- openldap-technical - openldap.org

Re: Windows AD --> Linux/OpenLDAP
by Gustavo Mendes de Carvalho 22 Aug '08

22 Aug '08

Hi Janskey, You can try it using ldifde command, like this ldifde -f exportuserfile.ldif -s ServerName -d "dc=foo,dc=com " \ -r " (&(objectCategory=Person)(objectClass=User)(givenName=*)) " \ -l " CN,givenName,objectClass,sAMAccountName " If you have any doubt, try ldifde /? Regards > Date: Thu, 21 Aug 2008 06:32:58 -0700 (PDT) > From: janskey <janskey_boy(a)yahoo.com> > Subject: Windows AD --> Linux/OpenLDAP > To: openldap-technical(a)openldap.org > Message-ID: <543692.93491.qm(a)web51701.mail.re2.yahoo.com> > Content-Type: text/plain; charset="us-ascii" > > Hi All, > > I need advice on how I can migrate my AD to linux/OpenLDAP? > Currently we're using Windows 2003 evaluation and its going to expire. > > cheers, > > janskey --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

Windows AD --> Linux/OpenLDAP
by janskey 21 Aug '08

21 Aug '08

Hi All, I need advice on how I can migrate my AD to linux/OpenLDAP? Currently we're using Windows 2003 evaluation and its going to expire. cheers, janskey

3 2

Can't bind to server even though everything is running and seems normal
by Kristen Walker 21 Aug '08

21 Aug '08

Hello, I am sorry to bug this list about another problem with LDAP. This morning I logged in to LDAP via phpldapadmin and added users and everything seemed find. Now, a few hours later, I cannot seem to bind to the server to add users via the web interface or command line. Here is the output from the command line: sudo ldapadd -x -D "cn=Manager,dc=sbceoportal,dc=org" -W -f /home/upadmin/ldap/new_users.ldif Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) I started openLDAP in debugging mode, and nothing seems out of the ordinary: su root -c "/usr/local/libexec/slapd -d 65535" @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ root@porthole:/etc/openldap/openldap-2.3.39/servers/slapd daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened slapd init: initiated server. bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) reading config file /usr/local/etc/openldap/slapd.conf line 5 (include /usr/local/etc/openldap/schema/core.schema) reading config file /usr/local/etc/openldap/schema/core.schema line 77 (attributetype ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )) line 86 (attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name )) line 92 (attributetype ( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial number of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} )) line 96 (attributetype ( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC2256: ISO-3166 country 2-letter code' SUP name SINGLE-VALUE )) line 100 (attributetype ( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: locality which this object resides in' SUP name )) line 104 (attributetype ( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2256: state or province which this object resides in' SUP name )) line 110 (attributetype ( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC2256: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )) line 114 (attributetype ( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256: organization this object belongs to' SUP name )) line 118 (attributetype ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC 'RFC2256: organizational unit this object belongs to' SUP name )) line 122 (attributetype ( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name )) line 134 (attributetype ( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search guide, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 )) line 140 (attributetype ( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: business category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )) line 146 (attributetype ( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )) line 152 (attributetype ( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} )) line 158 (attributetype ( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Office Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} )) line 164 (attributetype ( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )) line 170 (attributetype ( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Telephone Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} )) line 174 (attributetype ( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Number' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 )) line 178 (attributetype ( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC2256: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 )) line 182 (attributetype ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.121.1.22 )) line 188 (attributetype ( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Address' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{15} )) line 194 (attributetype ( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256: international ISDN number' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} )) line 199 (attributetype ( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: registered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )) line 205 (attributetype ( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: destination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} )) line 210 (attributetype ( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC2256: preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE-VALUE )) line 216 (attributetype ( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: presentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.43 SINGLE-VALUE )) line 221 (attributetype ( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'RFC2256: supported application context' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )) line 225 (attributetype ( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a group' SUP distinguishedName )) line 229 (attributetype ( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the object)' SUP distinguishedName )) line 233 (attributetype ( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupant of role' SUP distinguishedName )) line 251 (attributetype ( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.509 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )) line 258 (attributetype ( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )) line 263 (attributetype ( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC2256: X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )) line 268 (attributetype ( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC2256: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )) line 273 (attributetype ( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X.509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 )) line 283 (attributetype ( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) for which the entity is known by' SUP name )) line 287 (attributetype ( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of some or all of names, but not the surname(s).' SUP name )) line 291 (attributetype ( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: name qualifier indicating a generation' SUP name )) line 296 (attributetype ( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X.500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )) line 303 (attributetype ( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN qualifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 )) line 307 (attributetype ( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: enhanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 )) line 312 (attributetype ( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: protocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.42 )) line 322 (attributetype ( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique member of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )) line 328 (attributetype ( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: house identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )) line 333 (attributetype ( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: supported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 )) line 338 (attributetype ( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: delta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )) line 342 (attributetype ( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' SUP name )) line 346 (attributetype ( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudonym for the object' SUP name )) line 366 (objectclass ( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP top STRUCTURAL MUST c MAY ( searchGuide $ description ) )) line 371 (objectclass ( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SUP top STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ description ) )) line 382 (objectclass ( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organization' SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )) line 393 (objectclass ( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an organizational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )) line 399 (objectclass ( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP top STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) )) line 408 (objectclass ( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an organizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l ) )) line 419 (objectclass ( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an organizational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l $ description ) )) line 425 (objectclass ( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )) line 436 (objectclass ( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an residential person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ preferredDeliveryMethod $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) )) line 442 (objectclass ( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an application process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ description ) )) line 449 (objectclass ( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an application entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MAY ( supportedApplicationContext $ seeAlso $ ou $ o $ l $ description ) )) line 454 (objectclass ( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory system agent (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformation )) line 460 (objectclass ( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP top STRUCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ description ) )) line 465 (objectclass ( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC2256: a strong authentication user' SUP top AUXILIARY MUST userCertificate )) line 471 (objectclass ( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256: a certificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ certificateRevocationList $ cACertificate ) MAY crossCertificatePair )) line 477 (objectclass ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uniqueMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )) line 482 (objectclass ( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC2256: a user security information' SUP top AUXILIARY MAY ( supportedAlgorithms ) )) line 486 (objectclass ( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP certificationAuthority AUXILIARY MAY ( deltaRevocationList ) )) line 492 (objectclass ( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTURAL MUST ( cn ) MAY ( certificateRevocationList $ authorityRevocationList $ deltaRevocationList ) )) line 502 (objectclass ( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST ( dmdName ) MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )) line 510 (objectclass ( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' SUP top AUXILIARY MAY userCertificate )) line 516 (objectclass ( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate authority' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRevocationList $ cACertificate $ crossCertificatePair ) )) line 521 (objectclass ( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SUP top AUXILIARY MAY deltaRevocationList )) line 534 (objectclass ( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'RFC2079: object that contains the URI attribute type' SUP top AUXILIARY MAY ( labeledURI ) )) line 551 (attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )) line 556 (objectclass ( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject' DESC 'RFC1274: simple security object' SUP top AUXILIARY MUST userPassword )) line 564 (attributetype ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainComponent' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )) line 569 (objectclass ( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: domain component object' SUP top AUXILIARY MUST dc )) line 574 (objectclass ( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid object' SUP top AUXILIARY MUST uid )) line 582 (attributetype ( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DESC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 590 (attributetype ( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'pkcs9email' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )) line 6 (include /usr/local/etc/openldap/schema/cosine.schema) reading config file /usr/local/etc/openldap/schema/cosine.schema line 130 (attributetype ( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 168 (attributetype ( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: general information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} )) line 187 (attributetype ( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDrink' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 205 (attributetype ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 227 (attributetype ( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} )) line 248 (attributetype ( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC1274: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 264 (attributetype ( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: host computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 279 (attributetype ( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC1274: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 296 (attributetype ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' DESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 312 (attributetype ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC 'RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 329 (attributetype ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DESC 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 344 (attributetype ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 361 (attributetype ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DESC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 380 (attributetype ( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTelephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )) line 395 (attributetype ( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 411 (attributetype ( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 )) line 480 (attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 486 (attributetype ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 501 (attributetype ( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 516 (attributetype ( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 531 (attributetype ( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 546 (attributetype ( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )) line 581 (attributetype ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 599 (attributetype ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' DESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )) line 616 (attributetype ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 635 (attributetype ( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTelephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )) line 653 (attributetype ( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelephoneNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )) line 671 (attributetype ( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCountryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 691 (attributetype ( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DESC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 713 (attributetype ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 734 (attributetype ( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC 'RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )) line 764 (attributetype ( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )) line 781 (attributetype ( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC 'RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )) line 796 (attributetype ( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RFC1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE )) line 811 (attributetype ( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE )) line 827 (attributetype ( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQuality' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE )) line 843 (attributetype ( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQuality' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE )) line 865 (attributetype ( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' DESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23 )) line 884 (attributetype ( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'RFC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )) line 900 (attributetype ( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274: audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} )) line 916 (attributetype ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' DESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 1084 (objectclass ( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilotPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ homePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ businessCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelephoneNumber $ organizationalStatus $ mailPreferenceOption $ personalSignature ) )) line 1110 (objectclass ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ host ) )) line 1142 (objectclass ( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUCTURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ documentTitle $ documentVersion $ documentAuthor $ documentLocation $ documentPublisher ) )) line 1165 (objectclass ( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURAL MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) )) line 1191 (objectclass ( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ localityName $ organizationName $ organizationalUnitName ) )) line 1222 (objectclass ( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCTURAL MUST domainComponent MAY ( associatedName $ organizationName $ description $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $ stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) )) line 1252 (objectclass ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP domain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telephoneNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) )) line 1275 (objectclass ( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord ) )) line 1293 (objectclass ( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' DESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associatedDomain )) line 1311 (objectclass ( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP country STRUCTURAL MUST friendlyCountryName )) line 1345 (objectclass ( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SUP ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName )) line 1361 (objectclass ( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STRUCTURAL MAY dSAQuality )) line 1382 (objectclass ( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximumQuality ) )) line 7 (include /usr/local/etc/openldap/schema/inetorgperson.schema) reading config file /usr/local/etc/openldap/schema/inetorgperson.schema line 36 (attributetype ( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC2798: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 46 (attributetype ( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC 'RFC2798: identifies a department within an organization' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 59 (attributetype ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )) line 70 (attributetype ( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RFC2798: numerically identifies an employee within an organization' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )) line 81 (attributetype ( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )) line 92 (attributetype ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 )) line 107 (attributetype ( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )) line 123 (attributetype ( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' DESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )) line 135 (attributetype ( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )) line 155 (objectclass ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) )) line 16 (pidfile /usr/local/var/run/slapd.pid) line 17 (argsfile /usr/local/var/run/slapd.args) line 58 (database bdb) bdb_db_init: Initializing BDB database line 59 (suffix "dc=sbceoportal,dc=org") >>> dnPrettyNormal: <dc=sbceoportal,dc=org> => ldap_bv2dn(dc=sbceoportal,dc=org,0) <= ldap_bv2dn(dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=sbceoportal,dc=org)=0 <<< dnPrettyNormal: <dc=sbceoportal,dc=org>, <dc=sbceoportal,dc=org> line 60 (rootdn "cn=Manager,dc=sbceoportal,dc=org") >>> dnPrettyNormal: <cn=Manager,dc=sbceoportal,dc=org> => ldap_bv2dn(cn=Manager,dc=sbceoportal,dc=org,0) <= ldap_bv2dn(cn=Manager,dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Manager,dc=sbceoportal,dc=org)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,dc=sbceoportal,dc=org)=0 <<< dnPrettyNormal: <cn=Manager,dc=sbceoportal,dc=org>, <cn=manager,dc=sbceoportal,dc=org> line 64 (rootpw ***) line 68 (directory /usr/local/var/openldap-data) line 70 (index objectClass eq) index objectClass 0x0004 >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox ) ) 2.5.13.35 (certificateMatch): matchingRuleUse: ( 2.5.13.35 NAME 'certificateMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES userPassword ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcGentleHUP $ olcLastMod $ olcReadOnly $ olcReverseLookup $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcSpNoPresent $ olcSpReloadHint ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcSpCheckpoint $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcSpCheckpoint $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ namingContexts $ aliasedObjectName $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=include{0}" config_build_entry: "cn=include{1}" config_build_entry: "cn=include{2}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}inetorgperson" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=sbceoportal,dc=org" bdb_db_open: dc=sbceoportal,dc=org bdb_db_open: dbenv_open(/usr/local/var/openldap-data) slapd starting daemon: added 4r listener=(nil) daemon: added 7r listener=0x81b5290 daemon: added 8r listener=0x81b5350 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL And this is the output in the log file: Aug 21 11:12:37 porthole slapd[32498]: daemon: shutdown requested and initiated. Aug 21 11:12:37 porthole slapd[32498]: slapd shutdown: waiting for 0 threads to terminate Aug 21 11:12:37 porthole slapd[32498]: slapd stopped. Aug 21 11:12:50 porthole slapd[32513]: @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ ^Iroot@porthole:/etc/openldap/openldap-2.3.39/servers/slapd Aug 21 11:12:50 porthole slapd[32514]: slapd starting Aug 21 11:13:51 porthole slapd[32514]: daemon: shutdown requested and initiated. Aug 21 11:13:51 porthole slapd[32514]: slapd shutdown: waiting for 0 threads to terminate Aug 21 11:13:51 porthole slapd[32514]: slapd stopped. Aug 21 11:14:02 porthole slapd[32522]: @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ ^Iroot@porthole:/etc/openldap/openldap-2.3.39/servers/slapd Aug 21 11:14:02 porthole slapd[32523]: slapd starting Aug 21 11:14:09 porthole slapd[32523]: daemon: shutdown requested and initiated. Aug 21 11:14:09 porthole slapd[32523]: slapd shutdown: waiting for 0 threads to terminate Aug 21 11:14:09 porthole slapd[32523]: slapd stopped. Aug 21 11:14:15 porthole slapd[32528]: @(#) $OpenLDAP: slapd 2.3.39 (Aug 14 2008 16:29:51) $ ^Iroot@porthole:/etc/openldap/openldap-2.3.39/servers/slapd Aug 21 11:14:15 porthole slapd[32528]: slapd starting Any help is much appreciated! Thanks, Kristen -- Kristen Walker Digital Media Resources Developer Instructional Media Services Santa Barbara County Education Office 4400 Cathedral Oaks Road P.O. Box 6307 Santa Barbara, CA 93160-6307 (805)964-4711 ext. 5244/FAX (805)683-3597 kwalker(a)sbceo.org http://www.sbceoportal.org

1 1

Prooblem loading dynamic module
by Ricardo Moreira 21 Aug '08

21 Aug '08

Hello, I am new to openldap so any help is wellcome! I am trying to build dynamic modules and I have got this error when trying to load them: lt_dlopenext failed: (back_monitor.la) /usr/local/libexec/openldap/back_monitor-2.3.so.0: undefined symbol: slapd_rq /etc/openldap/slapd.conf: line 23: failed to load or initialize module back_monitor.la Could someone help me with this issue? Here are some extra information: - Source package: openldap-2.3.39.tgz - Configure options: configure --libdir=/usr/lib --libexecdir=/usr/local/libexec/openldap --enable-dynamic --enable-modules --enable-monitor=mod --enable-shell=mod - Ldd output: ldd /usr/local/libexec/openldap/back_monitor.so libldap_r-2.3.so.0 => /home/ricardo/openldap-work/libraries/libldap_r/.libs/libldap_r-2.3.so.0 (0x00aa2000) liblber-2.3.so.0 => /home/ricardo/openldap-work/libraries/liblber/.libs/liblber-2.3.so.0 (0x00bc6000) libc.so.6 => /lib/tls/libc.so.6 (0x0056b000) libresolv.so.2 => /lib/libresolv.so.2 (0x00111000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x00124000) libssl.so.4 => /lib/libssl.so.4 (0x008cc000) libcrypto.so.4 => /lib/libcrypto.so.4 (0x00780000) /lib/ld-linux.so.2 (0x002f0000) libdl.so.2 => /lib/libdl.so.2 (0x00138000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00362000) libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x0013c000) libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x006a6000) libcom_err.so.2 => /lib/libcom_err.so.2 (0x00b9c000) libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x001c2000) libz.so.1 => /usr/lib/libz.so.1 (0x00f85000) - Slapd.conf: modulepath /usr/local/libexec/openldap moduleload back_monitor.la -- :: Ricardo Moreira

1 0

ACL: user who can just create but not delete entries
by Stefano Zanmarchi 21 Aug '08

21 Aug '08

Hi, I'd like to create a special user ("cn=useradmin,dc=myorg,dc=com") whose task would be creating new entries under "ou=people,dc=myorg,dc=com". My problem is that useradmin will be used by a not completely trusted application. Can I prevent useradmin from deleting or modifying entries under "ou=people,dc=myorg,dc=com"? Thank you very much for your help, Stefano

2 1

LDAP lookup problem
by Stelios A. 21 Aug '08

21 Aug '08

Hello all, I have a master and a slave Openldap server on an Ubuntu 8.0.4 server with 2.4.9 version of Openldap. I'm sing syncrepl to sync data between 2 servers. Data are transfered from master to the slave without a problem and I'm able to query the slave ldap via phpldapadmin without a problem. Having said that, as soon as I add a new user to the master ldap that is been replicated fine (I can see the user details on the slave server) but when I run from bash 'id user1' I'm getting an 'id: user1: No such user. This is happening no matter if I stop and start nscd or ldap. The sync part of the slave server is pasted below: syncrepl rid=001 provider=ldap://192.168.1.0 type=refreshOnly interval=00:00:01:00 searchbase="dc=mydomain,dc=edu,dc=com" binddn="uid=syncrepl,ou=System,dc=mydomain,dc=edu,dc=com" bindmethod=simple credentials=mypassword updateref ldap://192.168.1.0 and the ACL's into slave are: access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=edu,dc=com" write by dn="uid=syncrepl,ou=System,dc=mydomain,dc=edu,dc=com" write by dn="uid=authenticate,ou=System,dc=mydomain,dc=edu,dc=com" read by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=mydomain,dc=edu,dc=com" write by dn="uid=syncrepl,ou=System,dc=mydomain,dc=edu,dc=com" write by * read On master slave I can query any user fine. It just doesn't work on slave. nsswitch.conf is same as master: passwd: files ldap group: files ldap shadow: files ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis ldap I have no clue how to troubleshoot this problem. Any help is much appreciated. Thanks a lot

2 4

DN question
by Kós Tamás 21 Aug '08

21 Aug '08

Hi List! I got a little bit off topic problem, but I hope you can help me about it. We got an LDAP directory, with many names. We got some same CNs for instance: John Smiths. The only difference is between the 2 names is the e-mail address. How can I modify one of them? ldapmodify request DN, but our enviroment DN seems to be DN: CN=John Smiths. How can I include the e-mail address to the DN? Any help appreciated. Yours, K.T. -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life."

4 17

Re: translucent overlay with local-only entries
by Sven Ulland 20 Aug '08

20 Aug '08

Gavin Henry wrote: [...] >> Are they really correct? With local-only entries working well (as >> they should, with my recent version of openldap), I would assume >> that local-only would return local-only entries, and that >> local-and-remote would return both remote and local entries. > > So are you getting local entries at all? I see local *modifications*, yes. Example: A remote entry with uid=andrew is edited on the translucent extension with a new description. When searching, I see the locally changed description without problems. On the other hand, when I create *entries* that only exist on the translucent extension, I never see any sign of them when searching. I do see them when running slapcat, so they are indeed present in the local database. This should be fixed with Howard's 2.4.8 patch some time ago, so I can only assume there's something strange with my config or the 2.4.10 Debian build. I will try to build a vanilla OpenLDAP from source as soon as I have time. sven

2 2

How To (correctly) reference an LDAP entry
by Christian Marg 20 Aug '08

20 Aug '08

Hello, I have some entries in my own OpenLDAP server (Server A, Base: dc=tu-clausthal,dc=de) and would like to link each of them to entries stored on a foreign LDAP Server (Server B, Base: ou=X,o=Y,c=Z). I have added the "seeAlso"-attribute containing the DNs I want to link my LDAP-entries to, but since they are in another name space and on a foreign Server, they point to "nil". Do I have to rebuild the foreign namespace to just add a reference to the other server? How would I do that most cleverly on OpenLDAP? Or is there another way to create (correct) external references? Am I even using the "seeAlso" attribute correctly? bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Rechenzentrum TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2626 Germany jabber: ifcma(a)jabber.tu-clausthal.de

2 3

Re: translucent overlay with local-only entries
by Sven Ulland 20 Aug '08

20 Aug '08

Gavin Henry wrote: > ----- "Sven Ulland" <sveniu(a)ifi.uio.no> wrote: > >> Gavin Henry wrote: >> [...] >>>> Are they really correct? With local-only entries working well (as >>>> they should, with my recent version of openldap), I would assume >>>> that local-only would return local-only entries, and that >>>> local-and-remote would return both remote and local entries. >>> So are you getting local entries at all? >> I see local *modifications*, yes. Example: A remote entry with >> uid=andrew is edited on the translucent extension with a new >> description. When searching, I see the locally changed description >> without problems. >> >> On the other hand, when I create *entries* that only exist on the >> translucent extension, I never see any sign of them when searching. >> I do see them when running slapcat, so they are indeed present in >> the local database. >> >> This should be fixed with Howard's 2.4.8 patch some time ago, so I >> can only assume there's something strange with my config or the >> 2.4.10 Debian build. I will try to build a vanilla OpenLDAP from >> source as soon as I have time. > > OK, thanks. Does a slapcat of the local db show the new entries > you've added to existing remote ones? I assume you mean new and/or modified attributes. Yes, those are shown as well, with all the needed glue records in place. So as far as I can see, writing new entries/attributes works perfectly fine, but the searching does not. I'll send an update after trying the vanilla distr. sven

1 0

Re: Help with authz-regexp mapping kerberos
by Chavez, James R. 20 Aug '08

20 Aug '08

Rahul, Sorry I am not clear in my explanations. What I am trying to achieve is to login to my linux and solaris boxes from the console or through a remote ssh session using Active directory or kerberos credentials and have that effectively map to my users that exist in the LDAP directory. And this works with a catch.. If the username in LDAP (joe_montana) matches the kerberos principal name (joe_montana) I have no issue.. I login using the kerberos username and password and the uid, gid, for that user in LDAP is correct when issuing the id command. So effectively it uses the kerberos credentials and logs me in as that ldap user. Pam-krb is used for authentication and things seem beautiful. However in this case, I have user's with the 8 character unix naming convention(migrated from NIS). I am trying to find the correct way to map that username to the kerberos username. There has got to be a way!! Actually reading over the openldap Admin guide, I see that it mentions using passthrough authentication to an Active directory server. Seems this is done by modifying the userPassword attribute of the ldap dn. As I understand from reading the guide, for my user jmontana the entry should look something like this.. dn: cn=jmontana,ou-People,dc=example,dc=com userPassword: {SASL}joe_montana(a)EXAMPLE.COM However all the userPassword attributes for the users are encrypted. I delete the dn's userPassword attribute first off. But when I attempt to add the userPassword attribute with the ldif below I still get an encrypted password in the userPassword attribute. How can I get the entry to show {SASL}joe_montana(a)EXAMPLE.COM? Is there something in slapd.conf or ldap.conf I need to modify? I may be barking up the wrong tree but it sounds like what I need. dn: uid=jmontana,ou=People,dc=example,dc=com changetype: modify add: userPassword userPassword: {SASL}joe_montana(a)EXAMPLE.COM Also the Openldap Admin guide mentions that "the server must be built with the --enable-spasswd configuration option to enable pass-through authentication." I am not sure how to check if this is the case. This is a RHEL5 box with openldap-servers-2.3.27-8 rpm. I did not install from source, I used Red Hat's precompiled RPM. Having to install from source is a whole other can of worms. But I will do what I have to. Thank you much James 1. Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL (Rahul Amaram) ---------------------------------------------------------------------- Message: 1 Date: Sun, 17 Aug 2008 11:30:25 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL To: openldap-technical(a)openldap.org Message-ID: <48A7BE79.2080704(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed This is the flow of events. 1. First GSSAPI (Kerberos) authentication takes place using the id "joe_montana". 2. Then LDAP gives this the DN "uid=joe_montana,cn=REALM,cn=gssapi,cn=auth". 3. Using authz-regexp, we can map this to another DN such as "uid=jomontana,ou=People,dc=company,dc=com" which I believe makes sense only to LDAP. Getting back to your query, could you precisely define what is it that you are trying to achieve? If you could give a clear step-to-step example of the workflow, then I might be able to be of some assistance. Regards, Rahul. Chavez, James R. wrote: > > Rahul, > Thank you again..I will try this expression you have provided. > Am I going about this in the correct way? What I want is to login > through ssh or even the local box and be authenticated by the kerberos > credentials. But I want the effective uid or account to be that of the > ldap user in the openldap directory. > I want my kerberos credentials to authorize my ldap login even though > the account names do not match. Is it possible with this authz-regexp? > Or is this simply for services. > Sorry for all the questions. > > Thanks > James > > > > Message: 1 > Date: Wed, 13 Aug 2008 15:08:43 +0530 > From: Rahul Amaram <rahul(a)synovel.com> > Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos > identity to dn --RAHUL > Cc: openldap-technical(a)openldap.org > Message-ID: <48A2ABA3.9090900(a)synovel.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Chavez, > Try this expression. It should work. > > authz-regexp uid=(.).*_([^,]*),cn=company.com,cn=gssapi,cn=auth > uid=$1$2,ou=People,dc=company,dc=com > > > The "sasl-realm" parameter is set in /etc/slapd/slapd.conf (main > slapd.conf file). You might also be interested in sasl-host (for > hard-coding the host sasl fqdn name to be used while fetching > ldap/<fqdn>@<REALM> password from the keytab file) and sasl-secprops > parameters. > > Regards, > Rahul. > > Chavez, James R. wrote: > >> >> Rahul, >> My friend finally a response. >> Thank you for the input I had also read that link you provided, it >> was >> > > >> somewhat helpful. If the usernames were identical that would work >> great I believe. However the source name is coming in as joe_montana >> and I need it to map to jmontana. >> So I need only the first character of the first name and everything >> after the underscore (last name). I am looking for the expression >> that >> > > >> would give me that. I am not too familiar with the expressions syntax >> or how to manipulate them. I see there is an option to search ldap >> using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I >> should look into that. Do you have any suggestions or source for >> reading on authz-regexp? I have been looking. If it was shell >> scripting I could manage another way. >> >> When you say the SASL Realm would that go in the main slapd.conf or >> the /usr/lib/sasl2/slapd.conf? >> >> I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting >> close,just gotta get past this. :) >> >> Thank you again. >> James >> >> >> >> >> ------------------------------ >> CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

Cannot find 2 particular users
by Stelios A. 19 Aug '08

19 Aug '08

Hello all, I'm going mad with this problem. Suddenly and without doing any modification 2 particular users cannot bind on slave ldap. Example: root@slaveldap:~# id user1 id: psamara: No such user root@slaveldap:~# id user2 id: idanias: No such user root@slaveldap:~# id stelios uid=1000(stelios) gid=100(users) groups=100(users) root@slaveldap:~# The above commands run fine on the master ldap server. Doing a search on slaveldap finds both user1 and user2. Because of the above lookup problem I cannot send emails to those 2 users as I'm getting the following error from the email server which is running on the same machine. Requested action not taken: mailbox unavailable 550 5.1.1 <user1(a)mydomain.com>: Recipient address rejected: User unknown in local recipient table I have no clue what is going on and how to solve it. I also try to delete and re-create the users but with same results. Any ideas? Thanks a lot

3 3

Re: translucent overlay with local-only entries
by Sven Ulland 19 Aug '08

19 Aug '08

Gavin Henry wrote: > ----- "Sven Ulland" <sveniu(a)ifi.uio.no> wrote: >> Gavin Henry wrote: >>> Did you read the man page? man slapo-translucent >> I did, but the significance of translucent_local and _remote didn't >> strike me. Unfortunately it seems that enabling local+remote >> searching doesn't change the result. I must have a silly bug in my >> configuration, but I cannot figure out where. >> >> Various combinations of translucent_local and _remote give different, >> but consistent, results: >> >> neither local nor remote: only remote entries returned >> local only: no entries returned >> remote only: only remote entries returned >> local and remote: only remote entries returned > > These are corrent results and are documented in the slapo-translucent man page. Are they really correct? With local-only entries working well (as they should, with my recent version of openldap), I would assume that local-only would return local-only entries, and that local-and-remote would return both remote and local entries. >> I use the following in my slapd.conf[1]: >> >> translucent_remote uid >> translucent_local uid > > Do you have uid indexed? Yes, and I have tried rebuilding the index (and set proper file ownership afterwards) several times. 'uid' is indexed on the main ldap and on the translucent one, using 'index uid eq,sub'. No effect. I search using equality with ldapsearch. I tried switching between bdb and hdb, also without any effect. It seems I have to dive into the code to resolve this one. sven

1 0

slapadd error when I add ldif file which export from Windows AD
by 绍庚曾 19 Aug '08

19 Aug '08

Hello ,all! First, I'm sorry for my poor english. In windowsXP, I export whole Windows AD as a ldif file by a tool called "Softerra LDAP Browser 2.6". But in my CentOS4.6, when I import this ldif file, It occured an error message: slapadd: could not parse entry (line=56) I find this ldif file contains some private objectclass, so I try to search the corresponding schema files in Windows AD server, but I find nothing.Whether the is a way to directly import the ldif file to OpenLDAP which export from a Windows AD server? By the way ,my OpenLDAP version is 2.2.13. Any help will be really appreciated. With Best regards!

1 0

Re: Proxying data for syncrepl
by ghenry＠OpenLDAP.org 18 Aug '08

18 Aug '08

----- "Gavin Henry" <ghenry(a)suretecsystems.com> wrote: > Yes, and that it is "proxying" data. Openldap as the remove has what > is needed, domino does not. Bonnie, that meant to say, "as the remote". For example, the OpenLDAP remote side might have an entry like so: # gavin.henry(a)suretecsystems.com, MailAliases, suretecsystems.com dn: cn=gavin.henry(a)suretecsystems.com,ou=MailAliases,dc=suretecsystems,dc=com structuralObjectClass: suretecMailAlias entryUUID: fdbf98ca-3118-102c-9eee-c3b0278f5eab creatorsName: cn=admin,dc=suretecsystems,dc=com createTimestamp: 20071127094345Z entryCSN: 20071127130047.357178Z#000000#000#000000 modifiersName: cn=admin,dc=suretecsystems,dc=com modifyTimestamp: 20071127130047Z entryDN: cn=gavin.henry(a)suretecsystems.com,ou=MailAliases,dc=suretecsystems,dc =com subschemaSubentry: cn=Subschema hasSubordinates: FALSE Note the entryCSN and entryUUID as per: RFC 4533 LDAP Content Synchronization Operation June 2006 [Page 28] Appendix A. CSN-based Implementation Considerations ...the server not only maintains a CSN for each directory entry (the entry CSN) but also maintains a value that we will call the context CSN. The context CSN is the greatest committed entry CSN that is not greater than any outstanding (uncommitted) entry CSNs for all entries in a directory context. The values of context CSN are used in syncCookie values as synchronization state indicators. These are what Syncrepl needs, and because the remote side you are proxying has them, all is well. Now take an entry from Active Directory on Windows Server 2008: dn: CN=Administrator,CN=Users,DC=ad,DC=suretecsystems,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Administrator description: Built-in account for administering the computer/domain distinguishedName: CN=Administrator,CN=Users,DC=ad,DC=suretecsystems,DC=com instanceType: 4 whenCreated: 20080818193354.0Z whenChanged: 20080818195251.0Z uSNCreated: 8194 memberOf: CN=Group Policy Creator Owners,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Domain Admins,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Enterprise Admins,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Schema Admins,CN=Users,DC=ad,DC=suretecsystems,DC=com memberOf: CN=Administrators,CN=Builtin,DC=ad,DC=suretecsystems,DC=com uSNChanged: 12715 name: Administrator objectGUID:: vuyXNovZB06PgC486y0UjA== userAccountControl: 512 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 128635631238177500 lastLogoff: 0 lastLogon: 128635645180075000 logonHours:: //////////////////////////// pwdLastSet: 128635613297241250 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAA4IX8iXHsQkLUe6ZE9AEAAA== adminCount: 1 accountExpires: 0 logonCount: 13 sAMAccountName: Administrator sAMAccountType: 805306368 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=ad,DC=suretecsystems,DC=com isCriticalSystemObject: TRUE dSCorePropagationData: 20080818193742.0Z dSCorePropagationData: 16010101000005.0Z lastLogonTimestamp: 128635619492443750 There is no entryCSN or entryUUID. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: Re: Proxying data for syncrepl
by Gavin Henry 18 Aug '08

18 Aug '08

Yes, and that it is "proxying" data. Openldap as the remove has what is needed, domino does not. ---- Original Message ---- From: Luca <luca.scamoni(a)sys-net.it> To: Bonnie <Bonnie.Oostenbrug(a)indaal.de>, Cc: openldap-technical <openldap-technical(a)openldap.org>, Sent: Mon, 18 Aug 2008 19:07 (GMT +0100) GMT+01:00 Subject: Re: Proxying data for syncrepl Because syncrepl depends heavily on entryUUID and entryCSN that are not provided by domino?

1 0

Proxying data for syncrepl
by Bonnie.Oostenbrug＠indaal.de 18 Aug '08

18 Aug '08

Hi, I am trying to set up the following configuration. Unfortunately, without much luck so far. 1. A Directory Server capable of LDAP e.g. LotusDomino, OpenLDAP, AD, etc.... (This Server isn't/can't be specially configured for replication. I can only ensure that the schema is correct. That is the whole point of my undertaking - because Lotus Domino/AD support it. 2. OpenLDAP configured as Proxy with a database of type LDAP with overlay syncprov configured and a uri that points to my Directory Server 3. A Consumer with a database of type BDB configured for syncrepl with my proxy as provider The whole idea is to be able to use this setup to incorporate information from diverse legacy directory servers and get it into a manageable standard OpenLDAP Directory. Without exports etc. I need to have the data replicated down local to my consumer due to Network restrictions. I want to be able to point my Proxy at 3 different Directory Servers and replicate this content down to a single consumer. If I set up the configuration using an OpenLDAP Server as my Directory Server it works. (more or less*) But when I change the proxy to point to e.g. Lotus Domino as my Directory Server I get the error "got empty SyncUUID with LDAP_SYNC_ADD" and the content doesn't replicate down from the Directory Server. Although I see activity on my proxy - he queries my Directory Server. Did I bite off to much for a newbie or am I missing something obvious?? Thanks for ideas in which direction I need to be looking! Bonnie (* the more or less refers to the fact that changes made to the Directory Server content don't replicate down unless I restart the Proxy. Then the changes are immediately replicated to the consumer..... I'm still working on that one??)

3 3

Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL
by Chavez, James R. 16 Aug '08

16 Aug '08

Rahul, Thank you again..I will try this expression you have provided. Am I going about this in the correct way? What I want is to login through ssh or even the local box and be authenticated by the kerberos credentials. But I want the effective uid or account to be that of the ldap user in the openldap directory. I want my kerberos credentials to authorize my ldap login even though the account names do not match. Is it possible with this authz-regexp? Or is this simply for services. Sorry for all the questions. Thanks James Message: 1 Date: Wed, 13 Aug 2008 15:08:43 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL Cc: openldap-technical(a)openldap.org Message-ID: <48A2ABA3.9090900(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Chavez, Try this expression. It should work. authz-regexp uid=(.).*_([^,]*),cn=company.com,cn=gssapi,cn=auth uid=$1$2,ou=People,dc=company,dc=com The "sasl-realm" parameter is set in /etc/slapd/slapd.conf (main slapd.conf file). You might also be interested in sasl-host (for hard-coding the host sasl fqdn name to be used while fetching ldap/<fqdn>@<REALM> password from the keytab file) and sasl-secprops parameters. Regards, Rahul. Chavez, James R. wrote: > > Rahul, > My friend finally a response. > Thank you for the input I had also read that link you provided, it was > somewhat helpful. If the usernames were identical that would work > great I believe. However the source name is coming in as joe_montana > and I need it to map to jmontana. > So I need only the first character of the first name and everything > after the underscore (last name). I am looking for the expression that > would give me that. I am not too familiar with the expressions syntax > or how to manipulate them. I see there is an option to search ldap > using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I > should look into that. Do you have any suggestions or source for > reading on authz-regexp? I have been looking. If it was shell > scripting I could manage another way. > > When you say the SASL Realm would that go in the main slapd.conf or > the /usr/lib/sasl2/slapd.conf? > > I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting > close,just gotta get past this. :) > > Thank you again. > James > > > > > ------------------------------ > > Message: 2 > Date: Mon, 11 Aug 2008 17:54:02 +0530 > From: Rahul Amaram <rahul(a)synovel.com> > Subject: Re: Help with authz-regexp mapping kerberos identity to dn > ....SASL > To: openldap-technical(a)openldap.org > Message-ID: <48A02F62.1000305(a)synovel.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Chavez, > This is the authz-regexp string I have used in slapd.conf: > > authz-regexp uid=([^,]*),cn=synovel.com,cn=gssapi,cn=auth > uid=$1,ou=People,dc=synovel,dc=com > > This works if the SASL auth mechanism is gssapi. I have also > hard-coded the SASL Realm with the below config option: > > sasl-realm SYNOVEL.COM > > If it uses the default realm (i.e. sasl-realm option is missing) then > the string would probably be: > > authz-regexp uid=([^,]*),cn=gssapi,cn=auth > uid=$1,ou=People,dc=synovel,dc=com > > > Hope this is of some assistance. For furthur information, kindly read > http://www.openldap.org/doc/admin24/sasl.html#Mapping%20Authentication > %2 > 0Identities > . > > Regards, > Rahul. > > Chavez, James R. wrote: > >> Hello all, >> My plan is to use Kerberos and LDAP as a replacement for NIS. >> My issue is that I need my kerberos credentials to map to a user in >> > LDAP > >> so I can avoid permission issues when logging in with kerberos creds. >> All the perms are based on the UNIX/LDAP users and groups. Thing is >> > the > >> user id's are different between kerberos and LDAP. >> The kerberos names consist of firstname_lastname@REALM. The ldap >> > entries > >> are in the format of standard Unix user names or first letter of >> first name and up to 7 characters of the last name (jmontana). I >> migrated >> > the > >> LDAP entries from my existing NIS maps. >> Now I understand that I can use SASL and authz-regexp in slapd.conf >> to map these id's. Please correct me if I am wrong. >> >> I added all the corresponding "krbName: first_last@REALM" to the >> > users > >> when I added them to the LDAP directory. >> For example for user Joe Montana..His ldap dn is "dn: >> uid=jmontana,ou=People,dc=test,dc=example,dc=com" >> His uid is "uid: jmontana >> And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" >> >> I think all the data is there to get a mapping I just am unsure of >> the auth-regexp strings I need to add to the slapd.conf file. >> Does anyone out there have any experience with this and better yet >> provide the string or example of what strings I can use? >> I have searched the net on how to authenticate with kerberos and >> effictively login with a local id but have been unsuccessful in my >> search. >> Appreciate any help. >> >> Thank You >> James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

How to build custom backend database?
by Ricardo Moreira 15 Aug '08

15 Aug '08

Hi, I am trying to create a custom backend database. I have read http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/12.html<http://www.umich.edu/%7Edirsvcs/ldap/doc/guides/slapd/12.html>and just created my custom API as indicated but I don't know how to make "configure" create the makefile for my custom backend? Do I have to edit "configure.in" and see how the other backends are configured to create my custom code? Regards, -- :: Ricardo Moreira

2 2

DN question
by Kós Tamás 15 Aug '08

15 Aug '08

2008/8/15 Andrew Findlay <andrew.findlay(a)skills-1st.co.uk>: > On Fri, Aug 15, 2008 at 10:41:54AM +0200, Kós Tamás wrote: > >> >> I got a little bit off topic problem, but I hope you can help me about >> >> it. We got an LDAP directory, with many names. We got some same CNs >> >> for instance: John Smiths. The only difference is between the 2 names >> >> is the e-mail address. How can I modify one of them? ldapmodify >> >> request DN, but our enviroment DN seems to be DN: CN=John Smiths. >> >> How can I include the e-mail address to the DN? > >> Thank for your help. I tried to search with this command: >> ldapsearch -xv -h host.somewhere.net -D "CN=jsmiths,O=ACME" -w >> password mail=jsmiths(a)moewhere.net+CN=John\ Smiths >> Nothing found... > > Ah - we have some confusion here. Michael and I both replied to your > first message assuming that you wanted to add new entries for two > people with the same name. I now think that you are trying to > find and modify an existing entry. Yes, we want to modify existing entries, which could be same CN, the unique is the mail attribute. > If you already have two people in the directory who have the same name > then they must have different DNs. It does not matter what those DNs > are - we just need to find them. It looks as if the mail address is > the best way to select the one you want so the search should look > something like this: > > ldapsearch -x -h host.somewhere.net -D "CN=jsmiths,O=ACME" \ > -w password -b O=ACME mail=jsmiths(a)moewhere.net > In this directory where are the two John Smiths don't have Organization, because it has been synchronised from an other directory. The unique attribute is the mail address... The Acme organization needs for only the authentication. I could write admin, not jsmiths. Sorry. > Note that I am assuming that there really is a user with DN > "CN=jsmiths,O=ACME". If not, you will get an "Invalid credentials" > error. In many directories you do not need to specify the DN and > password as they allow anonymous users to search and read. > > Note also that I have supplied a base for the search with the -b > flag. If you do not do this you will get a "No such object" error. > The base object must exist. > >> This persons don't have O or DC attributes. >> Can I ask you to give me some examples for searches and to modify >> people by mail and CN attributes. > > Get the search working first, to find the DN of the entry. > To modify the entry using command-line tools you will need to write > a small LDIF file. Let us assume that you want to add a phone > number to CN=jsmiths,O=ACME: > > dn: CN=jsmiths,O=ACME > changetype: modify > add: telephonenumber > telephonenumber: +1 234 567 890 > > (the file should end with a blank line). > > Now the command will be: > > ldapmodify -x -h host.somewhere.net -D "CN=jsmiths,O=ACME" \ > -w password -f FILENAME > > This assumes that the user "CN=jsmiths,O=ACME" is allowed > to modify their own entry. > > Why not try jXplorer? I will try it, thanks for the idea. > > Andrew > -- > ----------------------------------------------------------------------- > | From Andrew Findlay, Skills 1st Ltd | > | Consultant in large-scale systems, networks, and directory services | > | http://www.skills-1st.co.uk/ +44 1628 782565 | > ----------------------------------------------------------------------- > -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life." -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life."

1 0

Re: ldap_bind: Can't contact LDAP server (-1)
by Michael Ströder 14 Aug '08

14 Aug '08

Kristen Walker wrote: > >> Kristen, please stay on the mailing list you started the thread. Don't >> e-mail me solely personally. > > Sorry about that. Again: Please, use your "Reply to all" button! >> Kristen Walker wrote: >>> Thanks for your help. I can't seem to be able to start the server with the >>> -d flag. Here is what I tried: >>> >>> su root -c /usr/local/libexec/slapd -d 65535 >>> >>> I also tried: >>> >>> su root -d 65535 -c /usr/local/libexec/slapd >>> >>> And it complains in both cases that -d is an invalid option. >> Using -d works for me. Which version of OpenLDAP is this? >> >> Can you post any output it produces? > > I am using openldap-2.3.39 on Ubuntu. > > Here is the output: > > su root -d 65535 -c /usr/local/libexec/slapd > su: invalid option -- d > Usage: su [options] [LOGIN] Obviously this is wrong since you use option -d for the su command. How about doing "su -" just to get root and then use /usr/local/libexec/slapd -d 65535 [..other needed args..] You also have to check your syslog and which user is running slapd normally. Ciao, Michael.

1 0

Re: allow admin group to write excluding specific users
by Gavin Henry 14 Aug '08

14 Aug '08

----- "Stelios A." <stelios.a(a)gmail.com> wrote: > No, i have seperated Groups like: > > dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr > cn: IT > objectClass: groupOfUniqueNames > uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com > uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com > > and all users under ou=Users,dc=mydomain,dc=edu,dc=com OK, just grant one group write and not the other. Remember, ACLs are accessed from top down. There are plenty of examples on the FAQ: http://www.openldap.org/faq/data/cache/52.html Again, also read the man page. Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: allow admin group to write excluding specific users
by Stelios A. 14 Aug '08

14 Aug '08

No, i have seperated Groups like: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com and all users under ou=Users,dc=mydomain,dc=edu,dc=com Thanks 2008/8/14 Gavin Henry <ghenry(a)openldap.org>: > Stelios A. wrote: >> >> Hello, >> >> I have a group called IT and another one called LDAP Admins. There are >> 5 users under IT and 2 under LDAP Admins. >> I'm looking for an acl where members of IT (groupOfUniqueNames) can >> modify/write anywhere under ou=Users.... apart from those users under >> the LDAP Admins group. >> Can anyone give me a help about this please. >> >> I've found only how to give access to IT group but not how to exclude >> LDAP Admins (2 in total) where those 2 exist also under IT group. >> >> Any ideas? > > Your DIT sounds a bit messy. Do you have groups under ou=Users? > > What is your design? > > BTW, man slapd.access > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > -- Stelios A

1 0

Drupal/OpenLDAP integration
by Jeff Sussna 13 Aug '08

13 Aug '08

Anyone have success integrating Drupal with OpenLDAP via the ldapauth module? I've been thrashing all day. Have read Drupal posts that imply others have thrashed as well. Details of my pain are at http://drupal.org/node/295029 . Thx, Jeff

2 1

Re: Drupal/OpenLDAP integration
by Jeff Sussna 13 Aug '08

13 Aug '08

Never mind. I am a blithering idiot. When I changed user passwords in JXplorer, I clicked OK in the password dialog, but then forgot to click Submit in the main window, so the changes never took effect. Tried againd and did it right this time, and everything works just fine. Good news is that I can attest that integrating Drupal with OpenLDAP is trivial, as long as you have a few brain cells left to spare :-).

1 0

NewBi: Trying to setup a custom project.
by Flip Vernooij 13 Aug '08

13 Aug '08

Hi all, For a project at work I need to setup a LDAP server and make it possible to authenticate allot of (yet unwriten) applications. I have been reading for the past 2 days on the internet about this issue but I have the feeling I do not have enough knowledge to provide a correct setup. The idea is that there are a few different ou¹s holding several users. These users all hold login-profiles for the applications we are developping right now. Alldue this sounds kinda logic, I do not exactly understand how the authentication should take place. Lets say: Dn=domain,dn=com ou=test -user name=me pass=secret --app_1 username=appuser password=appSecret ap_related_opt=variable --app_2 username=app2user password=app2secret other_ap_related_opt=variable --app_3 username=app3user password=app3secret other_ap_related_opt=variable -user /// Next user holding the same structure. Now I wrote a master_app that should handle the authentication using LDAP. It received the ³me² username with corresponding password and must fetch a list of profiles used for the requested applications (say app_1 and app_2) I¹m still in doubt about the app username and password, as without a matching profile, application access would be denied anyways so I could store some acl values to (is that right?) Am I on the right track here, any ideas sugestions links or examples? Thanks for reading! Flip Vernooij

1 0

allow admin group to write excluding specific users
by Stelios A. 13 Aug '08

13 Aug '08

Hello, I have a group called IT and another one called LDAP Admins. There are 5 users under IT and 2 under LDAP Admins. I'm looking for an acl where members of IT (groupOfUniqueNames) can modify/write anywhere under ou=Users.... apart from those users under the LDAP Admins group. Can anyone give me a help about this please. I've found only how to give access to IT group but not how to exclude LDAP Admins (2 in total) where those 2 exist also under IT. Thanks

1 0

Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL
by Chavez, James R. 13 Aug '08

13 Aug '08

Rahul, My friend finally a response. Thank you for the input I had also read that link you provided, it was somewhat helpful. If the usernames were identical that would work great I believe. However the source name is coming in as joe_montana and I need it to map to jmontana. So I need only the first character of the first name and everything after the underscore (last name). I am looking for the expression that would give me that. I am not too familiar with the expressions syntax or how to manipulate them. I see there is an option to search ldap using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I should look into that. Do you have any suggestions or source for reading on authz-regexp? I have been looking. If it was shell scripting I could manage another way. When you say the SASL Realm would that go in the main slapd.conf or the /usr/lib/sasl2/slapd.conf? I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting close,just gotta get past this. :) Thank you again. James ------------------------------ Message: 2 Date: Mon, 11 Aug 2008 17:54:02 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Help with authz-regexp mapping kerberos identity to dn ....SASL To: openldap-technical(a)openldap.org Message-ID: <48A02F62.1000305(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Chavez, This is the authz-regexp string I have used in slapd.conf: authz-regexp uid=([^,]*),cn=synovel.com,cn=gssapi,cn=auth uid=$1,ou=People,dc=synovel,dc=com This works if the SASL auth mechanism is gssapi. I have also hard-coded the SASL Realm with the below config option: sasl-realm SYNOVEL.COM If it uses the default realm (i.e. sasl-realm option is missing) then the string would probably be: authz-regexp uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=People,dc=synovel,dc=com Hope this is of some assistance. For furthur information, kindly read http://www.openldap.org/doc/admin24/sasl.html#Mapping%20Authentication%2 0Identities . Regards, Rahul. Chavez, James R. wrote: > Hello all, > My plan is to use Kerberos and LDAP as a replacement for NIS. > My issue is that I need my kerberos credentials to map to a user in LDAP > so I can avoid permission issues when logging in with kerberos creds. > All the perms are based on the UNIX/LDAP users and groups. Thing is the > user id's are different between kerberos and LDAP. > The kerberos names consist of firstname_lastname@REALM. The ldap entries > are in the format of standard Unix user names or first letter of first > name and up to 7 characters of the last name (jmontana). I migrated the > LDAP entries from my existing NIS maps. > Now I understand that I can use SASL and authz-regexp in slapd.conf to > map these id's. Please correct me if I am wrong. > > I added all the corresponding "krbName: first_last@REALM" to the users > when I added them to the LDAP directory. > For example for user Joe Montana..His ldap dn is "dn: > uid=jmontana,ou=People,dc=test,dc=example,dc=com" > His uid is "uid: jmontana > And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" > > I think all the data is there to get a mapping I just am unsure of the > auth-regexp strings I need to add to the slapd.conf file. > Does anyone out there have any experience with this and better yet > provide the string or example of what strings I can use? > I have searched the net on how to authenticate with kerberos and > effictively login with a local id but have been unsuccessful in my > search. > Appreciate any help. > > Thank You > James > > CONFIDENTIALITY > This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. > ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity. > > CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

implicit context attribute in add request
by Wolfgang Bergbauer 12 Aug '08

12 Aug '08

Hi all, I have a problem with the standard JNDI LDAP bind request and wanted to know if OpenLdap behaves differently: e.g. when creating and object with a LDAP addRequest with a context of umObjectGUID=0, OU=People, DC=avaya then I will automatically get a attribute: umObjectGUID with value "0". So this is implicit, I do not specify this attribute. Unfortunately the ldap server then responds that this attribute is readOnly. Can anyone tell me if OpenLdap also add this implicit context attribute, or perhaps what other options do I have here? Thanks a lot, Wolfgang

1 0

ACL's for admin users
by Aravind Arjunan 12 Aug '08

12 Aug '08

hi, In my openldap i created a OU called india under this ou there are many users and one administrator as admin. I want this admin user to add and modify the users details only in this ou. for that i need to set the access control list. Can any one plz help me how to set acl's for this case. Remaining users have only read only permissions. eg: ou=india cn=admin---administrator cn=sachin cn=rahul cn=saurav cn=anil

2 1

allow admin group to write excluding specific users
by Stelios A. 12 Aug '08

12 Aug '08

Hello, I have a group called IT and another one called LDAP Admins. There are 5 users under IT and 2 under LDAP Admins. I'm looking for an acl where members of IT (groupOfUniqueNames) can modify/write anywhere under ou=Users.... apart from those users under the LDAP Admins group. Can anyone give me a help about this please. I've found only how to give access to IT group but not how to exclude LDAP Admins (2 in total) where those 2 exist also under IT group. Any ideas? Thanks

1 0

Re: mail Routing thorugh openldap attribute
by Santosh Balan 11 Aug '08

11 Aug '08

Hi, Create an MX record in your DNS server with the IP of the server, to which you need to divert your mails to and then give the host's name in mailHost attribute of LDAP. Regards Santosh Balan > ----- Original Message ----- > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Subject: Re: mail Routing thorugh openldap attribute > Date: Thu, 07 Aug 2008 14:18:31 +0200 > > > "Aravind Arjunan" <aravind.arjunan(a)gmail.com> writes: > > > hi, > > > > I had configured mailserver in postfix and integrated openldap with postfix. > > All my users information is in openldap. > > > > Now i need to route my mail for particular user to his respective mail box. > > eg: > [...] > > > > So when i send mail to user1 , it will first check the mail > > address is correct or not from ldap entries > > and check mailHost for the particular user and must go the > > particular SMTP server where i had mentioned > > in mailHost attribute in ldap. > > > > But for me it is checking the mailHost attribute and i had > > mentioned the IP of the SMTP server in my LDAP > > for mailHost attribute.So for me it checks the mailHost attribute > > and delivering the mail in the same > > SMTP server by creating the IP as the username and droping the mail > > > > Any body plz guide me home to route the mail to the particular user > > . > > http://www.postfix.org/LDAP_README.html > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://www.dkluenter.de > GPG Key ID:8EF7B6C6 > 53°08'09,95"N > 10°08'02,42"E > = -- Powered by Outblaze

1 0

Help with authz-regexp mapping kerberos identity to dn ....SASL
by Chavez, James R. 11 Aug '08

11 Aug '08

Hello all, My plan is to use Kerberos and LDAP as a replacement for NIS. My issue is that I need my kerberos credentials to map to a user in LDAP so I can avoid permission issues when logging in with kerberos creds. All the perms are based on the UNIX/LDAP users and groups. Thing is the user id's are different between kerberos and LDAP. The kerberos names consist of firstname_lastname@REALM. The ldap entries are in the format of standard Unix user names or first letter of first name and up to 7 characters of the last name (jmontana). I migrated the LDAP entries from my existing NIS maps. Now I understand that I can use SASL and authz-regexp in slapd.conf to map these id's. Please correct me if I am wrong. I added all the corresponding "krbName: first_last@REALM" to the users when I added them to the LDAP directory. For example for user Joe Montana..His ldap dn is "dn: uid=jmontana,ou=People,dc=test,dc=example,dc=com" His uid is "uid: jmontana And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" I think all the data is there to get a mapping I just am unsure of the auth-regexp strings I need to add to the slapd.conf file. Does anyone out there have any experience with this and better yet provide the string or example of what strings I can use? I have searched the net on how to authenticate with kerberos and effictively login with a local id but have been unsuccessful in my search. Appreciate any help. Thank You James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

Updating password in slave ldap server
by Gustavo Mendes de Carvalho 11 Aug '08

11 Aug '08

Hi All, I have 2 LDAP Servers (1 master and 1 slave) and I synchronize bdb database by slurp daemon. So, when somebody needs to update his/her password or other information, everything is done in master server and then slave server receives this updates. This 2 servers are in the same physical place. Now I am planning to put another LDAP slave in other geographical place (far from this 2 servers) and because of that I am planning to put some slave server receiving all updates from master server, but in all ldap client machines in this new location I would like to configure this new slave server (Slave server 2) as URI host in ldap.conf files. I mean Location 1: Master server 1 and slave server 1 Location 2: Slave server 2 Is there any way to do: 1. ldap client machines in location 2 to authenticate using Slave server 2 ? 2. when client machines needs to change some ldap information (like password or personal information), to force this update to occurs in slave server 2 and then master server 1 receives this uodate ? Do I have to use 2 Master servers (1 in each location) ? If yes, can I synchronize both BDB databases ? How ? Any other suggestions ? Thanks in advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 4

using query filter with dynlist attributes
by Rahul Amaram 09 Aug '08

09 Aug '08

Hi, I would like to know if it is possible to use the dynamic attributes (obtained by dynlist overlay), in a ldapsearch query filter. I have tried using it but it does not seem to be working. Is there any fix for this or is there any other overlay which will allow me to perform an operation similar to sql join across different DN? Thanks and Regards, Rahul.

2 1

RE: LDAP Group Membership Scalability
by Jeff Sussna 08 Aug '08

08 Aug '08

Fantastic! What I was hoping/expecting to hear :-). ________________________________________ From: Gavin Henry [ghenry(a)OpenLDAP.org] Sent: Friday, August 08, 2008 4:57 PM To: Jeff Sussna Cc: openldap-technical(a)openldap.org Subject: Re: LDAP Group Membership Scalability Jeff Sussna wrote: > I am looking into using OpenLDAP to manage users and groups for my > system. A single group may contain up to 50,000 users. Does the LDAP > group membership mechanism suffer any scalability problems at that size? > > --------------------------------------------------------------- > Jeff Sussna > No. Some fortune 50s have every employee in an OpenLDAP Dynamic Group. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

LDAP Group Membership Scalability
by Jeff Sussna 08 Aug '08

08 Aug '08

I am looking into using OpenLDAP to manage users and groups for my system. A single group may contain up to 50,000 users. Does the LDAP group membership mechanism suffer any scalability problems at that size? --------------------------------------------------------------- Jeff Sussna

3 2

Using logical operators in LDAP queries.....
by ashish mahamuni 08 Aug '08

08 Aug '08

Hello everybody... I've my own objectClass called 'Agency'. It has fields called 'radius' and 'agencyName'. I want to find out all 'agencyNames' such that 'radius' is less than 400. How can I achieve this? Regards Ashish Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

3 4

Basic Master/Slave replication, take slave down, slave hangs
by Brad T Waldorf 07 Aug '08

07 Aug '08

This may be problem that's been fixed from 2.4.6 to 2.4.11. I'm hoping someone recognizes it and can confirm it's been fixed. (We committed to 2.4.6 for the short term future.) We've got basic refreshAndPersist replication working fine. Replication declarations from the master slapd.conf... overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Replication declarations from the slave slapd.conf.... syncrepl rid=123 provider=ldap://<masterIP>:389 type=refreshAndPersist retry="120 +" searchbase="o=replDB" bindmethod=simple binddn="cn=replman,o=replDB" credentials=password When we shut down the slave, the slave hangs. Here's the debug log... daemon: closing 12582954+ slapd shutdown: waiting for 1 threads to terminate+ =.do_syncrepl rid=123+ connection_get(12582955)+ connection_get(12582955): got connid=0+ daemon: removing 12582955r+ ldap_free_request (origid 2, msgid 2)+ ldap_free_connection 1 1+ ldap_send_unbind+ ber_flush2: 7 bytes to sd 12582955+ 0000: 30 05 02 01 03 42 00 0....B. + ldap_write: want=7, written=7+ 0000: 30 05 02 01 03 42 00 0....B. + ldap_free_connection: actually freed+ We think the problem is with the following code in tpool.c. Specifically, ltp_open_count has a value of 1, so we're stuck in a loop. If we set ltp_open_count to 0, the server comes down properly. At that point we can restart it again. while (pool->ltp_open_count) { if (!pool->ltp_pause) ldap_pvt_thread_cond_broadcast(&pool->ltp_cond); ldap_pvt_thread_cond_wait(&pool->ltp_cond, &pool-> ltp_mutex); } Does this problem look familiar to anyone? Once again, we apologize for being on a backlevel release... but we committed to 2.4.6 for the first release, which is coming up shortly. We'll be upgrading for future releases... and we're hoping this problem (if it is a real problem) has been fixed. Thanks in advance...

2 1

RE : [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 07 Aug '08

07 Aug '08

Hi All I found my error about this problem. I correct the right of certificate ssl files. Regards for all Karim Bourenane 112 Av. Charles de Gaules 92520 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com <http://www.equant.com/> ********************************* This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender. ********************************

1 0

mail Routing thorugh openldap attribute
by Aravind Arjunan 07 Aug '08

07 Aug '08

hi, I had configured mailserver in postfix and integrated openldap with postfix. All my users information is in openldap. Now i need to route my mail for particular user to his respective mail box. eg: user1(a)afnet.com to machine1 user2(a)afnet.com to machine2 So in openldap i had added attribute like for user1 mail: user1(a)afnet.com mailHost: machine1(IP) or Hostname mailRoutingAddress: user1(a)afnet.com for user2 mail: user2(a)afnet.com mailHost: machine2(IP) or Hostname mailRoutingAddress: user2(a)afnet.com In /etc/postfix/main.cf queryfilter = (mail=%s) resultattribute = mailRoutingAddress So when i send mail to user1 , it will first check the mail address is correct or not from ldap entries and check mailHost for the particular user and must go the particular SMTP server where i had mentioned in mailHost attribute in ldap. But for me it is checking the mailHost attribute and i had mentioned the IP of the SMTP server in my LDAP for mailHost attribute.So for me it checks the mailHost attribute and delivering the mail in the same SMTP server by creating the IP as the username and droping the mail Any body plz guide me home to route the mail to the particular user .

2 1

VMware and mirror/multimaster
by Dave Horsfall 05 Aug '08

05 Aug '08

Has anyone tried mirroring or multimaster under VMware i.e. are the virtual clocks stable enough? We're starting to use VMware to cut down on the number of physical hosts, but I'd like to use the latest 2.4 features as well. -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

5 11

TLS Configuration - "unable to get TLS client DN, error=49"
by Brad T Waldorf 05 Aug '08

05 Aug '08

Hi. We're trying to configure a basic SSL (TLS) connection through OpenLDAP version 2.4.6. We're using Linux, Debian Version 4.0 ('etch') INTEL. The pertinent info... slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel -1 logfile /usr/local/var/openldap-data/logb TLSCACertificateFile /home/bwaldorf/certs/1024pcert.pem TLSCertificateFile /home/bwaldorf/certs/1024pcert.pem TLSCertificateKeyFile /home/bwaldorf/certs/1024pkey.pem TLSCipherSuite DES-CBC-SHA TLSVerifyClient never #TLSRandFile #TLSEphemeralDHParamFile ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=replDB" rootdn "cn=replman,o=replDB" rootpw password timelimit 1 idletimeout 4 access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by * read directory /usr/local/var/openldap-data index sn,mail,uid,title eq ldap.conf TLS_CACERT /home/bwaldorf/certs/1024pcert.pem TLS_CERT /home/bwaldorf/certs/1024pcert.pem TLS_KEY /home/bwaldorf/certs/1024pkey.pem So we try the following search (-ZZ to force the command to be successful)... ldapsearch -x -D "cn=replman,o=replDB" -w password -b "o=replDB1" -ZZ And we get the following output (below) with -d -1... (sorry for the excessive messages). Looks like the problem is... "connection_read(13): unable to get TLS client DN, error=49 id=5" I did some googling for this error, but never found a thread with a cause/solution. Thanks in advance for your time and help! daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: listen=8, new connection on 13 daemon: activity on:daemon: added 13r (active) listener=(nil) conn=5 fd=13 ACCEPT from IP=127.0.0.1:32933 (IP=0.0.0.0:389)) daemon: epoll: listen=7 active_threads=1 tvp=zero. daemon: epoll: listen=8 active_threads=1 tvp=zero. daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero. connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero. connection_get(13): got connid=5 connection_read(13): checking for input on id=5 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0xa0c11fc8 ptr=0xa0c11fc8 end=0xa0c11fe5 len=29. 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=5 op=0 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0xa0c11fc8 ptr=0xa0c11fcb end=0xa0c11fe5 len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 conn=5 op=0 EXT oid=1.3.6.1.4.1.1466.20037 do_extended: oid=1.3.6.1.4.1.1466.20037 daemon: activity on 1 descriptor conn=5 op=0 STARTTLS daemon: activity on:send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 daemon: epoll: listen=7 active_threads=1 tvp=zero ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ conn=5 op=0 RESULT oid= err=0 text= daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 80 74 01 03 01 00 4b 00 00 00 20 .t....K....... tls_read: want=107, got=107 0000: 00 00 39 00 00 38 00 00 35 00 00 16 00 00 13 00 ..9..8..5....... 0010: 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f 03 00 .......3..2../.. 0020: 80 00 00 05 00 00 04 01 00 80 00 00 15 00 00 12 ................ 0030: 00 00 09 06 00 40 00 00 14 00 00 11 00 00 08 00 .....@.......... 0040: 00 06 04 00 80 00 00 03 02 00 80 15 2d dd 5d 9a ............-.]. 0050: f5 29 55 3b 15 f2 e5 47 18 9c 22 f2 7d 07 51 72 .)U;...G..".}.Qr 0060: 60 1f 38 61 8d 9a e7 67 2a 5e 9e `.8a...g*^..}. TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=985, written=985 0000: 16 03 01 00 4a 02 00 00 46 03 01 48 92 1d e7 69 ....J...F..H...i 0010: f3 a0 ea 95 0f 3b 21 71 a5 b0 11 34 27 91 b8 0b .....;!q...4'... 0020: d1 25 4f ca d5 56 fd 55 d2 0f 33 20 a7 fe 44 07 .%O..V.U..3 ..D. 0030: 8a 33 a1 ec 46 61 01 94 2a 05 9a 59 9e 95 02 ec .3..Fa..*..Y.... 0040: 99 82 42 77 1d f6 bf 6e b4 0f 05 23 00 09 00 16 ..Bw...n...#.... 0050: 03 01 03 7c 0b 00 03 78 00 03 75 00 03 72 30 82 ...|...x..u..r0. 0060: 03 6e 30 82 02 d7 a0 03 02 01 02 02 01 00 30 0d .n0...........0. 0070: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 81 87 ..*.H........0.. 0080: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 1.0...U....US1.0 0090: 0f 06 03 55 04 08 13 08 4e 65 77 20 59 6f 72 6b ...U....New York 00a0: 31 15 30 13 06 03 55 04 07 13 0c 50 6f 75 67 68 1.0...U....Pough 00b0: 6b 65 65 70 73 69 65 31 0c 30 0a 06 03 55 04 0a keepsie1.0...U.. 00c0: 13 03 49 42 4d 31 0c 30 0a 06 03 55 04 0b 13 03 ..IBM1.0...U.... 00d0: 54 50 46 31 0e 30 0c 06 03 55 04 03 13 05 44 61 TPF1.0...U....Da 00e0: 76 69 64 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 vid1"0 ..*.H.... 00f0: 09 01 16 13 6d 6f 7a 65 73 68 74 61 40 75 73 2e ....mozeshta@us. 0100: 69 62 6d 2e 63 6f 6d 30 1e 17 0d 30 38 30 33 31 ibm.com0...08031 0110: 31 30 31 31 36 31 31 5a 17 0d 31 30 31 32 30 37 1011611Z..101207 0120: 30 31 31 36 31 31 5a 30 81 87 31 0b 30 09 06 03 011611Z0..1.0... 0130: 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 U....US1.0...U.. 0140: 13 08 4e 65 77 20 59 6f 72 6b 31 15 30 13 06 03 ..New York1.0... 0150: 55 04 07 13 0c 50 6f 75 67 68 6b 65 65 70 73 69 U....Poughkeepsi 0160: 65 31 0c 30 0a 06 03 55 04 0a 13 03 49 42 4d 31 e1.0...U....IBM1 0170: 0c 30 0a 06 03 55 04 0b 13 03 54 50 46 31 0e 30 .0...U....TPF1.0 0180: 0c 06 03 55 04 03 13 05 44 61 76 69 64 31 22 30 ...U....David1"0 0190: 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 6d 6f ..*.H........mo 01a0: 7a 65 73 68 74 61 40 75 73 2e 69 62 6d 2e 63 6f zeshta(a)us.ibm.co 01b0: 6d 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 m0..0...*.H..... 01c0: 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ac ee .......0........ 01d0: f9 a7 40 cc 73 af 67 a0 ea 46 08 45 a5 fd 44 71 ..@.s.g..F.E..Dq 01e0: a4 04 3e 51 f7 39 51 82 3d 7e 9b 99 ae 1d c1 22 ..>Q.9Q.=~....." 01f0: 67 10 e7 15 d1 a9 65 75 e9 3e 0f 77 64 d1 14 4d g.....eu.>.wd..M 0200: 28 f0 8c ba d3 ed 87 e9 b1 5b 11 c1 3f 11 ed 1a (........[..?... 0210: 96 9a 3f b3 4b f3 db bd 84 41 11 aa ea 37 6d ab ..?.K....A...7m. 0220: c5 fb a9 bb ab 9d 87 66 b2 31 7a c8 35 06 06 ec .......f.1z.5... 0230: fb 07 f1 29 f5 f3 fd 29 f4 df 33 bf 40 de 84 6f ...)...)..3.@..o 0240: 9d 66 ea 57 42 ab 0f 13 a0 07 71 d5 e0 6d 02 03 .f.WB.....q..m.. 0250: 01 00 01 a3 81 e7 30 81 e4 30 1d 06 03 55 1d 0e ......0..0...U.. 0260: 04 16 04 14 11 76 af b1 5a bd 99 53 a5 de 02 35 .....v..Z..S...5 0270: 06 51 c4 01 74 71 2c c6 30 81 b4 06 03 55 1d 23 .Q..tq,.0....U.# 0280: 04 81 ac 30 81 a9 80 14 11 76 af b1 5a bd 99 53 ...0.....v..Z..S 0290: a5 de 02 35 06 51 c4 01 74 71 2c c6 a1 81 8d a4 ...5.Q..tq,..... 02a0: 81 8a 30 81 87 31 0b 30 09 06 03 55 04 06 13 02 ..0..1.0...U.... 02b0: 55 53 31 11 30 0f 06 03 55 04 08 13 08 4e 65 77 US1.0...U....New 02c0: 20 59 6f 72 6b 31 15 30 13 06 03 55 04 07 13 0c York1.0...U.... 02d0: 50 6f 75 67 68 6b 65 65 70 73 69 65 31 0c 30 0a Poughkeepsie1.0. 02e0: 06 03 55 04 0a 13 03 49 42 4d 31 0c 30 0a 06 03 ..U....IBM1.0... 02f0: 55 04 0b 13 03 54 50 46 31 0e 30 0c 06 03 55 04 U....TPF1.0...U. 0300: 03 13 05 44 61 76 69 64 31 22 30 20 06 09 2a 86 ...David1"0 ..*. 0310: 48 86 f7 0d 01 09 01 16 13 6d 6f 7a 65 73 68 74 H........mozesht 0320: 61 40 75 73 2e 69 62 6d 2e 63 6f 6d 82 01 00 30 a@us.ibm.com...0 0330: 0c 06 03 55 1d 13 04 05 30 03 01 01 ff 30 0d 06 ...U....0....0.. 0340: 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 00 .*.H............ 0350: a8 39 22 f9 88 b2 c1 e6 95 5e af 4d ae f6 89 e5 .9"......^.M.... 0360: 64 82 37 42 f6 5b 00 56 22 d0 c6 b9 5f 70 36 2f d.7B.[.V"..._p6/ 0370: 8f 10 bb 5a d1 18 33 2a 37 8a a0 f2 c3 53 21 12 ...Z..3*7....S!. 0380: 2c 28 8a 62 a9 e0 b5 5a 70 4c 77 f1 5c 33 d2 a3 ,(.b...ZpLw.\3.. 0390: 6d 77 e8 6e e8 7e 5b 74 d9 3a 70 24 38 89 ce 11 mw.n.~[t.:p $8... 03a0: 4c ec 64 51 f2 be 61 4c 18 09 25 13 48 e2 5b 13 L.dQ..aL..%.H.[. 03b0: d9 fa 8c 0c b7 a2 dd 09 dd e8 da 01 c7 29 2b 9a .............)+. 03c0: 22 51 6f 19 54 e7 02 90 75 0e a9 3a 4b e0 d1 a4 "Qo.T...u..:K... 03d0: 16 03 01 00 04 0e 00 00 00 ...........: TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A.........: TLS trace: SSL_accept:error in SSLv3 read client certificate A.........: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=1 tvp=zero daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 tls_read: want=5, got=5 0000: 16 03 01 00 86 ...........: tls_read: want=134, got=134 0000: 10 00 00 82 00 80 91 6b 72 70 d5 4e 89 66 4e 5f .......krp.N.fN_ 0010: f2 d6 d6 41 e7 3a 85 1e 8e ce 85 4d 90 ac 4a ec ...A.:.....M..J. 0020: 81 f6 4d 2c 1d 94 85 e8 78 cf c9 68 11 77 b3 4e ..M,....x..h.w.N 0030: 13 97 62 43 e2 e8 12 44 42 46 c6 bc c3 74 c7 ad ..bC...DBF...t.. 0040: f7 46 22 2b ac 8c 8e 59 5d de f4 fd f9 73 3f 76 .F"+...Y]....s?v 0050: 1b 58 1f da 5c 95 49 a6 73 ec 75 37 fc 38 fa 53 .X..\.I.s.u7.8.S 0060: 6d 3c a9 fd 2a 7d c3 f7 b9 79 e7 3f 8f da df 04 m<..*}...y.?.... 0070: cb 06 e2 67 75 3c 57 cf 8e 60 6e e4 27 fa 23 a3 ...gu<W..`n.'.#. 0080: b8 fb c6 5b 14 7e ...[.~ TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 0000: 14 03 01 00 01 ..... tls_read: want=1, got=1 0000: 01 ..... tls_read: want=5, got=5 0000: 16 03 01 00 28 ....( tls_read: want=40, got=40 0000: 77 34 09 6c 45 e9 f1 f0 a2 e6 cb 2d e4 49 27 42 w4.lE......-.I'B 0010: 45 a5 84 74 bb bd 0f 6e 24 70 e1 b0 0f 19 83 4a E..t...n $p.....J 0020: 7a 41 c3 b3 ca fe 80 68 zA.....h TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=51, written=51 0000: 14 03 01 00 01 01 16 03 01 00 28 97 a6 bb b1 8c ..........(..... 0010: 50 d4 6f 60 2c fb c7 d1 10 a6 a6 37 ff ea 0b e8 P.o`,......7.... 0020: 60 d0 f1 6b 34 d7 26 7b a9 c8 c0 45 72 33 7c 67 `..k4.&{...Er3| g 0030: b4 07 93 ... TLS trace: SSL_accept:SSLv3 flush data connection_read(13): unable to get TLS client DN, error=49 id=5 conn=5 fd=13 TLS established tls_ssf=56 ssf=56 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=1 tvp=zero daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 ber_get_next tls_read: want=5, got=0 ldap_read: want=8, got=0 ber_get_next on fd 13 failed errno=0 (Success) connection_read(13): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=13 for close connection_close: conn=5 sd=13 daemon: removing 13 daemon: activity on 1 descriptor tls_write: want=29, written=29 0000: 15 03 01 00 18 73 41 45 4f f9 51 03 05 e6 66 c2 .....sAEO.Q...f. 0010: f5 65 d2 a9 ab 03 aa 8d d1 79 ef 18 8c .e.......y.... TLS trace: SSL3 alert write:warning:close notify conn=5 fd=13 closed (connection lost) daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL

4 4

updateref difficulty
by John Oliver 05 Aug '08

05 Aug '08

I added an updateref statement to my slave/consumer server, referring back to the master/producer: updateref ldap://test1.mydomain.com In the logs on the slave, I can see that it does look like it refers the client to the master... Aug 5 09:21:19 unix-services2 slapd[29985]: daemon: select: listen=7 active_threads=0 tvp=zero Aug 5 09:21:19 unix-services2 slapd[29985]: daemon: select: listen=8 active_threads=0 tvp=zero Aug 5 09:21:19 unix-services2 slapd[29985]: do_modify Aug 5 09:21:19 unix-services2 slapd[29985]: do_modify: dn (uid=joliver,ou=People,dc=mydomain,dc=com) Aug 5 09:21:19 unix-services2 slapd[29985]: >>> dnPrettyNormal: <uid=joliver,ou=People,dc=mydomain,dc=com> Aug 5 09:21:19 unix-services2 slapd[29985]: <<< dnPrettyNormal: <uid=joliver,ou=People,dc=mydomain,dc=com>, <uid=joliver,ou=people,dc=mydomain,dc=com> Aug 5 09:21:19 unix-services2 slapd[29985]: modifications: Aug 5 09:21:19 unix-services2 slapd[29985]: replace: userPassword Aug 5 09:21:19 unix-services2 slapd[29985]: one value, length 41 Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 MOD dn="uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 MOD attr=userPassword Aug 5 09:21:19 unix-services2 slapd[29985]: bdb_dn2entry("uid=joliver,ou=people,dc=mydomain,dc=com") Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: conn=22 op=5 p=3 Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: err=10 matched="" text="" Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: referral="ldap://test1.mydomain.com/uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_response: msgid=6 tag=103 err=10 Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_response: ref="ldap://test1.mydomain.com/uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 RESULT tag=103 err=10 text= Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: activity on 1 descriptor Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: activity on: Aug 5 09:21:22 unix-services2 slapd[29985]: 28r Aug 5 09:21:22 unix-services2 slapd[29985]: Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: read active on 28 Aug 5 09:21:22 unix-services2 slapd[29985]: connection_get(28) Aug 5 09:21:22 unix-services2 slapd[29985]: connection_get(28): got connid=22 Aug 5 09:21:22 unix-services2 slapd[29985]: connection_read(28): checking for input on id=22 Aug 5 09:21:22 unix-services2 slapd[29985]: do_unbind Aug 5 09:21:22 unix-services2 slapd[29985]: ber_get_next on fd 28 failed errno=0 (Success) Aug 5 09:21:22 unix-services2 slapd[29985]: conn=22 op=6 UNBIND Aug 5 09:21:22 unix-services2 slapd[29985]: connection_read(28): input error=-2 id=22, closing. Aug 5 09:21:22 unix-services2 slapd[29985]: connection_closing: readying conn=22 sd=28 for close Aug 5 09:21:22 unix-services2 slapd[29985]: connection_close: deferring conn=22 sd=28 Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: select: listen=7 active_threads=0 tvp=zero Aug 5 09:21:22 unix-services2 slapd[29985]: connection_resched: attempting closing conn=22 sd=28 Howver, nothing is logged on the master, and the client bombs out with: LDAP password information update failed: Can't contact LDAP server The client can authenticate against test1 (the master server) with the appropriate change to /etc/ldap.conf -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 2

Multiple email addresses +Postfix
by Stelios A. 05 Aug '08

05 Aug '08

Hello all, I have a master/slave Openldap 2.4.9 running on ubuntu server along with Postfix and dovecot. At the moment email server is able to server email for domain1.com with Maildir support for Dovecot at /home/username/ for each user. There is a need to add a 2nd domain let's say domain2.com. My question is where that domain will store the emails as the user home dir is already setup in ldap at /home/username Is there a way to define a new attribute like alternative email and have the same user with same auth details authenticate to both domains like user1(a)domain1.com and with same pass on user1(a)domain2.com? I'm not sure if I'm explain enough the situation, please ask for any clarification if you want to. -- Stelios A

2 1

Creating a "big" database... large LDIF file. automated procedure?
by Brad T Waldorf 04 Aug '08

04 Aug '08

Hi again. Thanks again for your responses to my prior posts. So far, all of my experience with OpenLDAP has been with databases with a minimal number of entries... 200 at the most. I'd like to do some performance experiments with a much larger database, say 10,000 database entries or so. What would you recommend for creating such a database? (Entries don't have to have real, sensible data... maybe the distinguished name is an integer that increases by 1?) Is there an automated way for creating such a database? Thanks,

2 2

Organizational Unit Listing
by Emre Yilmaz 04 Aug '08

04 Aug '08

hi list, We need list to all of organizational unit's in Active Directory with members. Its very important for me. Is there any idea? _________________________________________________________________ Windows Live Spaces – hayatınız, Alanınız. Daha fazlasını öğrenmek için buraya tıklayın. http://get.live.com/spaces/overview

5 5

Newbi question.
by Narsi Bala 03 Aug '08

03 Aug '08

I have just started to dig into openLDAP and I am against a roadblock right now...I am sure the issue i am having is straightforward for those LDAP experts out there, so bear with my ignorance. My slapd.conf file is listed below # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path ./ucdata include ./schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap:/root.openldap.org pidfile ./run/slapd.pid argsfile ./run/slapd.args # Load dynamic backend modules: # modulepath ./libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq I am connecting to the server just fine, and I am looking at the database through eclipse apache DS studio plugin. Notice how I have the rootDN set to "cn=Manager,dc=my-domain,dc=com" and the suffix set to "dc=my-domain,dc=com", but I dont see this root entry in my editor. all I see is Root DSE(1). I expand that tree and there is nothing underneath it. I assume that by starting the server with the above slapd.conf, I should be able to create the rootDN, if not how does one go about creating a rootDN ? Thanks Narsi

4 4

Replicating between Active Directory and Openldap
by Greg McConnel 01 Aug '08

01 Aug '08

Can anyone refer me to documentation or a site that describes how to replicate user and password information between Active Directory and Openldap. I have found a number of sites but most are a few years old and none seem to provide the necessary instructions and tools. Thanks!

2 1

Re: Understanding TLS SSF
by J Davis 31 Jul '08

31 Jul '08

That was it. I'm using 2.4.11 now compiled against openssl and it's working. Thanks! -Jake On Wed, Jul 30, 2008 at 7:36 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > I doubt that's the SSL that OpenLDAP is compiled against. It looks to me > like it is compiled against GnuTLS, and likely affected by ITS#5585, which > was fixed in OpenLDAP 2.4.11. If that's correct, then the real TLS value > is 256. Have you actually run ldd on slapd to see what libraries it is > linked against for SSL? > > --Quanah > > > --On Wednesday, July 30, 2008 1:16 PM -0400 J Davis <mrsalty0(a)gmail.com> > wrote: > > >> Openssl 0.9.8g-4ubuntu3.3 >> >> Thanks, >> -Jake >> >> >> On Wed, Jul 30, 2008 at 12:02 PM, Buchan Milne >> <bgmilne(a)staff.telkomsa.net> wrote: >> >> >> >> >> On Wednesday 30 July 2008 15:59:52 J Davis wrote: >> >>> Greetings, >>> >>> I'm testing an installation of openldap 2.4.9. I want to enforce TLS for >>> all access to the directory. >>> My problem is that I cannot get the client to meet the ssf restictions I >>> have in place. The documentation I've seen on ssf and tls_ssf is very >>> sparse so I don't really understand what it does. >>> >>> I'm using self signed cert created using the openssl CA.sh script. >>> >>> Relevant portions of the slapd.conf... >>> >>> TLSCACertificateFile /etc/ldap/ssl/cacert.pem >>> TLSCertificateFile /etc/ldap/ssl/servercrt.pem >>> TLSCertificateKeyFile /etc/ldap/ssl/serverkey.pem >>> ... >>> access to * >>> by tls_ssf=128 ssf=128 anonymous auth >>> by tls_ssf=128 ssf=128 self write >>> >>> Relevant portions of the lapd.conf... >>> >>> TLS_CACERT /etc/ldap/ssl/cacert.pem >>> >>> With those ACLs in place I get the following error: >>> >>> $ ldapsearch -x -ZZ -D "uid=jake,ou=people,dc=example,dc=com" -W -b >>> "uid=jake,ou=people,dc=example,dc=com" >>> ldap_bind: Invalid credentials (49) >>> >>> And slapd in debug mode shows me that I didn't meet the ssf >>> requirments... >>> >>> connection_read(15): unable to get TLS client DN, error=49 id=0 >>> conn=0 fd=15 TLS established tls_ssf=32 ssf=32 >>> ... >>> <= check a_authz.sai_tls_ssf: ACL 128 > OP 32 >>> >> >> What ssl implementation is your slapd using ? >> >> >> >> > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: translucent overlay with local-only entries
by Sven Ulland 31 Jul '08

31 Jul '08

Gavin Henry wrote: > Did you read the man page? man slapo-translucent I did, but the significance of translucent_local and _remote didn't strike me. Unfortunately it seems that enabling local+remote searching doesn't change the result. I must have a silly bug in my configuration, but I cannot figure out where. Various combinations of translucent_local and _remote give different, but consistent, results: neither local nor remote: only remote entries returned local only: no entries returned remote only: only remote entries returned local and remote: only remote entries returned I use the following in my slapd.conf[1]: translucent_remote uid translucent_local uid The databases on each host seem fine. The main ldap directory contains an ou with a single uid[2]; the branch extension directory contains one attribute modification and one local-only entry[3]. I ran a full debug with 'translucent_local uid' in the configuration file: slapd -g openldap -u openldap -f /etc/ldap/slapd.conf -d 65535 The search command I use: ldapsearch -x -W -D 'cn=branchadmin,dc=branch,dc=example,dc=com' \ -H ldap://localhost -b 'dc=example,dc=com' -LLL 'uid=*' uid The output[5] seems to show (on lines 523 and 615, for example), that uid=barney is found, but I'm not able to determine why it is not returned to the client. I also dumped the network packets to verify that uid=barney was not retured. It wasn't. sven [1] Entire /etc/ldap/slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/autofs.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload translucent sizelimit 500 tool-threads 1 backend bdb backend ldap database bdb directory /var/lib/ldap/translucent4 suffix "dc=example,dc=com" rootdn "cn=branchadmin,dc=branch,dc=example,dc=com" rootpw "admin" index objectclass eq index uid eq,sub lastmod off overlay translucent translucent_remote uid translucent_local uid uri "ldap://172.27.27.37" idassert-bind bindmethod=simple binddn="cn=mainadmin,dc=example,dc=com" credentials="admin" mode=none #end [2] slapcat on main ldap: dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization dc: example o: Simple example structuralObjectClass: organization dn: cn=mainadmin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: mainadmin description: LDAP administrator userPassword:: e2NyeXB0fTRUT2NoeFV0M3AyUEU= structuralObjectClass: organizationalRole dn: ou=People,dc=example,dc=com ou: People objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: uid=andrew,ou=People,dc=example,dc=com uid: andrew cn: Andrew sn: Andrewson uidNumber: 401 gidNumber: 501 homeDirectory: /home/andrew structuralObjectClass: person objectClass: person objectClass: posixAccount #end [3] slapcat on local branch, after a) one modification of existing 'description' field for uid=andrew, and b) one new local-only entry for uid=barney. dn: dc=example,dc=com structuralObjectClass: glue objectClass: top objectClass: glue dn: ou=people,dc=example,dc=com structuralObjectClass: glue objectClass: top objectClass: glue dn: uid=andrew,ou=People,dc=example,dc=com description: changed on branch only dn: uid=barney,ou=People,dc=example,dc=com uid: barney cn: Barney sn: Barneyson uidNumber: 402 gidNumber: 502 homeDirectory: /home/barney objectClass: person objectClass: posixAccount description: only exists on branch #end [4] slapd debug output. 1 @(#) $OpenLDAP: slapd 2.4.10 (Jul 17 2008 14:44:35) $ 2 buildd@ninsei:/build/buildd/openldap-2.4.10/debian/build/servers/slapd 3 ldap_pvt_gethostbyname_a: host=debian, r=0 4 daemon_init: <null> 5 daemon_init: listen on ldap:/// 6 daemon_init: 1 listeners to open... 7 ldap_url_parse_ext(ldap:///) 8 daemon: listener initialized ldap:/// 9 daemon_init: 2 listeners opened 10 ldap_create 11 slapd init: initiated server. 12 slap_sasl_init: initialized! 13 reading config file /etc/ldap/slapd.conf 14 line 1 (include /etc/ldap/schema/core.schema) 15 reading config file /etc/ldap/schema/core.schema [several lines of schema debugging removed] 208 line 7 (pidfile /var/run/slapd/slapd.pid) 209 line 8 (argsfile /var/run/slapd/slapd.args) 210 line 9 (loglevel none) 211 line 11 (modulepath /usr/lib/ldap) 212 line 12 (moduleload back_bdb) 213 loaded module back_bdb 214 bdb_back_initialize: initialize BDB backend 215 bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) 216 module back_bdb: null module registered 217 line 13 (moduleload back_ldap) 218 loaded module back_ldap 219 module back_ldap: null module registered 220 line 14 (moduleload translucent) 221 loaded module translucent 222 ==> translucent_initialize 223 module translucent: null module registered 224 line 16 (sizelimit 500) 225 line 17 (tool-threads 1) 226 line 19 (backend bdb) 227 line 20 (backend ldap) 228 line 22 (database bdb) 229 bdb_db_init: Initializing BDB database 230 line 23 (directory /var/lib/ldap/translucent4) 231 line 24 (suffix "dc=example,dc=com") 232 >>> dnPrettyNormal: <dc=example,dc=com> 233 => ldap_bv2dn(dc=example,dc=com,0) 234 <= ldap_bv2dn(dc=example,dc=com)=0 235 => ldap_dn2bv(272) 236 <= ldap_dn2bv(dc=example,dc=com)=0 237 => ldap_dn2bv(272) 238 <= ldap_dn2bv(dc=example,dc=com)=0 239 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> 240 line 25 (rootdn "cn=branchadmin,dc=branch,dc=example,dc=com") 241 >>> dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com> 242 => ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com,0) 243 <= ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com)=0 244 => ldap_dn2bv(272) 245 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 246 => ldap_dn2bv(272) 247 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 248 <<< dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com>, <cn=branchadmin,dc=branch,dc=example,dc=com> 249 line 26 (rootpw ***) 250 line 27 (index objectclass eq) 251 index objectClass 0x0004 252 line 28 (index uid eq,sub) 253 index uid 0x0714 254 line 29 (lastmod off) 255 line 31 (overlay translucent) 256 ==> translucent_db_init 257 line 32 (translucent_local uid) 258 line 33 (uri "ldap://172.27.27.37") 259 ==> translucent_db_config: uri 260 ldap_url_parse_ext(ldap://172.27.27.37) 261 line 38 (idassert-bind ***) 262 ==> translucent_db_config: idassert-bind 263 >>> dnNormalize: <cn=mainadmin,dc=example,dc=com> 264 => ldap_bv2dn(cn=mainadmin,dc=example,dc=com,0) 265 <= ldap_bv2dn(cn=mainadmin,dc=example,dc=com)=0 266 => ldap_dn2bv(272) 267 <= ldap_dn2bv(cn=mainadmin,dc=example,dc=com)=0 268 <<< dnNormalize: <cn=mainadmin,dc=example,dc=com> 269 >>> dnNormalize: <cn=Subschema> 270 => ldap_bv2dn(cn=Subschema,0) 271 <= ldap_bv2dn(cn=Subschema)=0 272 => ldap_dn2bv(272) 273 <= ldap_dn2bv(cn=subschema)=0 274 <<< dnNormalize: <cn=subschema> 275 matching_rule_use_init [schema lines omitted] 302 slapd startup: initiated. 303 backend_startup_one: starting "cn=config" 304 config_back_db_open 305 config_build_entry: "cn=config" 306 config_build_entry: "cn=module{0}" 307 config_build_entry: "cn=schema" 308 config_build_entry: "cn={0}core" 309 config_build_entry: "cn={1}cosine" 310 config_build_entry: "cn={2}nis" 311 config_build_entry: "cn={3}inetorgperson" 312 config_build_entry: "cn={4}autofs" 313 config_build_entry: "olcDatabase={-1}frontend" 314 config_build_entry: "olcDatabase={0}config" 315 config_build_entry: "olcDatabase={1}bdb" 316 config_build_entry: "olcOverlay={0}translucent" 317 ==> translucent_cfadd 318 config_build_entry: "olcDatabase=ldap" 319 backend_startup_one: starting "dc=example,dc=com" 320 bdb_db_open: "dc=example,dc=com" 321 bdb_db_open: database "dc=example,dc=com": dbenv_open(/var/lib/ldap/translucent4). 322 ==> translucent_db_open 323 backend_startup_one: starting "dc=example,dc=com" 324 ldap_back_db_open: URI=ldap://172.27.27.37 325 slapd starting 326 daemon: added 4r listener=(nil) 327 daemon: added 7r listener=0x82f6068 328 daemon: added 8r listener=0x82f6130 329 daemon: epoll: listen=7 active_threads=0 tvp=NULL 330 daemon: epoll: listen=8 active_threads=0 tvp=NULL 331 daemon: activity on 1 descriptor 332 daemon: activity on: 333 daemon: epoll: listen=7 active_threads=0 tvp=NULL 334 daemon: epoll: listen=8 active_threads=0 tvp=NULL 335 daemon: activity on 1 descriptor 336 daemon: activity on: 337 slap_listener_activate(8): 338 >>> slap_listener(ldap:///) 339 daemon: listen=8, new connection on 13 340 daemon: added 13r (active) listener=(nil) 341 conn=0 fd=13 ACCEPT from IP=127.0.0.1:51638 (IP=0.0.0.0:389) 342 daemon: epoll: listen=7 active_threads=0 tvp=NULL 343 daemon: epoll: listen=8 active_threads=0 tvp=NULL 344 daemon: activity on 1 descriptor 345 daemon: activity on: 346 daemon: epoll: listen=7 active_threads=0 tvp=NULL 347 daemon: epoll: listen=8 active_threads=0 tvp=NULL 348 daemon: activity on 1 descriptor 349 daemon: activity on: 13r 350 daemon: read active on 13 351 daemon: epoll: listen=7 active_threads=0 tvp=NULL 352 daemon: epoll: listen=8 active_threads=0 tvp=NULL 353 connection_get(13) 354 connection_get(13): got connid=0 355 connection_read(13): checking for input on id=0 356 ber_get_next 357 ldap_read: want=8, got=8 358 0000: 30 3b 02 01 01 60 36 02 0;...`6. 359 ldap_read: want=53, got=53 360 0000: 01 03 04 2a 63 6e 3d 62 72 61 6e 63 68 61 64 6d ...*cn=branchadm 361 0010: 69 6e 2c 64 63 3d 62 72 61 6e 63 68 2c 64 63 3d in,dc=branch,dc= 362 0020: 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 example,dc=com.. 363 0030: 61 64 6d 69 6e admin 364 ber_get_next: tag 0x30 len 59 contents: 365 ber_dump: buf=0x83a9dd8 ptr=0x83a9dd8 end=0x83a9e13 len=59 366 0000: 02 01 01 60 36 02 01 03 04 2a 63 6e 3d 62 72 61 ...`6....*cn=bra 367 0010: 6e 63 68 61 64 6d 69 6e 2c 64 63 3d 62 72 61 6e nchadmin,dc=bran 368 0020: 63 68 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 ch,dc=example,dc 369 0030: 3d 63 6f 6d 80 05 61 64 6d 69 6e =com..admin 370 ber_get_next 371 ldap_read: want=8 error=Resource temporarily unavailable 372 conn=0 op=0 do_bind 373 ber_scanf fmt ({imt) ber: 374 ber_dump: buf=0x83a9dd8 ptr=0x83a9ddb end=0x83a9e13 len=56 375 0000: 60 36 02 01 03 04 2a 63 6e 3d 62 72 61 6e 63 68 `6....*cn=branch 376 0010: 61 64 6d 69 6e 2c 64 63 3d 62 72 61 6e 63 68 2c admin,dc=branch, 377 0020: 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f dc=example,dc=co 378 0030: 6d 80 05 61 64 6d 69 6e m..admin 379 ber_scanf fmt (m}) ber: 380 ber_dump: buf=0x83a9dd8 ptr=0x83a9e0c end=0x83a9e13 len=7 381 0000: 00 05 61 64 6d 69 6e ..admin 382 >>> dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com> 383 => ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com,0) 384 <= ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com)=0 385 => ldap_dn2bv(272) 386 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 387 => ldap_dn2bv(272) 388 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 389 <<< dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com>, <cn=branchadmin,dc=branch,dc=example,dc=com> 390 conn=0 op=0 BIND dn="cn=branchadmin,dc=branch,dc=example,dc=com" method=128 391 do_bind: version=3 dn="cn=branchadmin,dc=branch,dc=example,dc=com" method=128 392 translucent_bind: <cn=branchadmin,dc=branch,dc=example,dc=com> method 128 393 conn=0 op=0: rootdn="cn=branchadmin,dc=branch,dc=example,dc=com" bind succeeded 394 conn=0 op=0 BIND dn="cn=branchadmin,dc=branch,dc=example,dc=com" mech=SIMPLE ssf=0 395 do_bind: v3 bind: "cn=branchadmin,dc=branch,dc=example,dc=com" to "cn=branchadmin,dc=branch,dc=example,dc=com" 396 send_ldap_result: conn=0 op=0 p=3 397 send_ldap_result: err=0 matched="" text="" 398 send_ldap_response: msgid=1 tag=97 err=0 399 ber_flush2: 14 bytes to sd 13 400 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 401 ldap_write: want=14, written=14 402 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 403 conn=0 op=0 RESULT tag=97 err=0 text= 404 daemon: activity on 1 descriptor 405 daemon: activity on: 406 daemon: epoll: listen=7 active_threads=0 tvp=NULL 407 daemon: epoll: listen=8 active_threads=0 tvp=NULL 408 daemon: activity on 1 descriptor 409 daemon: activity on: 13r 410 daemon: read active on 13 411 daemon: epoll: listen=7 active_threads=0 tvp=NULL 412 daemon: epoll: listen=8 active_threads=0 tvp=NULL 413 connection_get(13) 414 connection_get(13): got connid=0 415 connection_read(13): checking for input on id=0 416 ber_get_next 417 ldap_read: want=8, got=8 418 0000: 30 33 02 01 02 63 2e 04 03...c.. 419 ldap_read: want=45, got=45 420 0000: 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 .dc=example,dc=c 421 0010: 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 om.............. 422 0020: 00 87 03 75 69 64 30 05 04 03 75 69 64 ...uid0...uid 423 ber_get_next: tag 0x30 len 51 contents: 424 ber_dump: buf=0x83aa218 ptr=0x83aa218 end=0x83aa24b len=51 425 0000: 02 01 02 63 2e 04 11 64 63 3d 65 78 61 6d 70 6c ...c...dc=exampl 426 0010: 65 2c 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 e,dc=com........ 427 0020: 00 02 01 00 01 01 00 87 03 75 69 64 30 05 04 03 .........uid0... 428 0030: 75 69 64 uid 429 ber_get_next 430 ldap_read: want=8 error=Resource temporarily unavailable 431 conn=0 op=1 do_search 432 ber_scanf fmt ({miiiib) ber: 433 ber_dump: buf=0x83aa218 ptr=0x83aa21b end=0x83aa24b len=48 434 0000: 63 2e 04 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 c...dc=example,d 435 0010: 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 c=com........... 436 0020: 00 01 01 00 87 03 75 69 64 30 05 04 03 75 69 64 ......uid0...uid 437 >>> dnPrettyNormal: <dc=example,dc=com> 438 => ldap_bv2dn(dc=example,dc=com,0) 439 <= ldap_bv2dn(dc=example,dc=com)=0 440 => ldap_dn2bv(272) 441 <= ldap_dn2bv(dc=example,dc=com)=0 442 => ldap_dn2bv(272) 443 <= ldap_dn2bv(dc=example,dc=com)=0 444 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> 445 SRCH "dc=example,dc=com" 2 0 0 0 0 446 begin get_filter 447 PRESENT 448 ber_scanf fmt (m) ber: 449 ber_dump: buf=0x83aa218 ptr=0x83aa23f end=0x83aa24b len=12 450 0000: 87 03 75 69 64 30 05 04 03 75 69 64 ..uid0...uid 451 end get_filter 0 452 filter: (uid=*) 453 ber_scanf fmt ({M}}) ber: 454 ber_dump: buf=0x83aa218 ptr=0x83aa244 end=0x83aa24b len=7 455 0000: 00 05 04 03 75 69 64 ....uid 456 attrs: uid 457 conn=0 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=*)" 458 conn=0 op=1 SRCH attr=uid 459 ==> translucent_search: <dc=example,dc=com> (uid=*) 460 => bdb_search 461 bdb_dn2entry("dc=example,dc=com") 462 => bdb_dn2id("dc=example,dc=com") 463 <= bdb_dn2id: got id=0x1 464 entry_decode: "dc=example,dc=com" 465 <= entry_decode(dc=example,dc=com) 466 => access_allowed: search access to "dc=example,dc=com" "entry" requested 467 <= root access granted 468 => access_allowed: search access granted by manage(=mwrscxd) 469 search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 470 => bdb_dn2idl("dc=example,dc=com") 471 => bdb_filter_candidates 472 AND 473 => bdb_list_candidates 0xa0 474 => bdb_filter_candidates 475 OR 476 => bdb_list_candidates 0xa1 477 => bdb_filter_candidates 478 EQUALITY 479 => bdb_equality_candidates (objectClass) 480 daemon: activity on 1 descriptor 481 daemon: activity on: 482 daemon: epoll: listen=7 active_threads=0 tvp=NULL 483 daemon: epoll: listen=8 active_threads=0 tvp=NULL 484 => key_read 485 bdb_idl_fetch_key: [b49d1940] 486 <= bdb_index_read: failed (-30990) 487 <= bdb_equality_candidates: id=0, first=0, last=0 488 <= bdb_filter_candidates: id=0 first=0 last=0 489 => bdb_filter_candidates 490 PRESENT 491 => bdb_presence_candidates (uid) 492 <= bdb_presence_candidates: (uid) not indexed 493 <= bdb_filter_candidates: id=-1 first=1 last=4 494 <= bdb_list_candidates: id=-1 first=1 last=4 495 <= bdb_filter_candidates: id=-1 first=1 last=4 496 <= bdb_list_candidates: id=-1 first=1 last=4 497 <= bdb_filter_candidates: id=-1 first=1 last=4 498 bdb_search_candidates: id=-1 first=1 last=4 499 entry_decode: "ou=people,dc=example,dc=com" 500 <= entry_decode(ou=people,dc=example,dc=com) 501 => bdb_dn2id("ou=people,dc=example,dc=com") 502 <= bdb_dn2id: got id=0x2 503 entry_decode: "uid=andrew,ou=People,dc=example,dc=com" 504 <= entry_decode(uid=andrew,ou=People,dc=example,dc=com) 505 => bdb_dn2id("uid=andrew,ou=people,dc=example,dc=com") 506 <= bdb_dn2id: got id=0x3 507 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "2.5.17.0") no objectClass attribute 508 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "2.16.840.1.113730.3.2.6") no objectClass attribute 509 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "1.3.6.1.4.1.4203.666.3.4") no objectClass attribute 510 => test_filter 511 PRESENT 512 => access_allowed: search access to "uid=andrew,ou=People,dc=example,dc=com" "uid" requested 513 <= root access granted 514 => access_allowed: search access granted by manage(=mwrscxd) 515 <= test_filter 5 516 bdb_search: 3 does not match filter 517 entry_decode: "uid=barney,ou=People,dc=example,dc=com" 518 <= entry_decode(uid=barney,ou=People,dc=example,dc=com) 519 => bdb_dn2id("uid=barney,ou=people,dc=example,dc=com") 520 <= bdb_dn2id: got id=0x4 521 => test_filter 522 PRESENT 523 => access_allowed: search access to "uid=barney,ou=People,dc=example,dc=com" "uid" requested 524 <= root access granted 525 => access_allowed: search access granted by manage(=mwrscxd) 526 <= test_filter 6 527 ==> translucent_search_cb: uid=barney,ou=People,dc=example,dc=com 528 ldap_create 529 ldap_url_parse_ext(ldap://172.27.27.37) 530 =>ldap_back_getconn: conn=0 op=1: lc=0x83ab8c8 inserted refcnt=1 rc=0 531 ldap_sasl_bind 532 ldap_send_initial_request 533 ldap_new_connection 1 1 0 534 ldap_int_open_connection 535 ldap_connect_to_host: TCP 172.27.27.37:389 536 ldap_new_socket: 16 537 ldap_prepare_socket: 16 538 ldap_connect_to_host: Trying 172.27.27.37:389 539 ldap_pvt_connect: fd: 16 tm: -1 async: 0 540 ldap_open_defconn: successful 541 ldap_send_server_request 542 ber_scanf fmt ({it) ber: 543 ber_dump: buf=0x83b3b90 ptr=0x83b3b90 end=0x83b3bc1 len=49 544 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 545 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 546 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 547 0030: 6e n 548 ber_scanf fmt ({i) ber: 549 ber_dump: buf=0x83b3b90 ptr=0x83b3b95 end=0x83b3bc1 len=44 550 0000: 60 2a 02 01 03 04 1e 63 6e 3d 6d 61 69 6e 61 64 `*.....cn=mainad 551 0010: 6d 69 6e 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 min,dc=example,d 552 0020: 63 3d 63 6f 6d 80 05 61 64 6d 69 6e c=com..admin 553 ber_flush2: 49 bytes to sd 16 554 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 555 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 556 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 557 0030: 6e n 558 ldap_write: want=49, written=49 559 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 560 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 561 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 562 0030: 6e n 563 ldap_result ld 0x83ab908 msgid 1 564 wait4msg ld 0x83ab908 msgid 1 (timeout 100000 usec) 565 wait4msg continue ld 0x83ab908 msgid 1 all 1 566 ** ld 0x83ab908 Connections: 567 * host: 172.27.27.37 port: 389 (default) 568 refcnt: 2 status: Connected 569 last used: Wed Jul 30 14:50:54 2008 570 ** ld 0x83ab908 Outstanding Requests: 571 * msgid 1, origid 1, status InProgress 572 outstanding referrals 0, parent count 0 573 ld 0x83ab908 request count 1 (abandoned 0) 574 ** ld 0x83ab908 Response Queue: 575 Empty 576 ld 0x83ab908 response count 0 577 ldap_chkResponseList ld 0x83ab908 msgid 1 all 1 578 ldap_chkResponseList returns ld 0x83ab908 NULL 579 ldap_int_select 580 read1msg: ld 0x83ab908 msgid 1 all 1 581 ber_get_next 582 ldap_read: want=8, got=8 583 0000: 30 0c 02 01 01 61 07 0a 0....a.. 584 ldap_read: want=6, got=6 585 0000: 01 00 04 00 04 00 ...... 586 ber_get_next: tag 0x30 len 12 contents: 587 ber_dump: buf=0x83b4d08 ptr=0x83b4d08 end=0x83b4d14 len=12 588 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ 589 read1msg: ld 0x83ab908 msgid 1 message type bind 590 ber_scanf fmt ({eAA) ber: 591 ber_dump: buf=0x83b4d08 ptr=0x83b4d0b end=0x83b4d14 len=9 592 0000: 61 07 0a 01 00 04 00 04 00 a........ 593 read1msg: ld 0x83ab908 0 new referrals 594 read1msg: mark request completed, ld 0x83ab908 msgid 1 595 request done: ld 0x83ab908 msgid 1 596 res_errno: 0, res_error: <>, res_matched: <> 597 ldap_free_request (origid 1, msgid 1) 598 ldap_free_connection 0 1 599 ldap_free_connection: refcnt 1 600 ldap_parse_result 601 ber_scanf fmt ({iAA) ber: 602 ber_dump: buf=0x83b4d08 ptr=0x83b4d0b end=0x83b4d14 len=9 603 0000: 61 07 0a 01 00 04 00 04 00 a........ 604 ber_scanf fmt (}) ber: 605 ber_dump: buf=0x83b4d08 ptr=0x83b4d14 end=0x83b4d14 len=0 606 ldap_msgfree 607 ldap_search_ext 608 put_filter: "(objectclass=*)" 609 put_filter: simple 610 put_simple_filter: "objectclass=*" 611 ldap_build_search_req ATTRS: * 612 ldap_send_initial_request 613 ldap_send_server_request 614 ber_scanf fmt ({it) ber: 615 ber_dump: buf=0x83b3b90 ptr=0x83b3b90 end=0x83b3bdd len=77 616 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 617 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 618 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 619 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 620 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 621 ber_scanf fmt ({) ber: 622 ber_dump: buf=0x83b3b90 ptr=0x83b3b95 end=0x83b3bdd len=72 623 0000: 63 46 04 26 75 69 64 3d 62 61 72 6e 65 79 2c 6f cF.&uid=barney,o 624 0010: 75 3d 70 65 6f 70 6c 65 2c 64 63 3d 65 78 61 6d u=people,dc=exam 625 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 0a 01 00 0a 01 00 ple,dc=com...... 626 0030: 02 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 ...........objec 627 0040: 74 63 6c 61 73 73 30 00 tclass0. 628 ber_flush2: 77 bytes to sd 16 629 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 630 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 631 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 632 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 633 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 634 ldap_write: want=77, written=77 635 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 636 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 637 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 638 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 639 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 640 ldap_result ld 0x83ab908 msgid 2 641 wait4msg ld 0x83ab908 msgid 2 (infinite timeout) 642 wait4msg continue ld 0x83ab908 msgid 2 all 1 643 ** ld 0x83ab908 Connections: 644 * host: 172.27.27.37 port: 389 (default) 645 refcnt: 2 status: Connected 646 last used: Wed Jul 30 14:50:54 2008 647 ** ld 0x83ab908 Outstanding Requests: 648 * msgid 2, origid 2, status InProgress 649 outstanding referrals 0, parent count 0 650 ld 0x83ab908 request count 1 (abandoned 0) 651 ** ld 0x83ab908 Response Queue: 652 Empty 653 ld 0x83ab908 response count 0 654 ldap_chkResponseList ld 0x83ab908 msgid 2 all 1 655 ldap_chkResponseList returns ld 0x83ab908 NULL 656 ldap_int_select 657 read1msg: ld 0x83ab908 msgid 2 all 1 658 ber_get_next 659 ldap_read: want=8, got=8 660 0000: 30 27 02 01 02 65 22 0a 0'...e". 661 ldap_read: want=33, got=33 662 0000: 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 . ..ou=People,dc 663 0010: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 04 =example,dc=com. 664 0020: 00 . 665 ber_get_next: tag 0x30 len 39 contents: 666 ber_dump: buf=0x83b4d38 ptr=0x83b4d38 end=0x83b4d5f len=39 667 0000: 02 01 02 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f ...e".. ..ou=Peo 668 0010: 70 6c 65 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 ple,dc=example,d 669 0020: 63 3d 63 6f 6d 04 00 c=com.. 670 read1msg: ld 0x83ab908 msgid 2 message type search-result 671 ber_scanf fmt ({eAA) ber: 672 ber_dump: buf=0x83b4d38 ptr=0x83b4d3b end=0x83b4d5f len=36 673 0000: 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 e".. ..ou=People 674 0010: 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 ,dc=example,dc=c 675 0020: 6f 6d 04 00 om.. 676 read1msg: ld 0x83ab908 0 new referrals 677 read1msg: mark request completed, ld 0x83ab908 msgid 2 678 request done: ld 0x83ab908 msgid 2 679 res_errno: 32, res_error: <>, res_matched: <ou=People,dc=example,dc=com> 680 ldap_free_request (origid 2, msgid 2) 681 ldap_free_connection 0 1 682 ldap_free_connection: refcnt 1 683 ldap_parse_result 684 ber_scanf fmt ({iAA) ber: 685 ber_dump: buf=0x83b4d38 ptr=0x83b4d3b end=0x83b4d5f len=36 686 0000: 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 e".. ..ou=People 687 0010: 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 ,dc=example,dc=c 688 0020: 6f 6d 04 00 om.. 689 ber_scanf fmt (}) ber: 690 ber_dump: buf=0x83b4d38 ptr=0x83b4d5f end=0x83b4d5f len=0 691 ldap_msgfree 692 send_ldap_result: conn=0 op=1 p=3 693 send_ldap_result: err=0 matched="" text="" 694 send_ldap_response: msgid=2 tag=101 err=0 695 ber_flush2: 14 bytes to sd 13 696 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ 697 ldap_write: want=14, written=14 698 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ 699 conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= 700 daemon: activity on 1 descriptor 701 daemon: activity on: 13r 702 daemon: read active on 13 703 daemon: epoll: listen=7 active_threads=0 tvp=NULL 704 daemon: epoll: listen=8 active_threads=0 tvp=NULL 705 connection_get(13) 706 connection_get(13): got connid=0 707 connection_read(13): checking for input on id=0 708 ber_get_next 709 ldap_read: want=8, got=7 710 0000: 30 05 02 01 03 42 00 0....B. 711 ber_get_next: tag 0x30 len 5 contents: 712 ber_dump: buf=0x834fca0 ptr=0x834fca0 end=0x834fca5 len=5 713 0000: 02 01 03 42 00 ...B. 714 ber_get_next 715 ldap_read: want=8, got=0 716 ber_get_next on fd 13 failed errno=0 (Success) 717 connection_read(13): input error=-2 id=0, closing. 718 connection_closing: readying conn=0 sd=13 for close 719 daemon: activity on 1 descriptor 720 daemon: activity on: 721 daemon: epoll: listen=7 active_threads=0 tvp=NULL 722 daemon: epoll: listen=8 active_threads=0 tvp=NULL 723 connection_close: deferring conn=0 sd=13 724 conn=0 op=2 do_unbind 725 conn=0 op=2 UNBIND 726 connection_resched: attempting closing conn=0 sd=13 727 connection_close: conn=0 sd=13 728 translucent_connection_destroy 729 =>ldap_back_conn_destroy: fetching conn 0 730 daemon: removing 13 731 conn=0 fd=13 closed #end

1 0

FTP authentication against openldap
by Aravind Arjunan 31 Jul '08

31 Jul '08

hi, I had configured openldap in RHEL 5 and all my users are in ldap database. My FTP want to authenticate with my ldap users. how to do that, plz help me with this issue. Guide me with any link to configure FTP authentication with ldap.

2 1

slapd 2.4.10 and replication
by Christophe Thibault 31 Jul '08

31 Jul '08

Hi, I have two 2.4.10 slapd servers running on two machines, and I'm trying to setup replication. My problem is that the master dies when the slave try to connect to it (segmentation fault). I don't know where to search, so any help or idea is welcome :) * master configuration: ... syncprov-checkpoint 100 100 syncprov-sessionlog 100 ... * slave configuration: ... syncrepl rid=002 provider=ldap://172.16.0.3 type=refreshOnly interval=00:00:03:00 searchbase="dc=mycorp,dc=com" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mycorp,dc=com" credentials=xxxxxx retry="60 +" ... Thanks, chris -- Christophe THIBAULT - Planisware 102 Rue Etienne Dolet 92247 Malakoff Cedex France http://www.planisware.com

2 2

Re: Autofs-OpenLDAP Assistance
by Santosh Balan 31 Jul '08

31 Jul '08

Hi Buchan, The below settings you are saying are to be done on client side. But how would you configure seetings in ldap or the server side. How would the ldif files look like. Also I need it to communicate and authenticate for my qmail users. And my qmail users mails are stored in the /home partition of the Mail server. Then will it not conflict with my mail server's and login user's partition. How will I over come this issue. Can you please revert on the same. Anyways thanks for your reply. Thanks and Regards Santosh Balan +91-9819419509 > ----- Original Message ----- > From: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> > To: openldap-technical(a)openldap.org > Subject: Re: Autofs-OpenLDAP Assistance > Date: Wed, 30 Jul 2008 11:54:25 +0200 > > > On Tuesday 29 July 2008 20:19:33 Sven Ulland wrote: > > Santosh Balan wrote: > > > Can you please guide and provide some appropriate doccumentation or > > > method as how I hv to go about with the installation of OpenLDAP and > > > autofs such that it will authenticate my users and automatically > > > mounts the users partition. > > Depending on how your infrastructure is set up, you could get home directories > automounted for every user with a single automount (wildcard) rule. Unless you > give more details, it is difficult to know how you are associating the need > for home directories and automount rules. > > > To use ldap for login, you need to get nsswitch and pam to talk ldap. > > It is easily done by installing libnss-ldapd (or libnss-ldap -- they > > are functionally equivalent) and libpam-ldap. Package names are likely > > to be different on your platform -- these are from Debian. > > > > First change /etc/nsswitch.conf so that it reads something like this: > > > > passwd: compat ldap > > group: compat ldap > > shadow: compat ldap > > I would avoid compat unless you actually require the features. See the > discussion of compat in nsswitch.conf(5). Additionally, I would avoid adding > ldap to shadow unless you have applications that require access to the > password hash or are intending to use nss_ldap->pam_unix for authentication > (and forego any ldap authorization features). > > > hosts: files dns > > networks: files > > protocols: db files > > services: db files > > ethers: db files > > rpc: db files > > netgroup: nis > > automount: ldap > > > > Then set up /etc/pam.d/common-{account,auth,password,session} with the > > following *additions*: > > > > common-account: > > account sufficient pam_succeed_if.so uid < 1000 quiet > > account [default=bad success=ok user_unknown=ignore] pam_ldap.so > > account required pam_permit.so > > I would rather suggest adding: > > account sufficient pam_localuser.so > account sufficient pam_ldap.so > account required pam_deny.so > > otherwise password expiry, host attribute use etc. will most likely not work. > > > common-auth: > > auth requisite pam_succeed_if.so uid >= 1000 quiet > > auth sufficient pam_ldap.so use_first_pass > > auth required pam_deny.so > > > > common-password: > > password sufficient pam_ldap.so use_authtok > > password required pam_deny.so > > > > common-session > > session optional pam_ldap.so > > pam_ldap doesn't implement session as far as I know, pam_mkhomedir would be a > better candidate for the line above. > > > > > (There is probably some silly configuration in the above, but it > > works. I haven't looked into the details of PAM yet.) > > Have you tested every aspect with the configuration above? > > > Next, install autofs5-ldap (or v4 if you want). It is important that > > you understand the structure of autofs entries in ldap. You can get an > > overview here: http://efod.se/blog/archive/2006/06/27/autofs-and-ldap > > > > Finally, make sure that your /etc/ldap.conf (or /etc/ldap/ldap.conf), > > /etc/autofs_ldap_auth.conf and /etc/nss-ldapd.conf are set up to point > > to your ldap directory server. > > > > When things don't work, try running each daemon in debug mode. This > > is particularly true for slapd and the nslcd (that comes in > > libnss-ldapd). Also have a look in /var/log/auth.log or equivalent, to > > see if logins are accepted. > > > And disable nscd while troubleshooting. > > Regards, > Buchan > = -- Powered by Outblaze

1 0

Understanding TLS SSF
by J Davis 30 Jul '08

30 Jul '08

Greetings, I'm testing an installation of openldap 2.4.9. I want to enforce TLS for all access to the directory. My problem is that I cannot get the client to meet the ssf restictions I have in place. The documentation I've seen on ssf and tls_ssf is very sparse so I don't really understand what it does. I'm using self signed cert created using the openssl CA.sh script. Relevant portions of the slapd.conf... TLSCACertificateFile /etc/ldap/ssl/cacert.pem TLSCertificateFile /etc/ldap/ssl/servercrt.pem TLSCertificateKeyFile /etc/ldap/ssl/serverkey.pem ... access to * by tls_ssf=128 ssf=128 anonymous auth by tls_ssf=128 ssf=128 self write Relevant portions of the lapd.conf... TLS_CACERT /etc/ldap/ssl/cacert.pem With those ACLs in place I get the following error: $ ldapsearch -x -ZZ -D "uid=jake,ou=people,dc=example,dc=com" -W -b "uid=jake,ou=people,dc=example,dc=com" ldap_bind: Invalid credentials (49) And slapd in debug mode shows me that I didn't meet the ssf requirments... connection_read(15): unable to get TLS client DN, error=49 id=0 conn=0 fd=15 TLS established tls_ssf=32 ssf=32 ... <= check a_authz.sai_tls_ssf: ACL 128 > OP 32 I'm not really sure where to go from here. Any advice about how to increase the SSF of my connection would be greatly appreciated. Thanks, -Jake

6 8

Troubleshooting syncrepl
by John Oliver 30 Jul '08

30 Jul '08

I've set up a pair of OpenLDAP servers to work with, so that I can figure out my SSL problem without worrying about breaking my currently-working LDAP server. I got the producer up and running in about two minutes. I expected to get the consumer up just as fast, but ran into a problem... the sunchronization isn't succeeding. So I started logging and got: Consumer: Jul 30 08:55:32 unix-services2 slapd[8041]: slapd starting Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: added 4r Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: added 7r Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: select: listen=7 active_threads=0 tvp=zero Jul 30 08:55:32 unix-services2 slapd[8041]: =>do_syncrepl Jul 30 08:55:32 unix-services2 slapd[8041]: do_syncrep1: ldap_sasl_bind_s failed (49) Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: shutdown requested and initiated. Jul 30 08:55:32 unix-services2 slapd[8041]: daemon: closing 7 Jul 30 08:55:32 unix-services2 slapd[8041]: slapd shutdown: waiting for 0 threads to terminate Producer: Jul 30 08:55:18 test1 slapd[4919]: connection_get(13) Jul 30 08:55:18 test1 slapd[4919]: connection_get(13): got connid=0 Jul 30 08:55:18 test1 slapd[4919]: connection_read(13): checking for input on id=0 Jul 30 08:55:18 test1 slapd[4919]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Jul 30 08:55:18 test1 slapd[4919]: daemon: select: listen=7 active_threads=0 tvp=NULL Jul 30 08:55:18 test1 slapd[4919]: daemon: select: listen=8 active_threads=0 tvp=NULL Jul 30 08:55:18 test1 slapd[4919]: do_bind Jul 30 08:55:18 test1 slapd[4919]: >>> dnPrettyNormal: <cn=syncuser,dc=mydomain,dc=com> Jul 30 08:55:18 test1 slapd[4919]: <<< dnPrettyNormal: <cn=syncuser,dc=mydomain,dc=com>, <cn=syncuser,dc=mydomain,dc=com> Jul 30 08:55:18 test1 slapd[4919]: do_bind: version=3 dn="cn=syncuser,dc=mydomain,dc=com" method=128 Jul 30 08:55:18 test1 slapd[4919]: conn=0 op=0 BIND dn="cn=syncuser,dc=mydomain,dc=com" method=128 Jul 30 08:55:18 test1 slapd[4919]: ==> bdb_bind: dn: cn=syncuser,dc=mydomain,dc=com Jul 30 08:55:18 test1 slapd[4919]: bdb_dn2entry("cn=syncuser,dc=mydomain,dc=com") Jul 30 08:55:18 test1 slapd[4919]: => bdb_dn2id("cn=syncuser,dc=mydomain,dc=com") Jul 30 08:55:18 test1 slapd[4919]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Jul 30 08:55:18 test1 slapd[4919]: send_ldap_result: conn=0 op=0 p=3 Jul 30 08:55:18 test1 slapd[4919]: send_ldap_result: err=49 matched="" text="" Jul 30 08:55:18 test1 slapd[4919]: send_ldap_response: msgid=1 tag=97 err=49 Jul 30 08:55:18 test1 slapd[4919]: conn=0 op=0 RESULT tag=97 err=49 text= Googling for do_syncrep1: ldap_sasl_bind_s failed (49) indicates that this is likely to be an authentication issue with my syncuser. I double-checked the password, and verified that it's set as cleartext in slapd.conf I then tried to log on to a machine using the producer as the authentication server, since there's nothing (that I can think of) that makes this user in any way special. It logs on... and about a half second later is booted back out. No logs on the client machine indicate why. Googling bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) led to many mentions of this almost certainly being a permissions issue, but: [root@test1 ~]# ls -l /var/lib/ldap/ total 69816 -rw-r--r-- 1 ldap ldap 2048 Jul 30 08:54 alock -rw------- 1 ldap ldap 28672 Jul 29 15:45 cn.bdb -rw------- 1 ldap ldap 24576 Jul 29 15:45 __db.001 -rw------- 1 ldap ldap 80019456 Jul 29 15:45 __db.002 -rw------- 1 ldap ldap 335552512 Jul 29 15:45 __db.003 -rw------- 1 ldap ldap 2359296 Jul 29 15:45 __db.004 -rw------- 1 ldap ldap 352256 Jul 29 15:45 __db.005 -rw------- 1 ldap ldap 24576 Jul 29 15:45 __db.006 -rw-r----- 1 ldap ldap 886 Jul 29 15:41 DB_CONFIG -rw------- 1 ldap ldap 24576 Jul 29 15:45 dn2id.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 gidNumber.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 givenName.bdb -rw------- 1 ldap ldap 98304 Jul 30 08:54 id2entry.bdb -rw------- 1 ldap ldap 10485760 Jul 30 08:54 log.0000000001 -rw------- 1 ldap ldap 8192 Jul 29 15:45 loginShell.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 mail.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 memberUid.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 objectClass.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 ou.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 sn.bdb -rw------- 1 ldap ldap 20480 Jul 29 15:45 uid.bdb -rw------- 1 ldap ldap 8192 Jul 29 15:45 uidNumber.bdb They look OK to me. What can I do to further troubleshoot this issue? I want to make 100% sure that my underlying LDAP is working before I tackle the SSL part. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

1 1

role based access to various systems
by amit vyas 30 Jul '08

30 Jul '08

Hi All, I am little bit new to LDAP directory system. Presently, i am using OpenLDAP to authenticate users. Now i want authorization for various system(Like versioning system, bug tracking system etc.) So want to store the access rights corresponding to different roles in LDAP (Read, Write, Update, Delete permissions). Can anybody give me sample .ldif for the same or any other useful information. It will be very useful......... Regards Amit Download prohibited? No problem. CHAT from any browser, without download. Go to http://in.webmessenger.yahoo.com/

2 1

Autofs-OpenLDAP Assistance
by Santosh Balan 30 Jul '08

30 Jul '08

Hi Friends, I am new to this LDAP community. I am haivng redhat evironment on my servers and my clients are also linux based thin clients or redhat linux based clients. I am trying to configure LDAP to authenticate my user to login to the machine and then automatically mount a partition to the user's machine. I have searched through the net and unable to find an appropriate doccumentation on the same. Can you please guide and provide some appropriate doccumentation or method as how I hv to go about with the installation of OpenLDAP and autofs such that it will authenticate my users and automatically mounts the users partition. Thanks and Regards Santosh Balan +91-9819419509 = -- Powered by Outblaze

3 2

Re: N-way multimaster
by Miguel Jinez 29 Jul '08

29 Jul '08

Sure In this case the process was: master B and master C are without service master A performs a delete restart masters A B C Master A: # 20080729212056.000003Z, accesslog dn: reqStart=20080729212056.000003Z,cn=accesslog objectClass: auditDelete reqStart: 20080729212056.000003Z reqEnd: 20080729212056.000004Z reqType: delete reqSession: 33 reqAuthzID: cn=admin,dc=ar reqDN: cn=pbo101,dc=dominio,dc=ar reqResult: 0 Master B: # 20080729212438.000000Z, accesslog dn: reqStart=20080729212438.000000Z,cn=accesslog objectClass: auditModify reqStart: 20080729212438.000000Z reqEnd: 20080729212438.000001Z reqType: modify reqSession: 4294967295 reqAuthzID: cn=admin,dc=ar reqDN: dc=ar reqResult: 0 reqMod: contextCSN:= 20080728211620.143999Z#000000#003#000000 reqMod: contextCSN:= 20080729212056.356833Z#000000#001#000000 reqMod: contextCSN:= 20080728211533.044990Z#000000#002#000000 Master C: # 20080729212911.000000Z, accesslog dn: reqStart=20080729212911.000000Z,cn=accesslog objectClass: auditModify reqStart: 20080729212911.000000Z reqEnd: 20080729212911.000002Z reqType: modify reqSession: 4294967295 reqAuthzID: cn=admin,dc=ar reqDN: dc=ar reqResult: 0 reqMod: contextCSN:= 20080728211620.143999Z#000000#003#000000 reqMod: contextCSN:= 20080729212056.356833Z#000000#001#000000 reqMod: contextCSN:= 20080728211533.044990Z#000000#002#000000 Migue 2008/7/29 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Hi I have test from zero and I have test with historical information, I > > have > > found my old configuration and the logs are different, here master A: > > Can we see your actual logs, not the accesslog ones after the test when/i > fit fails. > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

translucent overlay with local-only entries
by Sven Ulland 29 Jul '08

29 Jul '08

I'm trying to extend an ldap directory using the translucent overlay, like many before me: http://www.openldap.org/lists/openldap-software/200802/msg00128.html http://www.openldap.org/lists/openldap-software/200802/msg00267.html http://www.openldap.org/lists/openldap-software/200511/msg00216.html http://www.openldap.org/lists/openldap-software/200707/msg00471.html Before version 2.4.8, this wasn't possible. Howard Chu seems to have fixed this in rev 1.40 (before release 2.4.8) of translucent.c: http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/overlays/translucent… (http://www.openldap.org/lists/openldap-bugs/200712/msg00109.html) Although it seems to have been fixed, I cannot get it to work on my setup. I use the packaged v2.4.10 in Debian testing. My config: # Config start include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload translucent sizelimit 500 tool-threads 1 backend hdb backend ldap database hdb directory /var/lib/ldap/translucent suffix "dc=example,dc=com" rootdn "cn=admin,dc=mybranch,dc=example,dc=com" rootpw "admin" overlay translucent uri "ldap://172.27.27.37" idassert-bind bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="admin" mode=none idassert-authzFrom "dn.subtree:dc=example,dc=com" # Config end This works perfectly fine for searches where the entry is remote. Changing entries works fine well, with the results stored in the local translucent db. Adding new entries works, but they are not returned on searches. I check this by running slapcat. So, it boils down to these questions: * Does Howard's patch not fully implement the searching? * Is my config wrong? * There is probably other ways to do this, perhaps using a meta ldap backend. With multiple backends, what determines where writes go? Probably where the object is based, but what about new objects? * Is it cleaner to keep my "branch" of the tree under a subdomain, such as mybranch.example.com using rwm, or should they all be on the main example.com domain? * Examples for exotic overlays are very scarce. It would be very helpful if anyone could provide their configuration file. sven

1 0

Modifying every entry in an LDAP address book
by Carr, Chris 29 Jul '08

29 Jul '08

Hi All, Apologies if this is a stupid question, but I can't find the answer via Google. I need to make the same modification to every entry in my address book. Can I do this with a single ldapmodify command? If so, what is the syntax for the mod file? I'm assuming something like this: dn: ?? changetype: modify add: objectClass objectClass: evolutionPerson ... but I can't think what the DN would be, since I don't really understand how wildcards work in DNs, if at all. The entries I want to modify are all in ou=addressbook,dc=mydomain, but all have different cns. Second, some of the entries already have that object class - will this cause a problem? Will ldapmodify simply ignore those entries, or create a duplicate identical objectClass, or crash? Many thanks in advance, CC This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

3 3

Client says Can't contact LDAP server, but it can!
by John Oliver 29 Jul '08

29 Jul '08

What can I do to troubleshoot this? OpenLDAP client says ldap_simple_bind Can't contact LDAP server but it can resolve the name, ping the server, connect to port 636... and I have no details as to why it thinks it cannot contact the server. Many other clients authenticate to the same server, and I'm using the same ldap.conf, nsswitch.conf, and pam.d/system-auth files. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

7 21

Re: Client says Can't contact LDAP server, but it can!
by Gustavo Mendes de Carvalho 28 Jul '08

28 Jul '08

Hi There, I use self signed certificates with OpenLDAP, and everything works fine. Check bellow which commands I used to create this certificate ===> Self signed certificate generation (I am using RHAS 4 Up6) cd /usr/share/ssl rm -fr demoCA /usr/share/ssl/misc/CA -newca openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem /usr/share/ssl/misc/CA -sign ===> putting certificate files to correct place cp demoCA/cacert.pem /etc/openldap/cacerts/cacert.pem cp newcert.pem /etc/openldap/cacerts/servercrt.pem cp newreq.pem /etc/openldap/cacerts/serverkey.pem chmod 0400 /etc/openldap/cacerts/serverkey.pem chown -R ldap:ldap /etc/openldap/cacerts /etc/init.d/ldap restart ===> putting public certificate files in ldap client machines scp /etc/openldap/cacerts/cacert.pem root@<ip_client>:/etc/openldap/cacerts/. And set in ldap config files (in ldap client machine) the correct path When generating certificate file, be sure to specify in hostname field "hostname -f" output command. You can try using localhost too I hope it helps you --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com Date: Mon, 28 Jul 2008 09:20:23 +0200 From: Buchan Milne <bgmilne(a)staff.telkomsa.net> Subject: Re: Client says Can't contact LDAP server, but it can! To: openldap-technical(a)openldap.org Cc: John Oliver <joliver(a)john-oliver.net> Message-ID: <200807280920.33142.bgmilne(a)staff.telkomsa.net> Content-Type: text/plain; charset="iso-8859-1" On Friday 25 July 2008 17:16:12 John Oliver wrote: > On Fri, Jul 25, 2008 at 10:20:55AM +0200, Buchan Milne wrote: > > On Friday 25 July 2008 01:13:37 John Oliver wrote: > > > On Thu, Jul 24, 2008 at 04:04:10PM -0700, Quanah Gibson-Mount wrote: > > > > Any client will need to know about the CA that signed your > > > > self-signed cert. > > > > > > I created my certificate with: > > > > > > openssl req -new -x509 -nodes -out /etc/ssl/ldap.pem -keyout > > > /etc/openldap/ssl/ldap.pem -days 3650 > > > > > > In slapd.conf I have: > > > > > > TLSCertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile > > > /etc/openldap/ssl/ldap.pem TLSCACertificateFile /etc/ssl/ldap.pem > > > > > > What do I need to do differently? > > > > Configure the *client* ??? > > The clients work perfectly with the working server. Why would they > have to have a different configuration to talk to the backup LDAP server? They don't necessarily need a different configuration, but it being valid for one server doesn't guarantee it will be valid for another server, especially when it comes to ssl, certificate validation etc. > At the moment, I'm far more interested in getting the second LDAP > server working than I am in having perfect security. Then it's easy, turn off SSL. If you don't want to do that, turn of certificate validation. It's better than exposing keys. Or, ensure that the "CA certificate" that the clients use contains the certificates of the issuer of both of the server certificates, and that the value of the subject CN on both certificates matches the name you use to connect to the servers. Regards, Buchan

1 0

Re: N-way multimaster
by Miguel Jinez 28 Jul '08

28 Jul '08

Hi I have test from zero and I have test with historical information, I have found my old configuration and the logs are different, here master A: # 20080728211533.000002Z, accesslog dn: reqStart=20080728211533.000002Z,cn=accesslog objectClass: auditDelete reqStart: 20080728211533.000002Z reqEnd: 20080728211533.000003Z reqType: delete reqSession: 387 reqAuthzID: cn=admin,dc=ar reqDN: cn=user1000,dc=osde1,dc=ar reqResult: 0 Here master B # 20080728211533.000002Z, accesslog dn: reqStart=20080728211533.000002Z,cn=accesslog objectClass: auditDelete reqStart: 20080728211533.000002Z reqEnd: 20080728211533.000003Z reqType: delete reqSession: 387 reqAuthzID: cn=admin,dc=ar reqDN: cn=user1000,dc=osde1,dc=ar reqResult: 0 I am just using accesslog to look what is happening Greetings 2008/7/28 Gavin Henry <ghenry(a)openldap.org> > Hi, > > I meant originally. To test for me: > > 1. Emtpy both databases, including the accesslogs (accesslog not needed > here) > 2. Add original data to one node only, with the other switched off. > 3. Bring the other one up and let it pull data from the first node. > 4. Test they are the same and then try your delete situation. > > I think you've either added fresh data to each node so their *CSN values > are different so the deletes won't work. > > Please test and report back. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > >

1 1

Re: N-way multimaster
by Miguel Jinez 28 Jul '08

28 Jul '08

Hi With my configuration at this time I have in one side: # 20080728202600.000001Z, accesslog dn: reqStart=20080728202600.000001Z,cn=accesslog objectClass: auditDelete reqStart: 20080728202600.000001Z reqEnd: 20080728202600.000002Z reqType: delete reqSession: 604 reqAuthzID: cn=admin,dc=ar reqDN: cn=user100,dc=osde1,dc=ar reqResult: 0 and nothing in the other side, let me try olds configurations to show you the mofify message 2008/7/26 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Yes, deletes are performed in one node > > How did you original load the data on each node? > > Can you show the failed delete logs? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: ACL Help Please
by david stackis 28 Jul '08

28 Jul '08

Hi Andrew - I unsubscribe to the openldap-software(a)openldap.org, but subscribe again today. I thought I had this ACL figured out. I'm trying to have users be able to add entries and to access their own address book. I think I have a pretty good start so far, but I'm having difficulty adding entries that only authenticated users have access to. I can add entries using "cn=root,dc=university,dc=edu" without any problems. Right now I have two users, but I'm confused as to how I get entries into their address book. Attached are both my init.ldif, and the slapd.conf I'm using. Any help is appreciated. My init.ldif # # Initialize the suffix entry defined in slapd.conf # dn: dc=University,dc=edu objectclass: top objectclass: dcObject objectclass: organization dc: university o: office # # Initialize the AddressBooks heirarchy # dn: ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organizationalUnit ou: AddressBooks # # Define individual address books # dn: o=me,ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organization o: me dn: o=you,ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organization o: you # # Initialize the Users heirarchy # dn: ou=Users,dc=University,dc=edu objectclass: top objectclass: organizationalUnit ou: Users # # Define individual users # dn: cn=me,ou=Users,dc=University,dc=edu objectclass: top objectclass: person cn: me sn: Person userPassword: {crypt}XXXXXXX dn: cn=you,ou=Users,dc=University,dc=edu objectclass: top objectclass: person cn: you sn: Lastname userPassword: {crypt}XXXXXXX My slapd.conf... # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # # # Allow users to authenticate access to attrs=userPassword by self write by anonymous auth # Allow authenticated users access to their own address book access to dn.regex="o=(.+),ou=AddressBooks,dc=University,dc=edu" by users.expand="cn=$1,ou=Users,dc=University,dc=edu" write # Allow authenticated users to read the resource to which # they have access by logging in with an empty Bind DN access to dn.base="ou=AddressBooks,dc=University,dc=edu" by * read access to dn.base="" by * read # Allow authenticated users to read the Subschema of the # resources to which they have access access to dn.base="cn=Subschema" by * read # Disallow anonymous access (binds) # With this policy in effect, unathenticated users receive a response of # Error 48: Inappropiate authentication disallow bind_anon # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=University,dc=edu" rootdn "cn=root,dc=University,dc=edu" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq Thanks ------------------- david stackis uc santa barbara

1 0

id returns no such user
by Stelios A. 28 Jul '08

28 Jul '08

Hello, I have 2 servers, one act as master and other as slave syncing data with syncrepl user without a problem. Suddenly and after adding an index to the slapd.conf (the problem is probably somewhere else but just mentioning the last thing that I did) on the slave server where email is running I'm getting a: id: shipsec: No such user wherever I'm trying to see a users details. Then webmail, pop etc are not working because machine is not able to resolve the users from ldap. Howver, the getent passwd command return with all users from ldap like been local without a problem. All users under /home are like 1700:users insteed of username:users. The problem is only at the slave as If I stop the ldap on the slave then everything works as it use the master for getting the ids. Any idea? -- Stelios A

3 2

Re: N-way multimaster
by Miguel Jinez 25 Jul '08

25 Jul '08

Yes, deletes are performed in one node 2008/7/25 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Sorry I have a mistake, changing words: > > It should be like this: > > > > syncrepl rid=001 > > provider=ldap://10.100.130.164 > > type=refreshAndPersist > > retry="5 5 300 +" > > searchbase="dc=dominio" > > attrs="*" > > bindmethod=simple > > binddn="cn=admin,dc=dominio" > > credentials=secret > > > > syncrepl rid=002 > > provider=ldap://10.100.130.181 > > type=refreshAndPersist > > retry="5 5 300 +" > > searchbase="dc=dominio" > > attrs="*" > > bindmethod=simple > > binddn="cn=admin,dc=dominio" > > credentials=secret > > > > mirrormode TRUE > > > > In addition when I add "schemachecking=on" syncrinization doesn't works. > > > > With the configurations file that I have made, works adds, updates, but > no > > deletes > > Can you confirm deletes work on one node? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: N-way multimaster
by Miguel Jinez 25 Jul '08

25 Jul '08

Sorry I have a mistake, changing words: It should be like this: syncrepl rid=001 provider=ldap://10.100.130.164 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=dominio" attrs="*" bindmethod=simple binddn="cn=admin,dc=dominio" credentials=secret syncrepl rid=002 provider=ldap://10.100.130.181 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=dominio" attrs="*" bindmethod=simple binddn="cn=admin,dc=dominio" credentials=secret mirrormode TRUE In addition when I add "schemachecking=on" syncrinization doesn't works. With the configurations file that I have made, works adds, updates, but no deletes 2008/7/25 Gavin Henry <ghenry(a)openldap.org> > Miguel Jinez wrote: > >> Hello, yes "dies" means shutdown >> I have made some changes in my config file, but the problem is the same, >> now I'm with openladap-2.4.11. >> Here my config file: >> Master A >> slapd.conf >> >> # Global Directives: >> # Schema and objectClass definitions >> include /etc/ldap/schema/core.schema >> include /etc/ldap/schema/cosine.schema >> include /etc/ldap/schema/nis.schema >> include /etc/ldap/schema/inetorgperson.schema >> include /etc/ldap/schema/samba.schema >> >> pidfile /var/run/slapd/slapd.pid >> argsfile /var/run/slapd/slapd.args >> loglevel 256 >> sizelimit 500 >> tool-threads 1 >> >> backend bdb >> >> database bdb >> suffix "dc=ar" >> >> overlay syncprov >> syncprov-sessionlog 100 >> syncprov-nopresent TRUE >> syncprov-reloadhint TRUE >> syncprov-checkpoint 1 1 >> rootdn "cn=admin,dc=dominio" >> rootpw secret >> >> directory "/usr/local/var/openldap-data" >> >> dbconfig set_cachesize 0 2097152 0 >> >> dbconfig set_lk_max_objects 1500 >> dbconfig set_lk_max_locks 1500 >> dbconfig set_lk_max_lockers 1500 >> >> index cn,sn,uid pres,sub,eq >> index uidNumber,gidNumber eq >> index sambaSID eq >> index sambaPrimaryGroupSID eq >> index sambaDomainName eq >> index objectClass pres,eq >> >> lastmod on >> access to attrs=userPassword,shadowLastChange >> by dn="cn=admin,dc=ar" write >> by anonymous auth >> by self write >> by * none >> access to * >> by dn="cn=admin,dc=ar" write >> by * read >> >> access to * >> by dn.base="cn=admin,dc=ar" read >> by * break >> serverID 3 >> >> syncrepl rid=001 >> provider=ldap://10.100.130.164 <http://10.100.130.164> >> type=refreshAndPersist >> retry="5 5 300 +" >> searchbase="dc=ar" >> attrs="*" >> bindmethod=simple >> binddn="cn=admin,dc=ar" >> credentials=osde >> > > Are you searching for the right attributes here? Just use the defaults like > in the docs: > > syncrepl rid=001 > provider=ldap://ldap-ridr1.example.com > bindmethod=simple > binddn="cn=mirrormode,dc=example,dc=com" > credentials=mirrormode > searchbase="dc=example,dc=com" > schemachecking=on > type=refreshAndPersist > retry="60 +" > > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: openLDAP, DCHP and DNS
by Bjørn Ruberg 25 Jul '08

25 Jul '08

On Wed, 23 Jul 2008 07:56:44 -0700, "Lawrence Anthony" <lanthony(a)postlogic.com> wrote: > Is there any documentation that you can point me too that explains this to > me? I need to make management understand. Most primers and/or SSL/TLS howtos should cover this, as it is rather essential for making certificates work. A Google search will help you :-) And please post/quote correctly, i.e. stop top-posting. It breaks context and readability. See http://www.greenend.org.uk/rjk/2000/06/14/quoting.html for further information. -- Bjørn

1 0

Setting up syncrepl, replicated LDAP doesn't work
by John Oliver 25 Jul '08

25 Jul '08

On my working master server openldap-2.3.27-8 under CentOS 5, I added: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 On the slave server openldap-2.3.27-8.el5_2.4 under CentOS 5.2, I added: syncrepl rid=123 provider=ldaps://primary-ldap-server:636 type=refreshOnly interval=01:00:00:00 searchbase="dc=mydomain,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=syncuser,dc=mydomain,dc=com" credentials=mysecret ldap started on the slave server OK, and /var/lib/ldap has all of the database files. On that server, from the command line, I can: [root@ldap2 ~]# ldapsearch -xLLL -b "dc=mydomain,dc=com" uid=joliver sn givenName cn dn: uid=joliver,ou=People,dc=mydomain,dc=com givenName: John sn: Oliver cn: John Oliver But when I point another machine at that slave server, it won't authenticate: Jul 23 03:06:28 localhost login(pam_unix)[9475]: check pass; user unknown Jul 23 03:06:28 localhost login(pam_unix)[9475]: authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= Jul 23 03:06:28 localhost login[9475]: pam_ldap: ldap_search_s No such object Jul 23 03:06:30 localhost login[9475]: FAILED LOGIN 1 FROM (null) FOR joliver, Authentication failure [root@localhost ~]# ldapsearch -H ldaps://ldap2.mydomain.com -b "dc=mydomain,dc=com" uid=joliver sn givenName cn ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed [root@localhost ~]# ldapsearch -H ldap://ldap2.mydomain.com -b "dc=mydomain,dc=com" uid=joliver sn givenName cn SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database When using just ldap:// with ldapsearch, I don't know what password it's asking for. My LDAP password doesn't work, the LDAP admin password doesn't work, the local root password doesn't work... Here's the odd thing. When I started setting this up, the machine that's the primary (and working) LDAP server now was running fedora-ds. I set up OpenLDAP on what is now the slave server, and it worked perfectly. I slapcat'ed it, installed OpenLDAP on the primary server, and slapadded the db. I never generated any certificates on it at all, and it works perfectly. I just regenerated the cert on the slave server, but no joy. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 1

mailHost
by Aravind Arjunan 24 Jul '08

24 Jul '08

hi, i had configured openldap in RHEL 5.1 operating system as master/slave for replication. It is working fine without any problem I had integrated openldap with my mailserver. mail server is in RHEL 5.1 OS and am using postfix. I have two mail box server in different location and two mail servers. unique users are existing in different mail servers The problem is when mail comes for a particular user it must go the respective mail box server. For that i need to mention in openldap a mailHost attribute. as you all know mailHost attribute is for specifying the location of mailbox. But in openldap misc.schema mailHoat attribute exits. When i add the misc.schema in slapd.conf file and if i add the mailHost attribute am getting error when i was restarting. And i had downloaded the qmail.schema from google and added that in schema directory as well as in slapd.conf Then i added the mailHost attribute. But when i specify the mailHost attribute as IP of my mailbox location, the mail is dropping by creating the IP as name.

2 1

Single master/multislave and passwords
by Bryan Payne 23 Jul '08

23 Jul '08

Our master is in dallas. One slave is in ohio. Our ohio users bind to their local server for speed's sake. This is obviously a problem if they change their password. Is there a way to bind locally but when it comes to updating passwords, it inform the master instead?

2 1

Re: N-way multimaster
by Miguel Jinez 23 Jul '08

23 Jul '08

Hello, yes "dies" means shutdown I have made some changes in my config file, but the problem is the same, now I'm with openladap-2.4.11. Here my config file: Master A slapd.conf # Global Directives: # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 sizelimit 500 tool-threads 1 backend bdb database bdb suffix "dc=ar" overlay syncprov syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE syncprov-checkpoint 1 1 rootdn "cn=admin,dc=dominio" rootpw secret directory "/usr/local/var/openldap-data" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index cn,sn,uid pres,sub,eq index uidNumber,gidNumber eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass pres,eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=ar" write by anonymous auth by self write by * none access to * by dn="cn=admin,dc=ar" write by * read access to * by dn.base="cn=admin,dc=ar" read by * break serverID 3 syncrepl rid=001 provider=ldap://10.100.130.164 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=ar" attrs="*" bindmethod=simple binddn="cn=admin,dc=ar" credentials=osde syncrepl rid=002 provider=ldap://10.100.130.181 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=ar" attrs="*" bindmethod=simple binddn="cn=admin,dc=dominio" credentials=secret mirrormode TRUE ##Accesslog overlay overlay accesslog logdb "cn=accesslog" logops writes logold (objectclass=auditModify) logoldattr reqOld logold (objectclass=auditDelete) logoldattr reqOld logsuccess TRUE logpurge 2+00:00 06:00 ##AccessLog DB database bdb suffix cn=accesslog rootdn "cn=accesslog" directory "/usr/local/var/access" index reqStart eq index default eq index entryUUID eq index entryCSN eq index objectClass,reqEnd,reqResult,reqDN,reqType access to * by dn="cn=admin,dc=dominio" read database monitor #******* 2008/7/23 Gavin Henry <ghenry(a)openldap.org>: > Miguel Jinez wrote: > >> Hello, I have upgrated openLDAP to 2.4.10, and I can t fix that situation >> Someone know what is the problem? or really is a bug? >> >> > Hi, > > I'm replying to this thread instead of: > > (ITS#5617) N-way multimaster replication problem > > Can we see your complete config? Also, "dies", do you mean shutdown? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

openLDAP, DCHP and DNS
by openLDAP 23 Jul '08

23 Jul '08

I would like to configure my openLDAP network using DHCP for my client machines. Is it necessary to have DNS names for all my clients, e.g. something.domain.com, for OpenLDAP to work properly or will it work as long as my openldap servers have fully qualified domain names?

2 1

Re: Client connect issues with OpenLDAP 2.3 on RHEL 4
by Gustavo Mendes de Carvalho 22 Jul '08

22 Jul '08

Hi Martin, Upgrade your RHEL from 4 to 5 that will work. I faced exactly same situation earlier. --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com > Date: Mon, 21 Jul 2008 18:33:42 +0100 > From: "Martin Benson" <martin_benson1972(a)hotmail.com> > Subject: Client connect issues with OpenLDAP 2.3 on RHEL 4 > To: <openldap-technical(a)openldap.org> > Message-ID: <BLU120-DAV199BFEDE2D0B7E6F309718B8A0(a)phx.gbl> > Content-Type: text/plain; charset="us-ascii" > > I have a Red Hat Enterprise Linux v4.4 installation that runs OpenLDAP 2.2 > using the provided Red Hat rpm's. I want to upgrade this to OpenLDAP 2.3 and > have created an LDAP server using the packages from > > > Thanks Martin

1 0

password changing problems
by Ron Echeverri 22 Jul '08

22 Jul '08

I've set up OpenLDAP 2.4.10 and have been using phpldapadmin for user management. The machines in our QA environment are set up to allow LDAP users to log in, and they are also able to change their password via the passwd command. However, they are only able to do this once; if they attempt it again, it bounces back with "LDAP Password incorrect: try again". They are able to log out and in regardless, but passwd will not accept their password in order to change it. If the user's password is reset in phpldapadmin, again they are able to change the password once, and no more. There is no password policy configured in slapd; should there be? I have loglevel set to 296, but i'm not sure what to look for. thanks rone

5 8

Automatically create home directory uppon Email login
by Stelios A. 22 Jul '08

22 Jul '08

Hello all, I've migrate an old Sun Directory Server to OpenLDAP (version 2.4.9 on Ubuntu 8.04 server) and setup a master/slave with syncrepl for data replication betwwen 2 servers. 1st server hold the master ldap and second the slave along with the email server (Sendmail + Dovecot). Email server requires ofcourse a home directory with a mbox file etc. Is there a way to avoid creating each users home directory and setup then his/her permissions? There are 980 users in the base dc and trying to figure out a way to avoid creating all this directories along with chmod manually. I've already setup pam to auto create home directory uppon user login but problem is that only 5 users will have access via ssh. Any ideas? Thanks a lot

3 4

Client connect issues with OpenLDAP 2.3 on RHEL 4
by Martin Benson 21 Jul '08

21 Jul '08

I have a Red Hat Enterprise Linux v4.4 installation that runs OpenLDAP 2.2 using the provided Red Hat rpm's. I want to upgrade this to OpenLDAP 2.3 and have created an LDAP server using the packages from http://staff.telkomsa.net/packages/rhel4/openldap/i386 . The problem I have is that I cannot get a client to attach or query the server. I have installed the openldap2.3-clients and openldap2.3 packages and the server with logging enabled does not even show a connection. I suspect it is a problem with the nss_ldap package that comes bundled with RHEL 4.4. I cannot compile the software on my system as it is a partial install for clients of ours and does not get delivered with compiler software. Does anyone know of an updated rpm for nss_ldap to be compatible with openldap2.3 and RHEL 4? Has anyone done the install and written an install guide? Thanks Martin

2 1

Reg:Design of openldap
by Chakri 21 Jul '08

21 Jul '08

Hi, i'm a newbie to this ldap world.But i have been spending so much time to understand the design of openldap-2.3.39. I wanted to understand the process flow during the functioning of slapd. can some one tell me where can i get the design documents of openldap....plz help...

1 0

memberOf search ACLs
by Andrew Bartlett 21 Jul '08

21 Jul '08

I've recently been trying to lock down Samba4's default ACLs, in it's generated LDAP backend configuration. I have memberOf configured to 'error' on dangling links, which I need for Samba. But I seem to be having some trouble with ACLs. I've attached my full config file, but the key part is: access to dn.base="" by dn=cn=samba-admin,cn=samba manage by anonymous read by * read access to dn.subtree="cn=samba" by anonymous auth access to dn.subtree="${DOMAINDN}" by dn=cn=samba-admin,cn=samba manage by * none If I change the last line to 'by * read', then the error is returned, but otherwise (due apparently to "" being unable to read the entry to validate it's existence). Shouldn't the search operations happen as the rootdn or memberof-dn, or am I missing some other configuration element here? In trying to fix this, I looked at what seemed to by typos in memberof.c, the patch of which I attach, but this didn't help. Any thoughts? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 5

Re: BDB selection, et al.
by William Jojo 20 Jul '08

20 Jul '08

---- Original message ---- >Date: Sat, 19 Jul 2008 04:33:46 -0700 >From: Howard Chu <hyc(a)symas.com> >Subject: Re: BDB selection, et al. >To: Quanah Gibson-Mount <quanah(a)zimbra.com> >Cc: William Jojo <jojowil(a)hvcc.edu>,openldap-technical(a)openldap.org > >Quanah Gibson-Mount wrote: >> --On Friday, July 18, 2008 9:11 PM -0400 William Jojo<jojowil(a)hvcc.edu> >> wrote: > >>> I have noticed that the Symas packages user BDB 4.2 (with 2.3.42) as does >>> Ubuntu with 2.4.9+. I was wondering what the preference is over 4.4 >>> (which I use) and 4.[67]. >> >> 4.2.52 + patches has the longest history of being solid. >> >> 4.3 was a disaster >> >> 4.4 was likely okay >> >> 4.5 was likely okay >> >> 4.6 also seems okay, and has some useful improvements >> >> 4.7 is not yet supported, but will be in a future release, and has >> additional useful improvements over 4.6. > >4.7 can be made to work, if you're willing to tweak things a bit. The memory >manager in 4.6 is much improved over earlier versions; the memory manager in >4.7 is slightly better still. The lock manager in 4.7 is more efficient in >multi-core systems than in previous versions. > Do you, Howard, consider BDB 4.4 stable? I originally worked on 4.2 for initial rollout some years ago. Admittedly, I have no problems at present with 4.4, and I could be convinced to step backward if there is a compelling reason to do so. >>> I ask because I build OpenLDAP (among other things) for AIX 5.2/5.3/6.1 >>> at (shameless plug) http://pware.hvcc.edu/ and I was considering moving >>> to 2.4.10 with BDB 4.6, but now I am not certain where to go for a few of >>> reasons: >>> >>> * Why the choice to stay with BDB 4.2? >> >> Proven track record over later releases (4.4, 4.5) for stability and >> performance. >> >>> * And OpenSSL 0.9.7l (over the 0.9.8 series)? >> >> I use OpenSSL 0.9.8 in my builds and have for ages. > >The Symas OpenLDAP 2.4 packages also use OpenSSL 0.9.8. However, the OpenSSL >build system changed, making it more difficult to complete the Windows build. >That's one of the reasons we stayed with 0.9.7 for so long in our OpenLDAP 2.3 >packages. >> >>> * 2.3.39 has been *stable* since 11/2007 and I have not moved from that >>> point within the software suite offered. Is a later version of 2.3 going >>> to be marked stable (like 2.3.42.1 is in the Symas prodcut). >> >> Not likely. > >True, no further 2.3.x release will be marked Stable. > >> Stable is really a fairly meaningless term. > >False. At the time that a release was marked stable, it was considered the >most stable release. I.e., after sufficient amount of time in release, no >major issues were discovered. > >> Assigning meaning >> to it as a guideline as to what version to build is a very bad idea. >> There's a major DoS vulnerability in 2.3.39, for example, that was fixed in >> 2.3.43 and 2.4.11. > >It's important to note that the Stable marker only changes if there's a new >release that we consider stable. The subsequent discovery of bugs in a Stable >release won't trigger the removal of that marker. So 2.3.39 is still marked >Stable, even though important bug fixes are in 2.3.43, because those bugs were >discovered long after 2.3.39 was released. > So, I guess I will stay where I am in production and prepare for a 2.4 upgrade at some soon time after I finish my testing in 2.4 and when a stable release is announced. >In the meantime, when moving the Stable marker, the Project's practice has >been that it can only be moved to the Current release stream, which is 2.4. >But we haven't yet seen a 2.4 release remain long enough in public use without >new issues quickly being discovered. So there is not yet a new Stable release. > >>> * 2.4.x seems stable enough to me and certainly to Ubuntu x86[_64], but I >>> would like some other indication that I should make the leap before I >>> begin to change dependencies to several of the products I produce. Is >>> 2.4.x going to be marked stable in the near future? > >> Hopefully. Note that stable does not remotely mean bug free (or relatively >> low in bug count). It simply means stable as far as core (i.e., not new) >> functionality is concerned. > >No. It means low bug count as of a particular point in time, e.g., within a >couple weeks after the release. > >And as I recall, we need to get to a feature freeze in the core code first. I >think 2.4 is just about at this point now. > Superb. Thank you very much, Quanah and Howard. It has been a very enlightening discussion. Cheers, Bill >-- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Please help me with ppolicy pwdReset
by Scott Classen 19 Jul '08

19 Jul '08

Hi All, this is my default ppolicy: dn: cn=default,ou=Policies,dc=example,dc=com objectClass: pwdPolicy objectClass: top objectClass: device pwdAttribute: userPassword pwdMaxFailure: 3 pwdFailureCountInterval: 0 pwdAllowUserChange: TRUE cn: default pwdSafeModify: FALSE pwdExpireWarning: 0 pwdInHistory: 1 pwdMinLength: 7 pwdGraceAuthNLimit: 1 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 63072000 pwdCheckQuality: 2 pwdMustChange: TRUE pwdMinAge: 0 Here is an example of a user with their pwdReset attribute set to TRUE. I've only included the relevant lines: dn: uid=newguy,ou=People,dc=example,dc=com pwdChangedTime: 20080718234642Z pwdReset: TRUE pwdPolicySubentry: cn=default,ou=Policies,dc=example,dc=com Shouldn't this user be requested to change their password the next time the log in? Well they're not. logins a successful and there is no prompting for a new password. Can someone please help me trouble shoot this? Thanks, Scott

1 1

RES: ppolicy woes
by Gustavo Mendes de Carvalho 19 Jul '08

19 Jul '08

Hi Bob, Some months ago I had similar problem trying to use Password Policy. I was using RHAS4 Up6, and my client machines was using RHES4 Up2, and for some unknown reason, no matter waht configuration I did, client machines did not recognizes ppolicy arguments sent from ldap server. I just solved this situation doing some upgrade in client machines, from Up2 to Up5. After this upgrade, everithing was OK. Did you try this client configuration in some other linux distribution ? --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

BDB selection, et al.
by William Jojo 19 Jul '08

19 Jul '08

I have noticed that the Symas packages user BDB 4.2 (with 2.3.42) as does Ubuntu with 2.4.9+. I was wondering what the preference is over 4.4 (which I use) and 4.[67]. I ask because I build OpenLDAP (among other things) for AIX 5.2/5.3/6.1 at (shameless plug) http://pware.hvcc.edu/ and I was considering moving to 2.4.10 with BDB 4.6, but now I am not certain where to go for a few of reasons: * Why the choice to stay with BDB 4.2? * And OpenSSL 0.9.7l (over the 0.9.8 series)? * 2.3.39 has been *stable* since 11/2007 and I have not moved from that point within the software suite offered. Is a later version of 2.3 going to be marked stable (like 2.3.42.1 is in the Symas prodcut). * 2.4.x seems stable enough to me and certainly to Ubuntu x86[_64], but I would like some other indication that I should make the leap before I begin to change dependencies to several of the products I produce. Is 2.4.x going to be marked stable in the near future? I appreciate all of the work of the OpenLDAP team and the community. I welcome any suggestions to help me make the right decision. In the meantime, my own production servers remain at 2.3.39-stable, but I can be persuaded to upgrade. :-) Cheers, Bill

3 2

ppolicy woes
by Robert Evans 18 Jul '08

18 Jul '08

Greetings, I've been trying to get openldap working with the ppolicy stuff for the last week. I think I've got things setup correctly, but the account lockout stuff isn't working and I can't figure out what I've done wrong. I've attached below the slapd.conf, ldap.conf and the ldif file I used to set up the test server. I'm relatively inexperienced in LDAP so I double checked things, but maybe.... If I include the ACL access part in the slapd.conf file (shown below), I can't ssh into a client that is using the server to authenticate. If I remove the access section, I can connect just fine, but then it authenticates me even though an ldapsearch with the -e ppolicy flag shows "ldap_bind: Invalid credentials (49); Account locked" I'm running openldap 2.3.39 on Cent OS 5.0. I'm starting ldap with the -d -1 option and don't see any error messages. Any suggestions? Thanks, Bob ================================ Below are the files used to populate the ppolicy attributes, and the slapd.conf and ldap.conf files on the server. =============================== 1) The following was used to populate the LDAP server, with the top level objects and the ppolicy values =============================== dn: dc=foo,dc=bar,dc=edu objectClass: top objectClass: organization objectClass: dcObject o: foo dc: foo dn: ou=People, dc=foo,dc=bar,dc=edu objectClass: top objectClass: organizationalUnit ou: People dn: ou=Group,dc=foo,dc=bar,dc=edu objectClass: top objectclass: organizationalUnit ou: Group dn: ou=Policies, dc=foo,dc=bar,dc=edu objectClass: top objectClass: organizationalUnit ou: Policies dn: cn=Standard Policy, ou=Policies, dc=foo,dc=bar,dc=edu objectClass: top objectClass: device objectClass: pwdPolicy cn: Standard Policy pwdAttribute: 2.5.4.35 # min passwd change of 7 days pwdMinAge: 604800 # max passwd change of 90 days pwdMaxAge: 7776000 # expire warning in 7 days pwdExpireWarning: 604800 # Can't reuse the last 24 passwords pwdInHistory: 24 # the server must verify the new passwd for changes to be made pwdCheckQuality: 2 # min passwd length pwdMinLength: 8 # Number of failed passwd attempts before lockout pwdMaxFailure: 3 # lockout user for failed attempts pwdLockout: TRUE # only lockout user for 15 minutes pwdLockoutDuration: 900 # Do not allow expired passwd's to access system pwdGraceAuthNLimit: 0 # only reset passwd attempt count on successful login pwdFailureCountInterval: 0 # specifies user must change passwd after admin has reset it pwdMustChange: TRUE # users can change their passwords pwdAllowUserChange: TRUE # Allows the user to change their passwd without typing in the old. pwdSafeModify: TRUE =============================== 2) Here is the slapd.conf file =============================== # master slapd config -- for testing # $OpenLDAP: pkg/ldap/tests/data/slapd-ppolicy.conf,v 1.6.2.7 2007/01/02 21:44:12 kurt Exp $ ## This work is part of OpenLDAP Software <http://www.openldap.org/>. ## ## Copyright 1998-2007 The OpenLDAP Foundation. ## All rights reserved. ## ## Redistribution and use in source and binary forms, with or without ## modification, are permitted only as authorized by the OpenLDAP ## Public License. ## ## A copy of this license is available in the file LICENSE in the ## top-level directory of the distribution or, alternatively, at ## <http://www.OpenLDAP.org/license.html>. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/lib/ldap/run/slapd.pid argsfile /var/lib/ldap/run/slapd.args #mod#modulepath ../servers/slapd/back-bdb/ #mod#moduleload back_bdb.la #monitormod#modulepath ../servers/slapd/back-monitor/ #monitormod#moduleload back_monitor.la modulepath /usr/sbin/openldap/ moduleload ppolicy.la ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=foo,dc=bar,dc=edu" directory /var/lib/ldap/openldap-data rootdn "cn=Manager,dc=foo,dc=bar,dc=edu" rootpw {SSHA}<root slappasswd went here> index objectClass eq #hdb#index objectClass eq #ldbm#index objectClass eq overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,dc=foo,dc=bar,dc=edu" ppolicy_use_lockout access to attr=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=foo,dc=bar,dc=edu" write by dn.base="cn=Manager,dc=foo,dc=bar,dc=edu" write by * none access to * by self write by dn.base="cn=Admin,dc=foo,dc=bar,dc=edu" write by dn.base="cn=Manager,dc=foo,dc=bar,dc=edu" write by * read #database monitor ================================================== 3) Here is the ldap.conf file on the client and server ================================================== # @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $ # # This is the configuration file for the LDAP nameservice # switch library and the LDAP PAM module. # # The man pages for this file are nss_ldap(5) and pam_ldap(5) # # PADL Software # http://www.padl.com # # Your LDAP server. Must be resolvable without using LDAP. # Multiple hosts may be specified, each separated by a # space. How long nss_ldap takes to failover depends on # whether your LDAP client library supports configurable # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. base dc=foo,dc=bar,dc=edu # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. #uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) #ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=proxyuser,dc=example,dc=com # The credentials to bind with. # Optional: default is no credential. #bindpw secret # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=Manager,dc=foo,dc=bar,dc=edu # The port. # Optional: default is 389. port 389 # The search scope. #scope sub #scope one #scope base # Search timelimit #timelimit 30 timelimit 120 # Bind/connect timelimit #bind_timelimit 30 bind_timelimit 120 # Reconnect policy: hard (default) will retry connecting to # the software with exponential backoff, soft will fail # immediately. #bind_policy hard # Idle timelimit; client will close connections # (nss_ldap only) if the server has not been contacted # for the number of seconds specified below. #idle_timelimit 3600 idle_timelimit 3600 # Filter to AND with uid=%s #pam_filter objectclass=account # The user ID attribute (defaults to uid) #pam_login_attribute uid # Search the root DSE for the password policy (works # with Netscape Directory Server) pam_lookup_policy yes # Check the 'host' attribute for access control # Default is no; if set to yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login. #pam_check_host_attr yes # Check the 'authorizedService' attribute for access # control # Default is no; if set to yes, and the user has no # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_template_login nobody # HEADS UP: the pam_crypt, pam_nds_passwd, # and pam_ad_passwd options are no # longer supported. # # Do not hash the password at all; presume # the directory server will do it, if # necessary. This is the default. #pam_password clear # Hash password locally; required for University of # Michigan LDAP server, and works with Netscape # Directory Server if you're using the UNIX-Crypt # hash mechanism and not using the NT Synchronization # service. #pam_password crypt # Remove old password first, then update in # cleartext. Necessary for use with Novell # Directory Services (NDS) #pam_password clear_remove_old #pam_password nds # RACF is an alias for the above. For use with # IBM RACF #pam_password racf # Update Active Directory password, by # creating Unicode password and updating # unicodePwd attribute. #pam_password ad # Use the OpenLDAP password change # extended operation to update the password. #pam_password exop # Redirect users to a URL or somesuch on password # changes. #pam_password_prohibit_message Please visit http://internal to change your password. # RFC2307bis naming contexts # Syntax: # nss_base_XXX base?scope?filter # where scope is {base,one,sub} # and filter is a filter to be &'d with the # default filter. # You can omit the suffix eg: # nss_base_passwd ou=People, # to append the default base DN but this # may incur a small performance impact. #nss_base_passwd ou=People,dc=example,dc=com?one #nss_base_shadow ou=People,dc=example,dc=com?one #nss_base_group ou=Group,dc=example,dc=com?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one #nss_base_services ou=Services,dc=example,dc=com?one #nss_base_networks ou=Networks,dc=example,dc=com?one #nss_base_protocols ou=Protocols,dc=example,dc=com?one #nss_base_rpc ou=Rpc,dc=example,dc=com?one #nss_base_ethers ou=Ethers,dc=example,dc=com?one #nss_base_netmasks ou=Networks,dc=example,dc=com?ne #nss_base_bootparams ou=Ethers,dc=example,dc=com?one #nss_base_aliases ou=Aliases,dc=example,dc=com?one #nss_base_netgroup ou=Netgroup,dc=example,dc=com?one # Just assume that there are no supplemental groups for these named users nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon # attribute/objectclass mapping # Syntax: #nss_map_attribute rfc2307attribute mapped_attribute #nss_map_objectclass rfc2307objectclass mapped_objectclass # configure --enable-nds is no longer supported. # NDS mappings #nss_map_attribute uniqueMember member # Services for UNIX 3.5 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount User #nss_map_attribute uid msSFU30Name #nss_map_attribute uniqueMember msSFU30PosixMember #nss_map_attribute userPassword msSFU30Password #nss_map_attribute homeDirectory msSFU30HomeDirectory #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_objectclass posixGroup Group #pam_login_attribute msSFU30Name #pam_filter objectclass=User #pam_password ad # configure --enable-mssfu-schema is no longer supported. # Services for UNIX 2.0 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount user #nss_map_attribute uid msSFUName #nss_map_attribute uniqueMember posixMember #nss_map_attribute userPassword msSFUPassword #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup Group #nss_map_attribute cn msSFUName #pam_login_attribute msSFUName #pam_filter objectclass=User #pam_password ad # RFC 2307 (AD) mappings #nss_map_objectclass posixAccount user #nss_map_objectclass shadowAccount user #nss_map_attribute uid sAMAccountName #nss_map_attribute homeDirectory unixHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup group #nss_map_attribute uniqueMember member #pam_login_attribute sAMAccountName #pam_filter objectclass=User #pam_password ad # configure --enable-authpassword is no longer supported # AuthPassword mappings #nss_map_attribute userPassword authPassword # AIX SecureWay mappings #nss_map_objectclass posixAccount aixAccount #nss_base_passwd ou=aixaccount,?one #nss_map_attribute uid userName #nss_map_attribute gidNumber gid #nss_map_attribute uidNumber uid #nss_map_attribute userPassword passwordChar #nss_map_objectclass posixGroup aixAccessGroup #nss_base_group ou=aixgroup,?one #nss_map_attribute cn groupName #nss_map_attribute uniqueMember member #pam_login_attribute userName #pam_filter objectclass=aixAccount #pam_password clear # Netscape SDK LDAPS #ssl on # Netscape SDK SSL options #sslpath /etc/ssl/certs # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 #ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". #tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key # Disable SASL security layers. This is needed for AD. #sasl_secprops maxssf=0 # Override the default Kerberos ticket cache location. #krb5_ccname FILE:/etc/.ldapcache # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control #pam_sasl_mech DIGEST-MD5

2 1

schema
by John Kellen 18 Jul '08

18 Jul '08

Hello, what schema do i need to have configured in slapd.conf to use this ldif file: *dn: cn=aderaede,ou=People,dc=vub,dc=ac,dc=be objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: inetLocalMailRecipient objectClass: shadowAccount uid: aderaede sn: *********** givenName: Anouk cn: aderaede userPassword: {crypt}WZpdKybON0LAQ loginShell: /bin/csh uidNumber: 25556 gidNumber: 3294 homeDirectory: /u/aderaede gecos: *************** mail: ************* displayName: *************** ** I have the following configured in slapd.conf *# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schemaµ* Thanks J

3 5

Problem deleting item because of DB_LOCK_NOTGRANTED
by Laurent Bourqui 17 Jul '08

17 Jul '08

Dear Openldap techies, I have been trying for hours to bring this server to work without any success so far. When I try to delete an object from the ldap server with ldapdelete, I get the following error message in the log file: Jul 18 00:43:00 zorg slapd[1904]: => bdb_dn2id_delete 0x3: "cn=laurent bourqui,ou=addresses,dc=apicus,dc=ch" Jul 18 00:43:00 zorg slapd[1904]: <= bdb_dn2id_delete 0x3: -30994 Jul 18 00:43:00 zorg slapd[1904]: <=- bdb_delete: dn2id failed: DB_LOCK_NOTGRANTED: Lock not granted (-30994) Jul 18 00:43:00 zorg slapd[1904]: ==> bdb_delete: retrying... The server is configured the following way: sladpd.conf: ------------------------ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/local/libexec/openldap moduleload back_bdb loglevel any ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=apicus,dc=ch" rootdn "cn=admin,dc=apicus,dc=ch" rootpw xxxxxxxx directory /var/db/openldap-data index objectClass eq ---------------------------------------- I have added some entries using the following ldif file: ---------------------------------------- dn: dc=apicus, dc=ch objectclass: dcObject objectClass: organization o: apicus dc: apicus dn: ou=addresses, dc=apicus, dc=ch objectclass: organizationalUnit ou: addresses description: Apicus Addressbook dn: cn=Laurent Bourqui, ou=addresses, dc=apicus, dc=ch objectClass: top objectClass: inetOrgPerson uid: 00001 cn: Laurent Bourqui gn: Laurent sn: Bourqui mobile: +xxxxxxxxx homePhone: +xxxxxxxxxxx street: xxxxxxxxxxxx postalCode: xxxxx l: xxxxxxxxxx st: xxx ---------------------------------------- The ldif file has been imported with the following command: ldapadd -x -W -D 'cn=admin,dc=apicus,dc=ch' -f apicus-addresses.ldiff I'm now trying to delete the entry: dn: cn=Laurent Bourqui, ou=addresses, dc=apicus, dc=ch using the following command: ldapdelete -x -W -D 'cn=admin,dc=apicus,dc=ch' "cn=Laurent Bourqui, ou=addresses, dc=apicus, dc=ch" This command hangs and continuisly bring the error message in the logs. I have search the FAQ, google and event the berkley DB infos for informations but I was not able to find any hint about the reason of this problem. Did anybody already encoutered this error ? Versions: openldap 2.4.10 FreeBSD 7.0 Any feedback will be welcom. Many thanks in advance for your help. Best Regards -- Laurent Bourqui

1 0

problem connection in local with account root
by GanGan 17 Jul '08

17 Jul '08

hello all I have problem for connect in local in my server rhel 5.1with the root account all the connection with ssh are good, root too I use ldap for other account the root account is not in ldap my /etc/nsswitch.conf passwd: files [SUCCESS=return] ldap shadow: files [SUCCESS=return] ldap group: files [SUCCESS=return] ldap when I delete ldap in my nsswitch.conf the connection local with the root account works well I have modified /etc/pam.d/sshd no other files in /etc/pam.d/ my /etc/pam.d/sshd auth optional pam_group.so auth required pam_env.so auth sufficient pam_unix.so likeauth auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so auth required pam_warn.so account sufficient pam_unix.so account sufficient pam_ldap.so ignore_unknown_user account required pam_deny.so account required pam_warn.so password required pam_cracklib.so retry=2 minlen=8 password sufficient pam_unix.so use_authok md5 shadow password sufficient pam_ldap.so use_authok password required pam_deny.so password required pam_warn.so session optional pam_mkhomedir.so skel=/etc/skel/ umask=077 silent session required pam_limits.so session optional pam_ldap.so ignore_unknown_user session required pam_warn.so someone could help me - GanGan -

1 0

forcing group membership removal
by daniel rahmeh 17 Jul '08

17 Jul '08

Hi, I have another question concerning group membership. Is there a way to force openldap to remove the user DN from a group when i delete the user entry from openLDAP? In other words, is there some kind of configuration that tells openLDAP to remove the user DN from the member attribute of a group once the user entry is deleted from the directory. Thank you

2 2

openldap entry modification
by daniel rahmeh 17 Jul '08

17 Jul '08

hi, I have a question concerning the best method to modify an entry (in openldap) using a programming API like php. php offers the ability to modify an entry using some fucntions like ldap_modify, ldap_mod_add, ldap_mod_del. sometimes it's complicated to use these functions, in this case, developpers use another approach, which is deleting the entry and then add it with the new attributes etc. my question is: is it fine to delete an entry and re-add it?? does this affect the performance of openLDAP? thank you

2 3

starting slapd 2.4.10
by Christophe Thibault 17 Jul '08

17 Jul '08

Hi, I'm currently playing with Samba 4 alpha and OpenLdap 2.4.10. I want to start slapd with this command line (i'm currently logged in as root) : slapd -d 16384 -f /usr/local/samba/private/ldap/slapd.conf -h ldapi://%2Fusr%2Flocal%2Fsamba%2Fprivate%2Fldap%2Fldapi But I get the following error trace: @(#) $OpenLDAP: slapd 2.4.10 (Jul 11 2008 09:22:55) $ buildd@vernadsky:/build/buildd/openldap-2.4.10/debian/build/servers/slapd daemon: bind(7) failed errno=13 (Permission denied) slapd stopped. connections_destroy: nothing to destroy. I tried to replace the ldapi uri by "ldap:///", but now I'm getting a could not open config file "/usr/local/samba/private/ldap/slapd.conf": Permission denied (13) error message, while all rights and group/owner seem to be OK (ls -l returns -rw-r--r--). I think I miss something, but i'm stuck for now, if someone has any idea... thanks, chris

2 1

Trouble with nisnetgrouptriple syntax / RFC 2307
by Jeff Blaine 16 Jul '08

16 Jul '08

I've come across the same problem as the original poster found here: http://www.openldap.org/lists/openldap-technical/200804/msg00127.html The only reply to him indicated that his syntax was incorrect for nisnetgrouptriple according to RFC 2307. I cannot see how it is invalid based on the syntax definition from RFC 2307. My example: > dn: cn=users1,ou=Netgroup,dc=rcf,dc=foo,dc=com > objectClass: nisNetgroup > objectClass: top > cn: users1 > nisNetgroupTriple: (-,asgen2m,) > nisNetgroupTriple: (-,apdons,) > nisNetgroupTriple: (-,ffeins,) > nisNetgroupTriple: (-,faullton,) The syntax definition: > nisnetgrouptriple = "(" hostname "," username "," domainname ")" > hostname = "" / "-" / keystring > username = "" / "-" / keystring > domainname = "" / "-" / keystring Does that not state that hostname, username, domainname can each be ANY of: empty - keystring ?? Any guidance would be welcome! Jeff Blaine

4 6

script for adding users information in ldap database
by Aravind Arjunan 16 Jul '08

16 Jul '08

hi, i had configured openldap in RHEL 5. It was in master/slave replication in syncrepl method (refreshOnly) method. I had to add users information in the ldap database. Nearly 15000 users are there so i can able to add all the 15000 users infromation at a time. so i need a script or some utility to add all the user infromation at the same time. Am using LDAP Browser for adding the entries now. so plz help me how to add all the users information at single time.

6 6

N-way multimaster
by Miguel Jinez 16 Jul '08

16 Jul '08

Hi. I need help to fix a problem. I am running openLdap 2.4 I have configurated 2 multimaster servers, which works fine, but I was thinking what happen if one of them die? When that master is restarted read the "logold" parameter in the other master and synchronize the changes, problem solved. But what happen if one master dies, meanwhile the other master performs changes in the Ldap tree (add, modify, delete) and that master dies too? I have test it and the changes that I made in the second master are not synchronized on the first one, and I don t know how I can synchronize the changes, I have accesslog configurated, I can see in the second one log these changes but the first one doesn t read it when is restarted. I need your help. sorry by the bad english. Migue

2 4

slapd was refusing connections from local clients
by Haim [Howard] Roman 15 Jul '08

15 Jul '08

I had a strange situation where the slapd would accept connections from other machines, but not from the local host. It didn't matter whether the local client program was the RADIUS server or ldapsearch. According to netstat & lsof, slapd was listening on all interfaces. Setup: * CentOS release 4.6 * slapd 2.2.13 (Jul 11 2008 09:16:05) (CentOS package) * This slapd maintains a replica data base. (The slapd on the master server is slapd 2.3.35, Jun 11 2007, running on Solaris 10.) * FreeRADIUS Version 1.0.1, built on May 10 2007 -- it uses the local slapd to get user names & passwords. Yesterday we had a power outage, and the UPS didn't work :-( Someone suggested that maybe things came up in the wrong order & that a reboot would help. And the reboot did indeed solve the problem. But I'd still like to know what happened. Before the reboot, I even tried turning on the following log levels (in /etc/slapd.conf): loglevel conns config stats sync packets BER ACL none But I really couldn't find any messages that helped me understand *why* I had this strange problem. Any suggestions, or even pointers on how to find out? Thanks. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Haim (Howard) Roman Computer Center, Jerusalem College of Technology roman(a)jct.ac.il Phone: 052-8-592-599 (6022 from within Machon Lev)

1 0

Convert Fedora-DS LDIF to OpenLDAP?
by John Oliver 15 Jul '08

15 Jul '08

Google hasn't helped... I only found something to go the other way. And I didn't see this addressed in the FAQ, either. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

5 5

Changing password from squirrelmail
by Aravind Arjunan 12 Jul '08

12 Jul '08

hi, I had configured openldap 2.3 in RHEL 5 operating system, and my squirrel mail is running in RHEL 4. I had integrated these two for address book synchronization. Its working fine .In my squirrelmail options i had change password option. I can able to chang the password by giving the old password and typing new password. SO that it will automatically changed in openldap database also for a particular user. But when am trying to change the password am getting error, *"Your login account was not found in the LDAP database, cannot change password!"*

1 0

Newbie OpenLDAP woes
by Kristen Walker 11 Jul '08

11 Jul '08

Hi everyone, I am new to OpenLDAP and this list. I joined because I am trying to set up an OpenLDAP server so that Moodle and ELGG can authenticate users from the LDAP server. It is a little more difficult than I thought it would be, and I am running into some frustrating problems that I don't understand. I am hoping someone here might be able to help. I am using Ubuntu and using the book Mastering OpenLDAP as my guide. I have the server set up, edited config files and installed phpldapadmin to make things a little easier for me. I added my first entries but do not see them when I do a search, and nothing appears under my base in phpldapadmin (see attached screen shot). I don't get any complaints when I add the entries from my .ldif file, so I just don't understand why they don't seem to end up in my directory. If I do this command, sudo slapcat -a '(uid=barbara)' , the result is: dn: ou: Users uid: barbara sn: Jensen cn: Barbara Jensen givenName: Barbara displayName: Barbara Jensen mail: barbara(a)example.com userPassword:: c2VjcmV0 objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson structuralObjectClass: inetOrgPerson entryUUID: 8565f97e-e25b-102c-828c-238ab0ab2691 creatorsName: cn=Manager,dc=example,dc=com modifiersName: cn=Manager,dc=example,dc=com createTimestamp: 20080709233555Z modifyTimestamp: 20080709233555Z entryCSN: 20080709233555Z#000005#00#000000 So, it seems like there is a user with uid barbara in the directory. But if I try using ldapsearch to find that user, and I use this command, ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -b 'ou=Users,dc=example,dc=com' -LLL '(userID=barbara)' + I get this: No such object (32) Also, it seems like I can't connect to my database unless I do an anonymous bind. When I try typing in a password to login to phpldapadmin it rejects my credentials and the same thing when I try using -w with a password on the command line. Thanks so much for any and all help in advance! -Kristen -- Kristen Walker Digital Media Resources Developer Instructional Media Services Santa Barbara County Education Office 4400 Cathedral Oaks Road P.O. Box 6307 Santa Barbara, CA 93160-6307 (805)964-4711 ext. 5244/FAX (805)683-3597 kwalker(a)sbceo.org http://www.sbceoportal.org

5 8

Problems using OpenLPAP for authentification of users: Client library issues STARTTLS but TLS is not configured
by Jörg Spilker 10 Jul '08

10 Jul '08

Hi, well, i don´t know what i´m doing wrong. I just want to authenticate unix and windows users against OpenLDAP Database. I followed some howtos to setup openldap, winbind etc. and nearly everything seems just fine. But authenticating unix users finally doesn´t work. I´ve attached the syslog output. START TLS extension not supportet. This is true, as i haven´t configured OpenLPAP for TLS. But my LDAP client configuration doesn´t specify an LDAPS URL. So what´s going wrong? Greeting, Jörg # # This is the configuration file for the LDAP nameservice # switch library, the LDAP PAM module and the shadow package. # # Your LDAP server. Must be resolvable without using LDAP. URI ldap://localhost # The distinguished name of the search base. base dc=jetsys,dc=de # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # Don't try forever if the LDAP server is not reacheable bind_policy soft # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. binddn cn=Manager,dc=jetsys,dc=de # The credentials to bind with. # Optional: default is no credential. bindpw XXXXXXXXX # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=Manager,dc=jetsys,dc=de Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 fd=23 ACCEPT from IP=127.0.0.1:15332 (IP=0.0.0.0:389) Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=0 RESULT tag=120 err=2 text=unsupported extended operation Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=1 UNBIND Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 fd=23 closed Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 fd=23 ACCEPT from IP=127.0.0.1:15333 (IP=0.0.0.0:389) Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=0 RESULT tag=120 err=2 text=unsupported extended operation Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=1 UNBIND Jul 9 07:32:27 xdaolin slapd[2241]: conn=703 fd=23 closed Jul 9 07:32:27 xdaolin getent: nss_ldap: could not search LDAP server - Server is unavailable

3 3

LDAP binding failure to Active Directory using certificates
by Clayton Tucker 10 Jul '08

10 Jul '08

Greetings: I'm wondering if anyone has had any experience with this problem. I am endevouring to use ldapmodify (from OpenLDAP 2.3) to connect to a domain controller (named intacta) in our Active Directory forest and perform account management operations. For this purpose, the bind to the AD's LDAP must provide credentials of a user with the rights to manage accounts in the domain in question. I'm attempting to perform the authentication using certificates generated by a certificate authority which we have established on a domain controller in the forest root domain of our AD (not the same domain as the domain where we are trying to perform account management but is the same forest). The bind account is named test_account_manager and the user certificate CSCFForestAccount.cer (listed below) is name mapped to the account. All domain controllers in the forest have domain controller certificates distributed to them from the forest's certificate authority. Below is the content of my .ldaprc file on the Solaris 8 host where I'm attempting to run ldapmodify. As stated above, the TLS_CERT certificate is name mapped to the test_account_manager account in the AD. The account of coarse, has a password but the key file has no access password as I believe is necessary for the current version of openldap. TLS_CACERT /u/ctucker/LDAP_Cert/CSCFTrustedCA.pem.cer TLS_CERT /u/ctucker/LDAP_Cert/CSCFForestAccount.cer TLS_KEY /u/ctucker/LDAP_Cert/private_test1.pem TLS_REQCERT demand Below is the output of an ldapmodify command run on the Solaris 8 host. When this command is run entries confirming the logon of the test_account_manager account appear in the security event logs of the domain controller intacta as a successful logon. This suggests that the connection was properly authenticated by the certificates for the user test_account_manager. However, the subsequent binding to LDAP fails with the error "Authentication method not supported" Any help with this persistent problem would be greatly appriciated. Thanks. Clayton % ldapmodify -d13 -H ldaps://intacta.cs.uwaterloo.ca/ ldap_create ldap_url_parse_ext(ldaps://intacta.cs.uwaterloo.ca/) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP intacta.cs.uwaterloo.ca:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 129.97.152.158:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /DC=ca/DC=uwaterloo/DC=cscf/CN=CSCF Forest CA, issuer: /DC=ca/DC=uwaterloo/DC=cscf/CN=CSCF Forest CA TLS certificate verification: depth: 0, err: 0, subject: /CN=intacta.cs.uwaterloo.ca, issuer: /DC=ca/DC=uwaterloo/DC=cscf/CN=CSCF Forest CA TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write certificate verify A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 64 bytes to sd 3 ldap_result ld 30748 msgid 1 ldap_chkResponseList ld 30748 msgid 1 all 1 ldap_chkResponseList returns ld 30748 NULL wait4msg ld 30748 msgid 1 (infinite timeout) wait4msg continue ld 30748 msgid 1 all 1 ** ld 30748 Connections: * host: intacta.cs.uwaterloo.ca port: 636 (default) refcnt: 2 status: Connected last used: Thu Jul 10 09:50:43 2008 ** ld 30748 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 30748 Response Queue: Empty ldap_chkResponseList ld 30748 msgid 1 all 1 ldap_chkResponseList returns ld 30748 NULL ldap_int_select read1msg: ld 30748 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 96 contents: read1msg: ld 30748 msgid 1 message type search-entry ber_get_next ber_get_next: tag 0x30 len 16 contents: read1msg: ld 30748 msgid 1 message type search-result ber_scanf fmt ({eaa) ber: read1msg: ld 30748 0 new referrals read1msg: mark request completed, ld 30748 msgid 1 request done: ld 30748 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 adding response ld 30748 msgid 1 type 101: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_get_values ber_scanf fmt ({x{{a) ber: ber_scanf fmt ([v]) ber: ldap_msgfree ldap_sasl_interactive_bind_s: server supports: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5 ldap_int_sasl_bind: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5 ldap_int_sasl_open: host=intacta.cs.uwaterloo.ca => ldap_dn2bv(16) <= ldap_dn2bv(CN=test_account_manager,OU=Test User,OU=Unassigned,DC=cs,DC=uwaterloo,DC=ca)=0 SASL/EXTERNAL authentication started ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush: 26 bytes to sd 3 ldap_result ld 30748 msgid 2 ldap_chkResponseList ld 30748 msgid 2 all 1 ldap_chkResponseList returns ld 30748 NULL wait4msg ld 30748 msgid 2 (infinite timeout) wait4msg continue ld 30748 msgid 2 all 1 ** ld 30748 Connections: * host: intacta.cs.uwaterloo.ca port: 636 (default) refcnt: 2 status: Connected last used: Thu Jul 10 09:50:43 2008 ** ld 30748 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 30748 Response Queue: Empty ldap_chkResponseList ld 30748 msgid 2 all 1 ldap_chkResponseList returns ld 30748 NULL ldap_int_select read1msg: ld 30748 msgid 2 all 1 ber_get_next ber_get_next: tag 0x30 len 103 contents: read1msg: ld 30748 msgid 2 message type bind ber_scanf fmt ({eaa) ber: read1msg: ld 30748 0 new referrals read1msg: mark request completed, ld 30748 msgid 2 request done: ld 30748 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_sasl_bind_result ber_scanf fmt ({eaa) ber: ldap_msgfree ldap_perror ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: 00002027: LdapErr: DSID-0C090499, comment: Invalid Authentication method, data 0, vece

1 1

problem with openldap ssl client
by Sambuddho Chakravarty 10 Jul '08

10 Jul '08

Hello I have an openldap server running slapd on 636 (LDAPS) . When I connect from a ldap browser , I am able to successfully browse the database. However when I try to connect from a linux client machine (Ubuntu Server 8.04) I am not able to connect to the ldaps. However regular ldap works fine. The /etc/ldap.conf looks like this ssl start_tls ssl on tls_checkpeer tes tls_cacertdir /etc/ldap/cacerts tls_cacertfile /etc/ldap/cacert/cacert.pem #server IP uri ldaps://30.0.0.2/ pam_password md5 base dc=example,dc=com The /etc/ldap/ldap.conf file is like this URI ldaps://30.0.0.2/ TLS_CACERTDIR /etc/ldap/cacerts TLS_CACERT /etc/ldap/cacerts/cacert.pem HOST 30.0.0.2 BASE dc=example,dc=com The same configuration (with approprirate changes - replacing ldaps with ldap and so on) works fine for regular ldap. But the problem is the ldaps. When ldaps client is enabled and I do a getent passed , the /var/log/auth.log looks like this Jul 7 23:57:46 host3 getent: nss_ldap: reconnecting to LDAP server... Jul 7 23:57:46 host3 getent: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)... Jul 7 23:57:47 host3 getent: nss_ldap: could not search LDAP server - Server is unavailable Jul 7 23:58:18 host3 getent: nss_ldap: reconnecting to LDAP server... Please suggest where I could have gone wrong. Any suggestions would be really appreciated. Thanks Sambuddho

5 8

Re: problem with openldap ssl client
by Pat Riehecky 09 Jul '08

09 Jul '08

On Tue, 2008-07-08 at 16:45 -0400, Sambuddho Chakravarty wrote: > Hello Pat > I think I am . I did apt-get update and tried a apt-get install > libnss-ldap and it said you already have the latest packages. > Ok, one more thing to check what does the output of apt-get -f dist-upgrade report? Pat > Thanks > Sambuddho > On Tue, 2008-07-08 at 15:39 -0500, Pat Riehecky wrote: > > On Tue, 2008-07-08 at 00:06 -0400, Sambuddho Chakravarty wrote: > > > Hello > > > I have an openldap server running slapd on 636 (LDAPS) . When I connect > > > from a ldap browser , I am able to successfully browse the database. > > > However when I try to connect from a linux client machine (Ubuntu Server > > > 8.04) I am not able to connect to the ldaps. However regular ldap works > > > fine. > > > > There was a problem with the original 8.04 ldap packages (I think it was > > actually gnutls related but memory fails). Are you on the latest and > > greatest packages? > > > > Pat > > > >

2 2

Importing data from SunLDAP to OpenLDAP
by Jayesh Kamdar 09 Jul '08

09 Jul '08

I just set up OpenLDAP instance and would like to export data from my SunLDAP and import into my OpenLDAP instance. How do I go about it? My main concern is, how do I make sure that the exported files' field will match and import properly in my OpenLDAP database. Please let me know, if any of you have gone through migration from SunLDAP to OpenLDAP and have any pointers for me. Thanks. Jayesh Kamdar jkamdar(a)yahoo.com

3 2

Setting up "slave" OpenLDAP server
by John Oliver 08 Jul '08

08 Jul '08

I know nothing about LDAP / OpenLDAP. With that out of the way... I have a CentOS 5 machine running openldap-2.3.27-8 I just built a CentOS 5.2 machine with openldap-2.3.27-8.el5_1.3 My goal is to have the LDAP on the first machine synch with, and stay synched to, the LDAP on the second machine, so if the first machine dies I can bring up an interface with it's IP on the second and get authentication working again. I've Googled "LDAP replication" and "LDAP synchronization". Both terms lead me to a variety of papers that have a variety of ideas of how this should be done, and some have diagrams of convoluted networks involving multiple load balancers, etc. Since I know nothing about LDAP or OpenLDAP, it is very difficult for me to evaluate what I'm seeing... is this way "best", but because it's part of a globe-spanning install with hundreds of thousands of users? I'm hoping for a pointer to a nice, simple document that doesn't pre-suppose any depth of knowledge and isn't part of a Holy War over which method of doing this confers the greatest bragging rights :-) -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

3 2

ldap changes
by Daniel Lamb 08 Jul '08

08 Jul '08

Hi I was wondering if there is a simple way to clear out the data within ldap, the first time I do an install it asked for a password but even if I try and reconfigure it, it does not ask for the password again, I have installed it using "apt-get install slapd ldap-utils migrationtools" on Ubuntu 8.04, the reason I would like to clear it out is so I can make a distro which has the software installed and only needs the config files changed. Cheers, Daniel

2 1

nss_ldap error
by GanGan 08 Jul '08

08 Jul '08

hello all, I have a ldap server and tls (all command on local in the server ldap) [root@srvtest3 /]# ldapsearch -x -H ldap://srvtest3.test.org -ZZ '*' # extended LDIF # # LDAPv3 # base with scope subtree # filter: (objectclass=*) # requesting: * # # midian.org dn: dc=midian,dc=org objectClass: top objectClass: dcObject objectClass: organization o: Midian dc: midian [...] # search result search: 3 result: 0 Success # numResponses: 13 # numEntries: 12 tls is ok ? non ? ps -ef | grep slapd : root 32279 1 0 00:42 ? 00:00:02 /usr/sbin/slapd -4 in my log sshd : July 08 10:13:11 srvtest3 sshd[1482]: nss_ldap: could not search LDAP server - Server is unavailable I do not see what side look -- gangan

1 0

Real idletimeout more than configured idletimeout
by Eric Déchaux 07 Jul '08

07 Jul '08

Dear openldap gurus, I am hitting some strange behavior with the idle sessions timeout feature. In my configuration this timeout is set to 60 seconds on 4 slaves that are behind a load balancer. This load balancer times-out idle sessions after 90 seconds, which should be fine. Openldap version is the stable one from Debian Etch r3. I however encounter random connection issues that have been traced to the load balancer timeouting and idle session *before* the ldap slave. I have straced the slapd process and I found out the applyed idletimeout was way above the configured one, please check the two following strace output : Output 1 futex(0x603428, FUTEX_WAKE, 1) = 1 select(16, [4 6 7], NULL, NULL, {300, 0}) = 1 (in [6], left {238, 132000}) accept(6, {sa_family=AF_INET, sin_port=htons(34103), sin_addr=inet_addr("192.168.1.1")}, [4647729933731233808]) = 12 setsockopt(12, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0 open("/etc/hosts.allow", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=677, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.allow: list of host"..., 4096) = 677 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 open("/etc/hosts.deny", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=901, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.deny: list of hosts"..., 4096) = 901 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 fcntl(12, F_GETFL) = 0x2 (flags O_RDWR) fcntl(12, F_SETFL, O_RDWR|O_NONBLOCK) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 sendto(3, "<167>Jul 1 09:14:14 slapd[2765]"..., 102, MSG_NOSIGNAL, NULL, 0) = 102 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 1 (in [12], left {15, 0}) read(12, "0b\2\1\1`]\2", 8) = 8 [ some uninteresting ldap stuff ] futex(0x603428, FUTEX_WAKE, 1) = 1 read(12, 0x6f30ff, 8) = -1 EAGAIN (Resource temporarily unavailable) futex(0x2b0db3b35dc8, FUTEX_WAKE, 1) = 1 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) write(5, "0", 1) = 1 shutdown(12, 2 /* send and receive */) = 0 close(12) = 0 Here, we can see 5 select system calls for a real idletimeout is 75 seconds instead of 60. Output 2 futex(0x603428, FUTEX_WAKE, 1) = 1 select(16, [4 6 7], NULL, NULL, {300, 0}) = 1 (in [6], left {230, 828000}) accept(6, {sa_family=AF_INET, sin_port=htons(51692), sin_addr=inet_addr("192.168.1.1")}, [4647729933731233808]) = 12 setsockopt(12, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0 open("/etc/hosts.allow", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=677, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.allow: list of host"..., 4096) = 677 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 open("/etc/hosts.deny", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=901, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.deny: list of hosts"..., 4096) = 901 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 fcntl(12, F_GETFL) = 0x2 (flags O_RDWR) fcntl(12, F_SETFL, O_RDWR|O_NONBLOCK) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 sendto(3, "<167>Jul 1 09:19:21 slapd[2765]"..., 102, MSG_NOSIGNAL, NULL, 0) = 102 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 1 (in [12], left {15, 0}) read(12, "0b\2\1\1`]\2", 8) = 8 [ some uninteresting ldap stuff ] futex(0x2b0db3b35dc8, FUTEX_WAKE, 1) = 1 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) write(5, "0", 1) = 1 shutdown(12, 2 /* send and receive */) = 0 close(12) = 0 Here, we can see 5 select system call for a real idletimeout is 75 Here we have 6 select system calls for a real idletimeout of 90 seconds which is enough for the session to expire on the load balancer. I have checked the source code and the logic that choose either to idletimeout the session or go into a "SLAP_EVENT_WAIT" (select) call is the following : from server/slap/daemon.c now = slap_get_time(); if ( ( global_idletimeout > 0 ) && difftime( last_idle_check + global_idletimeout/SLAPD_IDLE_CHECK_LIMIT, now ) < 0 ) { connections_timeout_idle( now ); last_idle_check = now; } As I understand this, no connection should be tested against the idletimeout before any "event wait loop" takes more time than the idletimeout parameter / 4. In my case, I need the "event wait loop" to last more than 15 seconds for connections to be checked against aging. If I am not mistaken, as the difftime call compares seconds, I need the loop to last a least for 16 seconds for the connections_timeout_idle procedure to be called. Am I understanding everything the right way ? If it is the case, shouldn't the difftime call be tested <= 0 to help idle sessions to be cleaned sonner ? Many thanks. -- Eric Déchaux Ingénieur Kébabiste Sun Microsystems Services France

2 3

Identifying replicas behind a load balancer
by Sean Burford 06 Jul '08

06 Jul '08

Hi, To help with troubleshooting I would like to identify my replicas through an ldap search, even when they are behind a load balancer. I was wondering what method and attribute other people generally use for this purpose. The RootDSE may be unique for each host, I can add a RootDSE config line to slapd.conf to insert an ldif into the root DSE, so it seems to be the ideal spot for per server identification. Other spots include cn=monitor, cn=config, cn=Subschema or the main directory tree. The monitorConnectionPeerAddress attribute in cn=monitor isn't useable for identifying the server, since the address appears as IP=0.0.0.0:389. cn=config isn't generally accessible so also isn't suitable. The subschema could conceivably be twisted for this purpose. The main directory tree is replicated so is not suitable for identifying unique servers. The RootDSE schema specifies that it may have a cn. OpenLDAP does not provide one by default. Is it safe to use cn=hostname.domain.name? It seems easiest to use CN for the host name, if it isn't earmarked for something else in the RootDN. The alternative would be to supplement the rootDSE with one or more new attributes. I've had a look at how Active Directory and Novell Directory Service identify servers. They both use attributes with similar names and definitions. Active Directory has three attributes that are used in the root DSE to identify the host. Novell Directory Service has the same three attributes with very similar names and equivalent descriptions/usage. The attributes are: * dnsHostName: The DNS name of this DC. * serverName: DN for the server object for this directory server as defined in the Configuration container. * ldapServiceName: The UPN (User Principal Name) of the domain controller hosting this instance of RootDSE. Computer objects are just special forms of User objects, so they can have UPNs. The dollar sign is Microsoft shorthand dating back to classic NT and SAM. It indicates a hidden or secret object. eg: $ ldapsearch -x -W -D unix.gurus(a)example.com -H ldaps://dc.example.com -b "" -s base serverName dnsHostName ldapServiceName dnsHostName: dc.example.com serverName: CN=DC,CN=Servers,CN=Configuration,DC=example,DC=com ldapServiceName: example.com:dc$@EXAMPLE.COM The schema for these attributes is described in various places. The existing schema is somewhat unsatisfactory with the dnsHostName OID (1.2.840.113556.1.4.619) being a duplicate of the lazy commit control OID and serverName syntax being a Directory String rather than a Distinguished Name. For my testing I've defined the following non standard attributes. There doesn't seem to be a need for an equality matching rule since these are single valued rootDSE attributes: # Non standard AD dNSHostName attribute (defines a max length in the syntax) attributetype ( 1.2.840.113556.1.4.619 NAME 'dNSHostName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15{256}' DESC 'DNS name of the directory server hosting this RootDSE.' SINGLE-VALUE ) # Non standard AD serverName attribute (DN syntax instead of Directory String) attributetype ( 1.2.840.113556.1.4.223 NAME 'serverName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' DESC 'DN for the server object for this directory server.' SINGLE-VALUE ) -- Thanks, Sean Burford

2 1

Trouble setting password
by Fred Zinsli 05 Jul '08

05 Jul '08

Hello everyone Newby here. I am having trouble getting started with my new ldap install. I got it installed on FC8 and am now attempting to configure it. I am attempting to setup the default password and I am getting this message. [root@dofiss ~]# ldappasswd SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database This is my second day on trying to sort this out so any comments would be most helpful. Regards Fred

2 2

[ldap with tls] installation problem
by GanGan 04 Jul '08

04 Jul '08

Hello all, I try to install tls for ldap but without success :( I make a CA (compiled openssl) when i start ldap with : service ldap start i have this logs : May 27 20:39:29 srvtest3 slapd[19546]: @(#) $OpenLDAP: slapd 2.3.27 (Jun 27 2007 08:48:26) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 39: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 44: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: main: TLS init def ctx failed: -1 May 27 20:39:29 srvtest3 slapd[19546]: slapd stopped. May 27 20:39:29 srvtest3 slapd[19546]: connections_destroy: nothing to destroy. my /etc/openldap/slapd.conf is : include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # logs loglevel 4 # needed for login_ldap allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=midian,dc=org" rootdn "cn=god,dc=midian,dc=org" rootpw {SSHA}EkM4ViGxzWnZQ2n5hKBBcfffFMTcCO-0E4 directory /var/lib/ldap index objectClass eq # ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=god,dc=midian,dc=org" write by * none access to * by self write by dn="cn=god,dc=midian,dc=org" write by * read # CA signed certificate and server cert entries: # TLS & SSL TLSCertificateFile /etc/openldap/cacerts/srvtest3.test.org.pem TLSCertificateKeyFile /etc/openldap/cacerts/srvtest3.test.org.key TLSCACertificateFile /etc/ssl/cacert.pem TLSVerifyClient never my /etc/openldap/ldap.conf base dc=midian,dc=org uri ldap//srvtest3.test.org/ ldap_version 3 TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT demand my /etc/ldap.conf # SSL & TLS ssl start_tls #ssl on #tls_checkpeer yes # Afin que le client puisse valider l'identitéu serveur, on doit le fournir la cléublique # du CA avec laquelle il pourra éblir que le certificat du serveur a bien é signéar # la clérivéde cette mê CA. TLS_CACERT /etc/openldap/cacerts/ldap.crt # On demande élement au client de toujours valider l'identitéu serveur. TLS_REQCERT demand # IP du serveur ldap #host 127.0.0.1 uri ldap://srvtest3.test.org/ # Le DN de base pour effectuer les recherches base dc=midian,dc=org # Optimisation de recherche dans la base scope=one # Pour que le poste demarre meme si le server ldap ne repond pas bind_policy soft # Version du protocole utilise ldap_version 3 # Port ecoute serveur port 389 # Filtres de validation dun utilisateur pam_filter objectclass=account pam_filter host=srvtest3.test.org # Attribut compare avec lindentifiant de connexion de lutilisateur pam_login_attribute uid # Verification attribut host pam_check_host_attr yes # DN groupe auquel il faut appartenir pour acces machine locale pam_groupdn ou=group,dc=midian,dc=org # Definit lattribut dappartenance au groupe pam_member_attribute member # password envoi serveur pam_password crypt # Parametres nss-ldap de recherche nss_base_passwd ou=user,dc=midian,dc=org?sub nss_base_shadow ou=user,dc=midian,dc=org?sub nss_base_group ou=group,dc=midian,dc=org?sub nss_base_hosts ou=machines,dc=midian,dc=org?sub if someone could help me it would be nice sorry for my bad english - GanGan -

2 1

Performance - keep connection open between operations?
by k bah 03 Jul '08

03 Jul '08

I have some code that connects do LDAP, and between LDAP operations for a connection made, I have to contact other server (not LDAP), I wanna know if closing the connection to LDAP and then making it again (and of course a new bind) will take more time (I guess so) than wait for the "other" server to respond, and keep the connection to LDAP open. On some tests, the whole code (connect to the other server, closing that connection, and after that connecting to LDAP), with similar operations (operations performed on the "other" server and on the LDAP server) take no more than 1 second. The test was made with a *test* LDAP server, serves just me, but the "other" server, is a production one, that "almost 1 second group of operations" was made on a test LDAP server, and a real "other" server(busy), our company has a huge network and that server is clustered, thousands of connections/minute. I think it's best to connect to LDAP, bind, make operations on LDAP server, keep the connection open, query the "other" server, then get back with the LDAP operations, and just then close the connection to the LDAP server, what do you think? thanks = Home Business Miracle Discover How I Made $72,144.13. Last Month Giving Away Free Training. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=650f274a600e14d771ac3ee… -- Powered by Outblaze

2 1

Integrate openldap with postfix
by Aravind Arjunan 03 Jul '08

03 Jul '08

hi, I had configured postfix for my mail server which is working fine. I had configured openldap on the same server and added many entries in that. It is also working fine.when i use ldapsearch i can able to view the entries etc. The users which i had created in ldap is already there in OS for postfix. I had integrated openldap with postfix, to fetch the mail infromation from openldap. like mailid,mailQuota,mailbox location etc. But when i send mail to user it is fetching from openldap at all. It is strainght away delivering to mailbox.plz help me with this issue This is my main.cf file parameters. [root@master ~]# postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, *ldap:aliases *command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix debug_peer_level = 2 html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain mydomain = panafnet.com myhostname = master.panafnet.com mynetworks = 192.168.117.0/24, 127.0.0.0/8 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES relay_domains = $mydestination relayhost = $mydomain sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550 *aliases_server_host = localhost aliases_server_port = 389 aliases_search_base = dc=panafnet,dc=com aliases_scope = sub aliases_bind = no aliases_query_filter = (&(objectClass=qmailUser)(mail=%s)) aliases_result_attribute = mailMessageStore aliases_timeout = 10 aliases_version = 3*

2 4

[ldap with tls] installation problem
by GanGan 03 Jul '08

03 Jul '08

Hello all, I try to install tls for ldap but without success :( I make a CA (compiled openssl) when i start ldap with : service ldap start i have this logs : May 27 20:39:29 srvtest3 slapd[19546]: @(#) $OpenLDAP: slapd 2.3.27 (Jun 27 2007 08:48:26) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 39: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 44: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: main: TLS init def ctx failed: -1 May 27 20:39:29 srvtest3 slapd[19546]: slapd stopped. May 27 20:39:29 srvtest3 slapd[19546]: connections_destroy: nothing to destroy. my /etc/openldap/slapd.conf is : include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # logs loglevel 4 # needed for login_ldap allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=midian,dc=org" rootdn "cn=god,dc=midian,dc=org" rootpw {SSHA}EkM4ViGxzWnZQ2n5hKBBcfffFMTcCO-0E4 directory /var/lib/ldap index objectClass eq # ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=god,dc=midian,dc=org" write by * none access to * by self write by dn="cn=god,dc=midian,dc=org" write by * read # CA signed certificate and server cert entries: # TLS & SSL TLSCertificateFile /etc/openldap/cacerts/srvtest3.test.org.pem TLSCertificateKeyFile /etc/openldap/cacerts/srvtest3.test.org.key TLSCACertificateFile /etc/ssl/cacert.pem TLSVerifyClient never my /etc/openldap/ldap.conf base dc=midian,dc=org uri ldap//srvtest3.test.org/ ldap_version 3 TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT demand my /etc/ldap.conf # SSL & TLS ssl start_tls #ssl on #tls_checkpeer yes # Afin que le client puisse valider l'identitéu serveur, on doit le fournir la cléublique # du CA avec laquelle il pourra éblir que le certificat du serveur a bien é signéar # la clérivéde cette mê CA. TLS_CACERT /etc/openldap/cacerts/ldap.crt # On demande élement au client de toujours valider l'identitéu serveur. TLS_REQCERT demand # IP du serveur ldap #host 127.0.0.1 uri ldap://srvtest3.test.org/ # Le DN de base pour effectuer les recherches base dc=midian,dc=org # Optimisation de recherche dans la base scope=one # Pour que le poste demarre meme si le server ldap ne repond pas bind_policy soft # Version du protocole utilise ldap_version 3 # Port ecoute serveur port 389 # Filtres de validation dun utilisateur pam_filter objectclass=account pam_filter host=srvtest3.test.org # Attribut compare avec lindentifiant de connexion de lutilisateur pam_login_attribute uid # Verification attribut host pam_check_host_attr yes # DN groupe auquel il faut appartenir pour acces machine locale pam_groupdn ou=group,dc=midian,dc=org # Definit lattribut dappartenance au groupe pam_member_attribute member # password envoi serveur pam_password crypt # Parametres nss-ldap de recherche nss_base_passwd ou=user,dc=midian,dc=org?sub nss_base_shadow ou=user,dc=midian,dc=org?sub nss_base_group ou=group,dc=midian,dc=org?sub nss_base_hosts ou=machines,dc=midian,dc=org?sub if someone could help me it would be nice sorry for my bad english - GanGan -

1 0

Quota and groupOfUniqueNames
by AlexanDER Franca 03 Jul '08

03 Jul '08

Hi all. I have a Linux + ext3 system and I'm stuck in a situtation that I can't configure any quota of groups because all my groups are groupOfUniqueNames. I'm using Plone/Zope, so, now it's essential to use groupOfUniqueNames (and not posixGroup). Is there any way to fix this mess? Maybe I'm telling stupid things (like it's not possible use groupOfUniqueNames and group quota), I really don't know. Must I change schemas or something like that? []'s Alexander Brazil - Rio de Janeiro

1 0

Performance and TLS on bind/search operations.
by k bah 03 Jul '08

03 Jul '08

Hi, I noticed binds to the LDAP server with TLS off (plain connection) generate around 14 packets, while with TLS on, generate around twice the number of packets. It's not always twice, but near that. The smtp server only does anonymous binds do LDAP, while the IMAP server always use TLS, because it makes bind with DN/passwords. I don't think about changing this setup (smtp = plain connections, imap = tls connections). My question is about other software, code me and others write, that makes queries to the same LDAP server. We want to define a standard to always use TLS on code any of us write, so we don't need to recheck the code, to find if authenticated binds are being made without TLS, or sensitive data is being passed on a LDAP query with plain text connections. We can't always be sure if sensitive data will be passed, it's not just passwords. My question is, any of you can share your experience on LDAP perfomance regarding this, whether or not to *always use TLS*? I think it's best to be sure we always use TLS, but don't know the impact on performance. For the code we write I guess it will be no more than 100 connections/hour (bind operations). That's really not much, so I think TLS on everything won't be a problem. The real load is the smtp server use of LDAP, thousands/hour, but that's all plain connections, anon bind, search operations. thanks = Manage Clusters Easier Easy to use Graphical Interface. Get 90-99% HW Utilization - Try Moab. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=c8db0bf13ca5dbd1a987ac0… -- Powered by Outblaze

1 0

different shells on different hosts?
by Joy Khoriaty 02 Jul '08

02 Jul '08

Hi! I'd like my LDAP users to have different shells on 2 different client machines. Is that possible? how can I set it up? e.g, on host1, user1 has for shell /bin/bash, on host2, user1 has for shell /bin/rsh Someone suggested having the defined shell for the user in their LDAP entry be called e.g. /bin/ldap_shell, and symbolic linking accordingly on each machine, but it doesn't give me the granularity I want on a per user basis Any suggestions, pointers, ideas are more than welcomed! Thanks! -- Joy Khoriaty elventails(a)elventails.com http://elventails.com

2 2

How does Openldap work with Cyrus SASL and MIT Kerberos V
by Le Trung Kien 02 Jul '08

02 Jul '08

Hi everyone, I have built up one server with Openldap, Cyrus SASL, MIT Kerberos V. Now, my server can authenticate users. In "Authentication Configuration", I set option information for LDAP server and Kerberos server. And I could login with accounts (Kerberos principals) which are created through Kerberos. And user information can be obtained from LDAP server. But it's seem to be only Openldap and Kerberos work with together. I can't figure out what the SASL role is in this strategy. And how it effects on my system. When I attempt setup phpldapadmin, I must configure SASL option, but I don't know how SASL works with LDAP in this strategy ? -- Le Trung Kien.

5 8

ldap_bind: Invalid credentials (49)
by Wael Mashal 02 Jul '08

02 Jul '08

I install the openldap on windows I add the .ldif file on ldap put the problem appear when I use c:\OpenLDAP>ldapwhoami -x -D "cn=admin,o=world" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) Please help Wael Mashal Java Team Leader ASAL Technologies Ramallah, Palestine Tel: +970-2-2409 101 Fax: +970-2-2409 103 Mob: +970-52-487-11-70 Web: http://www.asaltech.com

2 1

openldap Master/slave
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi i had configured openldap in rhel5 as master/slave openldap version is 2.3 Slave is not getting replicating from master. These are the logs generated in master and slave server. plz help me with this issue. At the time restarting slapd.conf in master server. [B][root@master~]# tail -f /var/log/slapd.log[/B]Jul 1 21:07:21 master slapd[2960]: daemon: shutdown requested and initiated. Jul 1 21:07:21 master slapd[2960]: slapd shutdown: waiting for 0 threads to terminate Jul 1 21:07:21 master slapd[2960]: slapd stopped. Jul 1 21:07:22 master slapd[3254]: @(#) $OpenLDAP: slapd 2.3.27 (Jan 3 2007 13:13:17) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jul 1 21:07:23 master slapd[3255]: slapd starting ============================================================================================================================ ###At the time of restarting the slave slapd.conf##### [root@master~]# tail -f /var/log/slapd.log Jul 1 21:08:34 master slapd[3255]: conn=0 fd=13 ACCEPT from IP= 192.168.117.5:35205 (IP=0.0.0.0:389) Jul 1 21:08:34 master slapd[3255]: conn=0 op=0 BIND dn="cn=syncuser,dc=panafnet,dc=com" method=128 *Jul 1 21:08:34 master slapd[3255]: conn=0 op=0 RESULT tag=97 err=49 text=* *Jul 1 21:08:35 master slapd[3255]: conn=0 op=1 UNBIND *Jul 1 21:08:35 master slapd[3255]: conn=0 fd=13 closed Jul 1 21:08:35 master slapd[3255]: connection_read(13): no connection! [B][root@slave ~]# tail -f /var/log/slapd.log[/B]Jun 30 10:40:36 slave slapd[6481]: daemon: shutdown requested and initiated. Jun 30 10:40:36 slave slapd[6481]: slapd shutdown: waiting for 0 threads to terminate Jun 30 10:40:36 slave slapd[6481]: slapd stopped. Jun 30 10:40:37 slave slapd[6758]: @(#) $OpenLDAP: slapd 2.3.27 (Jan 3 2007 13:13:17) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jun 30 10:40:38 slave slapd[6759]: slapd starting *Jun 30 10:40:38 slave slapd[6759]: do_syncrep1: ldap_sasl_bind_s failed (49)* * *

2 1

me
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi, i had configured openldap and postfix in rhel 5. I had not installed any source code for the above two. With the help of rpm only i had configured ldap and postfix. Now i need to integrate openldap with postfix. I had followed the redhat documents for integrating. I want to know wheather it is necessary to complie ldap with postfix source code instead of rpm's? and kindly tell what mistake i had made here? plz look the error which am getting while sending mail to user who is located in ldap database. This is my configuration paramaters: ===================================== alias_maps = hash:/etc/postfix/aliases, ldap:ldapaliases alias_database = hash:/etc/postfix/aliases, ldap:ldapaliases ldapaliases_server_host = localhost ldapaliases_server_port = 389 ldapaliases_search_base = dc=panafnet,dc=com ldapaliases_scope = sub ldapaliases_query_filter = (|(mailid=%s)) ldapaliases_result_attribute = maildrop Error in maillog ================= Jul 1 17:18:05 experts postfix/cleanup[7422]: 900CFFDFE1: message-id=< 20080701114805.900CFFDFE1(a)experts.panafnet.com> Jul 1 17:18:05 experts postfix/qmgr[7416]: 900CFFDFE1: from=< root(a)panafnet.com>, size=310, nrcpt=1 (queue active) Jul 1 17:18:05 experts postfix/local[7424]: warning: dict_ldap_lookup: ldapaliases: Search base '' not found: 32: No such object Jul 1 17:18:05 experts postfix/local[7424]: 900CFFDFE1: to=< aravind(a)panafnet.com>, orig_to=<aravind>, relay=local, delay=0, status=deferred (alias database unavailable)

2 1

me
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi, I had configured openldap 2.3 in RHEL 5 operating system. I had configured in master/slave. I want where can i fing the ldap logs. i had tried in /var/log/messages, but no logs were generating there. plz guide me where to find the ldap logs.

3 2

openldap
by Aravind Arjunan 30 Jun '08

30 Jun '08

hi, I got problem in openldap master,slave replication. I had configured openldap in RHEL 5 as master/slave in syncrepl method ( refreshOnly) my problem is my slave server is not getting replicated with master. I had integrated openldap with postfix also,so when i restart the postfix service i get the below error which i mentioned. plz help me with this issue. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/qmail.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # access to attrs=userPassword by self write by dn="cn=syncuser,dc=panafnet,dc=com" read by * auth access to * by dn="cn=syncuser,dc=panafnet,dc=com" read by * read # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=panafnet,dc=com" rootdn "cn=Manager,dc=panafnet,dc=com" rootpw {SSHA}9ma4wkvWQM2ws7E9q7qIgK9vQ2Rp4IhZ # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/panafnet.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index default sub index entryCSN,entryUUID eq # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM overlay syncprov syncprov-checkpoint 100 05 [root@master ~]# ============================================================================= /etc/ldap.conf(master) ============================================================================== #host 127.0.0.1 host 192.168.117.4 192.168.117.5 # The distinguished name of the search base. base dc=panafnet,dc=com # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. binddn dc=panafnet,dc=com # The credentials to bind with. # Optional: default is no credential. bindpw secret # may incur a small performance impact. nss_base_passwd ou=People,dc=panafnet,dc=com?one nss_base_shadow ou=People,dc=panafnet,dc=com?one nss_base_group ou=Group,dc=panafnet,dc=com?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one #nss_base_services ou=Services,dc=example,dc=com?one # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control #pam_sasl_mech DIGEST-MD5 #uri ldap://127.0.0.1/ ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 ================================================================================== /etc/openlldap/slapd.conf(slave) =================================================================================== # network or connect timeouts (see bind_timelimit). host 192.168.117.5 192.168.117.4 # The distinguished name of the search base. base dc=panafnet,dc=com # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. binddn dc=panafnet,dc=com # The credentials to bind with. # Optional: default is no credential. bindpw secret # to append the default base DN but this # may incur a small performance impact. nss_base_passwd ou=People,dc=panafnet,dc=com?one nss_base_shadow ou=People,dc=panafnet,dc=com?one nss_base_group ou=Group,dc=pananfet,dc=com?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one ssl no tls_cacertdir /etc/openldap/cacerts ===================================================================================== Note: I had integrated ldap with postfix. So when am restart my postfix service i got this error in logs. Jul 1 16:05:59 master postfix/postfix-script: stopping the Postfix mail system Jul 1 16:05:59 master postfix/master[6303]: terminating on signal 15 Jul 1 16:06:01 master postfix/postfix-script: starting the Postfix mail system Jul 1 16:06:02 master postfix/master[1283]: daemon started -- version 2.3.3, configuration /etc/postfix Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: could not search LDAP server - Server is unavailable Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: could not search LDAP server - Server is unavailable Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: could not search LDAP server - Server is unavailable Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: could not search LDAP server - Server is unavailable # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=panafnet,dc=com" rootdn "cn=Manager,dc=panafnet,dc=com" rootpw {SSHA}F/VF2kcFeRzWxmYddG2JryM/0odBN7Hy # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/panafnet.com syncrepl rid=0 provider=ldap://192.168.117.4:389 binddn="dc=panafnet,dc=com" bindmethod=simple credentials=SyncUser searchbase="dc=panafnet,dc=com" filter="(objectClass=*)" attrs="*" schemachecking=off scope=sub type=refreshOnly interval=00:00:00:06 access to attrs=userPassword by dn="cn=syncuser,dc=panafnet,dc=com" write by * auth access to * by dn="cn=syncuser,dc=panafnet,dc=com" write by * read # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index default sub index entryCSN,entryUUID eq # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@slave ~]# ===================================================================================== /etc/ldap.conf(slave ======================================================================================

1 0

Comments requested on some support for LDAP I received from Konica Minolta.
by Neil Marjoram 30 Jun '08

30 Jun '08

I would really like to here the groups comments on this email I received from KonicaMinolta, it refers to the Bizhub C451 printer, but I suspect it applies to the whole range. On purchase of the printer I was told it supports LDAP, and as you may expect this response somewhat annoys me! quote "Thank you for your observations, We have now received a reply from our colleagues in Germany and they have confirmed the following concerning LDAP compatibility on KonicaMinolta machines: "In a Windows environment, it will work fine, but as soon as Open Source is used, it may fail. The current limitation for LDAP is --> LDAP user authentication "user name field" --> 64 char LDAP address search "user name field" --> 254 char All Windows based LDAP V3 compatible Servers are supported. A problem may occur if within the reply string from the Server special Characters which are not corresponding to RFC 3986 are used. E.g. "^" sign within the names." Support for Open Source is something they are looking into but for now there is no due date. With regard to your question on "Referral Setting" "Referral Settings" Means to have an object stored in a local tree which is defined with certain (local&specific) attributes and with a referral to another object in a central tree which contains the (global) attributes (e.g name, email,..) Unfortunately Hotline are unable to offer any further assistance concerning this matter as we are only familiar with Windows based LDAP connections from our range of Machines and suggest you refer back to the open source community." Thanks for your comments on this, Neil -- Neil Marjoram Systems Manager Adastral Park Campus University College London Ross Building Adastral Park Martlesham Heath Ipswich - Suffolk IP5 3RE Tel: 01473 663711 Fax: 01473 635199 Reclaim Your Inbox! http://www.mozilla.org/products/thunderbird

4 5

OpenLDAP+Samba server to authenticate windows machines
by Gustavo Mendes de Carvalho 29 Jun '08

29 Jun '08

Hi Everyone , I'm planning to mount an OpenLDAP+Samba server to authenticate windows machines, but I have a not so common situation. I have windows machines that does not belong either to some windows domain or workgroup, machines that belongs to some workgroup and meny machines that belongs to some specific and different domains, whitout trusted relantionship among them, including some windows cluster machines. Is there any way to include all of them to authenticate in a single LDAP+Samba server ? I mean, to use samba without PDC or BDC or even some DC configured in Samba server... I know that this question should be posted in Samba maillist, and I already did it, but does anybody here know something about this ? Thanks in advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

2 1

Problem while inserting binary data....
by ashish mahamuni 29 Jun '08

29 Jun '08

I've define my own schema(couple of classes and attributes).... it looks like below... --------------------------------------------------------------- attributetype ( 2.5.4.73 NAME 'epType' SUP name ) attributetype ( 2.5.4.74 NAME 'agencyIcon' SUP jpegPhoto ) objectClass ( 2.5.6.24 NAME 'mlnkEp' DESC 'Object for end point' STRUCTURAL MUST ( epType ) objectClass ( 2.5.6.25 NAME 'agencyObject' DESC 'Object that extends organizationalUnit' SUP organizationalUnit STRUCTURAL MAY (agencyIcon) ) ------------------------------------------------------------ I want to store icon file in agencyIcon attribute... So I added below line for agencyIcon in ldif file ......... agencyIcon;binary: < file:///root/jbuilder.ico When I execute command: slapadd -l init.ldif I get error as..... <= str2entry: str2ad(version): attribute type undefined slapadd: could not parse entry (line=8) When I use ldapadd/ldapmodify I get following error ldap_add: Undefined attribute type (17) additional info: agencyIcon;binary: option "binary" not supported with type I also tried adding below line at the top of ldif file I also tried changing version number as 1,2,3 version: 1 I searched on google but found nothing... I am working on Cent-OS. And openldap version is 2.3.27 Help me Regards Ashish Best Jokes, Best Friends, Best Food and more. Go to http://in.promos.yahoo.com/groups/bestofyahoo/

3 5

Migration from Sun Directory Server to OpenLDAP.
by Jayesh Kamdar 27 Jun '08

27 Jun '08

Hi, I am kind of newbie to LDAP. I do have little experience with Sun LDAP but not an expert. Now, I am being asked to move over Sun ldap servers to OpenLDAP. I am looking for any pointers, document or if any one has personal experience on how easy/tough it is to do this migration from SunLDAP to OpenLDAP. Thanks for your help. Jayesh Kamdar jkamdar(a)yahoo.com

2 1

ldap error
by Aravind Arjunan 27 Jun '08

27 Jun '08

hi, I had integrated ldap with postfix in rhel 5 operating system. But when i try to send mail to user which i mentioned in ldap database. i got the below error. Jun 27 00:02:42 master postfix/pickup[3753]: C4FC51FB85: uid=0 from=<root> Jun 27 00:02:42 master postfix/cleanup[3831]: C4FC51FB85: message-id=< 20080626183242.C4FC51FB85(a)master.panafnet.com> Jun 27 00:02:42 master postfix/qmgr[3754]: C4FC51FB85: from=< root(a)panafnet.com>, size=326, nrcpt=1 (queue active) Jun 27 00:02:42 master postfix/local[3760]: warning: dict_ldap_lookup: ldapaliases: Search base '' not found: 32: No such object Jun 27 00:02:42 master postfix/local[3760]: C4FC51FB85: to=< rambo(a)panafnet.com>, orig_to=<rambo>, relay=local, delay=0.22, delays=0.19/0/0/0.03, dsn=4.3.0, status=deferred (alias database unavailable)

2 1

ldap error
by Aravind Arjunan 27 Jun '08

27 Jun '08

hi, I had configured openldap as master/slave in one of the customer site. But still the slave server was not ready in customer site, i had configured the master server part alone. After finishing the configuration part of master server i had restarted the ldap service. am getting the warning message as warning:line 58: no by claust(s) specify in access line (ignored) warning:line 64: no by claust(s) specify in access line (ignored) the below are the line 58 and 64 access to attrs=userPassword by self write by dn="cn=syncuser,dc=example,dc=com" read by * auth access to * by dn="cn=syncuser,dc=example,dc=com" read by * read

1 0

Problem with Chaining
by RamakrishnaDeepak Battu 27 Jun '08

27 Jun '08

Hi all, I'm a newbie. I recently installed openldap2.4.10 on 2 of my systems.My requirement is to chain the master database on to the slave database..I followed the manual and tried the folowing .The Master and Slave slapd.conf's are as follows: *The Master config file is as follows: *#include statments ......... ......... access to * by dn.base="cn=root,ou=Users,dc=example,dc=com" read by * break ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq overlay syncprov # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 10 *The Slave config file as folows: *#include statments ......... ......... ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq syncrepl rid=100 provider=ldap://Master type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs=* bindmethod=simple binddn="cn=root,ou=Users,dc=example,dc=com" credentials="<secret>" updateref "ldap://Master" ----------------------------------------------------------------------------------- After this i started the Master server and slave Server with -d 256 option to see like this: *master log:* ber_get_next on fd 12 failed errno=0 (Success) connection_read(12): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=12 for close connection_close: deferring conn=5 sd=12 daemon: activity on 1 descriptor conn=5 op=1 do_unbind daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_resched: attempting closing conn=5 sd=12 connection_close: conn=5 sd=12 daemon: removing 12 *slave log:* slapd starting request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (4 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (3 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (2 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (1 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying ------------------------------------------------------------------------------- It means that the slave is not being replicated .. can any one please tell me why this ldap_sasl_bind_s failed (49) is coming.. thanks in advance.

2 1

Re: ppolicy by group
by Jeroen van Aart 26 Jun '08

26 Jun '08

(I originally posted this on openldap-software, posting it to technical, since it seems to allow this type of discussion) Gavin Henry wrote: > If you don't have a default ppolicy defined and no pwdPolicySubentry > then slapd will perform as it is currently configured. Thanks I got it more or less working. But only ssh seems to obey it so far (I set pam_lookup_policy to yes). I would like to know if anyone had success to make other frequently used software to obey the password policy. Such as imap, MTAs, webservers, especially if used through pam. Thank you, Jeroen

3 7

Re: slapd replication (push based)
by Martin Simovic 26 Jun '08

26 Jun '08

On Thu, 2008-06-26 at 14:06 +0100, Gavin Henry wrote: > msimovic(a)concurrent-thinking.com wrote: > > > > On Tue, 24 Jun 2008 09:40:24 -0700, Howard Chu <hyc(a)symas.com> wrote: > >> Martin Simovic wrote: > >>> Hi, > >>> > >>> I have the following setup > >>> > >>> LAN --- slapd 2.4.7 (master) --- DMZ ---slapd 2.3.30 (slave) > >>> > >>> I'm trying to achieve replication from master to slave. > >>> the firewall policy is LAN-->DMZ allow > >>> DMZ-->LAN reject > >>> > >>> this was actually very easy with slurpd (removed from 2.4) as the only > >>> need was to allow TCP traffic from master to slave > >>> > >>> with syncrepl it seems to me that no matter if I use push/pull method > >>> the client (slave) is the one that binds to the master (provider). this > >>> means that firewall rule that allows TCP traffic to LAN is needed - this > >>> is very ugly. > >>> > >>> is there a way to workaround this (or did i just misunderstand the whole > >>> problem) > >> See the configuration used in test045 in the test suite. > > > > thanks for the answer. > > > > the truth is, i´ve alrady been through the test045 but can´t understand > > what > > is going on there. the openldap admin guide seems to be a lot more verbose > > about much simpler subjects and very sparse about something which does not > > seem so straightforward (and used to be so simple in slurpd times). > > > > my scenario seems pretty usual (like secured rw copy of DIT on lan, while > > read > > only copy on dmz - for mail server, apache auth, etc.) > > in this very usual and IMHO wise setup the DMZtoLAN traffic is undesirable. > > > > and yet there is no solid documentation in admin guide. > > > > any pointers to documentation would be much appreciated. > > > > Did you see: > > http://www.openldap.org/doc/admin24/replication.html#Push%20Based > > It really does need cleaning up. > > Thanks. > Yes, it's really messy. actually my desperate need for this made me overcome my laziness. i compiled the slapd from source, run the tests, immediately after the test045 copied the slapd.1. ...slapd.3.conf files. this made me understand what is really going on there. my understanding is that i need to run two instances of slapd on master (master + proxy) proxy is pulling down changes from master and stores them in it's backend (ldap backend pointing to slave server) all the rest is question of acl's. can you correct me please, if i'm wrong. trying to implement it right now. M.

1 0

contextCSN question, three attributes on single naming context
by Josh Miller 25 Jun '08

25 Jun '08

I'm chasing down an issue with multi-master replication on OpenLDAP 2.4.10 and I issue the following search to compare the contextCSN. Is there any reason to have 3 contextCSN attributes, and one of them looks like a base64 encoded string, that doesn't look right. Is this expected behavior? -4- user@f8-workstation ~ > > ldapsearch -xZZH ldap://server01.example.com -D "cn=manager,dc=openldap,dc=example,dc=com" -W -z 1 contextCSN dn: dc=openldap,dc=example,dc=com -LLL Enter LDAP Password: dn: dc=openldap,dc=example,dc=com contextCSN: 20080527205300.158966Z#000000#000#000000 contextCSN: 20080619202050.412763Z#000000#004#000000 contextCSN: 20080623172814.327835Z#000000#003#000000 Size limit exceeded (4) -4- user@f8-workstation ~ > > ldapsearch -xZZH ldap://server03.example.com -D "cn=manager,dc=openldap,dc=example,dc=com" -W -z 1 contextCSN dn: dc=openldap,dc=example,dc=com -LLL Enter LDAP Password: dn: dc=openldap,dc=example,dc=com contextCSN:: qBiaszA2MTIxNzMyMzMuMTA1MTA2WiMwMDAwMDAjMDAzIzAwMDAwMA== contextCSN: 20080620213035.498183Z#000000#004#000000 contextCSN: 20080527205300.158966Z#000000#000#000000 Size limit exceeded (4) TIA, -- Josh Miller, RHCE

2 1

Re: Need to configure openLDAP client to request authenication in LDAP version 2 format
by kenglund 25 Jun '08

25 Jun '08

Thank you all for your help. I found out the out mail server is a CommuniGate Pro version 4.x - an old version. This is why we have had to modify our code to work with its weird format. The code I need to change is down in the Plone "LDAP User Folder" software - written in Python. It is apparently not using openLDAP at all. I would love to either upgrade our Communigate Pro software to the newest release (which would work, but is costly), or go to openLDAP for authentication (which is free, but takes more time than we have right now). Sorry to take up your time and energies. Ken

1 0

schema file
by Aravind Arjunan 25 Jun '08

25 Jun '08

hi, I tried to extend my schema but getting errors.I had created a separate schema file called attr.schema file. This is the schema file, in that i had mentioned mailbox location and mailQuota and mailalternateaddress attribute. But when i restart the ldap service, i get [root@master schema]# service ldap restart Stopping slapd: [FAILED] Checking configuration files for slapd: /etc/openldap/schema/att.schema: line 3 : AttributeType SYNTAX or SUPerior required: "1.3.6.1.4.1.4203.666.1.100.124" slaptest: bad configuration file! [FAILED] # New attribute definitions: attributetype ( 1.3.6.1.4.1.4203.666.1.100.124 ) NAME 'mailboxlocation' DESC 'RFC2798: Where the mails are located' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE attributetype ( 1.3.6.1.4.1.4203.666.1.100.125 ) NAME 'mailQuota' DESC 'RFC2798: User level Quota' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE attributetype ( 1.3.6.1.4.1.4203.666.1.100.125 NAME 'mailalternateaddress' SUP mail ) objectClass ( 1.3.6.1.4.1.4203.666.1.100 NAME 'YoLinuxPerson' DESC 'X-Person' SUP inetOrgPerson STRUCTURAL MAY ( mailboxlocation $ mailQuota $ birthdate ) )

2 1

Issue with Referral+pwdReset
by Anthony Porcano 25 Jun '08

25 Jun '08

I am having a problem that I am hoping the list can help with. When using the pwdReset attribute to force a password change the user receives the following error when trying to reset the password on SSH login: LDAP password information update failed: Can't contact LDAP server passwd: Permission denied This only occurs for clients using a slave to authenticate, and only when changing the password on login in combination with the pwdReset attribute. A non-forced password change works fine when a user runs the passwd command manually on one of the slave clients. So it seems referrals by themselves work OK. Forced password changes using the pwdReset attr also work for clients that use the master directly, so the issue is specific to slave-authentication+pwdReset+referral. The debug log on the master shows that it is being reached by the client, but slapd refused to perform the action: slapd[1079]: conn=1 op=1 BIND dn="uid=jschmo,ou=users,dc=example,dc=com" method=128 slapd[1079]: conn=1 op=1 RESULT tag=97 err=53 text=unauthenticated bind (DN with no password) disallowed The debug log on the slave shows the following error: slapd[11339]: conn=5 op=10 MOD dn="uid=jschmo,ou=users,dc=example,dc=com" slapd[11339]: conn=5 op=10 MOD attr=userPassword slapd[11339]: conn=5 op=10 RESULT tag=103 err=10 text= I've tried searching for information on this, but to date nothing I have found resolved the issue. One attempt involved setting an allow statement in the master slapd.conf for "bind_anon_dn". This did prevent the err=53, but produced another error: Jun 19 12:21:12 admin5-ash slapd[30555]: conn=4 op=2 RESULT tag=103 err=8 text=modifications require authentication The following applies to both master and slave servers: OpenLDAP: openldap-2.3.39-3.rhel5 (Buchan's Packages) OS: Centos 5.1 For the client I have tried the following configurations: OpenLDAP: openldap-2.2.13-8 (RH Stock) PAM_LDAP: nss_ldap-226-20 (RH Stock) OS: RHEL4.6 OpenLDAP version: openldap-2.3.39-3.rhel5 (Buchan's Packages) PAM_LDAP: nss_ldap-253-5.el5 (Centos Stock) OS: Centos 5.1 If any other information is needed let me know. Thanks to all. --AP

2 2

LDAP Update Script
by Aravind Arjunan 25 Jun '08

25 Jun '08

Dear all, I had configured openldap in RHEL 5 operating system in master slave. Its working fine and entries are also adding without any problem. But i need to add entries for 15000 users. So it is hard for me to add in ldap browser or in command line for these much users. So i need to know is there any script or utility is there to add all the users entries at a time like adding all the entries in text file and update it by a command. if it so plz tell me it will be very helpfull for me.

2 1

Need to configure openLDAP client to request authenication in LDAP version 2 format
by kenglund 24 Jun '08

24 Jun '08

Hello, I am installing a new version of our Zope/Plone software for hosting our web portal. The new software is using a product called PloneLDAP, which (I think) in turn requests authentication using openLDAP client. openLDAP is authenticating through our mail server, which wants bind requests in version 2 format. Modification of the mail server software to use version 3 authentication does not seem to be an option, as (according to my Tech guy) it is "really not LDAP", but has an "LDAP Like" interface. The interface requires the bind to look like this: ldapConnection, userid, password not in version 3 format, which looks like this: ldapConnection, uid="userid", password I have tried to force openLDAP client to perform bind requests using the "ldap_version 2" parameter in the /usr/local/etc/openldap/ldap.conf system-wide ldap configuration file, and also in a .ldaprc file stored in the Zope working directory. Neither seem to work. Can anyone tell me how to successfully configure openLDAP to send a version 2 bind request? Thanks! Ken

7 10

slapd replication (push based)
by Martin Simovic 24 Jun '08

24 Jun '08

Hi, I have the following setup LAN --- slapd 2.4.7 (master) --- DMZ ---slapd 2.3.30 (slave) I'm trying to achieve replication from master to slave. the firewall policy is LAN-->DMZ allow DMZ-->LAN reject this was actually very easy with slurpd (removed from 2.4) as the only need was to allow TCP traffic from master to slave with syncrepl it seems to me that no matter if I use push/pull method the client (slave) is the one that binds to the master (provider). this means that firewall rule that allows TCP traffic to LAN is needed - this is very ugly. is there a way to workaround this (or did i just misunderstand the whole problem) thanks, Martin.

3 2

Odd password reset issue
by Kevin Brammer 21 Jun '08

21 Jun '08

Running the OpenLDAP server bundled with RH ES3. I had OpenLDAP running successfully. I could authenticate, pull information from the directory - everything seemed great! After the 90 day password rule I had put in place, I got the "your password has expired" message. I tried to change it, said it was successful. A subsequent login received the same message. Again I changed it, and it said successful. Now, I can't even login. I changed my user's password as root using ldappasswd, and a check of the entry shows the hash changing accordingly. However, I still can't login as the user. Any ideas?

3 2

newbie question: which objectClass?
by Stefano Zanmarchi 20 Jun '08

20 Jun '08

Hi, I'd like to set up a minimal ldap server just for authentication (bind) purposes. No attributes need to be stored apart from uid and userPassword. I'd like to insert entries like dn: uid=john.smith(a)myorg.com,ou=people,dc=myorg,dc=com objectClass: ????? uid: john.smith(a)myorg.com userPassword: secret (If I use objectClass: inetOrgPerson I need to enter cn and sn as well, which I don't wont) Can I achieve this? Thanks a lot, Stefano

3 2

Authenticating from MacOS X 10.5.3 to OpenLDAP
by Jason Keltz 20 Jun '08

20 Jun '08

I have spent 2+ days trying to get a MacOS 10.5.3 machine configured to authenticate against a basic openldap 2.4.10 server with SSL on a Linux box - no SASL, no kerberos - I was hoping it would be trivial, and from the looks of all the postings around on the web, it should be. I know I'm doing the right things, yet I must be missing one minor detail. I did the initial openldap setup, and within a very short time, I was able to authenticate the MacOS box against the Linux box NON-SSSL without any trouble. When I enable SSL on the Mac, I can use ldapsearch to probe the whole ldaps:// server without any trouble at all. On the Mac, I can verify the SSL certificate: openssl s_client -connect server:636 -CApath /certs (I've created the proper hash files for the parts of the CA path) and I can see: . . Verify return code: 0 (ok) In the /etc/openldap/ldap.conf on the MAC, I have: TLS_REQCERT demand (MAC default) TLS_CACERTDIR /certs (Even if I change "TLS_REQCERT to never", it doesn't make any difference.) When I'm in the "Directory Utility" and creating a new connection, I click "Continue", then it hangs for a bit, and just comes back. The connection doesn't work. The slapd.config on the Linux side has all the correct TLS paths as well (of course if it didn't, my ldapsearch -x queries wouldn't even work): TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificatePath /openssl/certs TLSCertificateFile /openssl/certs/mycert.pem TLSCertificateKeyFile /openssl/certs/mycert.pem (The certificate and key are appended together in mycert.pem - that seems to be allowed) The certificate is a paid one - not a self-signed one. Here's the openldap debug info that is printed while I'm waiting for initialization of the connection ... I do see: TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=0, closing connection_closing: readying conn=0 sd=14 for close ... but I just don't understand why given that everything seems set up properly. If it wasn't, why would the ldapsearch work!? Thanks! jas. ------ verbose openldap debugging output connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 tls_read: want=107, got=107 TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A tls_write: want=4096, written=4096 TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=723, written=723 TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 tls_read: want=5, got=5 tls_read: want=134, got=134 TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 tls_read: want=1, got=1 tls_read: want=5, got=5 tls_read: want=48, got=48 TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=59, written=59 TLS trace: SSL_accept:SSLv3 flush data connection_read(15): unable to get TLS client DN, error=49 id=1 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 ber_get_next tls_read: want=5, got=5 tls_read: want=32, got=32 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=1, closing. connection_closing: readying conn=1 sd=15 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_close: conn=1 sd=15 daemon: removing 15 tls_write: want=37, written=37 TLS trace: SSL3 alert write:warning:close notify daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=0 connection_read(14): checking for input on id=0 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=0 TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=0, closing connection_closing: readying conn=0 sd=14 for close connection_close: conn=0 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: listen=8, new connection on 14 daemon: added 14r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on: daemon: listen=8, new connection on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: added 15r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=94, got=94 ber_get_next: tag 0x30 len 100 contents: ber_dump: buf=0x82b9598 ptr=0x82b9598 end=0x82b95fc len=100 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=0 do_search daemon: activity on 1 descriptor ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82b9598 ptr=0x82b959b end=0x82b95fc len=97 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82b9598 ptr=0x82b95ae end=0x82b95fc len=78 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82b9598 ptr=0x82b95bb end=0x82b95fc len=65 daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "namingContexts" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 54 bytes to sd 15 ldap_write: want=54, written=54 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=2 connection_read(14): checking for input on id=2 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 14 failed errno=0 (Success) connection_read(14): input error=-2 id=2, closing. connection_closing: readying conn=2 sd=14 for close connection_close: conn=2 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=50, got=50 ber_get_next: tag 0x30 len 56 contents: ber_dump: buf=0x82cab08 ptr=0x82cab08 end=0x82cab40 len=56 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82cab08 ptr=0x82cab0b end=0x82cab40 len=53 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82cab08 ptr=0x82cab1e end=0x82cab40 len=34 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82cab08 ptr=0x82cab2b end=0x82cab40 len=21 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 48 bytes to sd 15 ldap_write: want=48, written=48 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=71, got=71 ber_get_next: tag 0x30 len 77 contents: ber_dump: buf=0x82b9578 ptr=0x82b9578 end=0x82b95c5 len=77 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=2 do_search ber_scanf fmt ({miiiib) ber: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_dump: buf=0x82b9578 ptr=0x82b957b end=0x82b95c5 len=74 >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> SRCH "cn=Subschema" 0 0begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82b9578 ptr=0x82b959a end=0x82b95c5 len=43 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82b9578 ptr=0x82b95b4 end=0x82b95c5 len=17 => test_filter => access_allowed: search access to "cn=Subschema" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="cn=Subschema" => access_allowed: read access to "cn=Subschema" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 16753 bytes to sd 15 ldap_write: want=16753, written=13032 ldap_write: want=3721, written=3721 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=2 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=111, got=111 ber_get_next: tag 0x30 len 117 contents: ber_dump: buf=0x82ba928 ptr=0x82ba928 end=0x82ba99d len=117 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL conn=3 op=3 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82ba928 ptr=0x82ba92b end=0x82ba99d len=114 >>> dnPrettyNormal: <dc=cse,dc=yorku,dc=ca> => ldap_bv2dn(dc=cse,dc=yorku,dc=ca,0) <= ldap_bv2dn(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 <<< dnPrettyNormal: <dc=cse,dc=yorku,dc=ca>, <dc=cse,dc=yorku,dc=ca> SRCH "dc=cse,dc=yorku,dc=ca" 2 0begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82ba928 ptr=0x82ba955 end=0x82ba99d len=72 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82ba928 ptr=0x82ba978 end=0x82ba99d len=37 end get_filter 0 end get_filter_list end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82ba928 ptr=0x82ba98e end=0x82ba99d len=15 ==> limits_get: conn=3 op=3 dn="[anonymous]" => bdb_search bdb_dn2entry("dc=cse,dc=yorku,dc=ca") => bdb_dn2id("dc=cse,dc=yorku,dc=ca") <= bdb_dn2id: got id=0x1 entry_decode: "dc=cse,dc=yorku,dc=ca" <= entry_decode(dc=cse,dc=yorku,dc=ca) => access_allowed: search access to "dc=cse,dc=yorku,dc=ca" "entry" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) search_candidates: base="dc=cse,dc=yorku,dc=ca" (0x00000001) scope=2 => bdb_dn2idl("dc=cse,dc=yorku,dc=ca") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [9bee355f] <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=3, last=4 <= bdb_filter_candidates: id=2 first=3 last=4 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (ou) <= bdb_equality_candidates: (ou) not indexed <= bdb_filter_candidates: id=-1 first=1 last=7 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 bdb_search_candidates: id=-1 first=3 last=4 entry_decode: "ou=people,dc=cse,dc=yorku,dc=ca" <= entry_decode(ou=people,dc=cse,dc=yorku,dc=ca) => bdb_dn2id("ou=people,dc=cse,dc=yorku,dc=ca") <= bdb_dn2id: got id=0x3 => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 3 does not match filter entry_decode: "ou=group,dc=cse,dc=yorku,dc=ca" <= entry_decode(ou=group,dc=cse,dc=yorku,dc=ca) => bdb_dn2id("ou=group,dc=cse,dc=yorku,dc=ca") <= bdb_dn2id: got id=0x4 => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 4 does not match filter send_ldap_result: conn=3 op=3 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=4 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ldap_read: want=8, got=8 ldap_read: want=42, got=42 ber_get_next: tag 0x30 len 48 contents: ber_dump: buf=0x82cab08 ptr=0x82cab08 end=0x82cab38 len=48 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=4 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82cab08 ptr=0x82cab0b end=0x82cab38 len=45 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82cab08 ptr=0x82cab1e end=0x82cab38 len=26 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82cab08 ptr=0x82cab2b end=0x82cab38 len=13 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 11 bytes to sd 15 ldap_write: want=11, written=11 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=4 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=5 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x82caea0 ptr=0x82caea0 end=0x82caea5 len=5 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=3, closing. connection_closing: readying conn=3 sd=15 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_close: deferring conn=3 sd=15 conn=3 op=5 do_unbind connection_resched: attempting closing conn=3 sd=15 connection_close: conn=3 sd=15 daemon: removing 15 daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(10): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 busy >>> slap_listener(ldaps:///) daemon: activity on 1 descriptor daemon: activity on: daemon: listen=10, new connection on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: added 15r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: slap_listener_activate(10): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 busy >>> slap_listener(ldaps:///) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: listen=10, new connection on 16 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: added 16r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16): got connid=5 connection_read(16): checking for input on id=5 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 tls_read: want=107, got=107 TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A tls_write: want=4096, written=4096 TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=723, written=723 TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=5 connection_read(16): checking for input on id=5 tls_read: want=5, got=5 tls_read: want=134, got=134 TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 tls_read: want=1, got=1 tls_read: want=5, got=5 tls_read: want=48, got=48 TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=59, written=59 TLS trace: SSL_accept:SSLv3 flush data connection_read(16): unable to get TLS client DN, error=49 id=5 daemon: activity on 2 descriptors daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=5 connection_read(16): checking for input on id=5 ber_get_next tls_read: want=5, got=5 tls_read: want=32, got=32 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Success) connection_read(16): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=16 for close connection_close: conn=5 sd=16 daemon: removing 16 tls_write: want=37, written=37 TLS trace: SSL3 alert write:warning:close notify daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=4 connection_read(15): checking for input on id=4 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=0 TLS: can't accept. connection_read(15): TLS accept failure error=-1 id=4, closing connection_closing: readying conn=4 sd=15 for close connection_close: conn=4 sd=15 daemon: removing 15 daemon: activity on 2 descriptors daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: listen=8, new connection on 15 daemon: added 15r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: listen=8, new connection on 16 daemon: activity on 1 descriptor daemon: activity on: daemon: added 16r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 2 descriptors daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=94, got=94 ber_get_next: tag 0x30 len 100 contents: ber_dump: buf=0x82bd918 ptr=0x82bd918 end=0x82bd97c len=100 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=0 do_search daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82bd918 ptr=0x82bd91b end=0x82bd97c len=97 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82bd918 ptr=0x82bd92e end=0x82bd97c len=78 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bd918 ptr=0x82bd93b end=0x82bd97c len=65 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "namingContexts" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 54 bytes to sd 16 ldap_write: want=54, written=54 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(15) daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=50, got=50 ber_get_next: tag 0x30 len 56 contents: connection_get(15): got connid=6 ber_dump: buf=0x82bbcd8 ptr=0x82bbcd8 end=0x82bbd10 len=56 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=1 do_search ber_scanf fmt ({miiiib) ber: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_dump: buf=0x82bbcd8 ptr=0x82bbcdb end=0x82bbd10 len=53 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0connection_read(15): checking for input on id=6 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcee end=0x82bbd10 len=34 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcfb end=0x82bbd10 len=21 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 48 bytes to sd 16 ldap_write: want=48, written=48 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=71, got=71 ber_get_next: tag 0x30 len 77 contents: ber_dump: buf=0x82cb5b0 ptr=0x82cb5b0 end=0x82cb5fd len=77 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=2 do_search daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82cb5b0 ptr=0x82cb5b3 end=0x82cb5fd len=74 >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> SRCH "cn=Subschema" 0 0begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82cb5b0 ptr=0x82cb5d2 end=0x82cb5fd len=43 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_get_next ber_dump: buf=0x82cb5b0 ptr=0x82cb5ec end=0x82cb5fd len=17 ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=6, closing. connection_closing: readying conn=6 sd=15 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_close: conn=6 sd=15 daemon: removing 15 => test_filter => access_allowed: search access to "cn=Subschema" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="cn=Subschema" => access_allowed: read access to "cn=Subschema" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 16753 bytes to sd 16 ldap_write: want=16753, written=13032 ldap_write: want=3721, written=3721 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=2 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=111, got=111 ber_get_next: tag 0x30 len 117 contents: ber_dump: buf=0x82bedb8 ptr=0x82bedb8 end=0x82bee2d len=117 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=3 do_search ber_scanf fmt ({miiiib) ber: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_dump: buf=0x82bedb8 ptr=0x82bedbb end=0x82bee2d len=114 >>> dnPrettyNormal: <dc=cse,dc=yorku,dc=ca> => ldap_bv2dn(dc=cse,dc=yorku,dc=ca,0) <= ldap_bv2dn(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 <<< dnPrettyNormal: <dc=cse,dc=yorku,dc=ca>, <dc=cse,dc=yorku,dc=ca> SRCH "dc=cse,dc=yorku,dc=ca" 2 0begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82bedb8 ptr=0x82bede5 end=0x82bee2d len=72 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82bedb8 ptr=0x82bee08 end=0x82bee2d len=37 end get_filter 0 end get_filter_list end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bedb8 ptr=0x82bee1e end=0x82bee2d len=15 ==> limits_get: conn=7 op=3 dn="[anonymous]" => bdb_search bdb_dn2entry("dc=cse,dc=yorku,dc=ca") => access_allowed: search access to "dc=cse,dc=yorku,dc=ca" "entry" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) search_candidates: base="dc=cse,dc=yorku,dc=ca" (0x00000001) scope=2 => bdb_dn2idl("dc=cse,dc=yorku,dc=ca") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [9bee355f] <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=3, last=4 <= bdb_filter_candidates: id=2 first=3 last=4 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (ou) <= bdb_equality_candidates: (ou) not indexed <= bdb_filter_candidates: id=-1 first=1 last=7 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 bdb_search_candidates: id=-1 first=3 last=4 => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 3 does not match filter => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 4 does not match filter send_ldap_result: conn=7 op=3 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=4 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=42, got=42 ber_get_next: tag 0x30 len 48 contents: ber_dump: buf=0x82bbcd8 ptr=0x82bbcd8 end=0x82bbd08 len=48 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL conn=7 op=4 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcdb end=0x82bbd08 len=45 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcee end=0x82bbd08 len=26 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcfb end=0x82bbd08 len=13 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 11 bytes to sd 16 ldap_write: want=11, written=11 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=4 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=5 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x82cac98 ptr=0x82cac98 end=0x82cac9d len=5 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Success) connection_read(16): input error=-2 id=7, closing. connection_closing: readying conn=7 sd=16 for close connection_close: deferring conn=7 sd=16 conn=7 op=5 do_unbind connection_resched: attempting closing conn=7 sd=16 connection_close: conn=7 sd=16 daemon: removing 16 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: shutdown requested and initiated. daemon: closing 7 daemon: closing 8 daemon: closing 9 daemon: closing 10

1 0

schema in openldap
by Aravind Arjunan 18 Jun '08

18 Jun '08

This is my newely created schema file in my ldap server for adding the attributes. But when i try to restart the ldap service i got the below error, [root@master schema]# service ldap restart Stopping slapd: [FAILED] Checking configuration files for slapd: /etc/openldap/schema/sample.schema: lin e 3: Missing closing parenthesis before AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slaptest: bad configuration file! [FAILED] # New attribute definitions: attributetype ( 1.3.6.1.4.1.4203.666.1.90 NAME 'E-mail address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.91 NAME 'Firstname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.92 NAME 'Last name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.93 NAME 'Nickname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.94 NAME 'Additional info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) objectClass ( 1.3.6.1.4.1.4203.666.1.100 NAME 'YoLinuxPerson' DESC 'X-Person' SUP inetOrgPerson STRUCTURAL MAY ( E-mail address $ First name $ Last name $ Nickname $ Additional info ) )

4 3

OpenLDAP and HP iLO
by "Maurice Völkel" 18 Jun '08

18 Jun '08

Hello together, Since a couple of weeks, I tried to connect an OpenLDAP server with an iLO board, for an central authentication system. The LDAP server Runs with Open SuSe 10.3 on OpenLDAP 2.3.37 and is configured with PAM, so that a user registration works. My problem is the configuration of the directory settings of iLO. I try to describe my config of the LDAP Server and the problem which I have with the config. In /etc/openldap/slap.conf, I included a schema called ilo.schema. The ilo.schema looks like: attributetype (1.3.6.1.4.1.15959.9.1.1 NAME 'memberOf' DESC 'Group which user belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12) objectclass (1.3.6.1.4.1.15959.9.2.1 NAME 'memberOf' SUP top AUXILIARY DESC 'Required by Integrated Lights-Out for OpenLDAP' MUST (memberOf)) objectclass (1.3.6.1.4.1.15959.9.2.2 NAME 'user' SUP top AUXILIARY DESC 'Required by Integrated Lights-Out for OpenLDAP') A test user for the iLO, added on the LDAP like the following schema: # Max, my-domain.de dn: uid = max, ou = Mitarbeiter, ou = users, dc = my-domain, dc = de cn: Max Doe givenName: Max SN: Foo gidNumber: 100 UID: Max uidNumber: 1003 userPassword: SSHA) (passwortmax homeDirectory: / home / max loginShell: / bin / bash Street: postalCode: l: ST: mail: max.mustermann(a)my-domain.de telephoneNumber: +49 shadowExpire: 14152 shadowInactive: 10 shadowLastChange: 14042 shadowMax: 14 shadowMin: 1 shadowWarning: 10 memberOf: cn = iloadmin, ou = groups, dc = my-domain, dc = de description: iLO users Max Mustermann objectClass: shadowAccount objectClass: person objectClass: inetOrgPerson objectClass: posixAccount objectClass: organizationalPerson objectClass: memberOf objectClass: user objectClass: top the cn = iloadmin, ou = groups, dc = my-domain, dc = de look like: dn: cn = iloadmin, ou = groups, dc = my-domain, dc = de cn: iloadmin objectClass: top objectClass: groupOfNames member: cn = Max Mustermann, ou = Mitarbeiter, ou = users, dc = my-domain, dc = de The settings I config on iLO web interface as follows: Under Administration -> Directory Settings -> Use Directory DefaultSchema: running Directory Server Address: my-domain.de [or IP] Directory Server LDAP Port: 636 Directory User Context 1: ou = Mitarbeiter, ou = users, dc = my-domain, dc = de And under Administration Groups -> Select a group: Administrator -> View / Modify Security Group Distinguished Name: cn = iloadmin, ou = groups, dc = my-domain, dc = de Administer Group and Accounts, Console Remote Access, Virtual Power and Reset, Virtual Media undConfigure iLO settings are enabled. If I had a test run, I get the following message: Overall status: Problem Detected Description Test status Ping Directory Server Passed Directory Server IP Address Not run Directory Server DNS name Passed Connect to Directory Server Passed Connect using SSL Passed Certificate of Directory Server Passed Bind to Directory Server Not run Directory administrator login Not Run User Authentication Failed User Authorization Not Run Directory User Context 1 Not run Directory User Not run Context 2 Directory User Context 3 Not run LOM exists Object Not Run LOM Word Object Not Run Sign Test Initiating diagnostic Directory settings for server my-domain.de Directory Server address my-domain.de resolved to IP address Accepting certificate for Directory Server / C = DE / ST = [state]/ O = [company] / OU = ldapserver / CN = meine-domain.de/EMAIL ca(a)meine-domain.de signed by / C = DE / ST = [state] / L = [place] / O = [company] / OU = [Department] / CN = [person] / EMAIL = ca(a)meine-domain.de Warning: certificate does not match my Address Directory Server-domain.de. Unable to authenticate user test max [Invalid credentials] Ceasing tests. Some diagnostics for server FAILED my-domain.de Complete tests. I read a lot of threads, but nothing could help me to find a mistake. I hope someone could help me to find the mistake. kind regards SysNewbie -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

1 0

Re: schema in openldap
by Buchan Milne 18 Jun '08

18 Jun '08

On Wednesday 18 June 2008 12:38:10 Aravind Arjunan wrote: > I like to know whether it is possible to create our own schema and add our > own attributes and objectclass for that or not? It is possible. But, in my opinion, it is not yet necessary for your requirements. If you want to waste your time learning schema design instead of the LDAP basics, that might solve your problem, that's your decision (but I'm not going to waste my time). > If it is possible send me an example file so that i would be very thankfull > to you. > Since am trying to create my own schema and try to add attributes in > that.But when i try to restart the ldap service i got the below error. > > Checking configuration files for slapd: /etc/openldap/schema/att.schema: > line 3: AttributeType SYNTAX or SUPerior required: > "1.3.6.1.4.1.4203.666.1.100.121" > slaptest: bad configuration file! > [FAILED] > please help me with this issue. You didn't supply att.schema, but it seems that your schema definition for your OID 1.3.6.1.4.1.4203.666.1.100.121 does not include the SYNTAX or SUP keywords, one of them is required. And, you really shouldn't be using the OpenLDAP Foundations' OID arc ... Regards, Buchan

1 0

Re: schema in openldap
by Buchan Milne 18 Jun '08

18 Jun '08

On Wednesday 18 June 2008 12:34:40 Aravind Arjunan wrote: > Ok i had add entries like what you said, but when i try synchronize the > ldap address book in squirrel mail its saying no such object in ldap. > This could merely be a configuration issue. How did you determine what the exact problem was? Did you see what search squirrelmail was doing? And why it failed? Regards, Buchan

1 0

Fwd: schema in openldap
by Aravind Arjunan 18 Jun '08

18 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 18 Jun 2008 16:08 Subject: Re: schema in openldap To: Buchan Milne <bgmilne(a)staff.telkomsa.net> I like to know whether it is possible to create our own schema and add our own attributes and objectclass for that or not? If it is possible send me an example file so that i would be very thankfull to you. Since am trying to create my own schema and try to add attributes in that.But when i try to restart the ldap service i got the below error. Checking configuration files for slapd: /etc/openldap/schema/att.schema: line 3: AttributeType SYNTAX or SUPerior required: "1.3.6.1.4.1.4203.666.1.100.121" slaptest: bad configuration file! [FAILED] please help me with this issue. On 18/06/2008, Aravind Arjunan <aravind.arjunan(a)gmail.com> wrote: > > Ok i had add entries like what you said, but when i try synchronize the > ldap address book in squirrel mail its saying no such object in ldap. > > On 18/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: >> >> On Wednesday 18 June 2008 10:33:47 Aravind Arjunan wrote: >> > This is my newely created schema file in my ldap server for adding the >> > attributes. >> >> Why are you making your life difficult? Just add entries like this: >> >> >> dn: cn=Saju Kuttan,ou=solution,dc=test,dc=com >> objectClass: inetOrgPerson >> cn: Saju Kuttan >> sn: Kuttan >> givenName: Saju >> description: Saju Kuttan in the Oracle team >> telephoneNumber: 9891950975 >> mail: csaju(a)hcl.in >> >> >> There doesn't seem to be an attribute for the Nick Name field in Outlook, >> see: >> http://www.openldap.org/faq/data/cache/294.html >> >> >> Regards, >> Buchan >> >> >

1 0

Re: Openldap fine grained / advanced ACLs
by Faraz R. Khan 18 Jun '08

18 Jun '08

So basically I can do: to * by cn=admin,dc=company,dc=com add by cn=faraz,dc=company,dc=com zap That is indeed not documented anywhere. Will start an ITS Pierangelo Masarati wrote: > Faraz R. Khan wrote: >> Is it possible to have fine grained ACLs in OpenLDAP? My problem is >> that the 'write' access is too broad. I wish to be able to control >> ADD, modify and delete separately. I tried looking at >> aacls.sourceforge.net but it involves the setup of a separate server >> and looks abandoned. >> >> Any pointers would be appreciated- maybe the denyop module? I was >> trying to find some docs but all I could find was a FAQ entry. > > OpenLDAP 2.4 allows to split the write privilege into "a" (add) and "z" > (zap). A separate privilege for "modify" does not make too much sense > to me: if a value is added, then one just needs "add"; if a (set of) > value(s) is replaced, then one needs both "zap" (to delete old values) > and "add" (to add new ones), and thus "write" is just fine. On a > related note, I just realized this is not documented anywhere but in the > mailing list. I suggest you file an ITS <http://ww.openldap.org/its/> > to request a documentation update. > > p. > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > ----------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: ando(a)sys-net.it > ----------------------------------- > > -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd +92.21.529.0381 x200 www.emergen.biz

2 1

Re: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

hi buchan, These are the schema files in my server. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema And i need to add the following attribute, 1)mail id or E-mail address 2)mailbox location 3)First name 4)Last name 5)Additional info 6)Nickname ( this is for squirrelmail address book syncronization with ldap database) On 17/06/2008, Michael Ströder <michael(a)stroeder.com> wrote: > > Aravind Arjunan wrote: > >> ldap_modify: Cannot modify object class (69) >> additional info: structural object class modification from 'person' >> to ' >> inetOrgPerson' not allowed >> > > You cannot change a structural object class. 'person' and 'inetOrgPerson' > are both structural object classes with the latter derived from the former. > In this case you have to delete and re-add the entries. > > See also: > http://www.openldap.org/faq/data/cache/1341.html > > Ciao, Michael. >

1 0

meta config help
by danz＠wustl.edu 17 Jun '08

17 Jun '08

We are attempting to setup a configuration that would allow us to bind/search 2 different back-ends with 2 completely different suffixes. Below is our configuration and the error we get back. We are able to connect to both back-ends provided the other is commented out in the slapd.conf file so we are sure the suffix change works for both targets. [slapd.conf] database meta suffix "dc=virtual" lastmod off #rebind-as-user uri "ldap://foo.wuaddev.wustl.edu/dc=virtual" suffixmassage "dc=virtual" "ou=Users,ou=Persons,dc=wuaddev,dc=wustl,dc=edu" #uri "ldap://bar.wustl.edu/dc=virtual" #suffixmassage "dc=virtual" "OU=users,OU=ais" [search command] -bash-3.00# ldapsearch -h localhost -v -b 'dc=virtual' -s sub -D 'cn=ssbinduser,dc=virtual' -w 'foobar' 'cn=ssbinduser' ldapsearch: started Tue Jun 17 13:28:59 2008 ldap_init( localhost, 389 ) ldap_simple_bind: Operations error [Debug output of /usr/local/libexec/slapd] Ldap Err: DSID-0C0906 2B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece. This error comes from the remote LDAP server not accepting the bind request successfully. Your insight is greatly appreciated. Regards, Dan

1 0

Re: Openldap fine grained / advanced ACLs
by Raphaël Ouazana-Sustowski 17 Jun '08

17 Jun '08

Hi, Le Mar 17 juin 2008 16:30, Faraz R. Khan a écrit : > Is it possible to have fine grained ACLs in OpenLDAP? My problem is that > the 'write' access is too broad. I wish to be able to control ADD, > modify and delete separately. I tried looking at aacls.sourceforge.net > but it involves the setup of a separate server and looks abandoned. Just a note: this project has not been abandoned. In fact the "set" functionality of OpenLDAP now supersedes AACLs: http://www.openldap.org/faq/data/cache/1133.html Regards, Raphaël Ouazana.

1 0

Openldap fine grained / advanced ACLs
by Faraz R. Khan 17 Jun '08

17 Jun '08

Is it possible to have fine grained ACLs in OpenLDAP? My problem is that the 'write' access is too broad. I wish to be able to control ADD, modify and delete separately. I tried looking at aacls.sourceforge.net but it involves the setup of a separate server and looks abandoned. Any pointers would be appreciated- maybe the denyop module? I was trying to find some docs but all I could find was a FAQ entry. Any pointers would be welcome. Thank you. -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd +92.21.529.0381 x200 www.emergen.biz

2 1

Re: Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

Ya i had tried through schema, in internet. It was mentioned tat we can create our own schema for eg: test.schema and we can add the list off attributes that are required for us. I have tried that also but it was not working. I will tell the objective of mine. we have mailserver in RHEL 5 and ldap server is separate. we have all the user information in ldap server including mail id mail box location and other things related to mail and organization. so when a user sends mail the information must want to fetched from ldap server and work accordingly. somehow please help with this issue.Since i need some help from you guys. And thanks in advance. On 17/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: > > On Tuesday 17 June 2008 14:55:34 Aravind Arjunan wrote: > > Its working when i do it intially. > > can you please tell wat objectclass i have to add when i add the below > > attributes. > > > > 1)Nickname: > > 2)E-mail address: > > 3)First name: > > 4)Last name: > > 5)Additional info: > > These aren't attributes. You haven't specified the client, so it is > difficult > to guess what attributes the client is going to map to these address book > fields. > > However, if I were to guess, they would be: > > 1)displayName (from officeperson.schema) > 2)mail > 3)gn > 4)sn > 5)N/A > > 2-4 are all supported with inetOrgPerson. > > However, this is the kind of information you can determine for yourself. > Please consult the schema definitions ... > > Regards, > Buchan >

2 1

Fwd: Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 17 Jun 2008 18:25 Subject: Re: Fwd: openldap To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Its working when i do it intially. can you please tell wat objectclass i have to add when i add the below attributes. 1)Nickname: 2)E-mail address: 3)First name: 4)Last name: 5)Additional info: On 17/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: > > On Tuesday 17 June 2008 14:22:59 Aravind Arjunan wrote: > > ---------- Forwarded message ---------- > > From: Aravind Arjunan <aravind.arjunan(a)gmail.com> > > Date: 17 Jun 2008 17:52 > > Subject: Re: openldap > > To: Michael Ströder <michael(a)stroeder.com> > > > > This is my ldif file, here i have used objectclass as person > > Objectclass person does not include the mail attribute. The objectclass > inetOrgPerson, which you have commented out, does. > > > and i have > > included attribute mail and i got the error. > > > > I had tested by adding objectClass as inetOrgPerson and i got the below > > error. > > > > ldap_modify: Cannot modify object class (69) > > additional info: structural object class modification from > 'person' > > to ' > > inetOrgPerson' not allowed > > Create the entry with the objectclass inetOrgPerson initially ... > > > # Oracle Team > > > > dn: cn=saju,ou=solution,dc=test,dc=com > > objectClass: person > > #objectClass: inetOrgPerson > > cn: saju > > sn: kuttan > > description: Oracle team > > telephoneNumber: 9891950975 > > mail: csaju(a)hcl.in > > > Regards, > Buchan >

1 0

Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 17 Jun 2008 17:52 Subject: Re: openldap To: Michael Ströder <michael(a)stroeder.com> This is my ldif file, here i have used objectclass as person and i have included attribute mail and i got the error. I had tested by adding objectClass as inetOrgPerson and i got the below error. ldap_modify: Cannot modify object class (69) additional info: structural object class modification from 'person' to ' inetOrgPerson' not allowed # Oracle Team dn: cn=saju,ou=solution,dc=test,dc=com objectClass: person #objectClass: inetOrgPerson cn: saju sn: kuttan description: Oracle team telephoneNumber: 9891950975 mail: csaju(a)hcl.in dn: cn=aravind,ou=solution,dc=test,dc=com objectClass: person #objectClass: inetOrgPerson cn: aravind sn: arjunan description: Oracle team mail: aaravind(a)hcl.in #mobilenumber: 9899798985 # Microsoft Team dn: cn=Kannan,ou=solution,dc=test,dc=com objectClass: person #objectClass: inetOrgPerson cn: Kannan sn: Kann description: Microsoft Team mail: kannans(a)hcl.in #mobilenumber: 9891200471 dn: cn=Manish,ou=solution,dc=test,dc=com objectClass: person cn: Manish sn: Gupta description: Microsoft Team telephoneNumber: 9818206547 dn: cn=sachin,ou=solution,dc=test,dc=com objectClass: person cn: sachin sn: saghal description: Microsoft Team telephoneNumber: 9873574433 On 17/06/2008, Michael Ströder <michael(a)stroeder.com> wrote: > > Aravind Arjunan wrote: > >> ldap_add: Object class violation (65) >> additional info: attribute 'mail' not allowed >> What i need to do for adding this attribute. tell me the correct >> objectclass for this attribute. >> > > Most people use object class 'inetOrgPerson' for adding attribute 'mail' to > user/person entries. Since you don't provide an example entry nobody can > tell what's right for your data. > > Ciao, Michael. >

2 1

openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

Hi, I had configured openldap 2.3.27-5 in RHEL 5 operating systems. my ldap is acting as a master slave. I have no problem with that, the changes what i make in master is getting replicated to slave. What i need to know is, I had to certain attributes to my openldap server. for eg: when i add an attribute called ' mail ' for specifying mail address and in the ldif file and if i add that ldif file using 'ldapadd' command am getting, ldap_add: Object class violation (65) additional info: attribute 'mail' not allowed What i need to do for adding this attribute. tell me the correct objectclass for this attribute.

1 0

syncrepl in OpenLDAP 2.3.x and updating on a replica
by Filipe Brandenburger 17 Jun '08

17 Jun '08

Hi, I have a setup with two CentOS 5 machines running OpenLDAP 2.3.x, right now the primary uses slurpd to send the updates to the second server, and the second server is using "updatedn" to allow updates (from what I understand! I'm no OpenLDAP guru here.) Clients are using pam_ldap and nss_ldap to get the users and authenticate them in LDAP. Right now hosts query only the primary LDAP server, that is the address set on the "host" variable of /etc/ldap.conf. Changing password with "passwd" works fine, and the password is correctly replicated to the secondary server. Now, first thing, I wanted to load balance between the two servers. The way I did it was to register a Round-Robin DNS record, with one A entry for each server IP, and I used that entry in the "host" variable of /etc/ldap.conf. Everything worked. Queries going each time to a different server. I was expecting to have problems changing passwords, but amazingly it worked. Apparently when a password change request goes to the second server, that server will do a query on the first server to do the password change, and then (through slurpd) the change gets replicated on the second one. Everything great. (Is there a better configuration for pam_ldap and nss_ldap on /etc/ldap.conf for load balancing other than round-robin DNS?) Now, I was reading that syncrepl is superior to slurpd, and that syncrepl is the preferred method of replication. I actually saw that it's true when I saw that it actually replicated the master without having to stop it and copy the dbs (which is necessary with slurpd.) I even saw that in OpenLDAP 2.4.x slurpd is deprecated/discontinued and only syncrepl is supported. So I'm trying to migrate from slurpd to syncrepl. And so far everything is working fine in my test environments. This is what I have configured on the master: overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 And on the slave: syncrepl rid=1 provider=ldap://ldap1.mydomain.com type=refreshAndPersist searchbase="dc=mydomain,dc=com" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=com" credentials=xxxxxxxxxxx updateref ldap://ldap1.mydomain.com/ It works with queries, and when I do an update on the master, it replicates fine to the slave. But when I try to do some change on the slave, that's what I get: $ ldapdelete -H ldap://ldap2.mydomain.com/ -D cn=Manager,dc=mydomain,dc=com \ -w XXXXXXX -x uid=usertodelete,ou=Users,dc=mydomain,dc=com ldap_delete: Referral (10) referrals: ldap://ldap1.mydomain.com/uid=usertodelete,ou=Users,dc=mydomain,dc=com I would like to have something closer to what happens when using slurpd, which seems to be more transparent to clients. I tried to set "updatedn" but slapd complained that it is supported when using slurpd. I also tried to start configuring overlay on the slave and syncrepl on the master, but when I do that I can't run updates on either side, both of them end up being read-only. I read that on OpenLDAP 2.4.x Administration Guide, on the section about multi-master replication, but I then saw that multi-master replication is supposed to work only on 2.4.x, and not on 2.3.x, so that's apparently not an option. So I ask: is there a way to configure OpenLDAP so that the slave (running syncrepl) can send updates to the master when receives from a client? Or (not as good but still an option): If I use "updateref" to send Referral, how can I make sure the tools (ldapdelete, ldapmodify, ldapadd, ...) actually *follow* the referral (I looked for that in man pages and didn't find any obvious options for that)? And more important, will pam_ldap and nss_ldap follow those referrals when changing the password? Do I have to set something on /etc/ldap.conf for that? Upgrade to 2.4.x is something I would like to avoid, since I would rather stick with what is supported by CentOS 5. Sorry for the long e-mail! Any help and advices will be appreciated. Thanks a lot! Filipe

4 7

Re: [Samba] ldap filter removed? - Solution
by Jarbas Peixoto Júnior 16 Jun '08

16 Jun '08

Can anybody help me about that? []s Jarbas Remy Zandwijk escreveu: > Hi Jarbas, > > Nice solution, but how do you handle ldap searches from different Samba domains? I mean, all searches will use the same filter, which will be converted to another filter. Is OpenLDAP capable of 'rewrite when search from IP number x.x.x.x' ? > > Remy > > > >> In reference at http://lists.samba.org/archive/samba/2005-August/108999.html and http://threebit.net/mail-archive/samba/msg00118.html >> >> Hi Remy, >> Hi Norbert, >> >> >> I have the similar problem e I resolved with the "overlay rwm in openldap". >> >> If in smb.conf I haved: ldap filter = (&(iufmLogin=%u)(gecos=#*)) >> >> When the new samba search by any user, the following filter in openldap is used: (&(uid=user)(objectClass=sambaSamAccount)). Then the overlay replace by filter by (&(iufmLogin=$1)(gecos=#*)) only in openldap server. >> >> My slapd.conf (only the part with overlay rwm) is: >> ... >> moduleload rwm >> overlay rwm >> rwm-rewriteEngine on >> rwm-rewriteContext searchFilter >> rwm-rewriteRule "\$&\\(uid=([a-z0-9_]+)\$\$objectClass=sambaSamAccount\$\\)" "(&(iufmLogin=$1)(objectClass=sambaSamAccount))" ":@I" >> ... >> >> This work fine to me. >> >> >

1 0

Thunderbird & OpenLDAP
by Erik Lotspeich 15 Jun '08

15 Jun '08

Hi, Is there anyone who is using Thunderbird and OpenLDAP with SSL enabled? I cannot get this combination to work -- I can only use Thunderbird with non-SSL OpenLDAP. If no one can say, definitively, that this works, I guess there must be a bug in one or both software packages. Any help would be greatly appreciated. Thanks, Erik.

2 1

slapd-passwd backend problems
by Lawrence Stewart 15 Jun '08

15 Jun '08

Hi all, I'm attempting to set up a very simple passwd database backed slapd instance and can't seem to make it work reliably. A number of hours on google and experimenting with options has not been fruitful so far. I'm running openldap 2.4.10 on FreeBSD 7.0 My slapd.conf looks like this: ############################################## include /usr/local/etc/openldap/schema/core.schema loglevel conns filter stats pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/local/libexec/openldap moduleload back_passwd moduleload back_monitor access to * by anonymous read database passwd readonly yes suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw <passwod> database monitor ############################################## I am able to successfully start slapd and I can successfully query for a user by running the following command on the server itself: ldapsearch -x -H ldap://127.0.0.1 -b 'dc=example,dc=com' 'uid=test' which correctly returns the following details about the test user already in the system's passwd database: ############################################## # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=test # requesting: ALL # # test, example.com dn: uid=test,dc=example,dc=com objectClass: person objectClass: uidObject uid: test cn: test cn: Testy McTest sn: test sn: McTest description: Testy McTest # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ############################################## However, attempting an identical, additional query after the first one results in an empty search being returned: ############################################## # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=test # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 ############################################## I have experimented with many different options in slapd.conf and have not found anything that is able to mitigate this behaviour. The only way I have found to make an additional query work successfully is to restart slapd. After a restart, I can successfully make a single query again and then it stops returning a query result. The debugging output from slapd when a query is successful looks like this: ############################################## Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: listen=7, new connection on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: added 8r (active) listener=0x0 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 fd=8 ACCEPT from IP=127.0.0.1:59836 (IP=0.0.0.0:389) Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:19:29 newtcp8 slapd[11410]: 8r Jun 16 13:19:29 newtcp8 slapd[11410]: Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=0 BIND dn="" method=128 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=0 RESULT tag=97 err=0 text= Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:19:29 newtcp8 slapd[11410]: 8r Jun 16 13:19:29 newtcp8 slapd[11410]: Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: begin get_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: end get_filter 0 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=test)" Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 6 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:19:29 newtcp8 slapd[11410]: 8r Jun 16 13:19:29 newtcp8 slapd[11410]: Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: connection_read(8): input error=-2 id=0, closing. Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=2 UNBIND Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: removing 8 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 fd=8 closed Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL ############################################## and for an unsuccessful query looks like this: ############################################## Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 busy Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: listen=7, new connection on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: added 8r (active) listener=0x0 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 fd=8 ACCEPT from IP=127.0.0.1:64362 (IP=0.0.0.0:389) Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:22:21 newtcp8 slapd[11410]: 8r Jun 16 13:22:21 newtcp8 slapd[11410]: Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=0 BIND dn="" method=128 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=0 RESULT tag=97 err=0 text= Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:22:21 newtcp8 slapd[11410]: 8r Jun 16 13:22:21 newtcp8 slapd[11410]: Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: begin get_filter Jun 16 13:22:21 newtcp8 slapd[11410]: EQUALITY Jun 16 13:22:21 newtcp8 slapd[11410]: end get_filter 0 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=test)" Jun 16 13:22:21 newtcp8 slapd[11410]: => test_filter Jun 16 13:22:21 newtcp8 slapd[11410]: EQUALITY Jun 16 13:22:21 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:22:21 newtcp8 slapd[11410]: 8r Jun 16 13:22:21 newtcp8 slapd[11410]: Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: connection_read(8): input error=-2 id=1, closing. Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=2 UNBIND Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: removing 8 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 fd=8 closed Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL ############################################## I have analysed both sets of debug output and there are no material differences except that the successful query applies a number of equality test operations (indicating it is successfully walking through the entries in the passwd file) where as the failed query only applies 1 equality test. It's like the subsequent queries are not causing a full re-walk of the passwd database to find a match, but that's pure speculation at this point. Any insights into why the passwd backend might be behaving like this would be greatly appreciated. Please let me know if additional information or more detailed debugging output would help to diagnose the issue. Thanks in advance. Cheers, Lawrence

1 0

LDAP ACL/ ADRESSBOOK Problems and more
by Sebastian Reinhardt 15 Jun '08

15 Jun '08

Hi, I have some huge (for me, but I hope not for the experts in this list) problems: First the server config: - openSuSE 10.3 (x86_64) - openldap openldap2-2.3.37-7.4 User administration, NFS and also Apache (for company intern information websites, not for "real" web) is running without problems and 5 clients (openSuSE 10.3 (x86_64 and i586), too), replication is not setup yet, but this is not the major problem. 1. Problem: I added an central adressbook into the ldap- directory. It can be edited by KAdressBook and also used by Thunderbird from every Client, but for editing the ldap-root- Login is required (no good idea, I know and I like to change) and everyone can read the hole ldap- directory (have to be changed, too). I tried to give only users of group "adressbook_write" permission to edit entries in "ou=people"- part (adressbook) of ldap and users of "adressbook_read"- group the "read"- rights. Any other should not be allowed to read or write in "ou=people" or other parts of the ldap directory. This is the section of slap.conf: ---------------------------------- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to dn.base="ou=people,dc=LMV,dc=LMV" by group="cn=adressbook_read,dc=LMV,dc=LMV" read by group="cn=adressbook_write,dc=LMV,dc=LMV" write access to * by * read ----------------------------------------- I tried it also without "dn.base=" in front of first line (access to..), but then user- auth. was disabled. What is wrong? Can I delete "access to * by * read", without disabling Login- capability ? 2. Problem: KAddressBook can access (r/w, only by using root- access, simple auth.) the ldap- address book (ou=people). Reading is no problem, but by saving an new entry, KAddressBook shows the busy- symbol (mouse symbol) an the new entry is not shown in KAddressBook, but the entry is saved in ldap (it can be read/ edited by other applications; ldapbrowser or other). Whats the problem? KAddressBook, user read/write permissions? Or is it LDAP? To show the new entry in KAddressBook, the program has to be restarted. But KAddressBook is not crashed or frozen, the user can add new address or show/ edit old entries. 3. Problem: Is any schema available, which can handle more (3 or more) email- addresses for every entry? I can not figure out, if the mozilla- schema ( german HowTo and schema taken from: http://www.pro-linux.de/t_office/openldap-adressbuch.html ) can handle more than one email- entry per person. Is this possible or is Thunderbird unable to read more than one email address from ldap? And if so, how can store all addresses from KAdressBook in LDAP (to share it with other KAddressBook- Clients)? 4. Auto- LogIn Some Clients where used only by one person/ login. With local user management, openSuSE provides the option to login an standard user at boot. Is an automatic user login with ldap-users and ldap- user management possible? 5. file/ dir- modes Is it possible to change the default file- mode (644) and dir- mode (755) in ldap user accounts for new generated files into file: 660 and dir: 770 ? So the group- members can edit files/ dirs generated by other users of same ldap managed group ? Thanks -- Mit freundlichen Grüßen Sebastian Reinhardt

1 0

help with ldapsearch on uid
by joshua＠itsecureadmin.com 13 Jun '08

13 Jun '08

Hello, I am using OpenLDAP 2.4.9 on CentOS 5.1 (32 bit) with a custom schema and I have added ~7500 objects and I am not able to search successfully for these objects by uid. What must I do to be able to search for these objects by uid? Sample object: # 496user, People, example.com dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S If I search for this user by uid, I will get no results back: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" uid=496user # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=496user # requesting: ALL # # search result search: 3 result: 0 Success # numResponses: 1 Searching by mailid does work: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" mailid=496user(a)nest.tld ...<snip>... dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 The schema is as follows (downloaded from riseuplabs.org): objectIdentifier OID 1.1 objectIdentifier ldapOID OID:2 objectIdentifier attributetypeOID ldapOID:1 objectIdentifier objectclassOID ldapOID:2 attributeType ( attributetypeOID:1 NAME 'mailAddress' DESC 'email address(es)' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) attributeType ( attributetypeOID:2 NAME 'maildrop' DESC 'Mail addresses where mail is delivered -- ie forwards' SUP mailAddress ) attributeType ( attributetypeOID:3 NAME 'mailid' DESC 'Mail addresses accepted by this account -- ie aliases' SUP mailAddress ) attributeType ( attributetypeOID:4 NAME 'mailquota' DESC 'Bytes of mail quota' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) attributetype ( attributetypeOID:5 NAME 'maildir' DESC 'where mail is stored' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) objectclass ( objectclassOID:1 NAME 'mailAccount' DESC 'users who receive mail' AUXILIARY MAY (maildrop $ mailid $ mailquota $ maildir) ) TIA, Josh Miller, RHCE

4 11

Shell script to monitor LDAP server
by Alexandre Vieira 13 Jun '08

13 Jun '08

Hello all, I have a Solaris 10 system that queries a clients openldap server to deliver a certain service and the client is complaining that my system sometimes denies services to clients. Well my system only denies service to clients if the openldap system from the customer fails to answer. In this sense I tried to write a script to monitor the openldap server and its responsiveness but ldapsearch client in Solaris 10 doesn't work as I expected :( For example, all ok: bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' namingContexts ldapsearch: started Fri Jun 13 01:51:53 2008 ldap_init( 192.168.1.102:7323, 389 ) filter pattern: objectclass=top returning: namingContexts filter is: (objectclass=top) version: 1 dn: namingContexts: nodeName=XXXXX 1 matches Now imagine that the ldap server goes down: bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' namingContexts ldapsearch: started Fri Jun 13 02:11:04 2008 ldap_init( 192.168.1.102:7323, 389 ) filter pattern: objectclass=top returning: namingContexts filter is: (objectclass=top) ldap_search: Can't connect to the LDAP server - Connection refused Now imagine that the machine hosting LDAP goes down or a problem somewhere in the network occurs or a firewall blocks traffic (timeout): bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' namingContexts ldapsearch: started Fri Jun 13 02:11:04 2008 ldap_init( 192.168.1.102:7323, 389 ) filter pattern: objectclass=top returning: namingContexts filter is: (objectclass=top) And it just stays here forever. The -l flag only works after the search is initiated server side. There isn't a switch for a connection timeout limit. With this behaviour I can't test this as I imagined. Maybe some of you already have a monitoring script? Thanks in advance for any tip! PS: The script I wrote initially: ############################################################## #!/bin/bash LDAP_HOST=127.0.0.1:10000 POOLING_INTERVAL=5 LOGFILE=/var/log/ldap_watchdog.log # echo "Watchdog started at `date`" >> $LOGFILE while `/bin/true`; do ldapsearch -v -b '' -s base -h $LDAP_HOST 'objectclass=top' namingContexts if [ $? -ne 0 ]; then echo "`date`: Could not establish connection to LDAP server" >> $LOGFILE fi sleep $POOLING_INTERVAL done ############################################################## Alexandre Vieira - nullpt(a)gmail.com

3 4

LDAP group memberships not working
by Doug Grantham 13 Jun '08

13 Jun '08

Hey, I'm setting up a small network with LDAP and I'm running into a little trouble. The openldap server is on a Suse linux box and the clients are on solaris 10. Currently I'm trying to configure user authentication and group memberships. So far I have the authentication working. Users can log in on any of the solaris workstations. However, when these users log in, they are not part of the correct groups. The only group that user is a member of is their default group. But when that user logs in on the linux server, things work just great and they're members of all the correct groups. For example: USER1 is part of groups AAA, BBB, and CCC with their default group as BBB. When this user logs into the linux server and performs the 'groups' command, it will show this user is part of all three groups AAA, BBB, and CCC. However, when this user logs into the solaris client and perform's the 'groups' command, they're only a member of the BBB group. The /etc/nsswitch.conf on the solaris machine is configure like: passwd: files ldap group: files ldap host: files ipnodes: files netgroup: etc... The /var/ldap/ldap_client_file on the solaris machine is configured like: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 12.12.74.122 NS_LDAP_SEARCH_BASEDN= dc=mydomain,dc=edu NS_LDAP_AUTH= simple NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy Here is an ldapsearch command and the results: ldapsearch -b "dc=mydomain,dc=edu" -h server1 "(objectclass=groupofnames)" dn: cn=AAA,ou=group,dc=mydomain,dc=edu cn: AAA gidNumber: 601 member: uid=USER1,ou=people,dc=mydomain,dc=edu member: uid=USER2,ou=people,dc=mydomain,dc=edu member: uid=USER3,ou=people,dc=mydomain,dc=edu objectClass: top objectClass: posixGroup objectClass: groupofnames dn: cn=BBB,ou=group,dc=mydomain,dc=edu cn: BBB gidNumber: 602 member: uid=USER1,ou=people,dc=mydomain,dc=edu member: uid=USER3,ou=people,dc=mydomain,dc=edu objectClass: top objectClass: posixGroup objectClass: groupofnames dn: cn=CCC,ou=group,dc=mydomain,dc=edu cn: CCC gidNumber: 603 member: uid=USER1,ou=people,dc=mydomain,dc=edu member: uid=USER2,ou=people,dc=mydomain,dc=edu member: uid=USER4,ou=people,dc=mydomain,dc=edu objectClass: top objectClass: posixGroup objectClass: groupofnames This has been a really weird problem. The default groups are getting properly set but none of the other memberships are working. I've not found any help online and I'm pulling my hair out!

3 2

Re: Shell script to monitor LDAP server
by karim.bourenane＠orange-ftgroup.com 13 Jun '08

13 Jun '08

Hello You cal also install HOBBIT ( old name Big Brother ) freeware with server and client side. Hobbit can send you email or notification by SMS .... you have also in, MRTG graph. Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com "Dieter Kluenter" <dieter(a)dkluenter.de> Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 13/06/2008 10:40 To: openldap-technical(a)openldap.org cc: bcc: Subject: Re: Shell script to monitor LDAP server "Alexandre Vieira" <nullpt(a)gmail.com> writes: > Hello all, > > I have a Solaris 10 system that queries a clients openldap server to deliver a > certain service and the client is complaining that my system sometimes denies > services to clients. Well my system only denies service to clients if the > openldap system from the customer fails to answer. > > In this sense I tried to write a script to monitor the openldap server and its > responsiveness but ldapsearch client in Solaris 10 doesn't work as I expected > :( > > For example, all ok: > > bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' > namingContexts > ldapsearch: started Fri Jun 13 01:51:53 2008 You should search the monitor backend, with something like ldapsearch -b "cn=connections,cn=monitor" -s sub -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi Karic I make modification, but the error is already here :/ Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com "Almir Karic" <redduck666(a)gmail.com> Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 12/06/2008 15:22 To: karim.bourenane(a)orange-ftgroup.com cc: openldap-technical(a)openldap.org bcc: Subject: Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID i solved the same error by running nscd. On Thu, Jun 12, 2008 at 2:56 PM, <karim.bourenane(a)orange-ftgroup.com> wrote: > > Hi All > > I send you my actual problem, because i cannot resolve from 1 week :/. > I've installed openldap 2.3.41 server and client on server. Ssh running fine > with sudo. But if i do SCP command from another server i have this error : > > server-without-ldap# scp kbourena@ldap-rain:/home/kbourena/toto.txt . > Password: > unknown user 1206 > > If anyone have idea. > > Best Regards > > Karim Bourenane > Orange Business Services / Equant > RO&SI / IBNF / ENO / GNS > 112 Avenue Charles de Gaules > 92200 Neuilly S/Seine > Phone: +33156 76 35 52 > Fax: +33156 76 35 04 > http://www.equant.com > > -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

2 1

How to lock user
by Gustavo Mendes de Carvalho 12 Jun '08

12 Jun '08

Hi there, Is there any way to lock user in LDAP database ? I mean, in linux, it's possible to use passwd <username> -l to lock user and -u to unlock. Is there a similar function in LDAP ? Thanks --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

5 9

additional info: homePhone: value #0 normalization failed
by Jay Jesus Amorin 12 Jun '08

12 Jun '08

ldapadd -x -D "cn=Administrator,dc=house,dc=org" -w 12345678 -f /home/ja9/data.ldif adding new entry "cn=labacan,ou=house_backup,dc=house,dc=org" ldap_add: Invalid syntax (21) additional info: homePhone: value #0 normalization failed Please help, Jay

2 1

Re: help with ldapsearch on uid
by joshua＠itsecureadmin.com 12 Jun '08

12 Jun '08

> Hi Joshua > > And without -ZZ, mean ldaps research in local server ? > Without -ZZ would be without TLS, which is working fine. Thanks, Josh Miller, RHCE

1 0

Re: help with ldapsearch on uid
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi Joshua And without -ZZ, mean ldaps research in local server ? Reagrds Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com joshua(a)itsecureadmin.com Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 12/06/2008 17:01 To: openldap-technical(a)openldap.org cc: bcc: Subject: help with ldapsearch on uid Hello, I am using OpenLDAP 2.4.9 on CentOS 5.1 (32 bit) with a custom schema and I have added ~7500 objects and I am not able to search successfully for these objects by uid. What must I do to be able to search for these objects by uid? Sample object: # 496user, People, example.com dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S If I search for this user by uid, I will get no results back: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" uid=496user # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=496user # requesting: ALL # # search result search: 3 result: 0 Success # numResponses: 1 Searching by mailid does work: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" mailid=496user(a)nest.tld ...<snip>... dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 The schema is as follows (downloaded from riseuplabs.org): objectIdentifier OID 1.1 objectIdentifier ldapOID OID:2 objectIdentifier attributetypeOID ldapOID:1 objectIdentifier objectclassOID ldapOID:2 attributeType ( attributetypeOID:1 NAME 'mailAddress' DESC 'email address(es)' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) attributeType ( attributetypeOID:2 NAME 'maildrop' DESC 'Mail addresses where mail is delivered -- ie forwards' SUP mailAddress ) attributeType ( attributetypeOID:3 NAME 'mailid' DESC 'Mail addresses accepted by this account -- ie aliases' SUP mailAddress ) attributeType ( attributetypeOID:4 NAME 'mailquota' DESC 'Bytes of mail quota' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) attributetype ( attributetypeOID:5 NAME 'maildir' DESC 'where mail is stored' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) objectclass ( objectclassOID:1 NAME 'mailAccount' DESC 'users who receive mail' AUXILIARY MAY (maildrop $ mailid $ mailquota $ maildir) ) TIA, Josh Miller, RHCE

1 0

Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi Karic Thanks you for your reply. I started nscd with nscd.conf : enable-cache passwd yes enable-cache group yes enable-cache hosts yes enable-cache services yes enable-cache protocols yes enable-cache rpc yes enable-cache networks yes I can put also some value about positive cache ? as : positive-time-to-live passwd 600 negative-time-to-live passwd 20 suggested-size passwd 211 Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com "Almir Karic" <redduck666(a)gmail.com> Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 12/06/2008 15:22 To: karim.bourenane(a)orange-ftgroup.com cc: openldap-technical(a)openldap.org bcc: Subject: Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID i solved the same error by running nscd. On Thu, Jun 12, 2008 at 2:56 PM, <karim.bourenane(a)orange-ftgroup.com> wrote: > > Hi All > > I send you my actual problem, because i cannot resolve from 1 week :/. > I've installed openldap 2.3.41 server and client on server. Ssh running fine > with sudo. But if i do SCP command from another server i have this error : > > server-without-ldap# scp kbourena@ldap-rain:/home/kbourena/toto.txt . > Password: > unknown user 1206 > > If anyone have idea. > > Best Regards > > Karim Bourenane > Orange Business Services / Equant > RO&SI / IBNF / ENO / GNS > 112 Avenue Charles de Gaules > 92200 Neuilly S/Seine > Phone: +33156 76 35 52 > Fax: +33156 76 35 04 > http://www.equant.com > > -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

1 0

[BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi All I send you my actual problem, because i cannot resolve from 1 week :/. I've installed openldap 2.3.41 server and client on server. Ssh running fine with sudo. But if i do SCP command from another server i have this error : server-without-ldap# scp kbourena@ldap-rain:/home/kbourena/toto.txt . Password: unknown user 1206 If anyone have idea. Best Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com

2 1

Solutions for creating a Samba4 OpenLDAP backend
by Andrew Bartlett 11 Jun '08

11 Jun '08

I've had a very useful discussion with Howard on IRC this morning, and wanted to summarise it for the lists. It follows on from http://www.openldap.org/its/index.cgi?findid=5534 We looked at a few things that were getting in the way of the consistency I need for Samba4. My primary gripe at the moment is the need to have invalid links detected at the time of creation, and to ensure that if this happens, nothing changes in the database. This is the main test that currently fails against the OpenLDAP backend. (In short, everything else seems to work!). The trivial solution to this is a pre-check of the consequences of the operation before attempting it. This will be racy (delete concurrent with adding a DN as a member), but can be backed by a transaction when that functionality is exposed. The problem with doing a pre-check is database loads and replication. In the replicated case, we can simply not check consistency except on the original server, as we will catch up to consistency pretty soon (catastrophic replication failures aside). For database loads (from a dump), we can simply permit inconsistent links by means of a configuration option, and hope that the admin knows what they are doing, and that the DB will be consistent at the conclusion. If we get this much done, then I think Samba4 and OpenLDAP can continue the forward march. I look forward to having Samba4 'powered by OpenLDAP', because without it (or a Fedora DS backend, with whom I'm having a similar discussion) Samba4 does not have a replicated deployment modal. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

1 0

slapd[26189]: warning: cannot open /etc/hosts.allow: Too many open files
by Andreas Moroder 11 Jun '08

11 Jun '08

Hello, today a client to connect via ftp to our server ( SLES 9 ) and I got this error: slapd[26189]: warning: cannot open /etc/hosts.allow: Too many open files according to lsof | grep REG | wc -l i have only 3267 regular files open and 4684 counting the IP connections too. cat /proc/sys/fs/file-nr returns 3573 1185 131072 and file-max 131072 ( as above ) According to this numbers there sould not be a system wide problem. Is there a limit of open files in slapd ? I restarted slapd and now it seems to work. Probably you need to know the version. Can anyone tell me how I get the running version ? There are no entries in /var/log/messages Thanks Andreas

5 5

[ Ldap Native client Solaris 10 conncet to openldap serveur RHEL ]
by Phuong VUONG 11 Jun '08

11 Jun '08

Hello, First, i m sorry about my English. I have an Openldap 2.3.39 Server RHEL 4.6 which work perfectly. All the authentification from Linux client are fine (with the ACL on and the option of host_chech_attr). However, I have some problem to connect a ldap client native Solaris 10. I use ldapclient manual to configure the Solaris client. The option is : #ldapclient -v manual -a "defaultServerList=IP_SERVER_OPENLDAP_RHEL" -a "credentialLevel=proxy" -a "proxyDN=cn=account,dc=example,dc=fr" -a "proxyPassword=Pass" -a "defaultSearchBase=dc=exemple,dc=fr" -a "defaultSearchScope=sub" -a "serviceSearchDescriptor=passwd:ou=People,dc=exemple,dc=fr?one" -a "serviceSearchDescriptor=shadow:ou=People,dc=exempl,dc=fr?one" -a "serviceSearchDescriptor=groupe:ou=Group,dc=exempl,dc=fr?one" When my ACL are activated, this command turne over timeout and the result are : When i put this below ACL on Openldap Server : access to * by * read. ldapclient is ok and the configuration are fine. But disable the ACL is not possible. In the Openldap server log, i can see : conn=6 op=0 BIND dn="" method=128 ... I dont know why the option -a "proxyDN=cn=account,dc=example,dc=fr" didn't send correctly.. Do anyone have this kind of problem ? Do you get any information about solaris ldap native client connect to an openldap server rhel ? I also follow some guide from : http://docs.lucidinteractive.ca/index.php/Solaris_LDAP_client_with_OpenLDAP… but it don't work neither. Any advice ? Thanks by advance for your answer and pardon me about my poor English.

2 1

Vote OpenLDAP for the 2008 Community Choice Awards!
by Gavin Henry 10 Jun '08

10 Jun '08

http://blog.suretecsystems.com/archives/121-Vote-OpenLDAP-for-the-2008-Comm… -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

Syncrepl : Monitor Replication issues
by smainklh＠free.fr 10 Jun '08

10 Jun '08

Hi everybody! I would like to know how to monitor syncrepl. Actually i would like to be warned when data have been rejected (failure on the provider, network issues ...). Thank you in advance, Smaïn

3 5

How to implement some relational behavior...
by AlexanDER Franca 09 Jun '08

09 Jun '08

Hi. How can I, or what tool must I use, to implement a relational visualization of groups on a LDAP directory? In other words, I need some system that permit users go to an specifc group and see a list of users of that group. And have some way to click on user and see the user informations. Must I develop a tool to to this... or is there some tool (web tool) that I can download and install in a Linux box? []'s Alexander Brazil - Rio de Janeiro

3 4

LDAP structure
by Fred Zinsli 09 Jun '08

09 Jun '08

Hi everyone I am completely new to LDAP so I hope my terminology is correct. I am looking at setting up an LDAP server but I can't find information on how I would like it structured. All of the information I find is based on a single directory tree: ie. domain.com and then under that you can have your sub domains. But I would like to be able to have multiple domains. domain1.com, domain2.com. domain1.co.uk, domain1.com.jp and so on. Is this at all possible using LDAP? If it is possible could someone please point me to some information on how I can do this. I don't explicitly want the answer given to me as I won't learn anything. Many thanks in advance for your help and patience. Regards Fred

3 2

Syncprov overlay not pushing change
by Chris 08 Jun '08

08 Jun '08

openldap 2.3.41 from FreeBSD 6.3 ports. I have been using a syncrepl setup for some time and it's been working great. I recently had an app written that allows a user to change his password. It works, but when the user binds and modifies userPassword, the syncprov overlay does not push the change to the refreshAndPersist consumer. contextCSN is updated, entryCSN is updated, but the "search" never gets pushed. If I disconnect the consumer and reconnect, the change is then propagated. If I use refreshOnly, everything works fine. If the same record is modified by rootdn, the update is sent immediately. Nothing is different except the credentials of the user that binds to do the entry modification I've tried everything I can think of short of going to 2.4 to see if it does the same thing. Any suggestions appreciated.

2 1

OpenLDAP & Thunderbird with SSL
by Erik Lotspeich 08 Jun '08

08 Jun '08

Hi: I have OpenLDAP set up and working such that Thunderbird can access my addressbook without SSL or authentication. This part is good, but I want to move to the next level. My OpenLDAP server (slapd) is set up with SASL authentication (using the PLAIN method) and a self-signed certificate. The slapd command line is: /usr/local/libexec/slapd -h ldap:/// ldaps:/// When I connect to my OpenLDAP server using an OpenLDAP client such as ldapsearch, everything works (I have my self-generated CA cert as part of my system's ca-bundle): ldapsearch -ZZ -b 'ou=xxx, dc=yyy,dc=zzz' '(objectclass=*)' ldapsearch prompts for authentication and returns the contents of my addressbook: SASL/PLAIN authentication started Please enter your password: SASL username: erik SASL SSF: 0 # extended LDIF # # LDAPv3 # base <ou=xxx, dc=yyy,dc=zzz> with scope subtree # filter: (objectclass=*) # requesting: ALL # . . . When I enable SSL in Thunderbird, Thunderbird is unable to connect. I know using tcpdump that it's attempting a connection on the SSL port, but is failing and giving up somewhere. Is this a known issue? In slapd.conf I'm not requiring authentication at the moment. I will require authentication once I get the SSL working; since I'm using PLAIN, I don't want to allow non-SSL authentication. Any help would be greatly appreciated. Regards, Erik.

1 0

slapcat: symbol lookup error ldap_pvt_sasl_mutex_unlock
by M. Todd Smith 07 Jun '08

07 Jun '08

Hello all, I'm currently looking at upgrading my LDAP server from version 2.3.19. In trying to slapcat my db from the old machine I am getting the following error: slapcat: symbol lookup error: slapcat: undefined symbol: ldap_pvt_sasl_mutex_unlock I get this error whenever I attempt to use any of the slap tools. There is a little noise on the web in regards to the ldap_pvt_sasl_mutex_unlock but nothing definitive that I can find. I am going to replicate the db if possible and see if I can slapcat them from a different machine. Barring that however it would be good to be able to solve this from the original perspective. Any ideas? Many thanks in advance. Cheers Todd Systems Administrator -- Soho VFX 99 Atlantc Ave. Suite 303 Toronto, Ontario M6K-3J8 (416)516-7863 x240

1 0

Password policy questions
by Vincent Panel 07 Jun '08

07 Jun '08

Hi list, I'd like to do something rather simple (at least to me) with password policy : * Ensure the userPassword is 6 characters long at least * Ensure there's at least onenumber * Ensure there's at least one uppercase character I found out my first condition can be set by using the pwdMinLength attribute and the ppolicy overlay, but what should I do for the other two ? If it implies using pwdCheckModule and writing a C function and plugging it into openldap then I find it rather difficult for an ldap administrator just wanting to enforce policies... Is there any plan to make things easier, like having openldap providing 2 or 3 default C functions for this module ? Finally, why is it taking so long for the IETF to approve the ppolicy draft published in 2001 ? Has the effort been abandonned ? Thanks, Vincent

2 2

Trouble authenticating using OSX 10.4 and Openldap 2.4
by Donald Thompson 06 Jun '08

06 Jun '08

I have an openldap 2.4 authentication system, that works smoothly with many versions of linux, and OSX 10.5. But I can't get OSX 10.4 to authenticate with it. I was previously using openldap 2.0.27 with an identical setup, and 10.4 was able to authenticate with it. I can su to user accounts that are in the ldap database, but when I'm required to enter a password for the user, the authentication fails. Heres the relevant section from my logfile when I try to authenticate: Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(|(uid=dthomp))(|(cn=dthomp))))" Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SRCH attr=uid cn Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SRCH attr=userPassword Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=22 op=22 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=22 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=35 fd=20 ACCEPT from IP=192.168.1.145:49405 (IP=0.0.0.0:636) Jun 6 16:03:58 owl slapd[10661]: conn=35 fd=20 closed (TLS negotiation failure) Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 ACCEPT from IP=192.168.1.145:49406 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 TLS established tls_ssf=32 ssf=32 Jun 6 16:03:59 owl slapd[10661]: conn=36 op=0 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: conn=36 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jun 6 16:03:59 owl slapd[10661]: conn=36 op=1 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: SASL [conn=36] Failure: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=36 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=36 op=2 UNBIND Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 closed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(|(uid=dthomp))(|(cn=dthomp))))" Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SRCH attr=uid cn Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SRCH attr=userPassword Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=22 op=25 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=25 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=37 fd=20 ACCEPT from IP=192.168.1.145:49407 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=37 fd=20 closed (TLS negotiation failure) Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 ACCEPT from IP=192.168.1.145:49408 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 TLS established tls_ssf=32 ssf=32 Jun 6 16:03:59 owl slapd[10661]: conn=38 op=0 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: conn=38 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jun 6 16:03:59 owl slapd[10661]: conn=38 op=1 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: SASL [conn=38] Failure: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=38 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=38 op=2 UNBIND Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 closed I'm not sure why its trying to use sasl to authenticate, or even sure if thats the problem. I ended up creating an empty sasl database, because originally it kept trying to open one that wasn't there. Do I have to do some king of mapping from the sasl database to ldap?

1 0

can syncrepl do this?
by Stefano Zanmarchi 06 Jun '08

06 Jun '08

Hi, I need to replicate in my local openldap server all the entries in a given subtree of a remote openldap server, but the two DITs differ. That means I'd like to replicate all entries under "dc=people,dc=A,dc=it" (remote server) to "dc=employees,dc=B,dc=it" (local server). Can syncrepl do that? Or is there another way to obtain this? Any help is greatly appreciated, thanks a lot, Stefano

1 0

Password Policy and SASL DIGEST-MD5
by alessandro patrissi 06 Jun '08

06 Jun '08

Hi everyone, I'm using openldap-2.4.8 and cyrus-sasl-2.1.22. I've enabled password policy in my OpenLdap Server and I've seen that when I authenticate myself using SASL DIGEST-MD5 I can make any searches even if my account is locked. In fact I have the following results: ./ldapsearch -b 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -D 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -x -W -e ppolicy '(objectClass=*)' Enter LDAP Password: ldap_bind: Invalid credentials (49); Account locked ./ldapsearch -b 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -W -Y DIGEST-MD5 -U apatrissi '(objectClass=*)' DIGEST-MD5 -U apatrissi '(objectClass=*)' Enter LDAP Password: SASL/DIGEST-MD5 authentication started SASL username: apatrissi SASL SSF: 128 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=apatrissi,ou=people,dc=my-domain,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # apatrissi, people, my-domain.com dn: uid=apatrissi,ou=people,dc=my-domain,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson ou: people cn: Alessandro Patrissi givenName: Alessandro sn: Patrissi uid: apatrissi userPassword:: YWxleA== mail: alessandro.patrissi(a)commprove.com telephoneNumber: +0039 description: test LDAP # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 Where I can look to solve the problem? Thanks a lot, Alessandro Patrissi

1 0

sasl problem with Scientific Linux / RedHat but not with debian ?!
by Bjørn Nachtwey 05 Jun '08

05 Jun '08

Dear all, I set up a ldap server and want to use sasl/kerberos5 for authetification. well, using debian/etch it works fine. using scientific linux 5.1 (SL5.1) it does not work, not even testsaslauthd works. the configuration of both systems is the same, besides hostname gives on debian just the name and on SL5.1 the FQN. i also tried to compile cyrus/sasl from sources -- just the same. sl being a clone of RHEL, does anyone have the same problem? does anyone have any idea? thanks & best regards, Bjørn -- ######################################################################## Dipl.-Ing. Bjørn Nachtwey Technische Universität Carolo-Wilhelmina zu Braunschweig Gauss-IT-Zentrum (GITZ) -- Abteilung Server Hans-Sommer-Straße 65, 38106 Braunschweig Telephon: +49 (0)531 / 391 - 5535 TeleFax: +49 (0)531 / 391 - 5549 http://www.tu-braunschweig.de/it mailto: b.nachtwey(a)tu-bs.de mailto: c0034031(a)tu-bs.de ######################################################################## PGP-Schluessel: http://www-public.tu-bs.de:8080/~nachtwey/bjoern_nachtwey.asc PGP-Fingerprint: B472 526A A903 4AEB 9269 EC0B 9CDE 7465 CE87 ########################################################################

2 3

slapd-meta question
by danz＠wustl.edu 04 Jun '08

04 Jun '08

We have a scenario that I’m hoping OpenLDAP can offer a solution to. We are in the process of transitioning from one ldap authentication source to another for several of our applications. During the transition we need to be able to authenticate users against one of two different ldap services. Unfortunately our applications do not support the capability to try authentication against multiple services. Would an OpenLDAP setup be able to take the authentication request and attempt to validate it against 2 different backends? I should note that each of the ldap backends would have different OU structures and that a given userID would not exist in both backends. Based on the slapd-meta man page SCENARIOS section it looks as though this may be possible. The examples don't illustrate whether or not the OU structures need to be the same between the backends. Any help would be greatly appreciated! Regards, Dan

4 5

ACLs Seem to Have No Effect
by nick＠ndmckinney.net 04 Jun '08

04 Jun '08

I am having some difficulty setting up the ACLs on my OpenLDAP server (2.4.8). No matter what I change, the ACL rules I write into my slapd.conf file seem to have no effect at all. I have followed the FAQ here to try to set a simple password change ACL: http://www.openldap.org/faq/data/cache/320.html As well as another to try to block Anonymous binds: http://www.openldap.org/faq/data/cache/318.html But neither seem to have any effect at all. My present slapd.conf ACLs are as follows: --- access to attrs=userPassword by self =xw by anonymous auth # allow only rootdn to read the monitor access to * by self write by anonymous none by users read --- Is there some other part of the configuration that might disable ACLs.

4 4

Re: slapd-meta question
by Gavin Henry 04 Jun '08

04 Jun '08

<quote who="Pierangelo Masarati"> > Gavin Henry wrote: > >> I can't see Ando's example in this thread? > > My fault: during a mail migration, my address got automatically > rewritten from ando(a)sys-net.it to the canonical > pierangelo.masarati(a)sys-net.it, which is not the address I used when > subscribing to the mailing list. I think the problem is now fixed > (hopefully :) > > Ah, makes sense now. I thought I was going mad ;-) -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

slapcat/ldapsearch question
by daniel rahmeh 04 Jun '08

04 Jun '08

Hi, i'm trying to export my openldap entries to an ldif file. My userPassword attribute has the following format: userPassword: {CRYPT}$1$$Y2j3VjkaCXmJ.YsPztha89 when i try to export it using slapcat or ldapsearch it doesn't remain the same, it becomes something like: userPassword:: e0NSWJBUfSQxJCRVMm8zVnpJYUNVbUolWHNXenRJKTgw If you have any idea about the origin of the issue please tell me thank you

2 2

Stupid question about search
by AlexanDER Franca 04 Jun '08

04 Jun '08

Hi all. Again, sorry for my horrible english. So... I implemented a ldap server at my work. All the systems are working fine. OpenLDAP have being a great backend. But now I need to satisfy the users. They must perform some 'intuitive' searches like "who are the persons on group X, or list all telephones of people on group Y". But all of this must be executed by 'normal' users. Phpldapadmin have a good interface, but for admins, not for users (IMO). I don't know, for example, about groups... I have groupOfUniquenames, so... if an user want a list of users, and when choose 'users' node of tree, he get all users. To know about a group, he must go to 'groups' node and look at 'uniqueMember'. It seems not too much intuitive. So... I don't know how to implement (and what) to have this stuffs working for my users. []'s Alexander Brazil - Rio de Janeiro

3 2

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 04 Jun '08

04 Jun '08

Hi, I am using openldap 2.4.9. Deleted entries do not get propagated to slave from master using syncrepl. I had tried the similar use case in 2.4.8 and ran into the same issue. Is this a known issue in 2.4.9 ? Any pointers would be helpful. - Srinidhi. On Tue, May 6, 2008 at 12:42 AM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > >> Hi Gavin, >> Here are the details . >> Following logs were available at -d255 level. >> >> user.ldif file >> ======== >> dn: cn=user19,ou=people,dc=example,dc=com >> objectclass: inetOrgPerson >> cn: user19 >> sn: user19-lastname1 >> uid: user19-user1-lastname1 >> userpassword: welcome1 >> carlicense: HISCAR 123 >> homephone: 555-111-2222 >> mail: user19(a)example.com <mailto:user19@example.com> >> >> description: cool guy >> ou: Human Resources >> >> >> Master node log file snippet: >> ==================== >> >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> >> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) >> <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, >> <cn=user19,ou=people,dc=example,dc=com> >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" >> => bdb_entry_get: oc: "(null)", at: "(null)" >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" >> bdb_entry_get: rc=0 >> ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => access_allowed: delete access to "ou=people,dc=example,dc=com" >> "children" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => access_allowed: delete access to >> "cn=user19,ou=people,dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_delete 0x11: 0 >> => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0096defd] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 >> <= key_change 0 >> <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> ====> bdb_cache_delete( 17 ) >> bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=1 op=15 p=3 >> send_ldap_result: err=0 matched="" text="" >> send_ldap_response: msgid=16 tag=107 err=0 >> ber_flush2: 14 bytes to sd 12 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> ldap_write: want=14, written=14 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> daemon: activity on 1 descriptor >> daemon: activity on: 12r >> daemon: read activity on 12 >> daemon: select: listen=7 active_threads=0 tvp=NULL >> connection_get(12) >> connection_get(12): got connid=1 >> connection_read(12): checking for input on id=1 >> >> >> Slave log snippet: ( I didnt see any log msg for delete entry in the >> slave, so wasnt sure what to cut/paste, so just cut/pasting the user >> addition log msg) >> ============= >> ber_scanf fmt ({mW}) ber: >> ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 >> 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 >> 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 >> 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 >> 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 >> 0#000000 => bdb_search >> bdb_dn2entry("dc=example,dc=com") >> => access_allowed: search access to "dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: search access granted by manage(=mwrscxd) >> search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 >> => bdb_dn2idl("dc=example,dc=com") >> => bdb_filter_candidates >> AND >> => bdb_list_candidates 0xa0 >> => bdb_filter_candidates >> EQUALITY >> => bdb_equality_candidates (entryUUID) >> => key_read >> bdb_idl_fetch_key: [e8d6b696] >> <= bdb_index_read: failed (-30989) >> <= bdb_equality_candidates: id=0, first=0, last=0 >> <= bdb_filter_candidates: id=0 first=0 last=0 >> <= bdb_list_candidates: id=0 first=1 last=0 >> <= bdb_filter_candidates: id=0 first=1 last=0 >> bdb_search_candidates: id=0 first=1 last=0 >> bdb_search: no candidates >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ==> bdb_add: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") >> <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found >> (-30989) >> => access_allowed: add access to "ou=people,dc=example,dc=com" "children" >> requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" >> "entry" requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_add 0x11: 0 >> => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [860433ad] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0096defd] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 >> <= key_change 0 >> <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com >> bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ldap_msgfree >> ldap_result ld 5b9630 msgid 2 >> wait4msg ld 5b9630 msgid 2 (infinite timeout) >> wait4msg continue ld 5b9630 msgid 2 all 0 >> ** ld 5b9630 Connections: >> >> - Srinidhi >> On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org<mailto: >> ghenry(a)openldap.org>> wrote: >> >> Srinidhi Sharma wrote: >> >> Hi, >> I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't >> applied any patch to either open ldap or to Berkeley DB). >> >> When I configure a slave process, the addition and modification >> of users get propogated from master to slave. But the deletion >> of users from the master do not get propogated. the slapd logs >> in the master show that user is getting deleted. >> >> >> Logs needed and an example user please ;-) >> >> >> >> I saw a old note >> "http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" >> which listed similar issue. >> >> >> Not relevant as that's for 2.2. >> >> -- Kind Regards, >> >> Gavin Henry. >> OpenLDAP Engineering Team. >> >> E ghenry(a)OpenLDAP.org >> >> Community developed LDAP software. >> >> http://www.openldap.org/project/ >> >> Suretec Systems is a limited company registered in Scotland. Registered >> number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, >> Aberdeenshire, AB51 4FP. >> >> >> >> >> -- >> Thanks, >> Srinidhi >> > > I'd wait for 2.4.9 as there are lots of syncrepl fixes..coming soon. > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

2 1

Current OpenLDAP Windows Binary
by guse＠kingmedia.de 03 Jun '08

03 Jun '08

Dear all, in a project we use the OpenLDAP proxy feature. Our server infrastructure is based on MS Windows, so it is tough to install a current OpenLDAP version. At the moment we use Cygwin to run OpenLDAP, but this doesn't seem to be the best solution. We searched the web and found OpenLDAP 2.0.27 as a Windows installer. Unfortunately this old version does not accept our configuration which runs like a charm in 2.3.39 we use in Cygwin. Is there anybody out there who can give us a helping hand getting a current windows OpenLDAP build? Regards, Christoph

1 0

Custom Syntaxes
by Jeff Sussna 03 Jun '08

03 Jun '08

Is it possible to add new syntax definitions to LDAP? I've done various searches without unearthing anything. In particular, I'd like to specify a syntax which is "an integer between 0 and 5". Can I do that or do I need to code the enforcement into my client?

2 1

bdb panics with openldap
by Govind c 03 Jun '08

03 Jun '08

We have openldap using the bdb has its database.For some reason the bdb had crashed complaining permission issue. May 13 16:04:40 ccc slapd[30372]: conn=12430 fd=10 ACCEPT from IP=xxx.yyy.zzz.aaa:33905 (IP=0.0.0.0:389) May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" method=128 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" mech=SIMPLE ssf=0 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 RESULT tag=97 err=0 text= May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD dn="uid=sysadmin,o=none.com" May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD noner=lastlogints lastaccessts authcookie May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): /var/lib/ldap/log.0000000002: log file open failed: Permission denied May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): PANIC: Permission denied May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): DB_ENV->log_put: 2: DB_RUNRECOVERY: Fatal error, run database recovery May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): /var/lib/ldap/log.0000000002: log file open failed: Permission denied The log.000000000 gets rotated based on the size (10MB).The new logfile(log.0000000002) was rotated at on Apr 30th and I believe the permission was set as root:root instead of ldap:ldap(Note: the ldap being run as user ldap).The reason why didnât crash till yesterday was, only search queries were run against the ldap/bdb (The ldap search test for testing ldap keep alive).Yesterday a modify query was run from IP xxx.yyy.zzz.aaa and I guess bdb complained of permission problem and panicked May 13 16:04:40 ccc slapd[30372]: conn=12430 fd=10 ACCEPT from IP=xxx.yyy.zzz.aaa:33905 (IP=0.0.0.0:389) May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" method=128 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" mech=SIMPLE ssf=0 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 RESULT tag=97 err=0 text= May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD dn="uid=sysadmin,o=none.com" [root@ccc ldap]# ls -l /var/lib/ldap total 13236 -rw------- 1 ldap ldap 106496 Mar 24 19:30 cn.bdb -rw------- 1 ldap ldap 16384 Mar 20 11:50 __db.001 -rw------- 1 ldap ldap 278528 Mar 20 11:50 __db.002 -rw------- 1 ldap ldap 98304 Mar 20 11:50 __db.003 -rw------- 1 ldap ldap 450560 Mar 20 11:50 __db.004 -rw------- 1 ldap ldap 16384 Mar 20 11:50 __db.005 -rw------- 1 ldap ldap 45056 Mar 24 19:30 dn2id.bdb -rw------- 1 ldap ldap 278528 Apr 2 13:40 id2entry.bdb -rw------- 1 ldap ldap 10485710 Apr 30 14:40 log.0000000001 -rw------- 1 root root 1827874 May 13 16:00 log.0000000002 -rw------- 1 ldap ldap 8192 Mar 20 11:50 mail.bdb -rw------- 1 ldap ldap 16384 Mar 24 19:30 objectClass.bdb -rw-r--r-- 1 ldap ldap 0 Apr 2 13:31 openldap-master-replog -rw-r--r-- 1 ldap ldap 0 Apr 2 13:31 openldap-master-replog.lock -rw------- 1 ldap ldap 8192 Mar 20 11:50 ou.bdb drwxr-xr-x 2 root root 4096 Mar 21 16:33 replica -rw------- 1 ldap ldap 49152 Mar 20 11:50 sn.bdb -rw------- 1 ldap ldap 8192 Mar 20 12:00 uid.bdb The ldap is being run as user ldap [root@ccc ~]# ps -ef | grep ldap root 8983 6956 0 15:40 pts/0 00:00:00 grep ldap ldap 31694 1 0 Mar20 ? 00:01:57 /usr/sbin/slapd -u ldap -h ldap:/// [root@ccc ~]# grep ldap /etc/passwd ldap:x:55:55:LDAP User:/var/lib/ldap:/bin/false Why should a modify cause a panic and not a search?Why did the rotated log had root as owner instead of ldap?Is there a fix for this issue? Cheers CG

3 2

Re: bdb panics with openldap
by Hallvard B Furuseth 03 Jun '08

03 Jun '08

Please keep replies on the list. Govind c writes: > Well I haven`t set any parameter to rotate.I guess the > bdb has some in-built feature where in it rotates > after the log file reached 10M. Ah, OK. I don't think BDB rotates, it just closes the old logfile and starts a new one. I expect that's what they want all the digits for: They don't reuse logfile names, but you are not likely to need 1000000000 logfiles for the lifetime of a database. Anyway, it looks like you have sometimes run slapd or the slap tools as user ldap and sometimes as root, and so the files have conflicting ownership. Make up your mind about the user, chown the files to that user and stick to it. -- Hallvard

1 0

ProFTP + LDAP + SSL (LDAPServer 1.2.3.4:636)
by catia.lavalle＠bechtle.com 03 Jun '08

03 Jun '08

Hello, I do not know if this is the place to ask but maybe some of you have already had this configuration. I have a problem configuring ProFTP to use LDAP over SSL (i.e. ldaps on port 636). In short: ProFTP without TLS (TLSEngine off) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES NOT authenticate with LDAP with SSL (LDAPUseTLS on; LDAPServer 1.2.3.4:636) The procedure is a 2 way SSL with 2 certificates: filezilla (for example) (acting as client for ProFTP) ->SSL(cert_ftp)-> ProFTP (acting as server for filezilla, cert_ftp) ProFTP (acting as client for LDAP) ->SSL(cert_LDAP)-> LDAP (acting as server for the ProFTP, cert_LDAP). If I look in the logs I see that the ProFTP Server connects to the LDAP server on the correct port, the LDAP server accepts the connection but the TLS fails! In principle for me it is obvious because in the ProFTP configuration I do give the path to the FTP-SSL certificates and keys but I do not input any path for the LDAP-SSL certificates i.e. in my opinion it can not work like this. So my question is how to make it work? As I have said in my opinion the key point is to be able to set the path where the ProFTP server finds the certificates for the LDAP server. I do not find any hint whatsoever in the net. The steps I have done: LDAP Server: The LDAP Server IP (say) 1.2.3.4 The LDAP Server listens to port 636 (ldaps) and port (ldap). I have created a certificate for the LDAP server (slapd.pem, slapd.key) The LDAP server itself is fully functioning on both ldap and ldaps (for example ldaps with apache ok) ProFTP Server: The ProFTP Server IP (say) 5.6.7.8 I have created a certificate for the ProFTP server (ftp2.pem, ftp2.key) I have copied locally the certificates of the LDAP server (slapd.pem) This is exactly what you do with apache (and it works) provided one gives the path for "both" certificates LDAPTrustedGlobalCert CA_BASE64 /apache/conf/ssl_certs/slapd.pem .... .... SSLCertificateFile /apache/conf/ssl_certs/apache.pem SSLCertificateKeyFile /apache/conf/ssl_certs/apache.key This is the ProFTP configuration (mod_tls and mod_ldap parts) <IfModule mod_tls.c> TLSEngine on TLSLog /ftp2/logs/tls.log TLSProtocol SSLv23 TLSOptions NoCertRequest TLSRSACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSRSACertificateKeyFile /ftp2/conf/ssl_certs/ftp2.key TLSCACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSVerifyClient off TLSRequired on TLSRenegotiate required off </IfModule> <IfModule mod_ldap.c> #LDAPServer 1.2.3.4:389 LDAPUseTLS on LDAPServer 1.2.3.4:636 LDAPDoAuth on "ou=bbb,dc=aaa,dc=de" "(&(uid=%v)(objectclass=posixAccount))" LDAPDNInfo "uid=1234,dc=aaa,dc=de" root LDAPAuthBinds on LDAPDoUIDLookups on "ou=bbb,dc=aaa,dc=de" LDAPSearchScope subtree </IfModule> Both LDAP server and ProFTP (proftp-ldap) server are: Linux version 2.6.18-6-amd64 (Debian 2.6.18.dfsg.1-18etch1) (waldi(a)debian.org) (gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)) #1 SMP Sun Feb 10 17:50:19 UTC 2008 OpenLDAP server (slapd) dpkg -l | grep slapd ii slapd 2.3.30-5+etch1 I have used the ProFTP with precompiled LDAP (proftp-ldap) dpkg -l | grep proftp ii proftpd 1.3.0-19 Versatile, virtual-hosting FTP daemon ii proftpd-ldap 1.3.0-19 Versatile, virtual-hosting FTP daemon Error in /var/log/syslog from slapd May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: listen=9, new connection on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: added 19r (active) listener=(nil) May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 ACCEPT from IP=5.6.7.8:42564 (IP=0.0.0.0:636) May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=6 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=7 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=8 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=9 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on: May 27 10:54:05 ftp1test slapd[7323]: 19r May 27 10:54:05 ftp1test slapd[7323]: May 27 10:54:05 ftp1test slapd[7323]: daemon: read activity on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: removing 19 May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 closed (TLS negotiation failure) Please Help Thanks.

1 0

could not hard reconnect to LDAP server - Server is unavailable
by Gar Nelson 03 Jun '08

03 Jun '08

"As it quite unlikely that issues raised in your message could not be discussed without talking about the particulars of nss_ldap, your message is more appropriately directed to the openldap-technical list." So, take two. :) Starting openldap takes about five minutes to come up due to all the timeouts indicated in /var/log/messages. I've been googling without success, and openldap-software is not the appropriate venue for discussion of my problem. Hopefully this is, since I'm running out of options on where to look. Thank you for any assistance, or pointers toward the right direction. Gar -------- Original Message -------- Subject: could not hard reconnect to LDAP server - Server is unavailable Date: Fri, 30 May 2008 15:17:32 -0600 From: Gar Nelson <gar.nelson(a)noaa.gov> Organization: National Weather Service To: openldap-software(a)openldap.org I'm currently using openldap-2.2.13-8.el4_6.4 on RHEL 4 and for the most part, it appears to be working. I can use ldap to log in on another machine, and on a different workstation, the Apache directory browser connects and browses (and edits) just fine. However, when watching /var/log/messages, all is not calm under the surface. A shortened snippet of the log is as follows; May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... [...] May 30 14:57:46 ggw-s-bdc runuser: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:57:46 ggw-s-bdc slaptest: sql_select option missing May 30 14:57:46 ggw-s-bdc slaptest: auxpropfunc error no mechanism available May 30 14:57:46 ggw-s-bdc runuser: config file testing succeeded May 30 14:57:46 ggw-s-bdc ldap: Checking configuration files for slapd: succeeded May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... [...] May 30 14:59:46 ggw-s-bdc slapd[16932]: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:59:46 ggw-s-bdc slapd[16932]: sql_select option missing May 30 14:59:46 ggw-s-bdc slapd[16932]: auxpropfunc error no mechanism available May 30 14:59:46 ggw-s-bdc ldap: slapd startup succeeded It takes around five minutes for ldap to come up waiting for all the bind timeouts. I've tried googling without success, I've tried changing from host to uri, and from the local 127 address to the machine's outside IP without success. SELinux is disabled. IPTables is not running. nmap localhost reports port 389 is open, along with an nmap to it's outside ip address. I'm at a loss as to how to get "nss-ldap" to bind. ldap.conf is as follows; # @(#)$Id: ldap.conf,v 1.34 2004/09/16 23:32:02 lukeh Exp $ # # PADL Software # http://www.padl.com # debug 256 logdir /var/log/ldap.log #host 127.0.0.1 base dc=ggw,dc=nws,dc=noaa uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator binddn cn=Manager,dc=ggw,dc=nws,dc=noaa bindpw [correct ldap password] port 389 timelimit 50 bind_timelimit 50 bind_policy hard idle_timelimit 3600 pam_password exop nss_base_passwd ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_passwd ou=Computers,dc=ggw,dc=nws,dc=noaa?one nss_base_shadow ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_group ou=Groups,dc=ggw,dc=nws,dc=noaa?one #nss_base_hosts ou=Hosts,dc=ggw,dc=nws,dc=noaa?one #nss_base_services ou=Services,dc=ggw,dc=nws,dc=noaa?one #nss_base_networks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_protocols ou=Protocols,dc=ggw,dc=nws,dc=noaa?one #nss_base_rpc ou=Rpc,dc=ggw,dc=nws,dc=noaa?one #nss_base_ethers ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_netmasks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_bootparams ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_aliases ou=Aliases,dc=ggw,dc=nws,dc=noaa?one #nss_base_netgroup ou=Netgroup,dc=ggw,dc=nws,dc=noaa?one ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5

2 1

Custom Schema
by openLDAP 02 Jun '08

02 Jun '08

I am quite new to OpenLDAP and cannot seem resolve why slapd does not start when I add a custom schema. Nothing appears in syslog and the following appears when I try to start it: root@control:/etc/ldap# sudo slapd -d acl @(#) $OpenLDAP: slapd 2.4.7 (Apr 29 2008 08:44:27) $ buildd@rothera:/build/buildd/openldap2.3-2.4.7/debian/build/servers/slapd AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slapd stopped. Can someone please point me in the right direction to resolving this type of error?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical