithRSAEncryption > Issuer: C=US, ST=California, O=, OU=ODIN, > CN=ldap01.example.com/emailAddress=dduong@yahoo.com Validity > Not Before: Sep 2 17:31:55 2008 GMT > Not After : Sep 2 17:31:55 2011 GMT > Subject: C=US, ST=California, O=, OU=, > CN=ldap01.example.com/emailAddress=dduong@yahoo.com Subject Public Key > Info: > Public Key Algorithm: rsaEncryption > RSA Public Key: (1024 bit) > Modulus (1024 bit): > 00:bf:eb:3e:89:2b:aa:4f:2f:31:0e:45:8f:7e:1b: > c6:3f:49:ae:62:ea:1b:fe:4a:71:60:38:b9:a8:02: > eb:7e:e4:3b:a6:cb:bb:9c:bb:23:b7:86:11:87:b4: > 2d:59:99:33:20:f4:90:dd:90:52:b0:59:1d:e4:e4: > 68:03:7f:d2:7f:0b:9d:e7:10:81:9d:d0:ef:d8:98: > dc:49:a0:2b:c1:71:5d:2c:63:34:e5:38:7c:13:11: > f4:cf:bd:0b:4a:2b:2c:03:23:9a:e1:67:6d:d9:ae: > c6:60:ac:85:41:98:43:03:28:fa:e1:e6:76:3e:69: > 8f:66:de:ca:56:ff:de:33:4d > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Subject Key Identifier: > 7C:49:79:29:08:EE:77:8D:C0:93:9B:44:62:63:F6:3F:FD:26:1E:E9 > X509v3 Authority Key Identifier: > > keyid:7C:49:79:29:08:EE:77:8D:C0:93:9B:44:62:63:F6:3F:FD:26:1E:E9 > DirName:/C=US/ST=California/O=/OU=ODIN/CN=ldap01.example.com/emailAddress=d >duong(a)yahoo.com serial:B1:FE:10:70:C6:7E:FE:24 > > X509v3 Basic Constraints: > CA:TRUE > Signature Algorithm: sha1WithRSAEncryption > 4f:c5:42:62:d2:75:38:0f:cd:8c:18:a3:6f:d5:9b:92:23:4b: > a6:74:f9:e1:fd:9a:2f:43:ee:25:d6:f4:33:cb:2c:e1:f9:f2: > 1c:13:87:f4:cf:1c:68:ef:99:a3:5e:8c:4c:73:bd:e1:43:80: > 14:bb:dc:96:12:bf:93:4c:03:f3:f5:0d:bb:2f:92:26:fb:ae: > 54:62:de:cc:0a:d5:f1:cf:9a:b0:61:53:eb:6c:76:a4:f5:f2: > 9a:90:a6:a8:cc:db:f6:ba:aa:8c:ad:f5:4d:63:d2:3a:4b:e9: > 45:41:73:ac:5b:a8:ab:7f:8f:41:07:5d:02:73:a2:b9:9d:27: > 87:67 > -----BEGIN CERTIFICATE----- > . > . > . > . > . > -----END CERTIFICATE----- > > > *****On the client RHEL5, /etc/openldap/ldap.conf look like this: > > # > # LDAP Defaults > # > > # See ldap.conf(5) for details > # This file should be world readable but not world writable. > > #BASE dc=example, dc=com > #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 > > #SIZELIMIT 12 > #TIMELIMIT 15 > #DEREF never > URI ldap://xxx.xxx.xxx.xxx/ > BASE dc=foobar,dc=example,dc=com > TLS_CACERTDIR /etc/openldap/cacerts If you use this directive (and not TLS_CACERT), then you must have created the hashes in /etc/openldap/cacerts, using c_rehash (on RHEL, you must install openssl-perl to get this), e.g. c_rehash /etc/openldap/cacerts > > > ***** On Client RHEL5, the ldap.conf located at /etc/ldap.conf look like > this: I've removed the useless lines of commented defaults .... > base dc=example,dc=com > > timelimit 120 > > bind_timelimit 120 > > idle_timelimit 3600 > > nss_base_passwd ou=People,dc=foobar,dc=example,dc=com?one > nss_base_shadow ou=People,dc=foobar,dc=example,dc=com?one > nss_base_group ou=Group,dc=foobar,dc=example,dc=com?one > nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon > ssl start_tls > tls_checkpeer yes > tls_cacertfile /etc/openldap/cacerts/cacert.pem > > uri ldap://ldap01.example.com/ > #ssl no > tls_cacertdir /etc/openldap/cacerts > pam_password crypt This should work, if your certificate wasn't broken. > On the LDAP server, This is how I create CA and certificates: > > #openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout > server.pem -days 365 I'm wondering if some files left over by the order in which you did things caused a problem. > ## create self signed certs > > ## generate root signing cert: > /usr/share/ssl/misc/CA.pl -newca Did you really give your CA the subject: C=US, ST=California, O=, OU=,CN=ldap01.example.com/emailAddress=dduong@yahoo.com ? Why did you make it so close to that of the LDAP server's certificate ? > > ## create a signing req for the server > openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem > > ## sign it with root CA > # /usr/local/ssl/misc/CA.sh -sign > > ## call the cert/key something useful > mv newcert.pem ldap01-cert.pem > mv newreq.pem ldap01-key.pem > > Copy ldap01-cert.pem and ldap01-key.pem and the root CA (in > demoCA/cacert.pem) to server:/opt/openldap/keys > > chmod 400 * > > Add these config params: > > TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv3 > TLSCACertificateFile /usr/local/etc/openldap/keys/cacert.pem > TLSCertificateFile /opt/openldap/keys/ldap01-cert.pem > TLSCertificateKeyFile /opt/openldap/keys/ldap01-key.pem > TLSVerifyClient never Can you verify the certificate on the server? E.g.: # openssl verify -CAfile /usr/local/etc/openldap/keys/cacert.pem /opt/openldap/keys/ldap01-cert.pem Regards, Buchan

1 0

Re: objectclass sambaSamAccount
by Michael Ströder 02 Sep '08

02 Sep '08

Laurence, please stay on the mailing list. Laurence Mayer wrote: > > I got this working and now I can add sambaSamAccounts. > > When I add passdb backend = ldapsam:ldap://ldap.example.com to my > smb.conf with all the other needed options the smb does not come up. You should provide more information. At first I'd recommend to have a closer look at the logs of OpenLDAP and Samba. Ciao, Michael.

1 0

RHEL 5 will not do TLS/SSL authentication
by Dat Duong 02 Sep '08

02 Sep '08

Hi, I can't find anywhere on how to fix my RHEL 5 to use TLS/SSL authentication. I will work when I comment out the ssl startTLS and SSL. On my Solaris 10, I can do ldapsearch with the -ZZ option Here is what I did with the debug on for ldapsearch. Please help me solve this problem...THANKS!! TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

2 1

Fw: RHEL 5 will not do TLS/SSL authentication
by Dat Duong 01 Sep '08

01 Sep '08

Hi, I can't find anywhere on how to fix my RHEL 5 to use TLS/SSL authentication. I will work when I comment out the ssl startTLS and SSL. On my Solaris 10, I can do ldapsearch with the -ZZ option Here is what I did with the debug on for ldapsearch. Please help me solve this problem...THANKS!! TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

1 0

ldapsearch - Active Directory proxyaddresses:smtp
by Chris Henderson 31 Aug '08

31 Aug '08

I am trying to filter proxyaddress:smtp email addresses querying Active Directory. I need to use this for sendmail address lookup. I tried the following queries but they give a lot of extraneous information I don't need. Any help would be much appreciated. Thanks. - ldapsearch -x -h 192.168.25.16 -p 3268 -b "DC=company,DC=com" "(&(proxyAddresses=SMTP:*))" - ldapsearch -x -h 192.168.25.16 -p 3268 -b "DC=company,DC=com" -P2 -s sub "objectclass=*" SMTP - ldapsearch -x -h 192.168.25.16 -p 3268 -b "DC=company,DC=com" -P2 -s sub "proxyAddresses=*" Normally the address comes in this exact format while querying Active Directory: "proxyAddresses: SMTP:firstname.lastname@company.com" Thanks.

4 3

Mistake in the doc ?
by Vincent Panel 30 Aug '08

30 Aug '08

Hi, Maybe I don't understand but, I'm looking at § 8.2.4.1 in this document : http://www.openldap.org/doc/admin22/schema.html The goal is to create an attributetype called "myUniqueName" which is unique. With the last definition of this attributetype : attributetype ( 1.1.2.1.1 NAME 'myUniqueName' DESC 'unique name with my organization' SUP name ) How can openldap guess that we cant a unique attributetype ? Isn't there a SINGLE-VALUE missing at the end of the description ? Thanks for your answers, Vincent

3 3

More info: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 30 Aug '08

30 Aug '08

Hi again, when I make sudo /etc/init.d/ssh restart after reboot, the network users can login, even when the tls_cert and tls_key options in /etc/ldap.conf have been disabled. After rebooting the machine, the login fails and I have to login as local user to restart the sshd. <some user>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Permission denied, please try again. <network_user>@<client>'s password: <some user>@<some host>:~> ssh <local_user>@<client> <local_user>@<client>'s password: Last login: Sat Aug 30 10:25:56 2008 from <some host> <local_user>@<client>:~$ sudo /etc/init.d/ssh restart [sudo] password for <local user>: * Restarting OpenBSD Secure Shell server sshd [ OK ] <local_user>@<client>:~$ logout <some user>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Sat Aug 30 10:23:40 2008 from <some host> <network_user>@<client>:~$ I'm very confused now! Best regards, Hauke ----- Ursprüngliche Mail ----- Von: "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> An: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> CC: openldap-technical(a)openldap.org Gesendet: Freitag, 29. August 2008 21:33:08 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: AW: Re: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server) Hi Buchan, summary first: the su - <network_user> problem is solved thanks to your question. ssh <network_user>@<client> works only under certain circumstances (see below). > > I want to use TLS-communication between my ldap server and > > the clients. > > [...] > > > Next, I activated TLSVerifyClient on the server side > > Why ? You don't need this to address your single remaining problem, > unless you haven't stated it in full. Sorry, I did not point out that I want only valid users/services to be able to get information from the ldap server at all. A valid service or user shall be identified by a certificate that is signed by a valid CA of mine. All other connection attempts shall be rejected. That is how I understood the combination of TLS_REQCRT (to verify the server) and TLSVerifyClient (to verify the client). Am I wrong here? > Since I use the ldap server for network user authentication, I can (as > local user) make a su - <network_user>, enter the password and get > authenticated, but have a look at the shell: > > <local user>@<client>:~$ su - <network_user> > Password: <network user password here> > id: cannot find name for group ID <network_user group> > I have no name!@<client>:~$ > > Does 'strace -e open id' tell you anything interesting (specifically about > the key/cert)? Wow, one single question of yours gave me several hours of work and the solution for my first problem. Thanks ;-) I ensured that the requested files are readable by the user (they already were, but I checked it again, even made a chmod -R 777 on the directory). This was not the problem. But after creating a new certificate for that network user with the CN set to the users username (instead of the surname/name before), the problem with su - <network_user> disappeared. Now I can su from a certified local user to my network user. <local user>@<client>:~$ su - <network user> Password: <network user>@<client>:~$ That's cool! > > In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for > > lib(pam|nss)_ldap.conf), > > Actually, Ubuntu reverts back to the upstream location, lib(pam|nss)_ldap.conf > is a Debian-ism. Thanks for the info, did not know that. > > I set the values for > > > > tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem > > tls_key /usr/lib/ssl/private/<client>.ldap.key.pem > > You didn't indicate any of the other /etc/ldap.conf settings, such as > tls_cacertfile, tls_check_peer. Additionally, you don't specify if you are > using nscd, or whether the logged in user (below) can read the tls_cert and > tls_key files. Since the verification of the server certificate works out fine, I only provided the client-verification specific values. Here are the missing values: base dc=... uri ldaps://<fqdn of my server>/ ldap_version 3 bind_policy soft pam_password md5 tls_check_peer yes tls_cacertfile /usr/lib/ssl/cacerts/<serverca>.chain.pem tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem nss_initgroups_ignoreusers backup,bin,daemon,dhcp,fetchmail,games,gnats,irc,klog,libuuid,list,lp,mail,man, \ messagebus,news,postfix,proxy,root,sshd,statd,sync,sys,syslog,uucp,www-data,zimbra The nss_initgroups_ignoreusers entry is automatically created when executing /etc/init.d/libnss-ldap restart or when booting the system. I disabled the nscd caches for passwd and group before starting to deal with TLS just to make sure that the ldap server is always contacted. ==== /etc/nscd.conf ==== ... enable-cache passwd no ... enable-cache group no ... == END /etc/nscd.conf == After tideous testing I found out something new: I wanted to strace the sshd, too and therefore stopped the running instance with /etc/init.d/ssh stop and started a new instance manually <local user>@<client> sudo -s root@<client># /usr/sbin/sshd -D Doing so, the login via SSH works sout perfectly. I assumed that this is because sshd would read the .ldaprc of <local user>, which has a valid cert/key entry (see above), so I straced the above command. But: root@<client>:/etc/init.d# strace -e open /usr/sbin/sshd -D 2>&1 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libwrap.so.0", O_RDONLY) = 3 open("/lib/libpam.so.0", O_RDONLY) = 3 open("/lib/libdl.so.2", O_RDONLY) = 3 open("/lib/libselinux.so.1", O_RDONLY) = 3 open("/usr/lib/libck-connector.so.0", O_RDONLY) = 3 open("/usr/lib/libdbus-1.so.3", O_RDONLY) = 3 open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 3 open("/lib/libutil.so.1", O_RDONLY) = 3 open("/usr/lib/libz.so.1", O_RDONLY) = 3 open("/lib/libnsl.so.1", O_RDONLY) = 3 open("/lib/libcrypt.so.1", O_RDONLY) = 3 open("/lib/libresolv.so.2", O_RDONLY) = 3 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 open("/lib/libcom_err.so.2", O_RDONLY) = 3 open("/lib/libc.so.6", O_RDONLY) = 3 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 open("/lib/libkeyutils.so.1", O_RDONLY) = 3 open("/etc/selinux/config", O_RDONLY) = -1 ENOENT (No such file or directory) open("/proc/mounts", O_RDONLY) = 3 open("/dev/null", O_RDWR) = 3 open("/proc/14556/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|0x80000) = 3 open("/etc/ssh/sshd_config", O_RDONLY) = 3 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3 open("/etc/gai.conf", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY) = 3 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY|0x80000 /* O_??? */) = 3 open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.RSA-2048", O_RDONLY) = 3 open("/etc/ssh/ssh_host_dsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.DSA-1024", O_RDONLY) = 3 open("/etc/localtime", O_RDONLY) = 4 open("/var/run/sshd.pid", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4 Now if I do ssh <network_user>@<client> from any machine in the net, everything works out perfectly: <some id>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Fri Aug 29 21:23:06 2008 from <fqdn of some host> <network user>@<client>:~$ But not a single ldap or libnss/libpam config file is stat'ed or read by the above sshd at all. The only thing that can be seen is that after logging out, the above sshd command echos --- SIGCHLD (Child exited) @ 0 (0) --- and that's it. When I kill the above sshd and do /etc/init.d/ssh start again, the login still works out. But after restarting the sytem, the login fails as always. As far as I can see, /etc/init.d/ssh starts sshd as root, obviously not chrooted or something similar. Do you have any idea, what this is all about? Kind regards, Hauke --

1 0

Re: SSHD doesn't start
by Jordi Espasa Clofent 29 Aug '08

29 Aug '08

> This is more of a sys-admin question, but change when sshd starts up so > ldap comes up first. Ok Gavin, I'd thought that the present 'openldap-technical' mail-list was the correct place to ask this kind of questions. ¿Can you point to me what is the correct list? -- Thanks, Jordi Espasa Clofent

1 0

AW: Re: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 29 Aug '08

29 Aug '08

Hi Buchan, summary first: the su - <network_user> problem is solved thanks to your question. ssh <network_user>@<client> works only under certain circumstances (see below). > > I want to use TLS-communication between my ldap server and > > the clients. > > [...] > > > Next, I activated TLSVerifyClient on the server side > > Why ? You don't need this to address your single remaining problem, > unless you haven't stated it in full. Sorry, I did not point out that I want only valid users/services to be able to get information from the ldap server at all. A valid service or user shall be identified by a certificate that is signed by a valid CA of mine. All other connection attempts shall be rejected. That is how I understood the combination of TLS_REQCRT (to verify the server) and TLSVerifyClient (to verify the client). Am I wrong here? > Since I use the ldap server for network user authentication, I can (as > local user) make a su - <network_user>, enter the password and get > authenticated, but have a look at the shell: > > <local user>@<client>:~$ su - <network_user> > Password: <network user password here> > id: cannot find name for group ID <network_user group> > I have no name!@<client>:~$ > > Does 'strace -e open id' tell you anything interesting (specifically about > the key/cert)? Wow, one single question of yours gave me several hours of work and the solution for my first problem. Thanks ;-) I ensured that the requested files are readable by the user (they already were, but I checked it again, even made a chmod -R 777 on the directory). This was not the problem. But after creating a new certificate for that network user with the CN set to the users username (instead of the surname/name before), the problem with su - <network_user> disappeared. Now I can su from a certified local user to my network user. <local user>@<client>:~$ su - <network user> Password: <network user>@<client>:~$ That's cool! > > In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for > > lib(pam|nss)_ldap.conf), > > Actually, Ubuntu reverts back to the upstream location, lib(pam|nss)_ldap.conf > is a Debian-ism. Thanks for the info, did not know that. > > I set the values for > > > > tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem > > tls_key /usr/lib/ssl/private/<client>.ldap.key.pem > > You didn't indicate any of the other /etc/ldap.conf settings, such as > tls_cacertfile, tls_check_peer. Additionally, you don't specify if you are > using nscd, or whether the logged in user (below) can read the tls_cert and > tls_key files. Since the verification of the server certificate works out fine, I only provided the client-verification specific values. Here are the missing values: base dc=... uri ldaps://<fqdn of my server>/ ldap_version 3 bind_policy soft pam_password md5 tls_check_peer yes tls_cacertfile /usr/lib/ssl/cacerts/<serverca>.chain.pem tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem nss_initgroups_ignoreusers backup,bin,daemon,dhcp,fetchmail,games,gnats,irc,klog,libuuid,list,lp,mail,man, \ messagebus,news,postfix,proxy,root,sshd,statd,sync,sys,syslog,uucp,www-data,zimbra The nss_initgroups_ignoreusers entry is automatically created when executing /etc/init.d/libnss-ldap restart or when booting the system. I disabled the nscd caches for passwd and group before starting to deal with TLS just to make sure that the ldap server is always contacted. ==== /etc/nscd.conf ==== ... enable-cache passwd no ... enable-cache group no ... == END /etc/nscd.conf == After tideous testing I found out something new: I wanted to strace the sshd, too and therefore stopped the running instance with /etc/init.d/ssh stop and started a new instance manually <local user>@<client> sudo -s root@<client># /usr/sbin/sshd -D Doing so, the login via SSH works sout perfectly. I assumed that this is because sshd would read the .ldaprc of <local user>, which has a valid cert/key entry (see above), so I straced the above command. But: root@<client>:/etc/init.d# strace -e open /usr/sbin/sshd -D 2>&1 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libwrap.so.0", O_RDONLY) = 3 open("/lib/libpam.so.0", O_RDONLY) = 3 open("/lib/libdl.so.2", O_RDONLY) = 3 open("/lib/libselinux.so.1", O_RDONLY) = 3 open("/usr/lib/libck-connector.so.0", O_RDONLY) = 3 open("/usr/lib/libdbus-1.so.3", O_RDONLY) = 3 open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 3 open("/lib/libutil.so.1", O_RDONLY) = 3 open("/usr/lib/libz.so.1", O_RDONLY) = 3 open("/lib/libnsl.so.1", O_RDONLY) = 3 open("/lib/libcrypt.so.1", O_RDONLY) = 3 open("/lib/libresolv.so.2", O_RDONLY) = 3 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 open("/lib/libcom_err.so.2", O_RDONLY) = 3 open("/lib/libc.so.6", O_RDONLY) = 3 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 open("/lib/libkeyutils.so.1", O_RDONLY) = 3 open("/etc/selinux/config", O_RDONLY) = -1 ENOENT (No such file or directory) open("/proc/mounts", O_RDONLY) = 3 open("/dev/null", O_RDWR) = 3 open("/proc/14556/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|0x80000) = 3 open("/etc/ssh/sshd_config", O_RDONLY) = 3 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3 open("/etc/gai.conf", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY) = 3 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY|0x80000 /* O_??? */) = 3 open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.RSA-2048", O_RDONLY) = 3 open("/etc/ssh/ssh_host_dsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.DSA-1024", O_RDONLY) = 3 open("/etc/localtime", O_RDONLY) = 4 open("/var/run/sshd.pid", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4 Now if I do ssh <network_user>@<client> from any machine in the net, everything works out perfectly: <some id>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Fri Aug 29 21:23:06 2008 from <fqdn of some host> <network user>@<client>:~$ But not a single ldap or libnss/libpam config file is stat'ed or read by the above sshd at all. The only thing that can be seen is that after logging out, the above sshd command echos --- SIGCHLD (Child exited) @ 0 (0) --- and that's it. When I kill the above sshd and do /etc/init.d/ssh start again, the login still works out. But after restarting the sytem, the login fails as always. As far as I can see, /etc/init.d/ssh starts sshd as root, obviously not chrooted or something similar. Do you have any idea, what this is all about? Kind regards, Hauke --

1 0

Re: Mistake in the doc ?
by Gavin Henry 29 Aug '08

29 Aug '08

----- "Vincent Panel" <yohonet(a)gmail.com> wrote: > Hi, > > Maybe I don't understand but, I'm looking at § 8.2.4.1 in this > document : http://www.openldap.org/doc/admin22/schema.html > > The goal is to create an attributetype called "myUniqueName" which is > unique. With the last definition of this attributetype : > > attributetype ( 1.1.2.1.1 NAME 'myUniqueName' > DESC 'unique name with my organization' > SUP name ) > > How can openldap guess that we cant a unique attributetype ? > > Isn't there a SINGLE-VALUE missing at the end of the description ? It's just talking about the name of the attribute, not the attribute value. SINGLE-VALUE means attributes of this type are restricted to a single value, nothing about uniqueness. Please have a read of doc/rfc/rfc4512.txt at your leisure. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 29 Aug '08

29 Aug '08

Hi everybody, hope, this is still the right group for my question, might also be a lib{pam|nss}_ldap problem. I am very happy to say that I have an almost completely running installation now. But one single problem still remains: I want to use TLS-communication between my ldap server and the clients. I started up with an own RootCA, created 2 SubCAs (one for server certs, one for user certs) and generated a certificate for my server, signed by the ServerCA. On client side, I have set ==== /etc/ldap/ldap.conf ==== BASE dc=... URI ldaps://<fqdn>/ # Require valid cert from server TLS_REQCERT yes # CA for trusted server certs TLS_CACERT /usr/lib/ssl/cacerts/<serverca>.chain.pem == END /etc/ldap/ldap.conf == This works out perfectly, as I can see using a paket sniffer. The client only communicates with the server using TLSv1 and only if the server's certificate is valid. Next, I activated TLSVerifyClient on the server side ==== /etc/ldap/slapd.conf ==== ... # The CA chain for valid client certs TLSCACertificateFile /usr/lib/ssl/cacerts/<userca>.chain.pem # The server's cert TLSCertificateFile /usr/lib/ssl/certs/<server>.cert.pem # The server's key TLSCertificateKeyFile /usr/lib/ssl/private/<server>.key.pem # Verify clients always TLSVerifyClient demand == END /etc/ldap/slapd.conf == and created a client cert without password for my local client user, signed by the UserCA. This cert and the according key are referenced in the (local) users .ldaprc on the client machine: ==== /home/<user>/.ldaprc ==== TLS_CERT /home/<user>/openldap/<user>.ldap.cert.pem TLS_KEY /home/<user>/openldap/<user>.ldap.key.pem == END /home/<user>/.ldaprc == So, when I start ldapsearch -x as local user, I get a positive result as long as the above mentioned certificate is valid. If the user's certificate is not valid, ldapsearch fails. Wonderful, that's exactly what I wanted. But now to my problem: Since I use the ldap server for network user authentication, I can (as local user) make a su - <network_user>, enter the password and get authenticated, but have a look at the shell: <local user>@<client>:~$ su - <network_user> Password: <network user password here> id: cannot find name for group ID <network_user group> I have no name!@<client>:~$ Without TLSVerifyClient, this works out fine: <local user>@<client>:~$ su - <network_user> Password: <network user password here> <network_user>@<client>:~$ Secondly: How do I make it possible that when connecting via ssh to the client machine (from any other machine), I can login as <network_user>? Here are the details: In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for lib(pam|nss)_ldap.conf), I set the values for tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem The certificate has been signed by the same CA as the above user certificate. The CN is the name of the host (not fqdn, that is, just the hostname). But when I try to login via ssh, quits the connection saying slapd -d127 -h "ldaps:///" -u openldap -g openldap ... TLS: can't accept: The peer did not send any certificate.. connection_read(12): TLS accept failure error=-1 id=0, closing ... Whithout TLSVerifyClient, I can login. I assume that both problems have the same background, but I just don't get it. Hope, this time I didn't miss reading a manual again ;-) Best regards, Hauke --

2 1

Proxy to Active Directory
by Nazeeruddin Mohammad 29 Aug '08

29 Aug '08

Hi Everyone, Like many organizations, we have two authentication systems here. I am trying to figure out a way of synchronizing LDAP passwords with AD passwords; or proxying the requests to AD. Management wants to keep LDAP intact, while enjoying the flexibility of single password. I have unsuccessfully tried to use proxy functionally of LDAP to get user information from AD. First of all, AD needs a user name and password to retrieve information. Is there a way of specifying username/password? Even the following ldapsearch FAILS on openldap server, but the same query works fine for AD server. ldapsearch -LLL -x -h localhost -b 'cn=users,dc=internal,dc=phg,dc=com,dc=au' -D "ldapauth(a)internal.phg.com.au" -W -x ldapsearch -LLL -x -h localhost -b 'dc=internal,dc=phg,dc=com,dc=au' -D "CN=Ldap Authentication,OU=Linux,OU=InformationTechnology,OU=Portland House,OU=Sites,DC=internal,DC=phg,DC=com,DC=au" -W -x Here is the relevant sladp.conf snippet. database ldap suffix "cn=users,dc=internal,dc=phg,dc=com,dc=au" subordinate rebind-as-user uri "ldap://192.168.100.100/" chase-referrals yes Any help is appreciated. Thank you very much. Cheers Nazeer *************************************************************************** CAUTION: This email message and accompanying data may contain information that is confidential and/or subject to legal privilege. If you are not the intended recipient, you are notified that any use, dissemination, distribution or copying of this message or data is prohibited. If you have received this email message in error, please notify us immediately and erase all copies of this message and attachments. Thank you. ***************************************************************************

5 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical